* [PATCH 7.3 000/547] 7.3.2-rc1 review
@ 2026-11-04 21:03 Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 001/547] net: skbuff: propagate shared-frag marker in skb_zerocopy() Greg Kroah-Hartman
` (555 more replies)
0 siblings, 556 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 7.3.2 release.
There are 547 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.3.2-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.3.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 7.3.2-rc1
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: keep retry timeout clamp bounds constant
Sean Young <sean@mess.org>
media: rc: Fix build failure with CONFIG_LIRC disabled
Alice Ryhl <aliceryhl@google.com>
rust_binder: wake epoll on self-work queued to poll thread
Ian Bridges <icb@fastmail.org>
ksmbd: fix use-after-free after a failed durable reconnect
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: rebind completed CREATE replays without draining the old channel
DaeMyung Kang <charsyam@gmail.com>
ksmbd: fix named stream write and EOF handling
DaeMyung Kang <charsyam@gmail.com>
ksmbd: use the existing xattr name for a named stream
Henry Hu <huhai@kylinos.cn>
ksmbd: fix invalid pointer dereference when get_inode_acl() fails
Ian Bridges <icb@fastmail.org>
ksmbd: fix app-instance non-durable supersede session UAF
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: retry break notifications on another connection
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: track delivery of queued TCP writes
Daijiamu <3058704216@qq.com>
ksmbd: use clear_and_wake_up_bit() directly
Ian Bridges <icb@fastmail.org>
ksmbd: fix out-of-bounds read when padding the final compound response
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
ksmbd: fix SMB2 CREATE response buffer overflow
Cheng Yongkang <teel4res@gmail.com>
io_uring/net: fix multishot recv length limit accounting
Cheng Yongkang <teel4res@gmail.com>
io_uring/timeout: count cancelled timeouts in cq_timeouts
Kyle Zeng <kylebot@openai.com>
io_uring: defer foreign io-wq enqueues to task_work
Chris Mason <mason@kernel.org>
io_uring/sqpoll: don't wait for the thread to exit
Chris Mason <mason@kernel.org>
io_uring: free the task context after a grace period
Chris Mason <mason@kernel.org>
io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
Chris Mason <mason@kernel.org>
io_uring: free XArray nodes left by a failed store
Chris Mason <mason@kernel.org>
io_uring: charge tctx nodes and personalities
Chris Mason <mason@kernel.org>
io_uring/rsrc: charge buffer arrays and nodes to memcg
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: no new workers once the exit has begun
Jens Axboe <axboe@kernel.dk>
io_uring: keep the drain active when a deferred drain request is started
Daan De Meyer <daan@amutable.com>
io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN
Dominik Maier <dmnk@google.com>
io_uring/register: enforce per-task restrictions in io_uring_register_blind()
Dominik Maier <dmnk@google.com>
io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
Yichong Chen <chenyichong@uniontech.com>
io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
Yichong Chen <chenyichong@uniontech.com>
io_uring/kbuf: advance head when a pickup empties the buffer ring
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Add support for AIE2 revision 9
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Move attribute init to after device query
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Add suspend function and gate access under bool.
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()
Derek J. Clark <derekjohn.clark@gmail.com>
HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup
Jiale Yao <yaojiale02@163.com>
HID: roccat: savu: reject short special reports
Jiale Yao <yaojiale02@163.com>
HID: roccat: ryos: reject short special reports
Jiale Yao <yaojiale02@163.com>
HID: roccat: pyra: reject short button reports
Jiale Yao <yaojiale02@163.com>
HID: roccat: kovaplus: reject short button reports
Jiale Yao <yaojiale02@163.com>
HID: roccat: konepure: reject short button reports
Jiale Yao <yaojiale02@163.com>
HID: roccat: koneplus: reject short button reports
Jiale Yao <yaojiale02@163.com>
HID: roccat: isku: reject short button reports
Gabor Tanz <gabor.tanz@gmail.com>
HID: quirks: Always poll the Anne Pro 2 with product ID a292
Jiale Yao <yaojiale02@163.com>
HID: pxrc: reject short input reports
Jiale Yao <yaojiale02@163.com>
HID: prodikeys: validate fixed-format MIDI reports
Lorenzo Stoakes (ARM) <ljs@kernel.org>
HID: picoLCD: check for fb_deferred_io_init() error
Jiale Yao <yaojiale02@163.com>
HID: mcp2221: validate response report length
Myeonghun Pak <mhun512@gmail.com>
HID: mcp2221: always initialize and cancel init_work
Jiale Yao <yaojiale02@163.com>
HID: mcp2200: validate READ_ALL response length
Jiale Yao <yaojiale02@163.com>
HID: logitech-dj: validate unnumbered keyboard reports
Jiale Yao <yaojiale02@163.com>
HID: elo: reject short touchscreen reports
Jiale Yao <yaojiale02@163.com>
HID: cp2112: validate response report lengths
Jiale Yao <yaojiale02@163.com>
HID: cougar: reject short special-key reports
Alan Stern <stern@rowland.harvard.edu>
HID: core: Fix out-of-bounds left shift by 32 in s32ton()
Panz Dev <panz.development@gmail.com>
HID: asus: do not send keyboard init reports to touchpads
Basavaraj Natikar <Basavaraj.Natikar@amd.com>
HID: amd_sfh: Use report type from request node
Basavaraj Natikar <Basavaraj.Natikar@amd.com>
HID: amd_sfh: Remove unsupported motion-state field from accelerometer report
Jiale Yao <yaojiale02@163.com>
HID: zydacron: validate key report length
Ahmed Yaseen <yaseen@ghoul.dev>
HID: usbhid: skip interrupt IN polling for devices with no input reports
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
Sean Christopherson <seanjc@google.com>
KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready
Shivank Garg <shivankg@amd.com>
KVM: guest_memfd: take the invalidate lock when unbinding a dying file
Sean Christopherson <seanjc@google.com>
KVM: guest_memfd: Split bind() into prepare()+commit() phases
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Enable Bus Lock VM exit
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Don't assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason()
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Enable Notify VM exit
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Check if there is valid exit infos based on vp_enter_ret
Sean Christopherson <seanjc@google.com>
KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
Chengfeng Ye <nicoyip.dev@gmail.com>
KVM: x86: Take SRCU in kvm_zap_gfn_range()
Loc Nguyen <loc@ryzome.com>
KVM: x86: Request event processing for exception VM-Exits
Sean Christopherson <seanjc@google.com>
KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
Keqiang Duan <duankeqiangcym@gmail.com>
KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted
David Woodhouse <dwmw@amazon.co.uk>
KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()
David Woodhouse <dwmw@amazon.co.uk>
KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: VMX: Make handle_bus_lock_vmexit() a shared helper
Sean Christopherson <seanjc@google.com>
KVM: VMX: Formally define KVM's "0xdead" exit reason used for failed VM-Enter
Sean Christopherson <seanjc@google.com>
KVM: VMX: Disallow using to_vmx() in common VT code
Sean Christopherson <seanjc@google.com>
KVM: Use goto to handle errors during memslot preparation
Sean Christopherson <seanjc@google.com>
KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
Sean Christopherson <seanjc@google.com>
KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
Yosry Ahmed <yosry@kernel.org>
KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch
Sean Christopherson <seanjc@google.com>
KVM: Only bind memslot to guest_memfd instance for CREATE operations
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: x86: hdmi: fix chmap array missing terminator entry
Mike Rapoport (Microsoft) <rppt@kernel.org>
x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
Sean Christopherson <seanjc@google.com>
x86/cpuid: Mark CPUID function 0x23 as being indexed
David Howells <dhowells@redhat.com>
rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
David Howells <dhowells@redhat.com>
rxrpc: Fix double IRQ enablement
David Howells <dhowells@redhat.com>
afs: Fix afs to abort the rxrpc call on send error
David Howells <dhowells@redhat.com>
rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()
David Howells <dhowells@redhat.com>
rxrpc: Fix update of call->tx_pending without holding lock
Chuck Lever <cel@kernel.org>
SUNRPC: Treat every TLS error alert as fatal
Ameer Hamza <ameer.hamza@truenas.com>
sunrpc: treat empty auth.unix.gid replies as negative entries
Zhiling Zou <zhilinz@nebusec.ai>
SUNRPC: trace an accepted transport before publishing it
Chuck Lever <cel@kernel.org>
SUNRPC: Resume receiving after a TLS control record
Chuck Lever <cel@kernel.org>
SUNRPC: Reject a TLS alert record that is not two octets
Chuck Lever <cel@kernel.org>
SUNRPC: Reject a socket that already has an svc_sock attached
Chris Mason <clm@meta.com>
sunrpc: pin gss module across auth_domain RCU free
Jeff Layton <jlayton@kernel.org>
SUNRPC: keep the first error in svc_register()
Ameer Hamza <ameer.hamza@truenas.com>
sunrpc: honor the netlink unix_gid NEGATIVE flag
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
SUNRPC: fix oversized GSS proxy token copy
Chuck Lever <cel@kernel.org>
SUNRPC: Do not credit control-record octets to the RPC stream
Chuck Lever <cel@kernel.org>
SUNRPC: Copy the deferred RPC Call from the head buffer
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
nfsd: zero NFSv4 COMPOUND tag padding
Jeff Layton <jlayton@kernel.org>
NFSD: validate transport name in listener_set before serv creation
Chuck Lever <cel@kernel.org>
NFSD: Set nn->cld_net before registering the cld pipe
Chuck Lever <cel@kernel.org>
NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file
Chuck Lever <cel@kernel.org>
NFSD: Resolve the recall-any mask names in the trace format
Chuck Lever <cel@kernel.org>
NFSD: Reject an oversized principal hash from nfsdcld
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
nfsd: propagate SETXATTR value decode errors
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
nfsd: preflight SEQUENCE replies before accepting a slot
Chuck Lever <cel@kernel.org>
NFSD: Map flex file layout IDs through the request's user namespace
Chuck Lever <cel@kernel.org>
NFSD: map fh_verify() status codes for NFS_ACLv3 replies
NeilBrown <neil@brown.name>
nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1
Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>
nfsd: hold cl_lock in client_has_openowners()
Chuck Lever <cel@kernel.org>
NFSD: Fix out-of-bounds read in the rpc_status dump
Wentao Liang <vulab@iscas.ac.cn>
nfsd: Fix id-to-name cache entry leak in idtoname_parse()
David Flynn <david.flynn@hammerspace.com>
nfsd: fetch direct I/O alignment for files handed to the filecache
Chuck Lever <cel@kernel.org>
NFSD: Fail a pool_threads read whose reply does not fit
Jeff Layton <jlayton@kernel.org>
nfsd: don't offer flexfiles layouts when NFSv3 isn't being served
Ameer Hamza <ameer.hamza@truenas.com>
nfsd: don't modify a session slot when replaying its cached reply
Chuck Lever <cel@kernel.org>
NFSD: Don't complete a cld upcall the daemon has not read
Chuck Lever <cel@kernel.org>
NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients
Chuck Lever <cel@kernel.org>
NFSD: Destroy a recalled delegation the client does not hold
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
NFSD: copy SETXATTR data from all XDR buffer segments
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
nfsd: clear XDR padding in GETXATTR replies
Jeff Layton <jlayton@kernel.org>
NFSD: cap the number of listeners accepted in listener_set
Mike Snitzer <snitzer@kernel.org>
NFS/localio: report the stability a DIO WRITE actually has
Mike Snitzer <snitzer@kernel.org>
NFS/localio: fix nfs_local_dio_misaligned tracepoint
Mike Snitzer <snitzer@kernel.org>
NFS/localio: detect a short read or write before the iterator has moved
Jimmy Zuber <jamz@amazon.com>
NFS: Fix stale negative cache on failed nfs_mkdir()
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/flexfiles: Use the full 64-bit stripe_unit
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/flexfiles: Use the full 64-bit offset for read DS selection
Benjamin Coddington <bcodding@hammerspace.com>
NFSv4/flexfiles: fail I/O to the data server once a lock is lost
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/filelayout: Anchor page coalescing on pattern_offset
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET
Trond Myklebust <trond.myklebust@hammerspace.com>
NFSv4: Fix a regression in the handling of CB_RECALL_ANY
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/pnfs: Free the netid when draining a data-server address list
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
Chuck Lever <cel@kernel.org>
pnfs/blocklayout: Complete a device upcall when the pipe is closed
Chuck Lever <cel@kernel.org>
pnfs/blocklayout: Complete a device upcall only on its own reply
Benjamin Coddington <ben.coddington@hammerspace.com>
pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate
Shakeel Butt <shakeel.butt@linux.dev>
kernfs: don't lose IN_DELETE_SELF when decoding a file handle
Daejun Park <daejun7.park@samsung.com>
xfs: map pNFS layouts to the end of the extent again
Abdifatah Suruur <suruurism@gmail.com>
smb: client: validate the data area in SMB2_read()
Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
smb: client: validate SMB1 EA list bounds before parsing
Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
smb: client: validate NT transaction response layout and offsets
Paulo Alcantara <pc@manguebit.org>
smb: client: require stable pages for SMB compression
Abdifatah Suruur <suruurism@gmail.com>
smb: client: reject short SESSION_SETUP responses
Diego Oliva <diego@bynar.io>
smb: client: reject short or out-of-range FIND response parameters
Diego Oliva <diego@bynar.io>
smb: client: reject FIND data areas that run past the received response
Paulo Alcantara <pc@manguebit.org>
smb: client: reclaim credits for decrypted reads with no matching mid
Dominik Maier <dmnk@google.com>
smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
Diego Oliva <diego@bynar.io>
smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
Diego Oliva <diego@bynar.io>
smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
Abdifatah Suruur <suruurism@gmail.com>
smb: client: fix fiemap wild read on empty truncated response
Luxiao Xu <rakukuip@gmail.com>
smb: client: fix buffer overflow in SMB2_tcon()
Paulo Alcantara <pc@manguebit.org>
smb: client: don't resurrect an exiting tcon from cached dir workers
Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
smb: client: bound POSIX lock data area by response length
Stefan Metzmacher <metze@samba.org>
smb: smbdirect: fix buffer length underflow in RDMA transfers
VeroFess <coderzeng@hotmail.com>
smb: server: size directory name conversion buffer correctly
Borislav Petkov (AMD) <bp@alien8.de>
x86/bugs: Adapt SRSO mitigation to Zen6
Darrick J. Wong <djwong@kernel.org>
xfs: reattach dquots after changing inode ids
Darrick J. Wong <djwong@kernel.org>
xfs: range-check bc_levels array access in scrub tracepoints
Darrick J. Wong <djwong@kernel.org>
xfs: propagate errors while checking null siblings
Darrick J. Wong <djwong@kernel.org>
xfs: opportunistically skip btree block checks
Darrick J. Wong <djwong@kernel.org>
xfs: only written file data blocks can be shared
Darrick J. Wong <djwong@kernel.org>
xfs: never reset the default quota timer
Darrick J. Wong <djwong@kernel.org>
xfs: init inode number for tracepoint
Darrick J. Wong <djwong@kernel.org>
xfs: fix data fork block count check in xrep_inode_blockcounts
Darrick J. Wong <djwong@kernel.org>
xfs: fix correction of unwritten extents in quota file data fork
Darrick J. Wong <djwong@kernel.org>
xfs: don't try to scrub self-referential dirent in metapath checker
Darrick J. Wong <djwong@kernel.org>
xfs: don't try to repair rtsummary if the summary file isn't computed
Darrick J. Wong <djwong@kernel.org>
xfs: don't subtract excess usage twice when computing agf_btreeblks
Darrick J. Wong <djwong@kernel.org>
xfs: don't set a metadata directory's parent to sb_rootino
Darrick J. Wong <djwong@kernel.org>
xfs: don't scan across metadata/regular directory trees for dirents
Darrick J. Wong <djwong@kernel.org>
xfs: don't rescan ifree and icount when frozen
Darrick J. Wong <djwong@kernel.org>
xfs: don't queue rmap update twice when reaping a fork
Darrick J. Wong <djwong@kernel.org>
xfs: don't overrun incore inode when cleaning attr forks
Darrick J. Wong <djwong@kernel.org>
xfs: don't clear COWEXTSIZE on directories on reflink filesystems
Darrick J. Wong <djwong@kernel.org>
xfs: don't allow sm_agno for non-group metadir path checking
Darrick J. Wong <djwong@kernel.org>
xfs: complain loudly when dirtree checker finds broken links
Darrick J. Wong <djwong@kernel.org>
xfs: clear set[ug]id mode bits when zapping attr fork
Darrick J. Wong <djwong@kernel.org>
xfs: clarify various parts of the bitmap API
Darrick J. Wong <djwong@kernel.org>
xfs: check for termination during rmap btree walk
Darrick J. Wong <djwong@kernel.org>
xfs: check for fragments when full-extent sharing matches
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
xfs: bound inode fork length against the fork size during log recovery
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
xfs: bound da-node entry count against the correct geometry
Darrick J. Wong <djwong@kernel.org>
xfs: always zero the whole shortform header when zeroing attr fork
Darrick J. Wong <djwong@kernel.org>
xfs: always report scrub errors in tracepoints
Darrick J. Wong <djwong@kernel.org>
xfs: always report inode repair setup failures
Darrick J. Wong <djwong@kernel.org>
xfs: always forget cached ACLs if the attr fork swap succeeds
Darrick J. Wong <djwong@kernel.org>
xfs: abort directory tree repair whenever dl->aborted is set
Darrick J. Wong <djwong@kernel.org>
xfs: update quota flags on secondary supers when metadir enabled
Darrick J. Wong <djwong@kernel.org>
xfs: rescan the AGs if incore delalloc counter is negative
Darrick J. Wong <djwong@kernel.org>
xfs: release ip after unlinked list store failure
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
xfs: reject remote xattr entries with an out-of-range value length
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value
Darrick J. Wong <djwong@kernel.org>
xfs: reject absurdly large xattr value lengths in xchk_xattr_actor
Darrick J. Wong <djwong@kernel.org>
xfs: reduce new btree slack factor if free space is negative
Andrea Parri <parri.andrea@gmail.com>
rtnetlink: wait for RCU readers in rtnl_link_unregister()
Florian Westphal <fw@strlen.de>
netfilter: nft_payload: restrict checksum offsets to known values
Darrick J. Wong <djwong@kernel.org>
xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null
Darrick J. Wong <djwong@kernel.org>
xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks
Darrick J. Wong <djwong@kernel.org>
xfs: adjust checks for cross-AG reaping issues
Darrick J. Wong <djwong@kernel.org>
xfs: cross-reference the primary superblock
Darrick J. Wong <djwong@kernel.org>
xfs: jump out of xchk_bmap_check_rmap if fatal signals
Darrick J. Wong <djwong@kernel.org>
xfs: mark overfull dabtree node blocks as corrupt
Darrick J. Wong <djwong@kernel.org>
xfs: check fork type against dabtree block magic number
Darrick J. Wong <djwong@kernel.org>
xfs: abort dirtree repair if the live update hook dies
Darrick J. Wong <djwong@kernel.org>
xfs: fix revalidation of xchk_dquot_iter cached mappings
Darrick J. Wong <djwong@kernel.org>
xfs: bail out of directory tree repairs on error
Darrick J. Wong <djwong@kernel.org>
xfs: assign an owner to scrub_stats_fops
Darrick J. Wong <djwong@kernel.org>
xfs: allow softlimit with no hardlimit in quota scrub
Darrick J. Wong <djwong@kernel.org>
xfs: fix lost errno returned from xfarray_foliosort
Darrick J. Wong <djwong@kernel.org>
xfs: don't repair fs summary counters with garbage
Darrick J. Wong <djwong@kernel.org>
xfs: fix skipped inode mask handling in iscan
Darrick J. Wong <djwong@kernel.org>
xfs: don't proceed with xattr repair if the live update fails
Eric Sandeen <sandeen@redhat.com>
xfs: validate rc_domain in xchk_rtrefcount_mergeable
Darrick J. Wong <djwong@kernel.org>
xfs: don't fix the directory tree if live update fails
Darrick J. Wong <djwong@kernel.org>
xfs: flag excessive delalloc rt extents as corruption
Darrick J. Wong <djwong@kernel.org>
xfs: zero out di_metatype when removing the metadir file iflag
Darrick J. Wong <djwong@kernel.org>
xfs: don't pass iget failures up when marking ondisk inodes
Darrick J. Wong <djwong@kernel.org>
xfs: always reset incore attr fork buffer when resetting fork
Darrick J. Wong <djwong@kernel.org>
xfs: fix inode btree repair when a cluster is larger than a chunk
Darrick J. Wong <djwong@kernel.org>
xfs: actually report corrupt xattrs as XFAIL during cross-referencing
Darrick J. Wong <djwong@kernel.org>
xfs: fix buffer overflow in corrupt inline attr structure
Darrick J. Wong <djwong@kernel.org>
xfs: fix unnecessary dapos truncation in xchk_dir_walk
Darrick J. Wong <djwong@kernel.org>
xfs: actually lock the metafile reservation when adjusting after repair
Darrick J. Wong <djwong@kernel.org>
xfs: avoid cross-rtgroup reaping after a repair
Darrick J. Wong <djwong@kernel.org>
xfs: online quotacheck must dirty dquot if enforcement adjustments needed
Darrick J. Wong <djwong@kernel.org>
xfs: fix buffer overruns in xfs_ioc_attr_list
Darrick J. Wong <djwong@kernel.org>
xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair
Darrick J. Wong <djwong@kernel.org>
xfs: fix xfs_rename_space_res for non-pptr filesystems
Darrick J. Wong <djwong@kernel.org>
xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork
Darrick J. Wong <djwong@kernel.org>
xfs: compute the correct fdblocks/frextents for repair when they're negative
Darrick J. Wong <djwong@kernel.org>
xfs: mark cow extents bad if there's no rmap mapping for them
Darrick J. Wong <djwong@kernel.org>
xfs: clear the symlink zapped flag if inline symlink is ok
Amir Goldstein <amir73il@gmail.com>
ovl: skip copy up of empty security.capability
Chris Mason <mason@kernel.org>
ovl: set the revalidate flags after d_instantiate()
Hungyu Lin <dennylin0707@gmail.com>
ovl: reserve space for the casefolded name terminator
Chris Mason <mason@kernel.org>
ovl: read the nlink xattr of every indexed non-dir
Amir Goldstein <amir73il@gmail.com>
ovl: fortify ovl_copy_xattr() against underlying layer modifications
Amir Goldstein <amir73il@gmail.com>
ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
Chris Mason <mason@kernel.org>
ovl: fix a torn path in ovl_get_redirect()
Chris Mason <mason@kernel.org>
ovl: do not copy up an xattr value that was never read
Chris Mason <mason@kernel.org>
ovl: do not copy up a dentry that was removed
Chris Mason <mason@kernel.org>
ovl: check the casefold flag of directories only
Chris Mason <mason@kernel.org>
ovl: check that the parents of volatile/dirty are dirs
Chris Mason <mason@kernel.org>
ovl: always encode the origin fh when index is enabled
Chris Mason <mason@kernel.org>
ovl: use the pinned upper dir in ovl_fix_origin()
Chris Mason <mason@kernel.org>
ovl: take a snapshot of the name for copy up
Chris Mason <mason@kernel.org>
ovl: set OVL_WHITEOUTS before publishing the upper dir
Chris Mason <mason@kernel.org>
ovl: hold a reference on the parent in readdir
Weiming Shi <bestswngs@gmail.com>
smb: client: stop processing a read response after a receive error
Eduard Zateev <hackerowskiy@gmail.com>
smb: client: hold server info until cifsd exits
Diego Oliva <diego@bynar.io>
smb: client: fix OOB last_entry pointer from unbounded LastNameOffset
Cen Zhang <zzzccc427@gmail.com>
ocfs2: snapshot dentry names in file and setattr traces
Cen Zhang <zzzccc427@gmail.com>
ocfs2: pin refcount trees before dropping the lookup lock
Jiaming Zhang <r772577952@gmail.com>
ocfs2: fix chunk number of the first chunk in a local quota file
Cen Zhang <zzzccc427@gmail.com>
ocfs2: cancel quota sync work before freeing quota info
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2/dlm: hold the lookup reference across convert AST enqueue
Cen Zhang <zzzccc427@gmail.com>
ocfs2/dlm: hold a lock reference across grant AST enqueue
Cen Zhang <zzzccc427@gmail.com>
ocfs2/heartbeat: unlink live slots when their node is missing
Sean Young <sean@mess.org>
media: rc: Fix ABBA deadlock by making locks more fine grained
Sean Young <sean@mess.org>
media: rc: Fix use after free in bpf progs
Sean Young <sean@mess.org>
media: rc: After rc_unregister_device() timers can be re-armed
Sean Young <sean@mess.org>
media: rc: Use after free in ir_raw_event_handle()
Sean Young <sean@mess.org>
media: rc: mce_kbd: Fix inconsistent locking of keylock
Sean Young <sean@mess.org>
media: rc: Fix race condition during rc_register_device()
Sean Young <sean@mess.org>
media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
Weigang He <geoffreyhe2@gmail.com>
media: rc: fintek-cir: process a full RX buffer instead of overflowing it
Sean Young <sean@mess.org>
media: rc: Ensure registered is cleared in error path
Sean Young <sean@mess.org>
media: rc: Ensure that rc_unregister_device() does not free input device
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
Janne Grunau <j@jannau.net>
nvmem: core: Fix OOB read for bit offsets of more than one byte
Danish Khateeb <danishkhateeb03@gmail.com>
pps: generators: don't use the driver's info after unregister
Myeonghun Pak <mhun512@gmail.com>
power: supply: sbs-battery: disable polling before supply teardown
Myeonghun Pak <mhun512@gmail.com>
power: supply: pf1550: drain IRQ work before unregistering supplies
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
phy: core: Fix race-condition between _of_phy_get() and try_module_get()
Nickolai Zeldovich <nickolai@csail.mit.edu>
resource: report a devm_request_resource() conflict under the lock
Weibin Liu <liuwb@xiaopeng.com>
spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
YANXIN LI <fadouse@pm.me>
ufs: use u64 for directory size in ufs_last_byte
Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
usb: gadget: fix refcount underflow in gadgetfs_bind() error path
Andrea Parri <parri.andrea@gmail.com>
vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
Weiming Shi <bestswngs@gmail.com>
virtio_net: atomically disable rx mode work
Zhao Li <enderaoelyther@gmail.com>
wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
Rosen Penev <rosenp@gmail.com>
wifi: ath9k: delete channel-context timers on deinit
Yuchao Zhang <ndaugoing@gmail.com>
xen-blkfront: unbind irq before tearing down ring and shadow requests
Tianchu Chen <flynnnchen@tencent.com>
staging: rtl8723bs: fix protected RX frame validation in decrypt path
Igor Putko <igorpetindev@gmail.com>
serial: core: shut down initialized port on removal
Fan Wu <fanwu01@zju.edu.cn>
scsi: dc395x: sync the waiting_timer before freeing the host
Kyle Zeng <kylebot@openai.com>
net: sched: prevent scheduling deactivated qdiscs
Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
mtd: virt-concat: unlink discarded items before freeing
Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
mtd: virt-concat: unlink concat node before freeing it
Daehyeon Ko <4ncienth@gmail.com>
mshv_vtl: detach poll waiter on POLLFREE
Ruide Cao <caoruide123@gmail.com>
mptcp: hold MP_JOIN msk ref when cloning reqsk
Vernon Yang <yanglincheng@kylinos.cn>
mm: khugepaged: fix swap entry value to folio_pfn()
Vernon Yang <yanglincheng@kylinos.cn>
mm: khugepaged: fix folio is used after pte_unmap_unlock()
Vernon Yang <yanglincheng@kylinos.cn>
mm: khugepaged: fix folio is used after folio_put/unlock()
Zhang Yi <yi.zhang@huawei.com>
mm/truncate: look up the end-edge straddler by index
Imre Kaloz <kaloz@kernel.org>
mm/slab: sample slab_state once in kmem_cache_destroy()
Zi Yan <ziy@nvidia.com>
mm/rmap: don't discard lazyfree THPs at PMD level
Fan Wu <fanwu01@zju.edu.cn>
media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog
Rik van Riel <riel@surriel.com>
media: redrat3: fix UAF in probe error path leaving rc device registered
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: take a reference on the parsed endpoints
Cong Nguyen <congnt264@gmail.com>
media: microchip-csi2dc: fix async notifier leak on probe error path
Fan Wu <fanwu01@zju.edu.cn>
media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers
Fan Wu <fanwu01@zju.edu.cn>
media: imx-jpeg: cancel timeout worker when streaming stops
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
media: gspca: use vb2_video_unregister_device() on disconnect
Myeonghun Pak <mhun512@gmail.com>
media: cx23885: unregister DVB bus when SP2 CI setup fails
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
David Woodhouse <dwmw@amazon.co.uk>
KVM: pfncache: use a dedicated invalidation sequence for cache refresh
Sean Christopherson <seanjc@google.com>
KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot
Nicolin Chen <nicolinc@nvidia.com>
iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
Andrea Parri <parri.andrea@gmail.com>
iomap: don't resubmit an ioend after ->writeback_submit() failed
Kyle Zeng <kylebot@openai.com>
io_uring/io-wq: save worker type before dropping its reference
Yousef Alhouseen <alhouseenyousef@gmail.com>
HID: hiddev: keep state alive through disconnect unlock
Richard Patel <ripatel@wii.dev>
genirq: Move interrupt thread exit_work object to irqaction
Richard Patel <ripatel@wii.dev>
genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
Eric Biggers <ebiggers@kernel.org>
fsverity: Set S_VERITY only after rollback is no longer possible
Ngoc Quy <ngocquy0700@gmail.com>
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
Zhao Gongyi <zhaogongyi@bytedance.com>
filelock: keep superblock active through delegation wait
Xiang Mei <xmei5@asu.edu>
fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use
Yibo Tan <lhfff@tju.edu.cn>
fbdev: atmel_lcdfb: Prevent FIFO work after removal
Osama Abdelkader <osama.abdelkader@gmail.com>
drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase
Bui Viet Dung <dungvn2345@gmail.com>
Bluetooth: hci_vhci: Pin module for debugfs file operations
Fan Wu <fanwu01@zju.edu.cn>
ASoC: amd: ps: fix snd_acp63_remove() teardown ordering
Sung Byeongchan <tjdqudcks0424@naver.com>
ALSA: pcmtest: handle multiple wraps in random capture fill
Takashi Iwai <tiwai@suse.de>
ALSA: emux: Fix UAF of soundfont zones at note-on
Takashi Iwai <tiwai@suse.de>
ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect
Eva Crystal <0xiviel@gmail.com>
accel/amdxdna: clear the mailbox channel pointer when starting it fails
Frank Zhang <rmxpzlb@gmail.com>
rust: rcpufreq_dt: add module alias
Priya Bala Govindasamy <pgovind2@uci.edu>
rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
Alice Ryhl <aliceryhl@google.com>
rust: fwctl: declare cfi_encoding for fwctl_rpc_scope
Mehmet Koseoglu <mehmet.mkoseoglu@gmail.com>
rust: cpufreq: reject NULL from cpufreq_cpu_get()
Andreas Hindborg <a.hindborg@kernel.org>
rust: configfs: fix data offset calculation for subsystem callbacks
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML
Andreas Hindborg <a.hindborg@kernel.org>
rust: block: require `Sync` for `Operations::QueueData`
Andreas Hindborg <a.hindborg@kernel.org>
rust: block: fix `Send` bound for `GenDisk`
Eliot Courtney <ecourtney@nvidia.com>
rust: bitmap: restrict bitmap length to at most i32::MAX
Lorenzo Stoakes <ljs@kernel.org>
rust: bindings: fix VM_MAYSHARE value
Miguel Ojeda <ojeda@kernel.org>
rust: bindings: fix `VM_MAYSHARE` blocklist entry
Miguel Ojeda <ojeda@kernel.org>
objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
Karl Mehltretter <kmehltretter@gmail.com>
klist: avoid accesses after waking klist_remove()
Ping Cheng <ping.cheng@wacom.com>
HID: wacom: Write shared touch initial status only once
Ping Cheng <ping.cheng@wacom.com>
HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration
Lee Jones <lee@kernel.org>
HID: wacom: Redesign shared sibling data lifecycle
Lee Jones <lee@kernel.org>
HID: wacom: Fix Use-After-Free in wacom_bamboo_pad
Lee Jones <lee@kernel.org>
HID: wacom: Fix Use-After-Free in wacom_intuos_pad
Lee Jones <lee@kernel.org>
HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
Lee Jones <lee@kernel.org>
HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities
Harald Freudenberger <freude@linux.ibm.com>
s390/zcrypt: Guard domain index uses against speculative bypass
Harald Freudenberger <freude@linux.ibm.com>
s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()
Harald Freudenberger <freude@linux.ibm.com>
s390/zcrypt: Fix and improve zcrypt reply message verification checks
Christian Borntraeger <borntraeger@linux.ibm.com>
s390/vmcp: Initialize full session info to zero
Heiko Carstens <hca@linux.ibm.com>
s390/signal: Fix incorrect return address in signal frame
Heiko Carstens <hca@linux.ibm.com>
s390/probes: Fix wrong opcode for cgrb fixup
Heiko Carstens <hca@linux.ibm.com>
s390/kprobes: Prevent kprobes on instructions with exception table entry
Heiko Carstens <hca@linux.ibm.com>
s390/extable: Fix mvcos instruction decoding
Sumanth Korikkar <sumanthk@linux.ibm.com>
s390/cpum_cf: Check session mask before cpu offline
Tobias Schumacher <ts@linux.ibm.com>
s390/pci: Add error cleanup in zpci_directed_irq_init()
Tobias Schumacher <ts@linux.ibm.com>
s390/pci: Fix use-after-free race in zpci floating interrupt cleanup
Tobias Schumacher <ts@linux.ibm.com>
s390/pci: Fix resource leak in zpci MSI setup
Tobias Schumacher <ts@linux.ibm.com>
s390/pci: Fix MSI directed-mode teardown IRQ bit count
Tobias Schumacher <ts@linux.ibm.com>
s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup
Wentao Liang <vulab@iscas.ac.cn>
drm/msm: Fix vm_bo use-after-free in with_vm_locks()
Niklas Cassel <cassel@kernel.org>
ata: sata_fsl: Fix use-after-free of host_priv on probe() failure
Wentao Liang <vulab@iscas.ac.cn>
ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()
Binbin Deng <18983559317@163.com>
apparmor: fix a use-after-free in aa_lookupn_ns()
Josef Bacik <josef@toxicpanda.com>
mm/hugetlb: fix use-after-free of a new anon folio
David Hildenbrand (Arm) <david@kernel.org>
mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
Yibo Tan <lhfff@tju.edu.cn>
media: ipu-bridge: Fix use-after-free in IVSC error path
Deepanshu Kartikey <kartikey406@gmail.com>
media: imon: fix use-after-free in display_close via dev_dbg
Anuj Bolewar <bolewara@gmail.com>
media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
Pei Xiao <xiaopei01@kylinos.cn>
media: cx23885: Fix use-after-free in cx23885_finidev due to race condition
Fan Wu <fanwu01@zju.edu.cn>
media: au0828: fix use-after-free in bulk_timeout timer on disconnect
Chuck Lever <cel@kernel.org>
lockd: Fix use-after-free in nlmsvc_retry_blocked
Günther Noack <gnoack@google.com>
landlock: Fix superblock use-after-free in release_inode()
Nirmoy Das <nirmoyd@nvidia.com>
iommufd: Fix event queue release use-after-free
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()
Daejun Park <daejun7.park@samsung.com>
nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd: hfi: Fix a use-after-free when unloading the driver
Denis Benato <denis.benato@linux.dev>
platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led
Fan Wu <fanwu01@zju.edu.cn>
PM: EM: Fix use-after-free of perf domain in netlink doit handlers
Danish Khateeb <danishkhateeb03@gmail.com>
pps: generators: fix use-after-free when closing a removed device
James Kim <james010kim@gmail.com>
rapidio: mport_cdev: fix use-after-free in mport_mm_close()
Guangshuo Li <lgs201920130244@gmail.com>
RDMA/irdma: avoid use-after-free in icrdma_remove
Deep Shah <deepshah146@gmail.com>
RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
Tejun Heo <tj@kernel.org>
sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu
Henry Martin <bsdhenrymartin@gmail.com>
smb: client: fix use-after-free in cifs_ses_add_channel()
Diego Oliva <diego@bynar.io>
smb: client: fix use-after-free infoleak via the readdir resume name
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
spmi: Fix potential use-after-free by grabbing of_node reference
Zijing Yin <yzjaurora@gmail.com>
SUNRPC: fix netns use-after-free in write_gssp()
Andreas Wendleder <gonsolo@gmail.com>
wifi: b43: fix use-after-free in b43_bcma_remove()
Daehyeon Ko <4ncienth@gmail.com>
cgroup: serialize migrations of newly forked processes
Eric Dumazet <edumazet@kernel.org>
vlan: restore HW VLAN tag insertion with reorder_hdr off
Dairui Zhang <zhangdairui@gmail.com>
ksmbd: verify transform SessionId matches the decrypted header
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: validate security descriptor offsets before pointer arithmetic
Sung Byeongchan <tjdqudcks0424@naver.com>
ksmbd: validate AppInstanceId takeover target
Karl Mehltretter <kmehltretter@gmail.com>
ksmbd: use u8 for SMB2 oplock level values
DaeMyung Kang <charsyam@gmail.com>
ksmbd: return end of file for reads past a named stream's data
Michail Andreas Michalopoulos <mike.michalo@gmail.com>
ksmbd: restore Kerberos logins with released ksmbd-tools
Abdifatah Suruur <suruurism@gmail.com>
ksmbd: reserve space for the UTF-16 terminator in stream info
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: reclaim ended sessions on logoff and expiration
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: prevent stale data from being written by SMB2 WRITE requests
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: prevent share root removal through empty paths
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: prevent session binding in compound requests
DaeMyung Kang <charsyam@gmail.com>
ksmbd: preserve unreadable named streams on open
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: limit sessions on each connection
Jan Koester <j.koester@act-marketing.de>
ksmbd: ignore network devices of other namespaces
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: hold a connection reference for each session channel
Ian Bridges <icb@fastmail.org>
ksmbd: fix session reference leak on compounded SESSION_SETUP
Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
ksmbd: fix parent dentry lifetime in directory enumeration
Giorgi Kobakhia <gkobakhi@asu.edu>
ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()
Dairui Zhang <zhangdairui@gmail.com>
ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix extended session security negotiation for raw NTLMSSP
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: drain session procfs readers before dropping table references
Aamir Ahmed <elb12345@hotmail.co.uk>
ksmbd: deny access for an empty DACL instead of granting the request
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: defer connection scavenging while session locks are busy
DaeMyung Kang <charsyam@gmail.com>
ksmbd: avoid restoring only in-memory EOF after allocation change
Michail Andreas Michalopoulos <mike.michalo@gmail.com>
ksmbd: accept share config responses from ksmbd-tools before 3.5.3
David Heidelberg <david@ixit.cz>
backlight: qcom-wled: Fix WLED3 brightness register stride
David Heidelberg <david@ixit.cz>
backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
David Heidelberg <david@ixit.cz>
backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
Myeonghun Pak <mhun512@gmail.com>
backlight: lm3630a: Cancel delayed work before destroying workqueue
Kameron Carr <kameroncarr@linux.microsoft.com>
Drivers: hv: vmbus: Bounds check the shared ring buffer indices
Mario Peter <mario.peter@leica-geosystems.com>
driver core: take parent lock in async device attach
Johan Hovold <johan@kernel.org>
driver core: fix parent lock use-after-free on USB disconnect
Josef Bacik <josef@toxicpanda.com>
driver core: Limit the messages on a refused uevent
Johan Hovold <johan@kernel.org>
driver core: take parent lock on deferred probe
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: act_ife: do not consume the inner header on egress
Antonio Quartulli <antonio@mandelbit.com>
net/sched: fix packet reordering on requeue
owen kwan <owen@verialabs.com>
net/sched: sch_teql: fix use-after-free on lower qdisc drop
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_teql: fix slaves_lock IRQ deadlock
Yuhang Zheng <z1652074432@gmail.com>
net/sched: cls_flower: avoid stale mask references after delete
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: cls_bpf: accept dev-bound programs on shared blocks
Hengyu Liang <hengyul@cs.unc.edu>
serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
Lorenzo Pieralisi <lpieralisi@kernel.org>
irqchip/gic-v5: Fix standalone IRSes OF probe
Lorenzo Pieralisi <lpieralisi@kernel.org>
dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
Darrick J. Wong <djwong@kernel.org>
xfs: fix integer overflow problem when setting large free areas
Bui Viet Dung <dungvn2345@gmail.com>
wwan: wwan_hwsim: Pin module for debugfs file operations
Giorgi Kobakhia <gkobakhi@asu.edu>
udf: fix return value for non-recorded-allocated extents in udf_map_block()
Jonathan Gopel <jgopel@gmail.com>
thunderbolt: Do not RPM complete unrelated subtrees on unplug
Fredric Cover <fredric.cover.lkernel@gmail.com>
smb: client: fix early procfs exposure race
Zikang Gao <2715417602@qq.com>
smb: client: do not pass a NULL buf to is_oplock_break()
Cen Zhang <zzzccc427@gmail.com>
ocfs2: publish the filecheck owner before adding sysfs attributes
Cen Zhang <zzzccc427@gmail.com>
ocfs2: pin owning modules for open debugfs files
Cen Zhang <zzzccc427@gmail.com>
ocfs2: drain quorum work before removing the cluster
Cen Zhang <zzzccc427@gmail.com>
ocfs2/dlm: drain join handlers before releasing module text
Ameer Hamza <ameer.hamza@truenas.com>
nfsd: fix race between client_info_show() and free_client()
Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
net: usb: pegasus: do not advance rx_skb->data on dropped frames
Kaho Jiang <kj2864@nyu.edu>
net: ipv4: add zero check for snd_cwnd_clamp
Aleksandr Nogikh <nogikh@google.com>
media: usbtv: fix null-pointer dereference on disconnect
Xiang Mei <xmei5@asu.edu>
media: go7007: only set audio_enabled if go7007_snd_init() succeeded
Xiang Mei <xmei5@asu.edu>
media: em28xx: reject audio endpoint with zero packet size
Myeonghun Pak <mhun512@gmail.com>
media: cx88: Disable PCI device on MPEG initialization failure
Xiang Mei <xmei5@asu.edu>
libceph: bound mon_command ack decode to front len
Yongjun Gwon <d3bugee@gmail.com>
ksmbd: serialize directory emptiness checks with readdir
Andrea Parri <parri.andrea@gmail.com>
kcsan: Avoid division by zero in kcsan_prandom_u32_max()
Fang Xieyan <fangxy@xiaopeng.com>
kcov: ignore an out-of-range comparison count in write_comp_data()
Xiang Mei <xmei5@asu.edu>
fuse: don't BUG when the copy buffer is exhausted
Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
ceph: fail readdir when the MDS reply carries no dirfrag
Baokun Li <libaokun@linux.alibaba.com>
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9524/1: mm: align hugetlb mappings to the huge page size
ck.chang <ck.chang@mediatek.com>
wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
Radek Podgorny <radek@podgorny.cz>
Bluetooth: forget a peer's RPA once it advertises its identity address
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: line6: Clear prev_fbuf on capture buffer release
Biju Das <biju.das.jz@bp.renesas.com>
clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks
Christian Brauner <brauner@kernel.org>
fork: don't create io threads once PF_POSTCOREDUMP is set
Christian Brauner <brauner@kernel.org>
fork: move the coredump and exec checks into create_io_thread()
Christian Brauner <brauner@kernel.org>
exec: cancel io_uring requests before de_thread()
Jens Axboe <axboe@kernel.dk>
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
Jens Axboe <axboe@kernel.dk>
io_uring/timeout: don't flush with the sequence behind the last flush
Jens Axboe <axboe@kernel.dk>
io_uring/timeout: don't put a sequence target behind the last flush
Josef Bacik <josef@toxicpanda.com>
io_uring: look up the file before queueing to io-wq
Josef Bacik <josef@toxicpanda.com>
io_uring/timeout: don't end a linked timeout with 1
Josef Bacik <josef@toxicpanda.com>
io_uring/timeout: no ABS update of multishot timeouts
Josef Bacik <josef@toxicpanda.com>
io_uring/net: don't retry recv on uncommitted buffers
Josef Bacik <josef@toxicpanda.com>
io_uring: don't pass restart error codes to userspace
Josef Bacik <josef@toxicpanda.com>
io_uring/openclose: keep the lock in io_pipe_fixed()
Josef Bacik <josef@toxicpanda.com>
io_uring/sqpoll: let the thread sleep on disabled rings
Josef Bacik <josef@toxicpanda.com>
io_uring/kbuf: handle index wrap in last buffer check
Josef Bacik <josef@toxicpanda.com>
io_uring/zcrx: fix buffer offsets in areas above 4GB
Josef Bacik <josef@toxicpanda.com>
io_uring/napi: don't busy poll past an expired timeout
Josef Bacik <josef@toxicpanda.com>
io_uring/napi: make stale entries time out after 60s
Josef Bacik <josef@toxicpanda.com>
io_uring/wait: no early -ETIME if min_wait finds work
Josef Bacik <josef@toxicpanda.com>
io_uring/timeout: use the right clock for ABS updates
Josef Bacik <josef@toxicpanda.com>
io_uring/timeout: keep repeat count on multishot update
Josef Bacik <josef@toxicpanda.com>
io_uring/timeout: don't skip over reached sequences
Josef Bacik <josef@toxicpanda.com>
io_uring/fdinfo: fix CQE dump of CQE32 rings
Josef Bacik <josef@toxicpanda.com>
io_uring/register: keep 128b SQEs intact on resize
Josef Bacik <josef@toxicpanda.com>
io_uring/register: handle index wrap when resizing
Josef Bacik <josef@toxicpanda.com>
io_uring/register: don't wrap 32b CQEs when resizing
Josef Bacik <josef@toxicpanda.com>
io_uring: don't split 128b SQEs at the SQPOLL cap
Josef Bacik <josef@toxicpanda.com>
io_uring: drop the CQE cache if a refill fails
Josef Bacik <josef@toxicpanda.com>
io_uring/futex: allocate private hash before waiting
Josef Bacik <josef@toxicpanda.com>
io_uring/poll: drop stale double poll entry on rearm
Josef Bacik <josef@toxicpanda.com>
io_uring/wait: look at all CQ waiters on wake up
Josef Bacik <josef@toxicpanda.com>
io_uring: wake ring pollers for local task_work
Josef Bacik <josef@toxicpanda.com>
io_uring/cancel: let CANCEL_ALL find parked requests
Josef Bacik <josef@toxicpanda.com>
io_uring/cancel: recognize "no timeout" on 32-bit
Josef Bacik <josef@toxicpanda.com>
io_uring/cancel: don't forget that the work was running
Josef Bacik <josef@toxicpanda.com>
io_uring: don't lose a cancel as io-wq parks a request
Josef Bacik <josef@toxicpanda.com>
io_uring/poll: don't lose a cancel as io-wq arms poll
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: let cancel find picked up hashed work
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: don't exit with a creation pending
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: don't strand work when a worker exits
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: don't go to sleep on pending work
Josef Bacik <josef@toxicpanda.com>
io_uring/mpscq: disable preemption while pushing
Josef Bacik <josef@toxicpanda.com>
io_uring/cancel: rearm local work wake up before sleep
Josef Bacik <josef@toxicpanda.com>
io_uring: don't lose the DEFER_TASKRUN wake up
Josef Bacik <josef@toxicpanda.com>
io_uring: don't flood a cancelling task with task_work
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: don't hide a link from cancellations
Josef Bacik <josef@toxicpanda.com>
io_uring/io-wq: don't lose the signal that ends work
Josef Bacik <josef@toxicpanda.com>
io_uring/wait: don't spin on a stuck overflow list
Josef Bacik <josef@toxicpanda.com>
io_uring/cmd: don't leave list poison in ->hash_node
Josef Bacik <josef@toxicpanda.com>
io_uring/waitid: own the request before clearing ->head
Ridham Khurana <khurana.ridham222@gmail.com>
platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()
Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
wifi: ath12k: Increase RXDMA buffer ring size for default memory profile
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE to inline helper
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: convert ATH12K_RX_DESC_COUNT to inline helper
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC to inline helper
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE to inline helper
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE to inline helper
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper
Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
wifi: ath12k: move dp_profile_params to dp.h
Lee Seong Hyeon <ihopenre@gmail.com>
ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle
Stefan Metzmacher <metze@samba.org>
smb: smbdirect: don't hand out already failed sockets in smbdirect_socket_accept()
Stefan Metzmacher <metze@samba.org>
smb: smbdirect: release failed pending sockets of a listener
Stefan Metzmacher <metze@samba.org>
smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync()
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: wait for negotiation before receiving another PDU
Zizhen Liu <pointerliu@126.com>
net: skbuff: propagate shared-frag marker in skb_zerocopy()
-------------
Diffstat:
.../bindings/interrupt-controller/arm,gic-v5.yaml | 9 +-
Documentation/networking/rxrpc.rst | 21 +-
Makefile | 4 +-
arch/arm/mm/mmap.c | 11 +-
arch/powerpc/kvm/book3s_hv.c | 76 +-
arch/powerpc/kvm/book3s_paired_singles.c | 7 +-
arch/s390/kernel/kprobes.c | 3 +
arch/s390/kernel/perf_cpum_cf.c | 3 +
arch/s390/kernel/process.c | 12 +-
arch/s390/kernel/signal.c | 6 +-
arch/s390/lib/probes.c | 2 +-
arch/s390/mm/extable.c | 4 +-
arch/s390/pci/pci_irq.c | 93 ++-
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/cpuid/api.h | 1 +
arch/x86/include/asm/kvm-x86-ops.h | 1 +
arch/x86/include/asm/kvm_host.h | 7 +
arch/x86/include/asm/vmx.h | 8 +
arch/x86/kernel/cpu/bugs.c | 18 +-
arch/x86/kernel/cpu/scattered.c | 1 +
arch/x86/kvm/hyperv.c | 2 +
arch/x86/kvm/mmu/mmu.c | 5 +
arch/x86/kvm/mmu/paging_tmpl.h | 13 +-
arch/x86/kvm/svm/nested.c | 6 +
arch/x86/kvm/svm/svm.c | 19 +-
arch/x86/kvm/vmx/common.h | 20 +
arch/x86/kvm/vmx/main.c | 26 +
arch/x86/kvm/vmx/posted_intr.c | 2 +
arch/x86/kvm/vmx/tdx.c | 92 ++-
arch/x86/kvm/vmx/vmx.c | 37 +-
arch/x86/kvm/vmx/x86_ops.h | 1 +
arch/x86/kvm/x86.c | 69 +-
arch/x86/kvm/xen.c | 18 +
arch/x86/mm/pat/set_memory.c | 8 +-
block/blk-crypto-fallback.c | 6 +
drivers/accel/amdxdna/aie2_message.c | 1 +
drivers/accel/amdxdna/aie2_msg_priv.h | 1 +
drivers/accel/amdxdna/npu4_regs.c | 1 +
drivers/android/binder/thread.rs | 38 +-
drivers/ata/sata_fsl.c | 20 +-
drivers/base/base.h | 1 +
drivers/base/bus.c | 32 +-
drivers/base/core.c | 4 +-
drivers/base/dd.c | 90 ++-
drivers/block/xen-blkfront.c | 12 +-
drivers/bluetooth/hci_vhci.c | 4 +
drivers/clk/renesas/r9a08g046-cpg.c | 6 +-
drivers/cpufreq/rcpufreq_dt.rs | 1 +
drivers/gpu/drm/msm/msm_gem_shrinker.c | 3 +-
drivers/gpu/drm/panthor/panthor_sched.c | 14 +-
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 4 +-
.../amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h | 2 -
.../hid_descriptor/amd_sfh_hid_report_desc.h | 7 -
drivers/hid/hid-asus.c | 14 +-
drivers/hid/hid-core.c | 4 +-
drivers/hid/hid-cougar.c | 3 +
drivers/hid/hid-cp2112.c | 9 +-
drivers/hid/hid-elo.c | 3 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-lenovo-go-s.c | 663 ++++++++++-----
drivers/hid/hid-logitech-dj.c | 3 +
drivers/hid/hid-mcp2200.c | 5 +
drivers/hid/hid-mcp2221.c | 10 +-
drivers/hid/hid-picolcd_fb.c | 12 +-
drivers/hid/hid-prodikeys.c | 7 +-
drivers/hid/hid-pxrc.c | 3 +
drivers/hid/hid-quirks.c | 1 +
drivers/hid/hid-roccat-isku.c | 3 +
drivers/hid/hid-roccat-koneplus.c | 3 +
drivers/hid/hid-roccat-konepure.c | 3 +
drivers/hid/hid-roccat-kovaplus.c | 3 +
drivers/hid/hid-roccat-pyra.c | 3 +
drivers/hid/hid-roccat-ryos.c | 3 +
drivers/hid/hid-roccat-savu.c | 3 +
drivers/hid/hid-zydacron.c | 3 +
drivers/hid/usbhid/hid-core.c | 9 +-
drivers/hid/usbhid/hiddev.c | 37 +-
drivers/hid/wacom_sys.c | 198 +++--
drivers/hid/wacom_wac.c | 99 ++-
drivers/hid/wacom_wac.h | 6 +-
drivers/hv/mshv_vtl_main.c | 28 +-
drivers/hv/ring_buffer.c | 29 +-
drivers/infiniband/core/ib_core_uverbs.c | 10 +-
drivers/infiniband/core/uverbs.h | 37 +
drivers/infiniband/core/uverbs_std_types_dmabuf.c | 39 +-
drivers/infiniband/hw/irdma/icrdma_if.c | 9 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
drivers/iommu/iommufd/eventq.c | 4 +-
drivers/irqchip/irq-gic-v5-irs.c | 4 +
drivers/media/pci/cx23885/cx23885-core.c | 4 +
drivers/media/pci/cx23885/cx23885-dvb.c | 14 +-
drivers/media/pci/cx88/cx88-mpeg.c | 9 +-
drivers/media/pci/intel/ipu-bridge.c | 2 +-
drivers/media/platform/marvell/mcam-core.c | 14 +-
.../media/platform/microchip/microchip-csi2dc.c | 1 +
.../media/platform/microchip/microchip-isc-base.c | 6 +
.../platform/microchip/microchip-sama5d2-isc.c | 17 +-
.../platform/microchip/microchip-sama7g5-isc.c | 17 +-
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 +
drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c | 4 +-
drivers/media/rc/bpf-lirc.c | 18 +-
drivers/media/rc/fintek-cir.c | 4 +
drivers/media/rc/imon.c | 5 -
drivers/media/rc/ir-mce_kbd-decoder.c | 5 +-
drivers/media/rc/lirc_dev.c | 3 +
drivers/media/rc/rc-ir-raw.c | 86 +-
drivers/media/rc/rc-main.c | 61 +-
drivers/media/rc/redrat3.c | 4 +
drivers/media/usb/au0828/au0828-dvb.c | 1 +
drivers/media/usb/em28xx/em28xx-audio.c | 7 +
drivers/media/usb/go7007/go7007-driver.c | 5 +-
drivers/media/usb/gspca/gspca.c | 3 +-
drivers/media/usb/hackrf/hackrf.c | 7 +-
drivers/media/usb/usbtv/usbtv-core.c | 2 -
drivers/media/usb/usbtv/usbtv-video.c | 4 +
drivers/mtd/mtd_virt_concat.c | 2 +
drivers/net/usb/pegasus.c | 6 +-
drivers/net/virtio_net.c | 26 +-
drivers/net/wireless/ath/ath12k/core.c | 2 +
drivers/net/wireless/ath/ath12k/core.h | 9 -
drivers/net/wireless/ath/ath12k/dp.c | 81 +-
drivers/net/wireless/ath/ath12k/dp.h | 108 ++-
drivers/net/wireless/ath/ath12k/dp_rx.c | 14 +-
drivers/net/wireless/ath/ath12k/mac.c | 5 +-
drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | 12 +-
drivers/net/wireless/ath/ath9k/channel.c | 2 +
drivers/net/wireless/broadcom/b43/main.c | 5 +-
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 1 -
drivers/net/wireless/mediatek/mt76/mt7925/regs.h | 3 +-
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 +-
drivers/net/wwan/wwan_hwsim.c | 4 +
drivers/nvme/target/auth.c | 1 +
drivers/nvme/target/fabrics-cmd-auth.c | 32 +-
drivers/nvme/target/fc.c | 8 +-
drivers/nvme/target/nvmet.h | 2 +
drivers/nvme/target/pr.c | 2 +-
drivers/nvmem/core.c | 4 +-
drivers/phy/phy-core.c | 45 +-
drivers/platform/cznic/turris-omnia-mcu-base.c | 1 +
drivers/platform/x86/amd/hfi/hfi.c | 5 +
drivers/platform/x86/asus-wmi.c | 12 +
drivers/power/supply/pf1550-charger.c | 32 +-
drivers/power/supply/sbs-battery.c | 11 +
drivers/pps/generators/pps_gen.c | 94 ++-
drivers/rapidio/devices/rio_mport_cdev.c | 5 +-
drivers/s390/char/vmcp.c | 4 +-
drivers/s390/crypto/zcrypt_api.c | 35 +-
drivers/s390/crypto/zcrypt_ccamisc.c | 22 +-
drivers/s390/crypto/zcrypt_msgtype50.c | 95 ++-
drivers/s390/crypto/zcrypt_msgtype6.c | 208 +++--
drivers/scsi/dc395x.c | 10 +-
drivers/spi/spi-pci1xxxx.c | 71 ++
drivers/spmi/spmi.c | 3 +-
drivers/staging/rtl8723bs/core/rtw_recv.c | 21 +-
drivers/thunderbolt/icm.c | 6 +-
drivers/tty/serial/serial_core.c | 16 +-
drivers/usb/core/driver.c | 1 -
drivers/usb/core/message.c | 1 +
drivers/usb/gadget/legacy/inode.c | 3 +-
drivers/vfio/pci/nvgrace-gpu/main.c | 17 +-
drivers/video/backlight/lm3630a_bl.c | 1 +
drivers/video/backlight/qcom-wled.c | 35 +-
drivers/video/fbdev/atmel_lcdfb.c | 11 +-
drivers/video/fbdev/udlfb.c | 5 +
fs/afs/rxrpc.c | 57 +-
fs/btrfs/verity.c | 7 +-
fs/ceph/dir.c | 4 +
fs/exec.c | 11 +-
fs/ext4/verity.c | 4 +-
fs/fuse/dev.c | 3 +-
fs/iomap/ioend.c | 10 +-
fs/kernfs/mount.c | 34 +-
fs/lockd/svclock.c | 2 +
fs/nfs/blocklayout/blocklayout.h | 5 -
fs/nfs/blocklayout/rpc_pipefs.c | 79 +-
fs/nfs/callback_xdr.c | 9 +-
fs/nfs/delegation.c | 3 +-
fs/nfs/dir.c | 2 +
fs/nfs/filelayout/filelayout.c | 8 +-
fs/nfs/filelayout/filelayoutdev.c | 17 +-
fs/nfs/flexfilelayout/flexfilelayout.c | 52 +-
fs/nfs/flexfilelayout/flexfilelayout.h | 2 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 17 +-
fs/nfs/localio.c | 31 +-
fs/nfs/netns.h | 5 +-
fs/nfs/nfs4_fs.h | 2 +
fs/nfs/nfs4proc.c | 8 +
fs/nfs/nfs4state.c | 38 +-
fs/nfs/nfstrace.h | 5 +-
fs/nfs/pnfs.c | 2 +
fs/nfs/pnfs.h | 1 +
fs/nfs/pnfs_nfs.c | 21 +-
fs/nfsd/filecache.c | 4 +-
fs/nfsd/flexfilelayout.c | 20 +-
fs/nfsd/flexfilelayoutxdr.c | 4 +-
fs/nfsd/flexfilelayoutxdr.h | 5 +-
fs/nfsd/nfs3acl.c | 15 +
fs/nfsd/nfs4idmap.c | 4 +-
fs/nfsd/nfs4layouts.c | 4 +-
fs/nfsd/nfs4proc.c | 4 +-
fs/nfsd/nfs4recover.c | 42 +-
fs/nfsd/nfs4state.c | 250 +++++-
fs/nfsd/nfs4xdr.c | 26 +-
fs/nfsd/nfsctl.c | 73 +-
fs/nfsd/nfsproc.c | 19 +-
fs/nfsd/state.h | 13 +-
fs/nfsd/xdr4.h | 1 +
fs/ocfs2/cluster/heartbeat.c | 13 +-
fs/ocfs2/cluster/netdebug.c | 4 +
fs/ocfs2/cluster/nodemanager.c | 3 +
fs/ocfs2/cluster/quorum.c | 7 +-
fs/ocfs2/cluster/quorum.h | 1 +
fs/ocfs2/dlm/dlmconvert.c | 10 +-
fs/ocfs2/dlm/dlmdebug.c | 5 +
fs/ocfs2/dlm/dlmdomain.c | 3 +-
fs/ocfs2/dlm/dlmlock.c | 8 +-
fs/ocfs2/dlmglue.c | 2 +
fs/ocfs2/file.c | 100 ++-
fs/ocfs2/filecheck.c | 5 +-
fs/ocfs2/quota_local.c | 12 +-
fs/ocfs2/refcounttree.c | 15 +-
fs/ocfs2/super.c | 1 +
fs/overlayfs/copy_up.c | 110 ++-
fs/overlayfs/dir.c | 22 +-
fs/overlayfs/inode.c | 16 +-
fs/overlayfs/namei.c | 11 +-
fs/overlayfs/overlayfs.h | 8 +-
fs/overlayfs/readdir.c | 40 +-
fs/overlayfs/super.c | 31 +-
fs/proc/task_mmu.c | 9 +-
fs/smb/client/cached_dir.c | 30 +-
fs/smb/client/cifsacl.c | 9 +-
fs/smb/client/cifsfs.c | 20 +-
fs/smb/client/cifsglob.h | 2 +
fs/smb/client/cifsproto.h | 1 +
fs/smb/client/cifssmb.c | 152 +++-
fs/smb/client/connect.c | 40 +-
fs/smb/client/inode.c | 4 +-
fs/smb/client/readdir.c | 69 +-
fs/smb/client/sess.c | 6 +-
fs/smb/client/smb2misc.c | 16 +
fs/smb/client/smb2ops.c | 37 +-
fs/smb/client/smb2pdu.c | 46 +-
fs/smb/client/trace.h | 3 +
fs/smb/client/transport.c | 2 +
fs/smb/common/smbglob.h | 1 +
fs/smb/server/auth.c | 6 +-
fs/smb/server/compress.c | 1 +
fs/smb/server/connection.c | 55 +-
fs/smb/server/connection.h | 26 +-
fs/smb/server/ksmbd_netlink.h | 8 +-
fs/smb/server/ksmbd_work.c | 19 +
fs/smb/server/ksmbd_work.h | 2 +
fs/smb/server/mgmt/user_session.c | 204 ++++-
fs/smb/server/mgmt/user_session.h | 12 +-
fs/smb/server/misc.c | 8 +-
fs/smb/server/oplock.c | 885 ++++++++++++---------
fs/smb/server/oplock.h | 14 +-
fs/smb/server/proc.c | 2 +
fs/smb/server/server.c | 23 +
fs/smb/server/server.h | 3 +
fs/smb/server/smb2misc.c | 8 +
fs/smb/server/smb2ops.c | 33 +
fs/smb/server/smb2pdu.c | 374 +++++++--
fs/smb/server/smb2pdu.h | 1 +
fs/smb/server/smb_common.c | 6 +-
fs/smb/server/smbacl.c | 49 +-
fs/smb/server/transport_ipc.c | 23 +-
fs/smb/server/transport_tcp.c | 308 ++++++-
fs/smb/server/vfs.c | 107 ++-
fs/smb/server/vfs.h | 3 +-
fs/smb/server/vfs_cache.c | 263 +++---
fs/smb/server/vfs_cache.h | 12 +-
fs/smb/smbdirect/accept.c | 227 ++++--
fs/smb/smbdirect/connection.c | 12 +-
fs/smb/smbdirect/internal.h | 2 +
fs/smb/smbdirect/listen.c | 137 +++-
fs/smb/smbdirect/rw.c | 1 -
fs/smb/smbdirect/socket.c | 113 ++-
fs/smb/smbdirect/socket.h | 42 +
fs/udf/inode.c | 2 +-
fs/ufs/dir.c | 2 +-
fs/verity/enable.c | 12 +-
fs/xfs/libxfs/xfs_attr_leaf.c | 13 +
fs/xfs/libxfs/xfs_da_btree.c | 14 +
fs/xfs/libxfs/xfs_inode_fork.c | 4 +-
fs/xfs/libxfs/xfs_symlink_remote.c | 8 +-
fs/xfs/libxfs/xfs_symlink_remote.h | 2 +-
fs/xfs/libxfs/xfs_trans_space.c | 6 +-
fs/xfs/scrub/agheader.c | 15 +-
fs/xfs/scrub/agheader_repair.c | 13 +-
fs/xfs/scrub/alloc_repair.c | 11 +-
fs/xfs/scrub/attr.c | 17 +-
fs/xfs/scrub/attr_repair.c | 18 +-
fs/xfs/scrub/bitmap.c | 20 +
fs/xfs/scrub/bmap.c | 7 +
fs/xfs/scrub/btree.c | 16 +-
fs/xfs/scrub/common.c | 7 +-
fs/xfs/scrub/cow_repair.c | 84 +-
fs/xfs/scrub/dabtree.c | 27 +-
fs/xfs/scrub/dir.c | 2 +
fs/xfs/scrub/dir_repair.c | 9 +-
fs/xfs/scrub/dirtree.c | 4 +-
fs/xfs/scrub/dirtree_repair.c | 76 +-
fs/xfs/scrub/dqiterate.c | 1 +
fs/xfs/scrub/fscounters.c | 38 +-
fs/xfs/scrub/ialloc_repair.c | 8 +-
fs/xfs/scrub/inode.c | 2 +-
fs/xfs/scrub/inode_repair.c | 181 ++++-
fs/xfs/scrub/iscan.c | 2 +-
fs/xfs/scrub/metapath.c | 17 +-
fs/xfs/scrub/newbt.c | 15 +-
fs/xfs/scrub/newbt.h | 1 -
fs/xfs/scrub/parent_repair.c | 4 +
fs/xfs/scrub/quota.c | 8 +-
fs/xfs/scrub/quota_repair.c | 39 +-
fs/xfs/scrub/quotacheck_repair.c | 54 +-
fs/xfs/scrub/readdir.c | 2 +-
fs/xfs/scrub/reap.c | 65 +-
fs/xfs/scrub/refcount.c | 17 +-
fs/xfs/scrub/repair.c | 18 +-
fs/xfs/scrub/repair.h | 2 +-
fs/xfs/scrub/rtbitmap_repair.c | 2 +-
fs/xfs/scrub/rtrefcount.c | 2 +
fs/xfs/scrub/rtsummary.c | 9 +-
fs/xfs/scrub/rtsummary.h | 1 +
fs/xfs/scrub/rtsummary_repair.c | 2 +-
fs/xfs/scrub/stats.c | 5 +-
fs/xfs/scrub/symlink.c | 17 +-
fs/xfs/scrub/trace.c | 13 +
fs/xfs/scrub/trace.h | 10 +-
fs/xfs/scrub/xfarray.c | 4 +-
fs/xfs/xfs_dquot.c | 20 +-
fs/xfs/xfs_dquot.h | 2 +-
fs/xfs/xfs_handle.c | 2 +-
fs/xfs/xfs_inode_item_recover.c | 20 +-
fs/xfs/xfs_mount.c | 9 +-
fs/xfs/xfs_pnfs.c | 19 +-
fs/xfs/xfs_qm.c | 42 +-
fs/xfs/xfs_quota.h | 9 +
fs/xfs/xfs_trans_dquot.c | 6 +-
include/linux/device.h | 5 +
include/linux/device/bus.h | 3 -
include/linux/filelock.h | 13 +-
include/linux/fsverity.h | 12 +-
include/linux/hiddev.h | 2 +
include/linux/interrupt.h | 2 +
include/linux/io_uring_types.h | 6 +
include/linux/kvm_host.h | 2 +
include/linux/pps_gen_kernel.h | 4 +-
include/net/af_rxrpc.h | 5 +-
include/net/mptcp.h | 9 +
include/trace/events/huge_memory.h | 18 +-
include/trace/events/rxrpc.h | 2 +-
include/trace/misc/nfs.h | 10 +
io_uring/bpf-ops.c | 16 +-
io_uring/cancel.c | 43 +-
io_uring/cancel.h | 2 +
io_uring/fdinfo.c | 14 +-
io_uring/futex.c | 32 +-
io_uring/io-wq.c | 138 +++-
io_uring/io_uring.c | 174 +++-
io_uring/io_uring.h | 44 +-
io_uring/kbuf.c | 6 +-
io_uring/loop.c | 8 +-
io_uring/mpscq.h | 14 +-
io_uring/napi.c | 4 +-
io_uring/net.c | 49 +-
io_uring/openclose.c | 11 +-
io_uring/poll.c | 21 +
io_uring/register.c | 61 +-
io_uring/rsrc.c | 7 +-
io_uring/rw.c | 18 -
io_uring/sqpoll.c | 35 +-
io_uring/sqpoll.h | 3 +-
io_uring/tctx.c | 9 +-
io_uring/timeout.c | 105 ++-
io_uring/tw.c | 36 +-
io_uring/uring_cmd.c | 2 +-
io_uring/wait.c | 32 +-
io_uring/wait.h | 15 +
io_uring/waitid.c | 12 +-
io_uring/zcrx.c | 2 +-
kernel/cgroup/cgroup.c | 28 +
kernel/fork.c | 4 +
kernel/irq/internals.h | 2 +
kernel/irq/manage.c | 31 +-
kernel/kcov.c | 8 +
kernel/kcsan/core.c | 7 +-
kernel/power/em_netlink.c | 126 +--
kernel/power/em_netlink.h | 8 +-
kernel/power/energy_model.c | 8 +-
kernel/resource.c | 9 +-
kernel/sched/ext/ext.c | 15 +-
lib/klist.c | 16 +-
lib/kobject_uevent.c | 6 +-
mm/hugetlb.c | 15 +-
mm/khugepaged.c | 21 +-
mm/rmap.c | 11 -
mm/slab_common.c | 17 +-
mm/truncate.c | 30 +-
net/8021q/vlan_dev.c | 33 +-
net/bluetooth/hci_event.c | 9 +
net/ceph/mon_client.c | 2 +-
net/core/dev.c | 3 +
net/core/rtnetlink.c | 4 +
net/core/skbuff.c | 2 +
net/ipv4/inet_connection_sock.c | 4 +
net/ipv4/metrics.c | 5 +
net/mptcp/subflow.c | 35 +-
net/netfilter/nft_payload.c | 40 +-
net/rxrpc/recvmsg.c | 22 +-
net/rxrpc/rxperf.c | 41 +-
net/rxrpc/sendmsg.c | 86 +-
net/sched/act_ife.c | 4 +
net/sched/cls_bpf.c | 28 +-
net/sched/cls_flower.c | 50 +-
net/sched/sch_generic.c | 14 +-
net/sched/sch_teql.c | 60 +-
net/sunrpc/auth_gss/svcauth_gss.c | 29 +-
net/sunrpc/svc.c | 9 +-
net/sunrpc/svc_xprt.c | 24 +-
net/sunrpc/svcauth_unix.c | 9 +
net/sunrpc/svcsock.c | 86 +-
rust/bindgen_parameters | 4 +-
rust/bindings/bindings_helper.h | 2 +-
rust/kernel/bitmap.rs | 70 +-
rust/kernel/block/mq/gen_disk.rs | 10 +-
rust/kernel/block/mq/operations.rs | 2 +-
rust/kernel/bug.rs | 9 +-
rust/kernel/configfs.rs | 43 +-
rust/kernel/cpufreq.rs | 22 +-
rust/kernel/fwctl.rs | 12 +-
rust/kernel/module_param.rs | 9 +-
security/apparmor/include/policy_ns.h | 16 +
security/apparmor/policy_ns.c | 2 +-
security/landlock/fs.c | 10 +-
sound/core/control.c | 2 +
sound/drivers/pcmtest.c | 42 +-
sound/soc/amd/ps/acp63.h | 8 +
sound/soc/amd/ps/pci-ps.c | 2 +
sound/soc/amd/ps/ps-common.c | 2 +
sound/soc/generic/audio-graph-card2.c | 3 +-
sound/synth/emux/emux_synth.c | 3 +
sound/synth/emux/soundfont.c | 9 +-
sound/usb/line6/pcm.c | 8 +
sound/x86/intel_hdmi_audio.c | 9 +-
tools/objtool/check.c | 1 +
virt/kvm/guest_memfd.c | 120 +--
virt/kvm/guest_memfd.h | 19 +-
virt/kvm/kvm_main.c | 75 +-
virt/kvm/pfncache.c | 18 +-
452 files changed, 8695 insertions(+), 3181 deletions(-)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 001/547] net: skbuff: propagate shared-frag marker in skb_zerocopy()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 002/547] ksmbd: wait for negotiation before receiving another PDU Greg Kroah-Hartman
` (554 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zizhen Liu, Eric Dumazet,
Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zizhen Liu <pointerliu@126.com>
commit 79dc34beb1fdb3da79753e51e15c68591a2561fe upstream.
skb_zerocopy() moves frag descriptors from @from into @to and takes a
reference on each frag, but it does not copy skb_shinfo(from)->flags into
skb_shinfo(to)->flags. A destination skb holding the same page-cache
backed frags as the source therefore reports skb_has_shared_frag() as
false.
That breaks the invariant relied on by later in-place writers. ESP input
checks skb_has_shared_frag() before deciding whether an uncloned
nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
decrypted in place, letting an unprivileged user write into the page
cache of a root-owned read-only file.
Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for
the other frag-transfer helpers.
Fixes: af2806f8f90a ("net: Export skb_zerocopy() to zerocopy from one skb to another")
Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
Cc: stable@kernel.org
Signed-off-by: Zizhen Liu <pointerliu@126.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261022104217.1852191-1-pointerliu@126.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3942,6 +3942,8 @@ skb_zerocopy(struct sk_buff *to, struct
}
skb_shinfo(to)->nr_frags = j;
+ skb_shinfo(to)->flags |= skb_shinfo(from)->flags & SKBFL_SHARED_FRAG;
+
if (i > 0 && from->unreadable)
to->unreadable = 1;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 002/547] ksmbd: wait for negotiation before receiving another PDU
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 001/547] net: skbuff: propagate shared-frag marker in skb_zerocopy() Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 003/547] smb: smbdirect: dont wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync() Greg Kroah-Hartman
` (553 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ihopenre-eng, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit 68f410faedaf6ee74d81e574733c50ebcc1bd8ed ]
The receive thread queues a request and can read the next PDU before
the negotiation worker finishes. While need_neg is set, the next PDU
can cause ksmbd_init_smb_server() to replace conn->ops. A pipelined
SMB2 request can therefore make the worker handle an earlier, shorter
SMB1 request with SMB2 operations and read beyond its buffer.
An SMB1 multi-protocol negotiate may be followed by an SMB2 NEGOTIATE
that changes conn->ops again. Wait for work queued while the connection
is new or needs negotiation to complete before reading another PDU.
This keeps the operations stable for both stages of negotiation without
changing when need_neg is cleared.
Fixes: dc8289f91238 ("ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr")
Reported-by: ihopenre-eng <ihopenre@gmail.com>
Reviewed-by: ihopenre-eng <ihopenre@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/server.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 0827c8c510066..e0d00ed22461f 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -382,6 +382,7 @@ static void handle_ksmbd_work(struct work_struct *wk)
static int queue_ksmbd_work(struct ksmbd_conn *conn)
{
struct ksmbd_work *work;
+ bool wait_for_neg = ksmbd_conn_new(conn) || ksmbd_conn_need_negotiate(conn);
int err;
err = ksmbd_init_smb_server(conn);
@@ -404,6 +405,10 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn)
conn->last_active = jiffies;
INIT_WORK(&work->work, handle_ksmbd_work);
ksmbd_queue_work(work);
+ /* Negotiation can change conn->ops, finish it before reading another PDU. */
+ if (wait_for_neg)
+ wait_event(conn->req_running_q,
+ atomic_read(&conn->req_running) == 0);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 003/547] smb: smbdirect: dont wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 001/547] net: skbuff: propagate shared-frag marker in skb_zerocopy() Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 002/547] ksmbd: wait for negotiation before receiving another PDU Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 004/547] smb: smbdirect: release failed pending sockets of a listener Greg Kroah-Hartman
` (552 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Paulo Alcantara,
Tom Talpey, linux-cifs, samba-technical, linux-rdma,
Stefan Metzmacher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 4ca76b89917ad5b317e07ae4f0edc16f7c2a1248 ]
smbdirect_socket_destroy_sync() waited for RDMA_CM_EVENT_DISCONNECTED
after smbdirect_socket_cleanup_work() called rdma_disconnect(). That
can take very long, e.g. if the peer just disappeared, until the
rdma cm gives up, or forever if the event already happened, but the
status was overwritten afterwards.
This is not needed: smbdirect_socket_destroy() drains the qp under
rdma_lock_handler(), destroys it and calls rdma_destroy_id(), which
only waits for a currently running event handler and makes sure no
further events are delivered. The rest of the disconnect protocol
(DREQ/DREP and timewait for IB, abrupt close for iWarp) is handled
by the rdma core asynchronously. drivers/nvme/host/rdma.c also just
calls rdma_disconnect() and ib_drain_qp() before rdma_destroy_id().
So smbdirect_socket_destroy() now also accepts
SMBDIRECT_SOCKET_DISCONNECTING and changes the status to
SMBDIRECT_SOCKET_DISCONNECTED itself under rdma_lock_handler().
We could still get RDMA_CM_EVENT_DISCONNECTED in the small
windows between rdma_unlock_handler() and rdma_destroy_id(),
but in that case smbdirect_connection_rdma_event_handler()
is basically a no-op.
Fixes: 422a2436697d ("smb: smbdirect: introduce smbdirect_socket_destroy[_sync]()")
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Cc: linux-rdma@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/smbdirect/connection.c | 12 ++++----
fs/smb/smbdirect/socket.c | 56 ++++++++++++++++++++++++++++-------
2 files changed, 52 insertions(+), 16 deletions(-)
diff --git a/fs/smb/smbdirect/connection.c b/fs/smb/smbdirect/connection.c
index afd31fa12a368..f48c857bda5a4 100644
--- a/fs/smb/smbdirect/connection.c
+++ b/fs/smb/smbdirect/connection.c
@@ -83,9 +83,9 @@ static int smbdirect_connection_rdma_event_handler(struct rdma_cm_id *id,
* smbdirect_socket_schedule_cleanup[_status]() =>
* smbdirect_socket_cleanup_work().
*
- * As otherwise we'd set SMBDIRECT_SOCKET_DISCONNECTING,
- * but never ever get RDMA_CM_EVENT_DISCONNECTED and
- * never reach SMBDIRECT_SOCKET_DISCONNECTED.
+ * As otherwise we'd set SMBDIRECT_SOCKET_DISCONNECTING
+ * and call rdma_disconnect(), but never ever get
+ * RDMA_CM_EVENT_DISCONNECTED.
*/
if (event->event == RDMA_CM_EVENT_DEVICE_REMOVAL)
smbdirect_socket_schedule_cleanup_status(sc,
@@ -113,9 +113,9 @@ static int smbdirect_connection_rdma_event_handler(struct rdma_cm_id *id,
* smbdirect_socket_schedule_cleanup_status() =>
* smbdirect_socket_cleanup_work().
*
- * As otherwise we'd set SMBDIRECT_SOCKET_DISCONNECTING,
- * but never ever get RDMA_CM_EVENT_DISCONNECTED and
- * never reach SMBDIRECT_SOCKET_DISCONNECTED.
+ * As otherwise we'd set SMBDIRECT_SOCKET_DISCONNECTING
+ * and call rdma_disconnect(), but never ever get
+ * RDMA_CM_EVENT_DISCONNECTED.
*
* This is also a normal disconnect so
* SMBDIRECT_LOG_INFO should be good enough
diff --git a/fs/smb/smbdirect/socket.c b/fs/smb/smbdirect/socket.c
index bb02df6158b97..c36cb7cc0088b 100644
--- a/fs/smb/smbdirect/socket.c
+++ b/fs/smb/smbdirect/socket.c
@@ -511,7 +511,13 @@ static void smbdirect_socket_destroy(struct smbdirect_socket *sc)
if (sc->status == SMBDIRECT_SOCKET_DESTROYED)
return;
- WARN_ONCE(sc->status != SMBDIRECT_SOCKET_DISCONNECTED,
+ /*
+ * smbdirect_socket_destroy_sync() doesn't wait
+ * for RDMA_CM_EVENT_DISCONNECTED, so we may still
+ * be in SMBDIRECT_SOCKET_DISCONNECTING
+ * (or already reached SMBDIRECT_SOCKET_DISCONNECTED)
+ */
+ WARN_ONCE(sc->status < SMBDIRECT_SOCKET_DISCONNECTING,
"status=%s first_error=%1pe",
smbdirect_socket_status_string(sc->status),
SMBDIRECT_DEBUG_ERR_PTR(sc->first_error));
@@ -542,6 +548,32 @@ static void smbdirect_socket_destroy(struct smbdirect_socket *sc)
if (sc->rdma.cm_id)
rdma_lock_handler(sc->rdma.cm_id);
+ /*
+ * We hold the handler lock, so the rdma event
+ * handlers can't change the status anymore.
+ *
+ * If RDMA_CM_EVENT_DISCONNECTED didn't arrive yet,
+ * we just stop waiting for it here.
+ *
+ * We already disabled disconnect_work above
+ * and before we call rdma_unlock_handler below
+ * we call smbdirect_connection_destroy_qp which
+ * sets sc->ib.qp = NULL.
+ *
+ * Between rdma_unlock_handler() and
+ * rdma_destroy_id() below there's a small
+ * windows where RDMA_CM_EVENT_DISCONNECTED
+ * could still arrive.
+ *
+ * But smbdirect_connection_rdma_event_handler
+ * will be a noop when calling smbdirect_socket_schedule_cleanup*
+ * ib_drain_qp() also won't be called.
+ */
+ if (sc->status < SMBDIRECT_SOCKET_DISCONNECTED) {
+ sc->status = SMBDIRECT_SOCKET_DISCONNECTED;
+ smbdirect_socket_wake_up_all(sc);
+ }
+
if (sc->ib.qp) {
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_INFO,
"drain qp\n");
@@ -679,17 +711,21 @@ void smbdirect_socket_destroy_sync(struct smbdirect_socket *sc)
"destroying rdma session\n");
if (sc->status < SMBDIRECT_SOCKET_DISCONNECTING)
smbdirect_socket_cleanup_work(&sc->disconnect_work);
- if (sc->status < SMBDIRECT_SOCKET_DISCONNECTED) {
- smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_INFO,
- "wait for transport being disconnected\n");
- wait_event(sc->status_wait, sc->status == SMBDIRECT_SOCKET_DISCONNECTED);
- smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_INFO,
- "waited for transport being disconnected\n");
- }
/*
- * Once we reached SMBDIRECT_SOCKET_DISCONNECTED,
- * we should call smbdirect_socket_destroy()
+ * We don't wait for RDMA_CM_EVENT_DISCONNECTED,
+ * rdma_disconnect() was already called by
+ * smbdirect_socket_cleanup_work() if needed
+ * and smbdirect_socket_destroy() drains the qp,
+ * destroys it and calls rdma_destroy_id(), which
+ * only waits for a currently running event handler
+ * and makes sure no further events are delivered.
+ * The rest of the disconnect protocol is handled
+ * by the rdma core asynchronously.
+ *
+ * Waiting for RDMA_CM_EVENT_DISCONNECTED could
+ * take very long or forever, e.g. if the peer
+ * just disappeared.
*/
smbdirect_socket_destroy(sc);
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_INFO,
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 004/547] smb: smbdirect: release failed pending sockets of a listener
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 003/547] smb: smbdirect: dont wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync() Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 005/547] smb: smbdirect: dont hand out already failed sockets in smbdirect_socket_accept() Greg Kroah-Hartman
` (551 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lee Seong Hyeon, Sashiko,
Namjae Jeon, Paulo Alcantara, Tom Talpey, linux-cifs,
samba-technical, Stefan Metzmacher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 328c7e307e8411899e2f90beae83da9e4c45d700 ]
A child of a listener only left the listen.pending or listen.ready
list via smbdirect_socket_accept() or when the listener was
destroyed. So every connection that failed before it was accepted
(negotiate timeout, peer disconnect, invalid negotiate request, ...)
stayed on the list and counted against the backlog until the listener
was destroyed. After about backlog (10 for ksmbd) such connections
smbdirect_listen_connect_request() rejected every new connection with
-EBUSY, so an unauthenticated peer was able to permanently stop
ksmbd from accepting SMB-Direct connections.
Now a failed child moves itself to a new listen.orphaned list at the
end of smbdirect_socket_cleanup_work(), after the disconnect was
started, and queues listen.purge_orphaned_work, which releases it
with smbdirect_socket_release(), without holding the listener's
rdma_lock_handler() lock, in the same way smbdirect_socket_destroy()
does for the remaining children. Orphaned sockets still count against
the backlog until they are released.
sc->accept.listener is now only changed under listener->listen.lock
and whoever clears it is responsible for releasing the socket:
smbdirect_socket_accept(), purge_orphaned_work or the destroy of the
listener.
In order to make that work:
- a struct smbdirect_socket that is a listener is now freed via
kfree_rcu(), so that a child can dereference sc->accept.listener
under rcu_read_lock(), even if the listener is released concurrently.
- smbdirect_listen_connect_request() adds nsc to the listen.pending
list and sets nsc->accept.listener before it calls
smbdirect_accept_connect_request(), and always returns 0 so the
rdma_cm core keeps the connection id and nsc owns it. On a non-zero
return it schedules nsc's teardown with
smbdirect_socket_schedule_cleanup(), which orphans it off the
listener so that purge_orphaned_work releases it; nsc destroys its
own connection id with rdma_destroy_id() in that teardown. The
teardown has to be deferred because the rdma_cm core holds nsc's
id_priv->handler_mutex across the handler, so nsc->rdma.cm_id must
not be destroyed synchronously from here. That same handler_mutex
(and the listener's) also guarantees nsc can't go away under us,
so setting the listener before the call is safe and lets a failure
orphan nsc.
- smbdirect_accept_negotiate_recv_work() no longer moves a socket to
the ready list if it already failed or no longer belongs to the
listener. Every accepting socket has a listener, so if
sc->accept.listener is already cleared, it no longer sends a
negotiate response, as the socket is about to be released.
- smbdirect_socket_destroy() of the listener disables
purge_orphaned_work and also releases the orphaned sockets.
Fixes: dc691b91ad16 ("smb: smbdirect: introduce smbdirect_socket_{listen,accept}()")
Reported-by: Lee Seong Hyeon <ihopenre@gmail.com>
Closes: https://lore.kernel.org/linux-cifs/CANTrAmxL5sWU8Sn29JAGZvSq5PBB2OA+VKA0MHsZJMesagtfzA@mail.gmail.com/
Reported-by: Sashiko <sashiko-bot+sashiko@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1791224972.git.metze%40samba.org
Closes: https://sashiko.dev/#/patchset/cover.1791229120.git.metze%40samba.org
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/smbdirect/accept.c | 141 +++++++++++++++++++++++-------------
fs/smb/smbdirect/internal.h | 2 +
fs/smb/smbdirect/listen.c | 137 ++++++++++++++++++++++++++++++++---
fs/smb/smbdirect/socket.c | 57 ++++++++++++++-
fs/smb/smbdirect/socket.h | 42 +++++++++++
5 files changed, 314 insertions(+), 65 deletions(-)
diff --git a/fs/smb/smbdirect/accept.c b/fs/smb/smbdirect/accept.c
index 1b30ca8476c1d..9771444429742 100644
--- a/fs/smb/smbdirect/accept.c
+++ b/fs/smb/smbdirect/accept.c
@@ -19,15 +19,33 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
const struct rdma_conn_param *param)
{
struct smbdirect_socket_parameters *sp = &sc->parameters;
- struct smbdirect_recv_io *recv_io;
+ struct smbdirect_recv_io *recv_io = NULL;
u8 peer_initiator_depth;
u8 peer_responder_resources;
struct rdma_conn_param conn_param;
__be32 ird_ord_hdr[2];
int ret;
- if (SMBDIRECT_CHECK_STATUS_WARN(sc, SMBDIRECT_SOCKET_CREATED))
- return -EINVAL;
+ /*
+ * Install the real event handler (and the event we expect next)
+ * before anything that can fail. On an early error the caller
+ * (smbdirect_listen_connect_request()) only schedules our deferred
+ * cleanup and returns 0 to the rdma_cm core, which keeps the cm_id, so
+ * the cm_id must already carry smbdirect_accept_rdma_event_handler():
+ * it turns any unexpected event (e.g. RDMA_CM_EVENT_DEVICE_REMOVAL)
+ * into a clean smbdirect_socket_schedule_cleanup(). Otherwise the
+ * placeholder smbdirect_socket_rdma_event_handler() installed by
+ * smbdirect_socket_init_accepting() stays in place and returns -ESTALE,
+ * which makes the rdma_cm core destroy the cm_id behind the back of our
+ * pending teardown.
+ */
+ sc->rdma.expected_event = RDMA_CM_EVENT_ESTABLISHED;
+ sc->rdma.cm_id->event_handler = smbdirect_accept_rdma_event_handler;
+
+ if (SMBDIRECT_CHECK_STATUS_WARN(sc, SMBDIRECT_SOCKET_CREATED)) {
+ ret = -EINVAL;
+ goto cleanup;
+ }
/*
* First set what the we as server are able to support
@@ -48,7 +66,7 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_ERR,
"smbdirect_accept_init_params() failed %1pe\n",
SMBDIRECT_DEBUG_ERR_PTR(ret));
- goto init_params_failed;
+ goto cleanup;
}
ret = smbdirect_connection_create_qp(sc);
@@ -56,7 +74,7 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_ERR,
"smbdirect_connection_create_qp() failed %1pe\n",
SMBDIRECT_DEBUG_ERR_PTR(ret));
- goto create_qp_failed;
+ goto cleanup;
}
ret = smbdirect_connection_create_mem_pools(sc);
@@ -64,7 +82,7 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_ERR,
"smbdirect_connection_create_mem_pools() failed %1pe\n",
SMBDIRECT_DEBUG_ERR_PTR(ret));
- goto create_mem_failed;
+ goto cleanup;
}
recv_io = smbdirect_connection_get_recv_io(sc);
@@ -73,7 +91,7 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_ERR,
"smbdirect_connection_get_recv_io() failed %1pe\n",
SMBDIRECT_DEBUG_ERR_PTR(ret));
- goto get_recv_io_failed;
+ goto cleanup;
}
recv_io->cqe.done = smbdirect_accept_negotiate_recv_done;
@@ -87,7 +105,7 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_ERR,
"smbdirect_connection_post_recv_io() failed %1pe\n",
SMBDIRECT_DEBUG_ERR_PTR(ret));
- goto post_recv_io_failed;
+ goto cleanup;
}
/*
* From here recv_io is known to the RDMA QP and needs ib_drain_qp and
@@ -123,14 +141,12 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
/* explicitly set above */
WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RDMA_CONNECT_NEEDED);
sc->status = SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING;
- sc->rdma.expected_event = RDMA_CM_EVENT_ESTABLISHED;
- sc->rdma.cm_id->event_handler = smbdirect_accept_rdma_event_handler;
ret = rdma_accept(sc->rdma.cm_id, &conn_param);
if (ret) {
smbdirect_log_rdma_event(sc, SMBDIRECT_LOG_ERR,
"rdma_accept() failed %1pe\n",
SMBDIRECT_DEBUG_ERR_PTR(ret));
- goto rdma_accept_failed;
+ goto cleanup;
}
/*
@@ -144,31 +160,25 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
return 0;
-rdma_accept_failed:
+cleanup:
/*
- * The recv_io posted above is now owned by the QP (recv_io was set to
- * NULL after a successful post). smbdirect_connection_destroy_qp()
- * calls ib_drain_qp(), whose completion
- * (smbdirect_accept_negotiate_recv_done) returns the recv_io to the
- * free list via smbdirect_connection_put_recv_io(). It therefore MUST
- * run BEFORE smbdirect_connection_destroy_mem_pools(): otherwise the
- * posted recv_io is still outstanding when kmem_cache_destroy() runs
- * ("Slab cache still has objects") and is later freed into an
- * already-destroyed mempool (mempool_free_bulk NULL-ptr-deref).
+ * No RDMA state is torn down here, and in particular sc is not
+ * released: the caller (smbdirect_listen_connect_request()) owns that
+ * decision and schedules sc's teardown via
+ * smbdirect_socket_schedule_cleanup() on a non-zero return. All of the
+ * RDMA state - the QP, the memory pools and the cm_id itself - is then
+ * torn down asynchronously by smbdirect_socket_cleanup_work() ->
+ * smbdirect_socket_release() -> smbdirect_socket_destroy(), which
+ * drains the QP (returning any posted recv_io to the pool) before
+ * destroying the memory pools and destroys the cm_id with
+ * rdma_destroy_id(), all in the correct order.
+ *
+ * The only resource not reachable by that teardown is a recv_io that
+ * was taken from the pool but not yet posted to the QP (recv_io is set
+ * to NULL after a successful post), so hand it back here.
*/
- smbdirect_connection_destroy_qp(sc);
- smbdirect_connection_destroy_mem_pools(sc);
- return ret;
-post_recv_io_failed:
- /* post failed: recv_io was not accepted by the QP, still in hand */
if (recv_io)
smbdirect_connection_put_recv_io(recv_io);
-get_recv_io_failed:
- smbdirect_connection_destroy_mem_pools(sc);
-create_mem_failed:
- smbdirect_connection_destroy_qp(sc);
-create_qp_failed:
-init_params_failed:
return ret;
}
@@ -302,6 +312,7 @@ static void smbdirect_accept_negotiate_recv_work(struct work_struct *work)
struct smbdirect_socket *sc =
container_of(work, struct smbdirect_socket, connect.work);
struct smbdirect_socket_parameters *sp = &sc->parameters;
+ struct smbdirect_socket *lsc;
struct smbdirect_recv_io *recv_io;
struct smbdirect_negotiate_req *nreq;
unsigned long flags;
@@ -464,29 +475,55 @@ static void smbdirect_accept_negotiate_recv_work(struct work_struct *work)
*/
sp->max_fragmented_send_size = max_fragmented_size;
- if (sc->accept.listener) {
- struct smbdirect_socket *lsc = sc->accept.listener;
- unsigned long flags;
+ /*
+ * Every accepting socket was created by
+ * smbdirect_listen_connect_request() and has a
+ * listener. If it's already cleared, the listener
+ * (or its purge_orphaned_work) is responsible for
+ * releasing us, so we must not send a negotiate
+ * response.
+ *
+ * The memory of the listener is freed via kfree_rcu(),
+ * see smbdirect_listen_orphan_socket().
+ */
+ rcu_read_lock();
+ lsc = READ_ONCE(sc->accept.listener);
+ if (!lsc) {
+ rcu_read_unlock();
+ return;
+ }
- spin_lock_irqsave(&lsc->listen.lock, flags);
- list_del(&sc->accept.list);
- list_add_tail(&sc->accept.list, &lsc->listen.ready);
+ spin_lock_irqsave(&lsc->listen.lock, flags);
+ /*
+ * The listener (or its purge_orphaned_work)
+ * may have cleared sc->accept.listener in the
+ * meantime and is responsible for releasing us.
+ *
+ * If we already failed, we're either
+ * already on the orphaned list or
+ * smbdirect_socket_cleanup_work() will
+ * move us there.
+ *
+ * In both cases we must not move us
+ * to the ready list.
+ */
+ if (sc->accept.listener == lsc && !READ_ONCE(sc->first_error)) {
+ list_move_tail(&sc->accept.list, &lsc->listen.ready);
wake_up(&lsc->listen.wait_queue);
- spin_unlock_irqrestore(&lsc->listen.lock, flags);
-
- /*
- * smbdirect_socket_accept() will call
- * smbdirect_accept_negotiate_finish(nsc, 0);
- *
- * So that we don't send the negotiation
- * response that grants credits to the peer
- * before the socket is accepted by the
- * application.
- */
- return;
}
+ spin_unlock_irqrestore(&lsc->listen.lock, flags);
+ rcu_read_unlock();
- ntstatus = le32_to_cpu(STATUS_SUCCESS);
+ /*
+ * smbdirect_socket_accept() will call
+ * smbdirect_accept_negotiate_finish(nsc, 0);
+ *
+ * So that we don't send the negotiation
+ * response that grants credits to the peer
+ * before the socket is accepted by the
+ * application.
+ */
+ return;
not_supported:
smbdirect_accept_negotiate_finish(sc, ntstatus);
@@ -839,7 +876,7 @@ struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
struct smbdirect_socket,
accept.list);
if (nsc) {
- nsc->accept.listener = NULL;
+ WRITE_ONCE(nsc->accept.listener, NULL);
list_del_init_careful(&nsc->accept.list);
arg->is_empty = list_empty_careful(&lsc->listen.ready);
}
diff --git a/fs/smb/smbdirect/internal.h b/fs/smb/smbdirect/internal.h
index e9959e6dc13ae..69d0c9f899dec 100644
--- a/fs/smb/smbdirect/internal.h
+++ b/fs/smb/smbdirect/internal.h
@@ -74,6 +74,8 @@ void __smbdirect_socket_schedule_cleanup(struct smbdirect_socket *sc,
void smbdirect_socket_destroy_sync(struct smbdirect_socket *sc);
+void smbdirect_listen_orphan_socket(struct smbdirect_socket *sc);
+
int smbdirect_socket_wait_for_credits(struct smbdirect_socket *sc,
enum smbdirect_socket_status expected_status,
int unexpected_errno,
diff --git a/fs/smb/smbdirect/listen.c b/fs/smb/smbdirect/listen.c
index 2f78bcaedbf82..3c91f00d95ce4 100644
--- a/fs/smb/smbdirect/listen.c
+++ b/fs/smb/smbdirect/listen.c
@@ -10,6 +10,78 @@
static int smbdirect_listen_rdma_event_handler(struct rdma_cm_id *id,
struct rdma_cm_event *event);
+/*
+ * This is called by a socket that failed while it
+ * is still on the pending or ready list of its
+ * listener, typically at the end of
+ * smbdirect_socket_cleanup_work(), when the
+ * disconnect was already started.
+ *
+ * It moves itself to the orphaned list and
+ * lets smbdirect_listen_purge_orphaned_work()
+ * release it. Otherwise it would stay on the
+ * pending or ready list until the listener is
+ * destroyed and fill up the backlog, so that
+ * no new connections would be accepted.
+ *
+ * It's fine to call this more than once.
+ */
+void smbdirect_listen_orphan_socket(struct smbdirect_socket *sc)
+{
+ struct smbdirect_socket *lsc;
+ unsigned long flags;
+
+ /*
+ * The memory of the listener is freed via
+ * kfree_rcu(), so it's safe to dereference it
+ * under rcu_read_lock(), even if sc->accept.listener
+ * is cleared and the listener is released concurrently.
+ */
+ rcu_read_lock();
+ lsc = READ_ONCE(sc->accept.listener);
+ if (!lsc) {
+ rcu_read_unlock();
+ return;
+ }
+
+ spin_lock_irqsave(&lsc->listen.lock, flags);
+ if (sc->accept.listener == lsc) {
+ list_move_tail(&sc->accept.list, &lsc->listen.orphaned);
+ queue_work(lsc->workqueues.cleanup, &lsc->listen.purge_orphaned_work);
+ }
+ spin_unlock_irqrestore(&lsc->listen.lock, flags);
+ rcu_read_unlock();
+}
+
+static void smbdirect_listen_purge_orphaned_work(struct work_struct *work)
+{
+ struct smbdirect_socket *lsc =
+ container_of(work, struct smbdirect_socket, listen.purge_orphaned_work);
+ struct smbdirect_socket *psc, *tsc;
+ LIST_HEAD(orphaned_list);
+ unsigned long flags;
+
+ /*
+ * Clearing accept.listener under listen.lock
+ * makes us responsible for releasing them.
+ */
+ spin_lock_irqsave(&lsc->listen.lock, flags);
+ list_splice_tail_init(&lsc->listen.orphaned, &orphaned_list);
+ list_for_each_entry(psc, &orphaned_list, accept.list)
+ WRITE_ONCE(psc->accept.listener, NULL);
+ spin_unlock_irqrestore(&lsc->listen.lock, flags);
+
+ /*
+ * We don't hold the listener's rdma_lock_handler()
+ * lock here, see smbdirect_socket_destroy()
+ * for why that's important.
+ */
+ list_for_each_entry_safe(psc, tsc, &orphaned_list, accept.list) {
+ list_del_init(&psc->accept.list);
+ smbdirect_socket_release(psc);
+ }
+}
+
int smbdirect_socket_listen(struct smbdirect_socket *sc, int backlog)
{
int ret;
@@ -47,6 +119,9 @@ int smbdirect_socket_listen(struct smbdirect_socket *sc, int backlog)
sc->rdma.cm_id->event_handler = smbdirect_listen_rdma_event_handler;
rdma_unlock_handler(sc->rdma.cm_id);
+ INIT_WORK(&sc->listen.purge_orphaned_work,
+ smbdirect_listen_purge_orphaned_work);
+
ret = rdma_listen(sc->rdma.cm_id, backlog);
if (ret) {
sc->first_error = ret;
@@ -214,6 +289,7 @@ static int smbdirect_listen_connect_request(struct smbdirect_socket *lsc,
size_t backlog = max_t(size_t, 1, lsc->listen.backlog);
size_t psockets;
size_t rsockets;
+ size_t osockets;
int ret;
if (!smbdirect_frwr_is_supported(&new_id->device->attrs)) {
@@ -254,14 +330,21 @@ static int smbdirect_listen_connect_request(struct smbdirect_socket *lsc,
spin_lock_irqsave(&lsc->listen.lock, flags);
psockets = list_count_nodes(&lsc->listen.pending);
rsockets = list_count_nodes(&lsc->listen.ready);
+ /*
+ * Orphaned sockets still count against
+ * the backlog until they are released by
+ * smbdirect_listen_purge_orphaned_work().
+ */
+ osockets = list_count_nodes(&lsc->listen.orphaned);
spin_unlock_irqrestore(&lsc->listen.lock, flags);
if (psockets > backlog ||
rsockets > backlog ||
- (psockets + rsockets) > backlog) {
+ osockets > backlog ||
+ (psockets + rsockets + osockets) > backlog) {
smbdirect_log_rdma_event(lsc, SMBDIRECT_LOG_ERR,
- "Backlog[%d][%zu] full pending[%zu] ready[%zu]\n",
- lsc->listen.backlog, backlog, psockets, rsockets);
+ "Backlog[%d][%zu] full pending[%zu] ready[%zu] orphaned[%zu]\n",
+ lsc->listen.backlog, backlog, psockets, rsockets, osockets);
return -EBUSY;
}
@@ -279,22 +362,54 @@ static int smbdirect_listen_connect_request(struct smbdirect_socket *lsc,
if (ret)
goto set_settings_failed;
+ /*
+ * Publish nsc on the pending list with accept.listener set before
+ * smbdirect_accept_connect_request() calls rdma_accept(). Once the
+ * connection can establish, smbdirect_accept_negotiate_recv_work()
+ * may run and it must observe accept.listener, otherwise nsc would
+ * be left stranded on the pending list forever.
+ *
+ * The listener's handler_mutex is held while we're called, so
+ * smbdirect_socket_destroy() of the listener can't reach nsc on the
+ * pending list before we're done.
+ *
+ * From here nsc is published on the pending list: on failure of
+ * smbdirect_accept_connect_request() below we schedule nsc's teardown,
+ * which orphans nsc off the listener so
+ * smbdirect_listen_purge_orphaned_work() -> smbdirect_socket_release()
+ * releases it.
+ */
spin_lock_irqsave(&lsc->listen.lock, flags);
list_add_tail(&nsc->accept.list, &lsc->listen.pending);
- nsc->accept.listener = lsc;
+ WRITE_ONCE(nsc->accept.listener, lsc);
spin_unlock_irqrestore(&lsc->listen.lock, flags);
ret = smbdirect_accept_connect_request(nsc, &event->param.conn);
- if (ret)
- goto accept_connect_failed;
+ if (ret) {
+ /*
+ * The rdma_cm core holds both the listener's and nsc's
+ * id_priv->handler_mutex across this CONNECT_REQUEST handler,
+ * so neither can go away under us here and nsc cannot receive
+ * any rdma event: it is safe to hand nsc to its teardown.
+ *
+ * That teardown must be deferred though: nsc->rdma.cm_id
+ * (= new_id) has its handler_mutex held by us, so it cannot be
+ * destroyed synchronously from here.
+ * smbdirect_socket_schedule_cleanup() only queues work;
+ * smbdirect_socket_cleanup_work() then orphans nsc off the
+ * listener and smbdirect_listen_purge_orphaned_work() releases
+ * it, destroying nsc's cm_id with rdma_destroy_id().
+ */
+ smbdirect_socket_schedule_cleanup(nsc, ret);
+ }
+ /*
+ * Always return 0 so the rdma_cm core keeps new_id: nsc owns it now.
+ * On success it stays connected; on failure its deferred teardown
+ * above destroys it.
+ */
return 0;
-accept_connect_failed:
- spin_lock_irqsave(&lsc->listen.lock, flags);
- list_del_init(&nsc->accept.list);
- nsc->accept.listener = NULL;
- spin_unlock_irqrestore(&lsc->listen.lock, flags);
set_settings_failed:
set_params_failed:
/*
diff --git a/fs/smb/smbdirect/socket.c b/fs/smb/smbdirect/socket.c
index c36cb7cc0088b..e270e36b3145e 100644
--- a/fs/smb/smbdirect/socket.c
+++ b/fs/smb/smbdirect/socket.c
@@ -319,6 +319,15 @@ void __smbdirect_socket_schedule_cleanup(struct smbdirect_socket *sc,
* (smbdirect_socket_destroy) to reap.
*/
if (sc->listen.backlog != -1) { /* was a listener */
+ /*
+ * We don't move them to the orphaned list here,
+ * each child does that itself at the end of its
+ * smbdirect_socket_cleanup_work(), see
+ * smbdirect_listen_orphan_socket(). Only that checks
+ * accept.listener, which is still NULL for a child
+ * that smbdirect_listen_connect_request() is still
+ * setting up and will release itself on failure.
+ */
spin_lock_irqsave(&sc->listen.lock, flags);
list_splice_init(&sc->listen.ready, &sc->listen.pending);
list_for_each_entry_safe(psc, tsc, &sc->listen.pending, accept.list)
@@ -427,6 +436,15 @@ static void smbdirect_socket_cleanup_work(struct work_struct *work)
* instances of one class -- harmless, but lockdep cannot tell).
*/
if (sc->listen.backlog != -1) { /* was a listener */
+ /*
+ * We don't move them to the orphaned list here,
+ * each child does that itself at the end of its
+ * smbdirect_socket_cleanup_work(), see
+ * smbdirect_listen_orphan_socket(). Only that checks
+ * accept.listener, which is still NULL for a child
+ * that smbdirect_listen_connect_request() is still
+ * setting up and will release itself on failure.
+ */
spin_lock_irqsave(&sc->listen.lock, flags);
list_splice_init(&sc->listen.ready, &sc->listen.pending);
list_for_each_entry_safe(psc, tsc, &sc->listen.pending, accept.list)
@@ -486,6 +504,18 @@ static void smbdirect_socket_cleanup_work(struct work_struct *work)
* in order to notice the broken connection.
*/
smbdirect_socket_wake_up_all(sc);
+
+ /*
+ * If we're still on the pending or ready list
+ * of a listener, we started the disconnect
+ * as far as possible above, so we move ourself
+ * to the orphaned list of the listener,
+ * which will release us.
+ *
+ * This is a no-op internally if
+ * sc->accept.listener is NULL.
+ */
+ smbdirect_listen_orphan_socket(sc);
}
static void smbdirect_socket_destroy(struct smbdirect_socket *sc)
@@ -544,6 +574,7 @@ static void smbdirect_socket_destroy(struct smbdirect_socket *sc)
disable_work_sync(&sc->recv_io.posted.refill_work);
disable_work_sync(&sc->idle.immediate_work);
disable_delayed_work_sync(&sc->idle.timer_work);
+ disable_work_sync(&sc->listen.purge_orphaned_work);
if (sc->rdma.cm_id)
rdma_lock_handler(sc->rdma.cm_id);
@@ -607,6 +638,19 @@ static void smbdirect_socket_destroy(struct smbdirect_socket *sc)
spin_lock_irqsave(&sc->listen.lock, flags);
list_splice_tail_init(&sc->listen.ready, &pending_list);
list_splice_tail_init(&sc->listen.pending, &pending_list);
+ /*
+ * purge_orphaned_work is already disabled above,
+ * so we also need to release the orphaned sockets.
+ *
+ * Clearing accept.listener under listen.lock
+ * makes us responsible for releasing them and
+ * prevents them from moving themselves to
+ * the orphaned list via
+ * smbdirect_listen_orphan_socket().
+ */
+ list_splice_tail_init(&sc->listen.orphaned, &pending_list);
+ list_for_each_entry(psc, &pending_list, accept.list)
+ WRITE_ONCE(psc->accept.listener, NULL);
spin_unlock_irqrestore(&sc->listen.lock, flags);
/* It's not possible for upper layer to get to reassembly */
@@ -650,7 +694,6 @@ static void smbdirect_socket_destroy(struct smbdirect_socket *sc)
"release %zu pending sockets\n", psockets);
list_for_each_entry_safe(psc, tsc, &pending_list, accept.list) {
list_del_init(&psc->accept.list);
- psc->accept.listener = NULL;
smbdirect_socket_release(psc);
}
if (sc->listen.backlog != -1) /* was a listener */
@@ -777,7 +820,17 @@ static void smbdirect_socket_release_destroy(struct kref *kref)
* in DESTROYED state, before we free the memory.
*/
smbdirect_socket_destroy_sync(sc);
- kfree(sc);
+
+ /*
+ * Only a listener (backlog != -1) is ever dereferenced
+ * via sc->accept.listener under rcu_read_lock(), see
+ * smbdirect_listen_orphan_socket(). Other sockets can be
+ * freed immediately.
+ */
+ if (sc->listen.backlog != -1) /* was a listener */
+ kfree_rcu(sc, refs.rcu);
+ else
+ kfree(sc);
}
void smbdirect_socket_release(struct smbdirect_socket *sc)
diff --git a/fs/smb/smbdirect/socket.h b/fs/smb/smbdirect/socket.h
index c09eddd8ad16d..14114a2567a2e 100644
--- a/fs/smb/smbdirect/socket.h
+++ b/fs/smb/smbdirect/socket.h
@@ -151,6 +151,12 @@ struct smbdirect_socket {
* the disconnect refcount.
*/
struct kref destroy;
+
+ /*
+ * smbdirect_socket_release_destroy() uses
+ * kfree_rcu(), see accept.listener.
+ */
+ struct rcu_head rcu;
} refs;
/* RDMA related */
@@ -216,6 +222,16 @@ struct smbdirect_socket {
* only be > 0.
*/
int backlog;
+ /*
+ * Sockets on pending or ready that failed
+ * move themselves to orphaned and queue
+ * purge_orphaned_work, which releases them.
+ * So that they are freed while the listener
+ * is still alive. They still count against
+ * the backlog until they are released.
+ */
+ struct list_head orphaned;
+ struct work_struct purge_orphaned_work;
} listen;
/*
@@ -226,7 +242,30 @@ struct smbdirect_socket {
* connection.
*/
struct {
+ /*
+ * This is only set, protected by
+ * listener->listen.lock, while the socket
+ * is owned by the listener (on its pending,
+ * ready or orphaned list). The one who clears
+ * it is responsible for releasing the socket.
+ *
+ * The memory of a struct smbdirect_socket is
+ * freed via kfree_rcu(), so the listener
+ * can be dereferenced under rcu_read_lock(),
+ * even if accept.listener is cleared and
+ * the listener is released concurrently.
+ */
struct smbdirect_socket *listener;
+ /*
+ * Linkage on one of the listener's
+ * listen.{pending,ready,orphaned} lists.
+ *
+ * accept.list and accept.listener are set
+ * together under listener->listen.lock before
+ * smbdirect_accept_connect_request() is called,
+ * so whenever the socket is on one of those lists
+ * accept.listener is that listener (never NULL).
+ */
struct list_head list;
} accept;
@@ -588,6 +627,9 @@ static __always_inline void smbdirect_socket_init(struct smbdirect_socket *sc)
spin_lock_init(&sc->listen.lock);
INIT_LIST_HEAD(&sc->listen.pending);
INIT_LIST_HEAD(&sc->listen.ready);
+ INIT_LIST_HEAD(&sc->listen.orphaned);
+ INIT_WORK(&sc->listen.purge_orphaned_work, __smbdirect_socket_disabled_work);
+ disable_work_sync(&sc->listen.purge_orphaned_work);
sc->listen.backlog = -1; /* not a listener */
init_waitqueue_head(&sc->listen.wait_queue);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 005/547] smb: smbdirect: dont hand out already failed sockets in smbdirect_socket_accept()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 004/547] smb: smbdirect: release failed pending sockets of a listener Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 006/547] ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle Greg Kroah-Hartman
` (550 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Namjae Jeon,
Paulo Alcantara, Tom Talpey, linux-cifs, samba-technical,
Stefan Metzmacher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 5c171c90c446bdce80ebaecfc5ed2c410bcc7427 ]
A socket on the ready list is in SMBDIRECT_SOCKET_NEGOTIATE_RUNNING,
but it may fail before smbdirect_socket_accept() picks it up, e.g.
RDMA_CM_EVENT_DISCONNECTED already moved it to
SMBDIRECT_SOCKET_DISCONNECTED.
smbdirect_socket_accept() unconditionally overwrote the status with
SMBDIRECT_SOCKET_CONNECTED and handed out the already disconnected
socket. smbdirect_socket_cleanup_work() then called rdma_disconnect()
on it again, and before the recent commit
smbdirect_socket_destroy_sync() waited forever for an
RDMA_CM_EVENT_DISCONNECTED that already happened.
Now we check first_error and change the status to
SMBDIRECT_SOCKET_CONNECTED only via cmpxchg() from
SMBDIRECT_SOCKET_NEGOTIATE_RUNNING, while we still hold listen.lock.
If the socket already failed, we move it to the orphaned list and
queue purge_orphaned_work, like smbdirect_listen_orphan_socket() does,
and try the next one. If we only found failed sockets, we wait for
the next one.
Fixes: dc691b91ad16 ("smb: smbdirect: introduce smbdirect_socket_{listen,accept}()")
Reported-by: Sashiko <sashiko-bot+sashiko@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1791224972.git.metze%40samba.org
Closes: https://sashiko.dev/#/bug/linux-f9dbca09-30a7-4145-9bdb-4676759982c8
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/smbdirect/accept.c | 84 +++++++++++++++++++++++++++++++++------
1 file changed, 72 insertions(+), 12 deletions(-)
diff --git a/fs/smb/smbdirect/accept.c b/fs/smb/smbdirect/accept.c
index 9771444429742..e7e5eb75a5aea 100644
--- a/fs/smb/smbdirect/accept.c
+++ b/fs/smb/smbdirect/accept.c
@@ -836,7 +836,11 @@ static long smbdirect_socket_wait_for_accept(struct smbdirect_socket *lsc, long
if (ret < 0)
return ret;
- return 0;
+ /*
+ * Return the remaining timeout, so the caller can carry it
+ * over to the next smbdirect_socket_wait_for_accept() call.
+ */
+ return ret;
}
struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
@@ -846,6 +850,7 @@ struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
struct smbdirect_socket *nsc;
unsigned long flags;
+again:
if (lsc->status != SMBDIRECT_SOCKET_LISTENING) {
arg->err = -EINVAL;
return NULL;
@@ -857,7 +862,7 @@ struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
}
if (list_empty_careful(&lsc->listen.ready)) {
- int ret;
+ long ret;
if (timeo == 0) {
arg->err = -EAGAIN;
@@ -865,16 +870,64 @@ struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
}
ret = smbdirect_socket_wait_for_accept(lsc, timeo);
- if (ret) {
+ if (ret < 0) {
arg->err = ret;
return NULL;
}
+ /*
+ * Carry the remaining timeout over, so that a stream of
+ * failed connections that we orphan and skip (goto again)
+ * can't reset the caller's timeout and wait forever.
+ */
+ timeo = ret;
}
spin_lock_irqsave(&lsc->listen.lock, flags);
- nsc = list_first_entry_or_null(&lsc->listen.ready,
- struct smbdirect_socket,
- accept.list);
+ /*
+ * Recheck under the lock.
+ */
+ if (lsc->status != SMBDIRECT_SOCKET_LISTENING) {
+ arg->err = -EINVAL;
+ spin_unlock_irqrestore(&lsc->listen.lock, flags);
+ return NULL;
+ }
+ if (lsc->first_error) {
+ arg->err = lsc->first_error;
+ spin_unlock_irqrestore(&lsc->listen.lock, flags);
+ return NULL;
+ }
+
+ while ((nsc = list_first_entry_or_null(&lsc->listen.ready,
+ struct smbdirect_socket,
+ accept.list))) {
+ /*
+ * nsc may have failed after it was moved
+ * to the ready list, e.g. RDMA_CM_EVENT_DISCONNECTED
+ * already moved it to SMBDIRECT_SOCKET_DISCONNECTED.
+ * We must not overwrite that with
+ * SMBDIRECT_SOCKET_CONNECTED and hand
+ * out an already disconnected socket.
+ *
+ * Doing this under listen.lock means nsc
+ * still belongs to us, so we can just move
+ * a failed socket to the orphaned list,
+ * like smbdirect_listen_orphan_socket() does,
+ * and try the next one.
+ */
+ if (!READ_ONCE(nsc->first_error) &&
+ cmpxchg(&nsc->status,
+ SMBDIRECT_SOCKET_NEGOTIATE_RUNNING,
+ SMBDIRECT_SOCKET_CONNECTED) ==
+ SMBDIRECT_SOCKET_NEGOTIATE_RUNNING)
+ break;
+
+ smbdirect_log_rdma_event(nsc, SMBDIRECT_LOG_INFO,
+ "orphaning failed socket status=%s first_error=%1pe\n",
+ smbdirect_socket_status_string(nsc->status),
+ SMBDIRECT_DEBUG_ERR_PTR(nsc->first_error));
+ list_move_tail(&nsc->accept.list, &lsc->listen.orphaned);
+ queue_work(lsc->workqueues.cleanup, &lsc->listen.purge_orphaned_work);
+ }
if (nsc) {
WRITE_ONCE(nsc->accept.listener, NULL);
list_del_init_careful(&nsc->accept.list);
@@ -882,8 +935,13 @@ struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
}
spin_unlock_irqrestore(&lsc->listen.lock, flags);
if (!nsc) {
- arg->err = -EAGAIN;
- return NULL;
+ /*
+ * If we only found failed sockets or no socket,
+ * we wait for the next one.
+ *
+ * A possible -EAGAIN/-ETIMEOUT is handled above.
+ */
+ goto again;
}
/*
@@ -892,12 +950,14 @@ struct smbdirect_socket *smbdirect_socket_accept(struct smbdirect_socket *lsc,
* so it didn't grant any credits to us.
*
* The caller expects a connected socket
- * now as there are no credits anyway.
+ * now as there are no credits anyway,
+ * above we already changed to SMBDIRECT_SOCKET_CONNECTED
+ * under the lsc->listen.lock and with cmpxchg.
*
- * Then we send the negotiation response in
- * order to grant credits to the peer.
+ * Now we send the negotiation response in
+ * order to grant credits to the peer,
+ * as the socket is now visible to the application layer.
*/
- nsc->status = SMBDIRECT_SOCKET_CONNECTED;
smbdirect_accept_negotiate_finish(nsc, 0);
return nsc;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 006/547] ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 005/547] smb: smbdirect: dont hand out already failed sockets in smbdirect_socket_accept() Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 007/547] wifi: ath12k: move dp_profile_params to dp.h Greg Kroah-Hartman
` (549 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lee Seong Hyeon, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Seong Hyeon <ihopenre@gmail.com>
[ Upstream commit ef85bad39cf273a8377722c9f3078294dcc2fc7a ]
An authenticated client with a writable tree connection can open a
directory with FILE_WRITE_DATA and send FSCTL_SET_ZERO_DATA on that
handle. The handler only checks fp->daccess & FILE_WRITE_DATA_LE, but on
a directory FILE_WRITE_DATA is the legitimate add-file right, so the
check passes. ksmbd_vfs_zero_data() then calls kernel_write() on the
directory file, which has no FMODE_WRITE, and __kernel_write_iter()
hits WARN_ON_ONCE(!(file->f_mode & FMODE_WRITE)), panicking a
panic_on_warn kernel.
Before commit 25e414db7033 ("ksmbd: report holes in allocated range
queries") the dense-file path used vfs_fallocate(), which rejects
directories with -EISDIR. The kernel_write() loop that replaced it has
no such check. Reject a directory handle in ksmbd_vfs_zero_data() before
writing, as ksmbd_vfs_write() already does for SMB2_WRITE.
WARNING: fs/read_write.c:608 at __kernel_write_iter+0x74b/0x8c0
Workqueue: ksmbd-io handle_ksmbd_work
Call Trace:
kernel_write+0x1ef/0x4d0
ksmbd_vfs_zero_data+0x413/0x590
smb2_ioctl+0x21fa/0x66a0
handle_ksmbd_work+0x61b/0x1ff0
Fixes: 25e414db7033 ("ksmbd: report holes in allocated range queries")
Signed-off-by: Lee Seong Hyeon <ihopenre@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/vfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index c2c9aaa5de1b5..bb1cab471d4c8 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -955,6 +955,15 @@ int ksmbd_vfs_zero_data(struct ksmbd_work *work, struct ksmbd_file *fp,
char *zero_buf = NULL;
int err;
+ /*
+ * A directory handle can hold FILE_WRITE_DATA (the add-file right),
+ * so the caller access check does not exclude it. Writing zeroes to a
+ * directory makes no sense and kernel_write() would warn on the
+ * directory file (no FMODE_WRITE), so reject it here.
+ */
+ if (S_ISDIR(file_inode(fp->filp)->i_mode))
+ return -EINVAL;
+
smb_break_all_levII_oplock(work, fp, 1);
if (!work->tcon->posix_extensions) {
loff_t size = i_size_read(file_inode(fp->filp));
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 007/547] wifi: ath12k: move dp_profile_params to dp.h
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 006/547] ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 008/547] wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper Greg Kroah-Hartman
` (548 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit bf7c19e231e2f48cafddbe3f4c2a2f5b6184b55f ]
Move struct ath12k_dp_profile_params from core.h to dp.h as it is
specifically used for Data Path operations. This improves code
organization by keeping DP-related structures in the DP header.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-2-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/core.h | 9 ---------
drivers/net/wireless/ath/ath12k/dp.h | 9 +++++++++
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/core.h b/drivers/net/wireless/ath/ath12k/core.h
index 93fd227b4d198..99d71dab7c04c 100644
--- a/drivers/net/wireless/ath/ath12k/core.h
+++ b/drivers/net/wireless/ath/ath12k/core.h
@@ -927,15 +927,6 @@ struct ath12k_wsi_info {
u32 hw_link_id_base;
};
-struct ath12k_dp_profile_params {
- u32 tx_comp_ring_size;
- u32 rxdma_monitor_buf_ring_size;
- u32 rxdma_monitor_dst_ring_size;
- u32 num_pool_tx_desc;
- u32 rx_desc_count;
- u32 rx_release_ring_size;
-};
-
struct ath12k_mem_profile_based_param {
u32 num_vdevs;
u32 max_client_single;
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index bef0f2ba0560f..72d3de2db5d8e 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -23,6 +23,15 @@ struct ath12k_ext_irq_grp;
struct ath12k_dp_rx_tid;
struct ath12k_dp_rx_tid_rxq;
+struct ath12k_dp_profile_params {
+ u32 tx_comp_ring_size;
+ u32 rxdma_monitor_buf_ring_size;
+ u32 rxdma_monitor_dst_ring_size;
+ u32 num_pool_tx_desc;
+ u32 rx_desc_count;
+ u32 rx_release_ring_size;
+};
+
#define DP_MON_PURGE_TIMEOUT_MS 100
#define DP_MON_SERVICE_BUDGET 128
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 008/547] wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 007/547] wifi: ath12k: move dp_profile_params to dp.h Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 009/547] wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE " Greg Kroah-Hartman
` (547 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit eaff19e86c2dbde320ccc8812cafb0a366dc65f4 ]
Replace DP_TX_COMP_RING_SIZE macro with ath12k_dp_tx_comp_ring_size()
static inline helper. Pass the DP profile parameters explicitly to
improve type safety and make the interface explicit.
Update code using ATH12K_TX_COMPL_NEXT to pass ring size directly rather
than deriving it from the ath12k_base structure.
Also remove the unused DP_TX_IDR_SIZE macro.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-3-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp.c | 10 +++++++---
drivers/net/wireless/ath/ath12k/dp.h | 11 +++++++----
drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | 12 +++++++-----
3 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index f9b37d75956d3..5980946d1e82f 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -439,6 +439,7 @@ static void ath12k_dp_srng_common_cleanup(struct ath12k_base *ab)
static int ath12k_dp_srng_common_setup(struct ath12k_base *ab)
{
+ const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
const struct ath12k_hal_tcl_to_wbm_rbm_map *map;
struct hal_srng *srng;
@@ -469,7 +470,7 @@ static int ath12k_dp_srng_common_setup(struct ath12k_base *ab)
ret = ath12k_dp_srng_setup(ab, &dp->tx_ring[i].tcl_comp_ring,
HAL_WBM2SW_RELEASE, tx_comp_ring_num, 0,
- DP_TX_COMP_RING_SIZE(ab));
+ ath12k_dp_tx_comp_ring_size(dp_params));
if (ret) {
ath12k_warn(ab, "failed to set up tcl_comp ring (%d) :%d\n",
tx_comp_ring_num, ret);
@@ -1465,6 +1466,7 @@ static int ath12k_dp_reoq_lut_setup(struct ath12k_base *ab)
static int ath12k_dp_setup(struct ath12k_base *ab)
{
+ const struct ath12k_dp_profile_params *dp_params;
struct ath12k_dp *dp;
struct hal_srng *srng = NULL;
size_t size = 0;
@@ -1474,6 +1476,7 @@ static int ath12k_dp_setup(struct ath12k_base *ab)
dp = ath12k_ab_to_dp(ab);
dp->ab = ab;
+ dp_params = &ab->profile_param->dp_params;
INIT_LIST_HEAD(&dp->reo_cmd_list);
INIT_LIST_HEAD(&dp->reo_cmd_cache_flush_list);
@@ -1528,7 +1531,7 @@ static int ath12k_dp_setup(struct ath12k_base *ab)
goto fail_dp_bank_profiles_cleanup;
size = ab->hal.hal_wbm_release_ring_tx_size *
- DP_TX_COMP_RING_SIZE(ab);
+ ath12k_dp_tx_comp_ring_size(dp_params);
ret = ath12k_dp_reoq_lut_setup(ab);
if (ret) {
@@ -1540,7 +1543,8 @@ static int ath12k_dp_setup(struct ath12k_base *ab)
dp->tx_ring[i].tcl_data_ring_id = i;
dp->tx_ring[i].tx_status_head = 0;
- dp->tx_ring[i].tx_status_tail = DP_TX_COMP_RING_SIZE(ab) - 1;
+ dp->tx_ring[i].tx_status_tail =
+ ath12k_dp_tx_comp_ring_size(dp_params) - 1;
dp->tx_ring[i].tx_status = kmalloc(size, GFP_KERNEL);
if (!dp->tx_ring[i].tx_status) {
ret = -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index 72d3de2db5d8e..6540b3453cc69 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -61,7 +61,7 @@ struct dp_rxdma_ring {
int bufs_max;
};
-#define ATH12K_TX_COMPL_NEXT(ab, x) (((x) + 1) % DP_TX_COMP_RING_SIZE(ab))
+#define ATH12K_TX_COMPL_NEXT(ring_size, x) (((x) + 1) % (ring_size))
struct dp_tx_ring {
u8 tcl_data_ring_id;
@@ -201,9 +201,6 @@ struct ath12k_pdev_dp {
#define DP_WBM_RELEASE_RING_SIZE 64
#define DP_TCL_DATA_RING_SIZE 512
-#define DP_TX_COMP_RING_SIZE(ab) \
- ((ab)->profile_param->dp_params.tx_comp_ring_size)
-#define DP_TX_IDR_SIZE(ab) DP_TX_COMP_RING_SIZE(ab)
#define DP_TCL_CMD_RING_SIZE 32
#define DP_TCL_STATUS_RING_SIZE 32
#define DP_REO_DST_RING_MAX 8
@@ -689,6 +686,12 @@ ath12k_dp_to_pdev_dp(struct ath12k_dp *dp, u8 pdev_idx)
return rcu_dereference(dp->dp_pdevs[pdev_idx]);
}
+static inline u32
+ath12k_dp_tx_comp_ring_size(const struct ath12k_dp_profile_params *p)
+{
+ return p->tx_comp_ring_size;
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
index 587d58eeccfa5..e14f1d190ba8d 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
@@ -922,12 +922,14 @@ void ath12k_wifi7_dp_tx_completion_handler(struct ath12k_dp *dp, int ring_id)
u64 desc_va;
enum hal_wbm_rel_src_module buf_rel_source;
enum hal_wbm_tqm_rel_reason rel_status;
+ u32 ring_size;
spin_lock_bh(&status_ring->lock);
+ ring_size = ath12k_dp_tx_comp_ring_size(&ab->profile_param->dp_params);
ath12k_hal_srng_access_begin(ab, status_ring);
- while (ATH12K_TX_COMPL_NEXT(ab, tx_ring->tx_status_head) !=
+ while (ATH12K_TX_COMPL_NEXT(ring_size, tx_ring->tx_status_head) !=
tx_ring->tx_status_tail) {
desc = ath12k_hal_srng_dst_get_next_entry(ab, status_ring);
if (!desc)
@@ -936,11 +938,11 @@ void ath12k_wifi7_dp_tx_completion_handler(struct ath12k_dp *dp, int ring_id)
memcpy(&tx_ring->tx_status[tx_ring->tx_status_head],
desc, sizeof(*desc));
tx_ring->tx_status_head =
- ATH12K_TX_COMPL_NEXT(ab, tx_ring->tx_status_head);
+ ATH12K_TX_COMPL_NEXT(ring_size, tx_ring->tx_status_head);
}
if (ath12k_hal_srng_dst_peek(ab, status_ring) &&
- (ATH12K_TX_COMPL_NEXT(ab, tx_ring->tx_status_head) ==
+ (ATH12K_TX_COMPL_NEXT(ring_size, tx_ring->tx_status_head) ==
tx_ring->tx_status_tail)) {
/* TODO: Process pending tx_status messages when kfifo_is_full() */
ath12k_warn(ab, "Unable to process some of the tx_status ring desc because status_fifo is full\n");
@@ -950,13 +952,13 @@ void ath12k_wifi7_dp_tx_completion_handler(struct ath12k_dp *dp, int ring_id)
spin_unlock_bh(&status_ring->lock);
- while (ATH12K_TX_COMPL_NEXT(ab, tx_ring->tx_status_tail) !=
+ while (ATH12K_TX_COMPL_NEXT(ring_size, tx_ring->tx_status_tail) !=
tx_ring->tx_status_head) {
struct hal_wbm_completion_ring_tx *tx_status;
u32 desc_id;
tx_ring->tx_status_tail =
- ATH12K_TX_COMPL_NEXT(ab, tx_ring->tx_status_tail);
+ ATH12K_TX_COMPL_NEXT(ring_size, tx_ring->tx_status_tail);
tx_status = &tx_ring->tx_status[tx_ring->tx_status_tail];
ath12k_wifi7_dp_tx_status_parse(dp, tx_status, &ts);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 009/547] wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE to inline helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 008/547] wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 010/547] wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE " Greg Kroah-Hartman
` (546 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit d57f90669269fad2dd9ca98cd32b7412ceccb0b0 ]
Replace DP_RXDMA_MONITOR_BUF_RING_SIZE macro with
ath12k_dp_rxdma_monitor_buf_ring_size() static inline helper. Pass the DP
profile parameters explicitly to improve type safety and make the interface
explicit.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-4-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp.h | 8 ++++++--
drivers/net/wireless/ath/ath12k/dp_rx.c | 4 +++-
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index 6540b3453cc69..9081655eae77e 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -216,8 +216,6 @@ struct ath12k_pdev_dp {
#define DP_RXDMA_REFILL_RING_SIZE 2048
#define DP_RXDMA_ERR_DST_RING_SIZE 1024
#define DP_RXDMA_MON_STATUS_RING_SIZE 1024
-#define DP_RXDMA_MONITOR_BUF_RING_SIZE(ab) \
- ((ab)->profile_param->dp_params.rxdma_monitor_buf_ring_size)
#define DP_RXDMA_MONITOR_DST_RING_SIZE(ab) \
((ab)->profile_param->dp_params.rxdma_monitor_dst_ring_size)
#define DP_RXDMA_MONITOR_DESC_RING_SIZE 4096
@@ -692,6 +690,12 @@ ath12k_dp_tx_comp_ring_size(const struct ath12k_dp_profile_params *p)
return p->tx_comp_ring_size;
}
+static inline u32
+ath12k_dp_rxdma_monitor_buf_ring_size(const struct ath12k_dp_profile_params *p)
+{
+ return p->rxdma_monitor_buf_ring_size;
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index 8fa0e90b45316..efc419d41d210 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -1692,6 +1692,8 @@ int ath12k_dp_rx_htt_setup(struct ath12k_base *ab)
int ath12k_dp_rx_alloc(struct ath12k_base *ab)
{
+ const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
+ u32 monitor_buf_ring_size = ath12k_dp_rxdma_monitor_buf_ring_size(dp_params);
struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
struct dp_srng *srng;
int i, ret;
@@ -1736,7 +1738,7 @@ int ath12k_dp_rx_alloc(struct ath12k_base *ab)
ret = ath12k_dp_srng_setup(ab,
&dp->rxdma_mon_buf_ring.refill_buf_ring,
HAL_RXDMA_MONITOR_BUF, 0, 0,
- DP_RXDMA_MONITOR_BUF_RING_SIZE(ab));
+ monitor_buf_ring_size);
if (ret) {
ath12k_warn(ab, "failed to setup HAL_RXDMA_MONITOR_BUF\n");
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 010/547] wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE to inline helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 009/547] wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 011/547] wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC " Greg Kroah-Hartman
` (545 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit 62e2758d17d307753457bd51af074be5f8265c03 ]
Replace DP_RXDMA_MONITOR_DST_RING_SIZE macro with
ath12k_dp_rxdma_monitor_dst_ring_size() static inline helper.
Pass the DP profile parameters explicitly to improve type safety and
make the interface explicit.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-5-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp.h | 8 ++++++--
drivers/net/wireless/ath/ath12k/dp_rx.c | 8 ++++++--
2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index 9081655eae77e..a7cd2535866bd 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -216,8 +216,6 @@ struct ath12k_pdev_dp {
#define DP_RXDMA_REFILL_RING_SIZE 2048
#define DP_RXDMA_ERR_DST_RING_SIZE 1024
#define DP_RXDMA_MON_STATUS_RING_SIZE 1024
-#define DP_RXDMA_MONITOR_DST_RING_SIZE(ab) \
- ((ab)->profile_param->dp_params.rxdma_monitor_dst_ring_size)
#define DP_RXDMA_MONITOR_DESC_RING_SIZE 4096
#define DP_TX_MONITOR_BUF_RING_SIZE 4096
#define DP_TX_MONITOR_DEST_RING_SIZE 2048
@@ -696,6 +694,12 @@ ath12k_dp_rxdma_monitor_buf_ring_size(const struct ath12k_dp_profile_params *p)
return p->rxdma_monitor_buf_ring_size;
}
+static inline u32
+ath12k_dp_rxdma_monitor_dst_ring_size(const struct ath12k_dp_profile_params *p)
+{
+ return p->rxdma_monitor_dst_ring_size;
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index efc419d41d210..31e7d47f77341 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -330,16 +330,20 @@ static int ath12k_dp_rx_pdev_srng_alloc(struct ath12k *ar)
{
struct ath12k_pdev_dp *dp = &ar->dp;
struct ath12k_base *ab = ar->ab;
+ u32 monitor_dst_ring_size;
+ u32 mac_id = dp->mac_id;
int i;
int ret;
- u32 mac_id = dp->mac_id;
+
+ monitor_dst_ring_size =
+ ath12k_dp_rxdma_monitor_dst_ring_size(&ab->profile_param->dp_params);
for (i = 0; i < ab->hw_params->num_rxdma_per_pdev; i++) {
ret = ath12k_dp_srng_setup(ar->ab,
&dp->rxdma_mon_dst_ring[i],
HAL_RXDMA_MONITOR_DST,
0, mac_id + i,
- DP_RXDMA_MONITOR_DST_RING_SIZE(ab));
+ monitor_dst_ring_size);
if (ret) {
ath12k_warn(ar->ab,
"failed to setup HAL_RXDMA_MONITOR_DST\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 011/547] wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC to inline helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 010/547] wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 012/547] wifi: ath12k: convert ATH12K_RX_DESC_COUNT " Greg Kroah-Hartman
` (544 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit 99b85a24189a518938eb0f1c4f8e15fbab4373ec ]
Replace ATH12K_NUM_POOL_TX_DESC with the ath12k_dp_num_pool_tx_desc()
static inline helper. Also replace ATH12K_TX_SPT_PAGES_PER_POOL,
ATH12K_NUM_TX_SPT_PAGES, and ATH12K_RX_SPT_PAGE_OFFSET, which are derived
from ATH12K_NUM_POOL_TX_DESC, with static inline helper functions.
Pass the DP profile parameters explicitly to improve type safety and
make the interface more explicit.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-6-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp.c | 55 ++++++++++++++++-----------
drivers/net/wireless/ath/ath12k/dp.h | 32 ++++++++++++----
drivers/net/wireless/ath/ath12k/mac.c | 5 ++-
3 files changed, 61 insertions(+), 31 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 5980946d1e82f..93a41b2440daa 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -967,14 +967,15 @@ void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif)
static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
{
- struct ath12k_rx_desc_info *desc_info;
+ const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
+ u32 pool_id, tx_spt_page, tx_spt_pages_per_pool;
struct ath12k_tx_desc_info *tx_desc_info, *tmp1;
struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
+ struct ath12k_rx_desc_info *desc_info;
struct ath12k_skb_cb *skb_cb;
struct sk_buff *skb;
struct ath12k *ar;
int i, j;
- u32 pool_id, tx_spt_page;
if (!dp->spt_info)
return;
@@ -1056,12 +1057,13 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
}
if (dp->txbaddr) {
+ tx_spt_pages_per_pool = ath12k_dp_tx_spt_pages_per_pool(dp_params);
+
for (pool_id = 0; pool_id < ATH12K_HW_MAX_QUEUES; pool_id++) {
spin_lock_bh(&dp->tx_desc_lock[pool_id]);
- for (i = 0; i < ATH12K_TX_SPT_PAGES_PER_POOL(ab); i++) {
- tx_spt_page = i + pool_id *
- ATH12K_TX_SPT_PAGES_PER_POOL(ab);
+ for (i = 0; i < tx_spt_pages_per_pool; i++) {
+ tx_spt_page = i + pool_id * tx_spt_pages_per_pool;
if (!dp->txbaddr[tx_spt_page])
continue;
@@ -1155,13 +1157,15 @@ static void *ath12k_dp_cc_get_desc_addr_ptr(struct ath12k_dp *dp,
struct ath12k_rx_desc_info *ath12k_dp_get_rx_desc(struct ath12k_dp *dp,
u32 cookie)
{
+ const struct ath12k_dp_profile_params *dp_params;
struct ath12k_rx_desc_info **desc_addr_ptr;
u16 start_ppt_idx, end_ppt_idx, ppt_idx, spt_idx;
ppt_idx = u32_get_bits(cookie, ATH12K_DP_CC_COOKIE_PPT);
spt_idx = u32_get_bits(cookie, ATH12K_DP_CC_COOKIE_SPT);
+ dp_params = &dp->ab->profile_param->dp_params;
- start_ppt_idx = dp->rx_ppt_base + ATH12K_RX_SPT_PAGE_OFFSET(dp->ab);
+ start_ppt_idx = dp->rx_ppt_base + ath12k_dp_rx_spt_page_offset(dp_params);
end_ppt_idx = start_ppt_idx + ATH12K_NUM_RX_SPT_PAGES(dp->ab);
if (ppt_idx < start_ppt_idx ||
@@ -1179,15 +1183,16 @@ EXPORT_SYMBOL(ath12k_dp_get_rx_desc);
struct ath12k_tx_desc_info *ath12k_dp_get_tx_desc(struct ath12k_dp *dp,
u32 cookie)
{
+ const struct ath12k_dp_profile_params *dp_params;
struct ath12k_tx_desc_info **desc_addr_ptr;
u16 start_ppt_idx, end_ppt_idx, ppt_idx, spt_idx;
ppt_idx = u32_get_bits(cookie, ATH12K_DP_CC_COOKIE_PPT);
spt_idx = u32_get_bits(cookie, ATH12K_DP_CC_COOKIE_SPT);
+ dp_params = &dp->ab->profile_param->dp_params;
start_ppt_idx = ATH12K_TX_SPT_PAGE_OFFSET;
- end_ppt_idx = start_ppt_idx +
- (ATH12K_TX_SPT_PAGES_PER_POOL(dp->ab) * ATH12K_HW_MAX_QUEUES);
+ end_ppt_idx = start_ppt_idx + ath12k_dp_num_tx_spt_pages(dp_params);
if (ppt_idx < start_ppt_idx ||
ppt_idx >= end_ppt_idx ||
@@ -1202,12 +1207,13 @@ EXPORT_SYMBOL(ath12k_dp_get_tx_desc);
static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
{
- struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
+ const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
struct ath12k_rx_desc_info *rx_descs, **rx_desc_addr;
struct ath12k_tx_desc_info *tx_descs, **tx_desc_addr;
+ u32 i, j, pool_id, tx_spt_page, tx_spt_pages_per_pool;
u32 num_rx_spt_pages = ATH12K_NUM_RX_SPT_PAGES(ab);
- u32 i, j, pool_id, tx_spt_page;
- u32 ppt_idx, cookie_ppt_idx;
+ u32 ppt_idx, cookie_ppt_idx, rx_spt_page_offset;
+ struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
spin_lock_bh(&dp->rx_desc_lock);
@@ -1219,9 +1225,9 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
return -ENOMEM;
}
- /* First ATH12K_NUM_RX_SPT_PAGES(ab) of allocated SPT pages are used for
- * RX
- */
+ rx_spt_page_offset = ath12k_dp_rx_spt_page_offset(dp_params);
+
+ /* First num_rx_spt_pages of allocated SPT pages are used for RX */
for (i = 0; i < num_rx_spt_pages; i++) {
rx_descs = kzalloc_objs(*rx_descs, ATH12K_MAX_SPT_ENTRIES,
GFP_ATOMIC);
@@ -1231,7 +1237,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
return -ENOMEM;
}
- ppt_idx = ATH12K_RX_SPT_PAGE_OFFSET(ab) + i;
+ ppt_idx = rx_spt_page_offset + i;
cookie_ppt_idx = dp->rx_ppt_base + ppt_idx;
dp->rxbaddr[i] = &rx_descs[0];
@@ -1250,14 +1256,17 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
spin_unlock_bh(&dp->rx_desc_lock);
dp->txbaddr = kzalloc_objs(struct ath12k_tx_desc_info *,
- ATH12K_NUM_TX_SPT_PAGES(ab), GFP_ATOMIC);
+ ath12k_dp_num_tx_spt_pages(dp_params),
+ GFP_ATOMIC);
if (!dp->txbaddr)
return -ENOMEM;
+ tx_spt_pages_per_pool = ath12k_dp_tx_spt_pages_per_pool(dp_params);
+
for (pool_id = 0; pool_id < ATH12K_HW_MAX_QUEUES; pool_id++) {
spin_lock_bh(&dp->tx_desc_lock[pool_id]);
- for (i = 0; i < ATH12K_TX_SPT_PAGES_PER_POOL(ab); i++) {
+ for (i = 0; i < tx_spt_pages_per_pool; i++) {
tx_descs = kzalloc_objs(*tx_descs,
ATH12K_MAX_SPT_ENTRIES,
GFP_ATOMIC);
@@ -1268,8 +1277,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
return -ENOMEM;
}
- tx_spt_page = i + pool_id *
- ATH12K_TX_SPT_PAGES_PER_POOL(ab);
+ tx_spt_page = i + pool_id * tx_spt_pages_per_pool;
ppt_idx = ATH12K_TX_SPT_PAGE_OFFSET + tx_spt_page;
dp->txbaddr[tx_spt_page] = &tx_descs[0];
@@ -1295,6 +1303,7 @@ static int ath12k_dp_cmem_init(struct ath12k_base *ab,
struct ath12k_dp *dp,
enum ath12k_dp_desc_type type)
{
+ const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
u32 cmem_base;
int i, start, end;
@@ -1303,11 +1312,11 @@ static int ath12k_dp_cmem_init(struct ath12k_base *ab,
switch (type) {
case ATH12K_DP_TX_DESC:
start = ATH12K_TX_SPT_PAGE_OFFSET;
- end = start + ATH12K_NUM_TX_SPT_PAGES(ab);
+ end = start + ath12k_dp_num_tx_spt_pages(dp_params);
break;
case ATH12K_DP_RX_DESC:
cmem_base += ATH12K_PPT_ADDR_OFFSET(dp->rx_ppt_base);
- start = ATH12K_RX_SPT_PAGE_OFFSET(ab);
+ start = ath12k_dp_rx_spt_page_offset(dp_params);
end = start + ATH12K_NUM_RX_SPT_PAGES(ab);
break;
default:
@@ -1338,7 +1347,9 @@ void ath12k_dp_partner_cc_init(struct ath12k_base *ab)
static u32 ath12k_dp_get_num_spt_pages(struct ath12k_base *ab)
{
- return ATH12K_NUM_RX_SPT_PAGES(ab) + ATH12K_NUM_TX_SPT_PAGES(ab);
+ const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
+
+ return ATH12K_NUM_RX_SPT_PAGES(ab) + ath12k_dp_num_tx_spt_pages(dp_params);
}
static int ath12k_dp_cc_init(struct ath12k_base *ab)
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index a7cd2535866bd..7e48379d18a0f 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -249,8 +249,6 @@ struct ath12k_pdev_dp {
#define ATH12K_SHADOW_DP_TIMER_INTERVAL 20
#define ATH12K_SHADOW_CTRL_TIMER_INTERVAL 10
-#define ATH12K_NUM_POOL_TX_DESC(ab) \
- ((ab)->profile_param->dp_params.num_pool_tx_desc)
/* TODO: revisit this count during testing */
#define ATH12K_RX_DESC_COUNT(ab) \
((ab)->profile_param->dp_params.rx_desc_count)
@@ -268,13 +266,7 @@ struct ath12k_pdev_dp {
#define ATH12K_NUM_RX_SPT_PAGES(ab) ((ATH12K_RX_DESC_COUNT(ab)) / \
ATH12K_MAX_SPT_ENTRIES)
-#define ATH12K_TX_SPT_PAGES_PER_POOL(ab) (ATH12K_NUM_POOL_TX_DESC(ab) / \
- ATH12K_MAX_SPT_ENTRIES)
-#define ATH12K_NUM_TX_SPT_PAGES(ab) (ATH12K_TX_SPT_PAGES_PER_POOL(ab) * \
- ATH12K_HW_MAX_QUEUES)
-
#define ATH12K_TX_SPT_PAGE_OFFSET 0
-#define ATH12K_RX_SPT_PAGE_OFFSET(ab) ATH12K_NUM_TX_SPT_PAGES(ab)
/* The SPT pages are divided for RX and TX, first block for RX
* and remaining for TX
@@ -700,6 +692,30 @@ ath12k_dp_rxdma_monitor_dst_ring_size(const struct ath12k_dp_profile_params *p)
return p->rxdma_monitor_dst_ring_size;
}
+static inline u32
+ath12k_dp_num_pool_tx_desc(const struct ath12k_dp_profile_params *p)
+{
+ return p->num_pool_tx_desc;
+}
+
+static inline u32
+ath12k_dp_tx_spt_pages_per_pool(const struct ath12k_dp_profile_params *p)
+{
+ return ath12k_dp_num_pool_tx_desc(p) / ATH12K_MAX_SPT_ENTRIES;
+}
+
+static inline u32
+ath12k_dp_num_tx_spt_pages(const struct ath12k_dp_profile_params *p)
+{
+ return ath12k_dp_tx_spt_pages_per_pool(p) * ATH12K_HW_MAX_QUEUES;
+}
+
+static inline u32
+ath12k_dp_rx_spt_page_offset(const struct ath12k_dp_profile_params *p)
+{
+ return ath12k_dp_num_tx_spt_pages(p);
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 99bf5cf79d102..a997e888feb56 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -9732,6 +9732,7 @@ static int ath12k_mac_config_mon_status_default(struct ath12k *ar, bool enable)
static int ath12k_mac_start(struct ath12k *ar)
{
+ const struct ath12k_dp_profile_params *dp_params;
struct ath12k_hw *ah = ar->ah;
struct ath12k_base *ab = ar->ab;
struct ath12k_pdev *pdev = ar->pdev;
@@ -9740,6 +9741,8 @@ static int ath12k_mac_start(struct ath12k *ar)
lockdep_assert_held(&ah->hw_mutex);
lockdep_assert_wiphy(ath12k_ar_to_hw(ar)->wiphy);
+ dp_params = &ab->profile_param->dp_params;
+
ret = ath12k_wmi_pdev_set_param(ar, WMI_PDEV_PARAM_PMF_QOS,
1, pdev->pdev_id);
@@ -9788,7 +9791,7 @@ static int ath12k_mac_start(struct ath12k *ar)
if (ab->hw_params->supports_cong_ctrl_max_msdus) {
ret = ath12k_wmi_pdev_set_param(ar,
WMI_PDEV_PARAM_SET_CONG_CTRL_MAX_MSDUS,
- ATH12K_NUM_POOL_TX_DESC(ab),
+ ath12k_dp_num_pool_tx_desc(dp_params),
pdev->pdev_id);
if (ret) {
ath12k_err(ab,
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 012/547] wifi: ath12k: convert ATH12K_RX_DESC_COUNT to inline helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 011/547] wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 013/547] wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE " Greg Kroah-Hartman
` (543 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit fafb9b0450fd6fd3618daf347717a6d6320bea38 ]
Replace ATH12K_RX_DESC_COUNT with ath12k_dp_rx_desc_count() static inline
helper, also replace ATH12K_NUM_RX_SPT_PAGES which is calculated from
ATH12K_RX_DESC_COUNT into static inline helper functions and pass the DP
profile parameters explicitly to improve type safety and make the interface
explicit.
Also remove the unused ATH12K_NUM_TX_SPT_PAGE_START macro.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-7-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp.c | 18 +++++++++++-------
drivers/net/wireless/ath/ath12k/dp.h | 24 ++++++++++++------------
2 files changed, 23 insertions(+), 19 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 93a41b2440daa..417d960bbd07d 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -968,7 +968,7 @@ void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif)
static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
{
const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
- u32 pool_id, tx_spt_page, tx_spt_pages_per_pool;
+ u32 pool_id, tx_spt_page, tx_spt_pages_per_pool, num_rx_spt_pages;
struct ath12k_tx_desc_info *tx_desc_info, *tmp1;
struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
struct ath12k_rx_desc_info *desc_info;
@@ -983,8 +983,10 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
/* RX Descriptor cleanup */
spin_lock_bh(&dp->rx_desc_lock);
+ num_rx_spt_pages = ath12k_dp_num_rx_spt_pages(dp_params);
+
if (dp->rxbaddr) {
- for (i = 0; i < ATH12K_NUM_RX_SPT_PAGES(ab); i++) {
+ for (i = 0; i < num_rx_spt_pages; i++) {
if (!dp->rxbaddr[i])
continue;
@@ -1166,7 +1168,7 @@ struct ath12k_rx_desc_info *ath12k_dp_get_rx_desc(struct ath12k_dp *dp,
dp_params = &dp->ab->profile_param->dp_params;
start_ppt_idx = dp->rx_ppt_base + ath12k_dp_rx_spt_page_offset(dp_params);
- end_ppt_idx = start_ppt_idx + ATH12K_NUM_RX_SPT_PAGES(dp->ab);
+ end_ppt_idx = start_ppt_idx + ath12k_dp_num_rx_spt_pages(dp_params);
if (ppt_idx < start_ppt_idx ||
ppt_idx >= end_ppt_idx ||
@@ -1208,10 +1210,10 @@ EXPORT_SYMBOL(ath12k_dp_get_tx_desc);
static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
{
const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
+ u32 num_rx_spt_pages = ath12k_dp_num_rx_spt_pages(dp_params);
struct ath12k_rx_desc_info *rx_descs, **rx_desc_addr;
struct ath12k_tx_desc_info *tx_descs, **tx_desc_addr;
u32 i, j, pool_id, tx_spt_page, tx_spt_pages_per_pool;
- u32 num_rx_spt_pages = ATH12K_NUM_RX_SPT_PAGES(ab);
u32 ppt_idx, cookie_ppt_idx, rx_spt_page_offset;
struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
@@ -1317,7 +1319,7 @@ static int ath12k_dp_cmem_init(struct ath12k_base *ab,
case ATH12K_DP_RX_DESC:
cmem_base += ATH12K_PPT_ADDR_OFFSET(dp->rx_ppt_base);
start = ath12k_dp_rx_spt_page_offset(dp_params);
- end = start + ATH12K_NUM_RX_SPT_PAGES(ab);
+ end = start + ath12k_dp_num_rx_spt_pages(dp_params);
break;
default:
ath12k_err(ab, "invalid descriptor type %d in cmem init\n", type);
@@ -1349,7 +1351,8 @@ static u32 ath12k_dp_get_num_spt_pages(struct ath12k_base *ab)
{
const struct ath12k_dp_profile_params *dp_params = &ab->profile_param->dp_params;
- return ATH12K_NUM_RX_SPT_PAGES(ab) + ath12k_dp_num_tx_spt_pages(dp_params);
+ return ath12k_dp_num_rx_spt_pages(dp_params) +
+ ath12k_dp_num_tx_spt_pages(dp_params);
}
static int ath12k_dp_cc_init(struct ath12k_base *ab)
@@ -1377,7 +1380,8 @@ static int ath12k_dp_cc_init(struct ath12k_base *ab)
return -ENOMEM;
}
- dp->rx_ppt_base = ab->device_id * ATH12K_NUM_RX_SPT_PAGES(ab);
+ dp->rx_ppt_base = ab->device_id *
+ ath12k_dp_num_rx_spt_pages(&ab->profile_param->dp_params);
for (i = 0; i < dp->num_spt_pages; i++) {
dp->spt_info[i].vaddr = dma_alloc_coherent(ab->dev,
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index 7e48379d18a0f..c8ca3ab4d5e1a 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -249,10 +249,6 @@ struct ath12k_pdev_dp {
#define ATH12K_SHADOW_DP_TIMER_INTERVAL 20
#define ATH12K_SHADOW_CTRL_TIMER_INTERVAL 10
-/* TODO: revisit this count during testing */
-#define ATH12K_RX_DESC_COUNT(ab) \
- ((ab)->profile_param->dp_params.rx_desc_count)
-
#define ATH12K_PAGE_SIZE PAGE_SIZE
/* Total 1024 entries in PPT, i.e 4K/4 considering 4K aligned
@@ -263,16 +259,8 @@ struct ath12k_pdev_dp {
/* Total 512 entries in a SPT, i.e 4K Page/8 */
#define ATH12K_MAX_SPT_ENTRIES 512
-#define ATH12K_NUM_RX_SPT_PAGES(ab) ((ATH12K_RX_DESC_COUNT(ab)) / \
- ATH12K_MAX_SPT_ENTRIES)
-
#define ATH12K_TX_SPT_PAGE_OFFSET 0
-/* The SPT pages are divided for RX and TX, first block for RX
- * and remaining for TX
- */
-#define ATH12K_NUM_TX_SPT_PAGE_START(ab) ATH12K_NUM_RX_SPT_PAGES(ab)
-
#define ATH12K_DP_RX_DESC_MAGIC 0xBABABABA
/* 4K aligned address have last 12 bits set to 0, this check is done
@@ -716,6 +704,18 @@ ath12k_dp_rx_spt_page_offset(const struct ath12k_dp_profile_params *p)
return ath12k_dp_num_tx_spt_pages(p);
}
+static inline u32
+ath12k_dp_rx_desc_count(const struct ath12k_dp_profile_params *p)
+{
+ return p->rx_desc_count;
+}
+
+static inline u32
+ath12k_dp_num_rx_spt_pages(const struct ath12k_dp_profile_params *p)
+{
+ return ath12k_dp_rx_desc_count(p) / ATH12K_MAX_SPT_ENTRIES;
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 013/547] wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE to inline helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 012/547] wifi: ath12k: convert ATH12K_RX_DESC_COUNT " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 014/547] wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile Greg Kroah-Hartman
` (542 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit 897d2e0046f941d8956f655f5ffc5d75c788558d ]
Replace DP_RX_RELEASE_RING_SIZE macro with ath12k_dp_rx_release_ring_size()
static inline helper. Pass the DP profile parameters explicitly to
improve type safety and make the interface explicit.
No functional change intended.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260820054804.3222296-8-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp.c | 2 +-
drivers/net/wireless/ath/ath12k/dp.h | 8 ++++++--
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 417d960bbd07d..779529d189f8a 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -488,7 +488,7 @@ static int ath12k_dp_srng_common_setup(struct ath12k_base *ab)
ret = ath12k_dp_srng_setup(ab, &dp->rx_rel_ring, HAL_WBM2SW_RELEASE,
HAL_WBM2SW_REL_ERR_RING_NUM, 0,
- DP_RX_RELEASE_RING_SIZE(ab));
+ ath12k_dp_rx_release_ring_size(dp_params));
if (ret) {
ath12k_warn(ab, "failed to set up rx_rel ring :%d\n", ret);
goto err;
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index c8ca3ab4d5e1a..ff62773cfa9ab 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -206,8 +206,6 @@ struct ath12k_pdev_dp {
#define DP_REO_DST_RING_MAX 8
#define DP_REO_DST_RING_SIZE 2048
#define DP_REO_REINJECT_RING_SIZE 32
-#define DP_RX_RELEASE_RING_SIZE(ab) \
- ((ab)->profile_param->dp_params.rx_release_ring_size)
#define DP_REO_EXCEPTION_RING_SIZE 128
#define DP_REO_CMD_RING_SIZE 256
#define DP_REO_STATUS_RING_SIZE 2048
@@ -716,6 +714,12 @@ ath12k_dp_num_rx_spt_pages(const struct ath12k_dp_profile_params *p)
return ath12k_dp_rx_desc_count(p) / ATH12K_MAX_SPT_ENTRIES;
}
+static inline u32
+ath12k_dp_rx_release_ring_size(const struct ath12k_dp_profile_params *p)
+{
+ return p->rx_release_ring_size;
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 014/547] wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 013/547] wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 015/547] wifi: ath12k: Increase RXDMA buffer ring size for default " Greg Kroah-Hartman
` (541 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaradhana Sahu, Baochen Qiang,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
[ Upstream commit 643f0bf936176c114d5631da7547e991b5d99f10 ]
Currently, the RXDMA buffer ring size is hardcoded to 4096 and shared
across all memory profiles. This prevents individual profiles from tuning
the ring size based on their memory and performance requirements.
Add the RXDMA buffer ring size to the memory profile configuration and
implement ath12k_dp_rxdma_buf_ring_size() static inline function to
access the configured value. This allows different memory profiles to
select an appropriate ring size based on available system resources.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0.c2-00074-QCACOLSWPL_V1_TO_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20261007-mpp_ws-v1-1-739b1fb87d24@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/core.c | 2 ++
drivers/net/wireless/ath/ath12k/dp.h | 8 +++++++-
drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +-
3 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
index b0107cde99ff3..a4e4abfb46e60 100644
--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
@@ -54,6 +54,7 @@ ath12k_mem_profile_based_param ath12k_mem_profile_based_param[] = {
.num_pool_tx_desc = 32768,
.rx_desc_count = 12288,
.rx_release_ring_size = 16384,
+ .rxdma_buf_ring_size = 4096,
},
},
[ATH12K_QMI_MEMORY_MODE_LOW_512_M] = {
@@ -68,6 +69,7 @@ ath12k_mem_profile_based_param ath12k_mem_profile_based_param[] = {
.num_pool_tx_desc = 16384,
.rx_desc_count = 6144,
.rx_release_ring_size = 8192,
+ .rxdma_buf_ring_size = 4096,
},
},
};
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index ff62773cfa9ab..842d8cdbaeb55 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -30,6 +30,7 @@ struct ath12k_dp_profile_params {
u32 num_pool_tx_desc;
u32 rx_desc_count;
u32 rx_release_ring_size;
+ u32 rxdma_buf_ring_size;
};
#define DP_MON_PURGE_TIMEOUT_MS 100
@@ -209,7 +210,6 @@ struct ath12k_pdev_dp {
#define DP_REO_EXCEPTION_RING_SIZE 128
#define DP_REO_CMD_RING_SIZE 256
#define DP_REO_STATUS_RING_SIZE 2048
-#define DP_RXDMA_BUF_RING_SIZE 4096
#define DP_RX_MAC_BUF_RING_SIZE 4096
#define DP_RXDMA_REFILL_RING_SIZE 2048
#define DP_RXDMA_ERR_DST_RING_SIZE 1024
@@ -720,6 +720,12 @@ ath12k_dp_rx_release_ring_size(const struct ath12k_dp_profile_params *p)
return p->rx_release_ring_size;
}
+static inline u32
+ath12k_dp_rxdma_buf_ring_size(const struct ath12k_dp_profile_params *p)
+{
+ return p->rxdma_buf_ring_size;
+}
+
void ath12k_dp_vdev_tx_attach(struct ath12k *ar, struct ath12k_link_vif *arvif);
void ath12k_dp_partner_cc_init(struct ath12k_base *ab);
int ath12k_dp_pdev_alloc(struct ath12k_base *ab);
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index 31e7d47f77341..3628344f3593c 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -1708,7 +1708,7 @@ int ath12k_dp_rx_alloc(struct ath12k_base *ab)
ret = ath12k_dp_srng_setup(ab,
&dp->rx_refill_buf_ring.refill_buf_ring,
HAL_RXDMA_BUF, 0, 0,
- DP_RXDMA_BUF_RING_SIZE);
+ ath12k_dp_rxdma_buf_ring_size(dp_params));
if (ret) {
ath12k_warn(ab, "failed to setup rx_refill_buf_ring\n");
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 015/547] wifi: ath12k: Increase RXDMA buffer ring size for default memory profile
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 014/547] wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 016/547] platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE() Greg Kroah-Hartman
` (540 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavankumar Nandeshwar,
Aaradhana Sahu, Baochen Qiang, Rameshkumar Sundaram, Jeff Johnson,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
[ Upstream commit 15f7603b69a83a0acc7fcc8992ecbea6110f9424 ]
The default RXDMA buffer ring size of 4096 entries can become a
bottleneck under high RX traffic load, resulting in reduced receive
throughput due to limited buffer availability.
Increase the RXDMA buffer ring size to 8192 entries for the default
memory profile to provide additional RX buffering and improve RX packet
processing efficiency.
This increases memory consumption by approximately 9-10 MiB and improves
RX throughput by ~20% with the default memory profile
(ATH12K_QMI_MEMORY_MODE_DEFAULT).
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0.c2-00074-QCACOLSWPL_V1_TO_SILICONZ-1
Signed-off-by: Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20261007-mpp_ws-v1-2-739b1fb87d24@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
index a4e4abfb46e60..b25202effb002 100644
--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
@@ -54,7 +54,7 @@ ath12k_mem_profile_based_param ath12k_mem_profile_based_param[] = {
.num_pool_tx_desc = 32768,
.rx_desc_count = 12288,
.rx_release_ring_size = 16384,
- .rxdma_buf_ring_size = 4096,
+ .rxdma_buf_ring_size = 8192,
},
},
[ATH12K_QMI_MEMORY_MODE_LOW_512_M] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 016/547] platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 015/547] wifi: ath12k: Increase RXDMA buffer ring size for default " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 017/547] io_uring/waitid: own the request before clearing ->head Greg Kroah-Hartman
` (539 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridham Khurana, Krzysztof Kozlowski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridham Khurana <khurana.ridham222@gmail.com>
[ Upstream commit 59797443846bc2451c35816026bbb79d281c9f23 ]
The driver wires of_omnia_mcu_match into the i2c_driver's
.of_match_table but never exports it with MODULE_DEVICE_TABLE(), so no
module alias is generated and the module is not autoloaded when the MCU
is probed from the device tree.
Found by code inspection. Not tested on the hardware itself; with the
module built, the alias lookup
$ modprobe -R 'of:Nsystem-controllerT(null)Ccznic,turris-omnia-mcu'
reports no match before this change and resolves to turris_omnia_mcu
after it.
Fixes: 992f1a3d4e88 ("platform: cznic: Add preliminary support for Turris Omnia MCU")
Signed-off-by: Ridham Khurana <khurana.ridham222@gmail.com>
Link: https://patch.msgid.link/20260921204204.797294-1-khurana.ridham222@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/cznic/turris-omnia-mcu-base.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/cznic/turris-omnia-mcu-base.c b/drivers/platform/cznic/turris-omnia-mcu-base.c
index e8fc0d7b33434..f0416302a1f3c 100644
--- a/drivers/platform/cznic/turris-omnia-mcu-base.c
+++ b/drivers/platform/cznic/turris-omnia-mcu-base.c
@@ -403,6 +403,7 @@ static const struct of_device_id of_omnia_mcu_match[] = {
{ .compatible = "cznic,turris-omnia-mcu" },
{}
};
+MODULE_DEVICE_TABLE(of, of_omnia_mcu_match);
static struct i2c_driver omnia_mcu_driver = {
.probe = omnia_mcu_probe,
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 017/547] io_uring/waitid: own the request before clearing ->head
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 016/547] platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE() Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 018/547] io_uring/cmd: dont leave list poison in ->hash_node Greg Kroah-Hartman
` (538 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit c254eec4364b9f4b4cbdce43be3fb4df5a651a70 ]
io_waitid_remove_wq() only takes the wait queue lock if ->head is set.
io_waitid_wait() clears ->head first thing, before it tries to become the
owner of the request by bumping ->refs. If somebody else owns the request
at that point, nothing keeps it from completing the request while the
wake up handler is still going to touch it:
CPU0 (io_waitid_wait) CPU1 (io_waitid, holds a ref)
list_del_init(&wait->entry)
smp_store_release(&iw->head, NULL)
__do_wait() finds another child
io_waitid_remove_wq()
// ->head == NULL, no locking
io_waitid_finish(), IOU_COMPLETE
// request freed and reused
atomic_fetch_inc(&iw->refs)
The same goes for __io_waitid_cancel() if it claims the request in that
window. ->refs is part of the per opcode data of the request, so this
increments whatever the next user of the request keeps there. If that
happens to be zero, the handler concludes that it owns the request, and
queues io_waitid_cb() for it. With the window held open by a delay, and
the request reused for a receive that is waiting for data:
BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0
__wake_up_sync_key+0x36/0x50
sock_def_readable+0xf1/0x420
unix_stream_sendmsg+0x60b/0x1110
Allocated by task 87:
io_arm_apoll+0x1ed/0x940
Freed by task 87:
__io_submit_flush_completions+0x118d/0x1a10
tctx_task_work_run+0x327/0x950
Only clear ->head once the handler owns the request. If it doesn't, the
owner finds ->head set and has to wait for the lock, which is held by the
caller of the handler. Deleting the already deleted entry again is
harmless.
Fixes: ab673c1bcaf2 ("io_uring/waitid: use io_waitid_remove_wq() consistently")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-1-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/waitid.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/io_uring/waitid.c b/io_uring/waitid.c
index 9ad8eadc5b8f7..f9211446efd44 100644
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -268,12 +268,18 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
return 0;
list_del_init(&wait->entry);
- smp_store_release(&iw->head, NULL);
- /* cancel is in progress */
+ /*
+ * Cancel or issue is in progress. Leave ->head alone, so that whoever
+ * owns the request has to take the wait queue lock, which we hold,
+ * before it can complete and free it.
+ */
if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
return 1;
+ /* pairs with the smp_load_acquire() in io_waitid_remove_wq() */
+ smp_store_release(&iw->head, NULL);
+
req->io_task_work.func = io_waitid_cb;
__io_req_task_work_add(req, IOU_F_TWQ_IN_WAKE);
return 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 018/547] io_uring/cmd: dont leave list poison in ->hash_node
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 017/547] io_uring/waitid: own the request before clearing ->head Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 019/547] io_uring/wait: dont spin on a stuck overflow list Greg Kroah-Hartman
` (537 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 4c83e39f4d1944d7146fd06094f2c8053238d55c ]
io_uring_cmd_del_cancelable() uses hlist_del() to take a command off
->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in
->hash_node. Requests are recycled through the request cache without
being reinitialised, and not every user of ->hash_node sets it up before
it is used:
If a vectored futex wait is woken while futex_wait_multiple_setup() is
still queueing the futexes, io_futexv_wait() doesn't add the request to
->futex_list, and leaves the completion to the task_work queued by the
wake up. io_futexv_complete() ends in __io_futex_complete(), whose
hlist_del_init() is fine for a request that is unhashed, which is how all
other users of the node leave it. If the request was a cancelable
uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through
LIST_POISON2:
Oops: general protection fault, probably for non-canonical address
KASAN: maybe wild-memory-access in range [0xdead000000000120-...]
RIP: 0010:io_futexv_complete+0x219/0x420
Call Trace:
tctx_task_work_run+0x804/0x950
tctx_task_work+0x71/0xa0
task_work_run+0x118/0x200
Leave the node unhashed.
Fixes: 93b8cc60c37b ("io_uring: cancelable uring_cmd")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-2-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/uring_cmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index 726a659f38c38..3baf6459c1c85 100644
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -87,7 +87,7 @@ static void io_uring_cmd_del_cancelable(struct io_uring_cmd *cmd,
cmd->flags &= ~IORING_URING_CMD_CANCELABLE;
io_ring_submit_lock(ctx, issue_flags);
- hlist_del(&req->hash_node);
+ hlist_del_init(&req->hash_node);
io_ring_submit_unlock(ctx, issue_flags);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 019/547] io_uring/wait: dont spin on a stuck overflow list
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 018/547] io_uring/cmd: dont leave list poison in ->hash_node Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 020/547] io_uring/io-wq: dont lose the signal that ends work Greg Kroah-Hartman
` (536 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 34f5a664c34d3cb62f6bec7f4156754594a7d25b ]
As long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()
returns right away, before it gets to look at signals or arms the timeout,
for io_cqring_wait() to flush the overflow list. If that doesn't empty the
list, and the CQ ring doesn't hold the number of events the caller wants,
the loop starts over, with the same result. The task spins in the kernel,
and can't be killed.
The assumption is that this can't happen: if CQEs can't be flushed, the
ring is full, and min_events is capped to the size of the ring. But:
- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It
is stuck on the list if a single one is free, and then the ring holds
less than cq_entries events. A single threaded application that asks
for as many events as the ring has entries never gets out of
io_uring_enter().
- Whether the ring is full is up to the CQ head, which the application
can write to. While one thread waits for events on an empty ring,
another one can move the head back so that the ring looks full and
have a CQE overflow. The waiter can't be stopped any more, not even by
SIGKILL.
Only the application can make room in the CQ ring. Return to it if the
list could not be flushed.
Fixes: 3fcf19d592d5 ("io_uring: parse check_cq out of wq waiting")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-3-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/wait.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/io_uring/wait.c b/io_uring/wait.c
index 8fc175f10c545..967be6ee12762 100644
--- a/io_uring/wait.c
+++ b/io_uring/wait.c
@@ -301,9 +301,18 @@ int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, u32 flags,
check_cq = READ_ONCE(ctx->check_cq);
if (unlikely(check_cq)) {
- /* let the caller flush overflows, retry */
- if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT))
+ if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT)) {
io_cqring_do_overflow_flush(ctx);
+ /*
+ * No room for what has overflown. It takes the
+ * application to change that, so return to it.
+ */
+ if (test_bit(IO_CHECK_CQ_OVERFLOW_BIT,
+ &ctx->check_cq)) {
+ ret = 0;
+ break;
+ }
+ }
if (check_cq & BIT(IO_CHECK_CQ_DROPPED_BIT)) {
ret = -EBADR;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 020/547] io_uring/io-wq: dont lose the signal that ends work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 019/547] io_uring/wait: dont spin on a stuck overflow list Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 021/547] io_uring/io-wq: dont hide a link from cancellations Greg Kroah-Hartman
` (535 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 63c103279a95e82280092f2f4232e91e8117a252 ]
When a thread exits, only its tracked requests are cancelled. Then its
io-wq is torn down. io_wq_exit_workers() signals every worker, to get it
out of an interruptible sleep, and waits for all of them to exit. Before
they do, they go through the work that is left. Unbounded work is
cancelled. Bounded work is run, as it is expected to end by itself.
Not all of it does. An open has no file yet, so it counts as bounded, and
the open of a FIFO waits for the other end. That is what the signal is for.
But the workers are signalled once, and a worker that hasn't started the
work by then loses the signal:
io_wq_exit_workers() io_worker_handle_work()
io_wq_worker_wake()
set TIF_NOTIFY_SIGNAL
io_assign_current_work()
io_run_task_work()
clear TIF_NOTIFY_SIGNAL
io_wq_submit_work()
fifo_open()
wait_for_partner()
wait_for_completion_timeout()
The thread never gets out of do_exit():
IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC
exit of the thread that has submitted it
hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is
killed.
Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT
set. The bit is set before the workers are signalled, and it is tested
after the flag has been cleared, with clear_notify_signal() providing the
barrier. So either the flag stays, or the bit is seen.
Work that is started while the io-wq exits is treated like work that is
being run at that time: it isn't interrupted unless it waits
interruptibly.
Fixes: afcc4015d1bf ("io-wq: provide an io_wq_put_and_exit() helper")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-4-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io-wq.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 2a980e86dd940..140b7e022fbf2 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -651,9 +651,15 @@ static void io_worker_handle_work(struct io_wq_acct *acct,
next_hashed = wq_next_work(work);
- if (do_kill &&
- (work_flags & IO_WQ_WORK_UNBOUND))
+ /*
+ * io_wq_exit_workers() signals us once, so that we
+ * don't sleep for ever. If that was before this work
+ * became the current one, the signal is gone.
+ */
+ if (do_kill && (work_flags & IO_WQ_WORK_UNBOUND))
atomic_or(IO_WQ_WORK_CANCEL, &work->flags);
+ else if (do_kill)
+ set_notify_signal(current);
req = container_of(work, struct io_kiocb, work);
kcov_remote_start_common(req->ctx->kcov_handle);
io_wq_submit_work(work);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 021/547] io_uring/io-wq: dont hide a link from cancellations
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 020/547] io_uring/io-wq: dont lose the signal that ends work Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 022/547] io_uring: dont flood a cancelling task with task_work Greg Kroah-Hartman
` (534 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 436d48a2ed13112d2d27085325838e5bce6b4507 ]
A task that exits cancels its tracked requests and waits until they are
gone. io_uring_cancel_generic() looks everywhere a request can be, and
goes to sleep if it found nothing to cancel. It is woken up each time
one of the requests of the task is completed by task work or freed.
When io-wq is done with a request that has a link, there is a time in which
the next request of the link can't be found:
io_worker_handle_work()
io_assign_current_work(worker, NULL)
io_wq_free_work(work)
io_req_find_next() // takes the link off the request
io_free_req() // task work for the task
io_assign_current_work(worker, linked)
io_run_task_work()
cond_resched()
worker->cur_work = linked
It is not pending, it is not the current work of a worker, and it is not
yet on the list that it is about to be parked on. If the pass that the
exiting task makes because of io_free_req() falls into that time, it finds
nothing and the task goes to sleep. The worker then runs the link, which
IO_WQ_BIT_EXIT doesn't prevent for bounded work. If that parks the request
nothing is completed or freed, and nobody wakes up the task. If it is the
process that exits it can't be killed any more either.
NOP, IOSQE_ASYNC | IOSQE_IO_LINK
FUTEX_WAIT, FUTEX2_PRIVATE
exit of the thread, or of the process, up to 63us later
With four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):
io_uring_cancel_generic
do_exit
Commit f8b632e89a10 ("io_uring: tighten task exit cancellations") is about
the same gap, and makes the task look again for whatever happens before
io_free_req().
Free the request once the link is the current work of the worker, or
pending. Whoever is woken up by that can find the link, until it is parked
where cancellations look as well. To do so split io_wq_free_work() in two.
Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-5-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io-wq.c | 18 +++++++++++++++---
io_uring/io_uring.c | 35 ++++++++++++++++++++++++-----------
io_uring/io_uring.h | 3 ++-
3 files changed, 41 insertions(+), 15 deletions(-)
diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 140b7e022fbf2..6a59994d4bd5e 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -642,12 +642,13 @@ static void io_worker_handle_work(struct io_wq_acct *acct,
/* handle a whole dependent link */
do {
bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
- struct io_wq_work *next_hashed, *linked;
+ struct io_wq_work *next_hashed, *linked, *done = work;
unsigned int work_flags = atomic_read(&work->flags);
unsigned int hash = __io_wq_is_hashed(work_flags)
? __io_get_work_hash(work_flags)
: -1U;
struct io_kiocb *req;
+ bool last;
next_hashed = wq_next_work(work);
@@ -666,7 +667,7 @@ static void io_worker_handle_work(struct io_wq_acct *acct,
kcov_remote_stop();
io_assign_current_work(worker, NULL);
- linked = io_wq_free_work(work);
+ last = io_wq_put_work(work, &linked);
work = next_hashed;
if (!work && linked && !io_wq_is_hashed(linked)) {
work = linked;
@@ -675,6 +676,13 @@ static void io_worker_handle_work(struct io_wq_acct *acct,
io_assign_current_work(worker, work);
if (linked)
io_wq_enqueue(wq, linked);
+ /*
+ * Not before the link is current or pending work again.
+ * This may be the last time that a task is woken up
+ * which exits and looks for requests to cancel.
+ */
+ if (last)
+ io_wq_free_work(done);
if (hash != -1U && !next_hashed) {
/* serialize hash clear with wake_up() */
@@ -1004,9 +1012,13 @@ void io_wq_set_exit_on_idle(struct io_wq *wq, bool enable)
static void io_run_cancel(struct io_wq_work *work, struct io_wq *wq)
{
do {
+ struct io_wq_work *linked;
+
atomic_or(IO_WQ_WORK_CANCEL, &work->flags);
io_wq_submit_work(work);
- work = io_wq_free_work(work);
+ if (io_wq_put_work(work, &linked))
+ io_wq_free_work(work);
+ work = linked;
} while (work);
}
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 91178f2fca09a..9db7e68ba9970 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1483,22 +1483,35 @@ int io_poll_issue(struct io_kiocb *req, io_tw_token_t tw)
return ret;
}
-struct io_wq_work *io_wq_free_work(struct io_wq_work *work)
+/*
+ * io-wq is done with @work. Returns true if it held the last reference, and
+ * hands out the next request of the link then. The caller has to make sure
+ * that cancellations can find the latter before it calls io_wq_free_work().
+ */
+bool io_wq_put_work(struct io_wq_work *work, struct io_wq_work **linked)
{
struct io_kiocb *req = container_of(work, struct io_kiocb, work);
struct io_kiocb *nxt = NULL;
- if (req_ref_put_and_test_atomic(req)) {
- if (req->flags & IO_REQ_LINK_FLAGS) {
- struct io_ring_ctx *ctx = req->ctx;
+ *linked = NULL;
+ if (!req_ref_put_and_test_atomic(req))
+ return false;
- mutex_lock(&ctx->uring_lock);
- nxt = io_req_find_next(req);
- mutex_unlock(&ctx->uring_lock);
- }
- io_free_req(req);
+ if (req->flags & IO_REQ_LINK_FLAGS) {
+ struct io_ring_ctx *ctx = req->ctx;
+
+ mutex_lock(&ctx->uring_lock);
+ nxt = io_req_find_next(req);
+ mutex_unlock(&ctx->uring_lock);
}
- return nxt ? &nxt->work : NULL;
+ if (nxt)
+ *linked = &nxt->work;
+ return true;
+}
+
+void io_wq_free_work(struct io_wq_work *work)
+{
+ io_free_req(container_of(work, struct io_kiocb, work));
}
void io_wq_submit_work(struct io_wq_work *work)
@@ -1509,7 +1522,7 @@ void io_wq_submit_work(struct io_wq_work *work)
bool needs_poll = false;
int ret = 0, err = -ECANCELED;
- /* one will be dropped by io_wq_free_work() after returning to io-wq */
+ /* one will be dropped by io_wq_put_work() after returning to io-wq */
if (!(req->flags & REQ_F_REFCOUNT))
__io_req_set_refcount(req, 2);
else
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 896aab1ed026c..71aa30186a667 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -204,7 +204,8 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin);
__cold void io_iopoll_try_reap_events(struct io_ring_ctx *ctx);
void __io_submit_flush_completions(struct io_ring_ctx *ctx);
-struct io_wq_work *io_wq_free_work(struct io_wq_work *work);
+bool io_wq_put_work(struct io_wq_work *work, struct io_wq_work **linked);
+void io_wq_free_work(struct io_wq_work *work);
void io_wq_submit_work(struct io_wq_work *work);
void io_free_req(struct io_kiocb *req);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 022/547] io_uring: dont flood a cancelling task with task_work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 021/547] io_uring/io-wq: dont hide a link from cancellations Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 023/547] io_uring: dont lose the DEFER_TASKRUN wake up Greg Kroah-Hartman
` (533 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 22e643e61b9b6299b42ff7d88bab48bccada8a5d ]
io_ring_exit_work() asks each task which has used the ring to remove its
tctx node, by task_work, and repeats that until the list is empty.
io_tctx_exit_cb() doesn't touch the node while the task is in
io_uring_cancel_generic(), which removes all the nodes at its end. So the
work item queues the callback again as soon as it has completed, for
nothing.
That is more than a waste of time. task_work_run() only returns when it
finds the list empty. If the rings are released from inside the
cancellation, because requests of other rings held the last references to
their files, up to 64 work items keep sending callbacks to the one task
which is running them. It never finds the list empty, never gets back to
the cancellation, the nodes stay, and so it goes on: a task with 60 pairs
of rings which poll each other ran 280000 callbacks in 5 seconds, 20
seconds after exit_group(). It ends when all the senders happen to be late
at the same time. Until then the task keeps a CPU and the work items busy.
An exiting task can't be killed meanwhile. execve() cancels the requests in
the same way, so a live task can get stuck there as well, for minutes. If
it takes more than five, the work items run into the
WARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No
privilege is needed for any of this.
If the callback has met a task in cancellation, wait a little before it is
sent again. Nobody has to wake the work item up for that: either the node
is gone by then, or it is the turn of the next round.
Fixes: d56d938b4bef ("io_uring: do ctx initiated file note removal")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-6-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 9db7e68ba9970..19f79e53c4d37 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2339,6 +2339,7 @@ struct io_tctx_exit {
struct callback_head task_work;
struct completion completion;
struct io_ring_ctx *ctx;
+ bool in_cancel;
};
static __cold void io_tctx_exit_cb(struct callback_head *cb)
@@ -2353,7 +2354,8 @@ static __cold void io_tctx_exit_cb(struct callback_head *cb)
* tctx can be NULL if the queueing of this task_work raced with
* work cancelation off the exec path.
*/
- if (tctx && !atomic_read(&tctx->in_cancel))
+ work->in_cancel = tctx && atomic_read(&tctx->in_cancel);
+ if (tctx && !work->in_cancel)
io_uring_del_tctx_node((unsigned long)work->ctx);
complete(&work->completion);
}
@@ -2447,6 +2449,14 @@ static __cold void io_ring_exit_work(struct work_struct *work)
* wait is marked as interruptible.
*/
wait_for_completion_interruptible(&exit.completion);
+ /*
+ * The task removes the node when it is done with its
+ * cancellation. Give it the time for that: it doesn't get back
+ * to it as long as it finds new task_work each time it has run
+ * the old one, and we may be one of many who send it.
+ */
+ if (exit.in_cancel)
+ schedule_timeout_idle(HZ / 20);
mutex_lock(&ctx->uring_lock);
mutex_lock(&ctx->tctx_lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 023/547] io_uring: dont lose the DEFER_TASKRUN wake up
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 022/547] io_uring: dont flood a cancelling task with task_work Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 024/547] io_uring/cancel: rearm local work wake up before sleep Greg Kroah-Hartman
` (532 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 8257f6ec45ee07c6ed933c59d8982b03cc7bc1ca ]
Since local task_work moved to the mpscq, ->cq_wait_nr is a credit: the
add that counts it down to zero, or exchanges it for IO_CQ_WAKE_INIT,
issues the only wake up of the wait cycle, and every later add returns
early as the count is <= 0.
An add looks at the count after it has queued its entry, so an add that
gets delayed in between can take the credit of a later cycle. That was
assumed to cause an early wake up at worst, but the waiter publishes the
count before it changes its task state:
CPU0 (submitter, io_cqring_wait) CPU1 (io_req_local_work_add)
mpscq_push(req A)
io_run_local_work() // runs req A
atomic_set(&ctx->cq_wait_nr, 1)
atomic_read(&ctx->cq_wait_nr) == 1
atomic_xchg(.., IO_CQ_WAKE_INIT)
wake_up_state(.., TASK_INTERRUPTIBLE)
// still TASK_RUNNING, no-op
set_current_state(TASK_INTERRUPTIBLE)
io_local_work_pending() == false
schedule()
mpscq_push(req B)
cq_wait_nr <= 0, return
The task now sleeps with req B queued, until a signal or a timeout ends
the wait.
Set the task state first and only then make the count visible, so that
whoever takes the credit finds a task it can wake. The full barrier that
orders the count against the check of the work list is kept. Do the same
for the wait of the BPF driven loop, which copied the sequence.
Fixes: d46ab2c98aba ("io_uring: switch local task_work to a mpscq")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-7-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/loop.c | 8 +-------
io_uring/tw.c | 2 +-
io_uring/wait.c | 3 +--
io_uring/wait.h | 15 +++++++++++++++
4 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/io_uring/loop.c b/io_uring/loop.c
index 3d472b7827fac..2340459164a1a 100644
--- a/io_uring/loop.c
+++ b/io_uring/loop.c
@@ -10,12 +10,6 @@ static inline int io_loop_nr_cqes(const struct io_ring_ctx *ctx,
return lp->cq_wait_idx - READ_ONCE(ctx->rings->cq.tail);
}
-static inline void io_loop_wait_start(struct io_ring_ctx *ctx, unsigned nr_wait)
-{
- atomic_set(&ctx->cq_wait_nr, nr_wait);
- set_current_state(TASK_INTERRUPTIBLE);
-}
-
static inline void io_loop_wait_finish(struct io_ring_ctx *ctx)
{
__set_current_state(TASK_RUNNING);
@@ -25,7 +19,7 @@ static inline void io_loop_wait_finish(struct io_ring_ctx *ctx)
static void io_loop_wait(struct io_ring_ctx *ctx, struct iou_loop_params *lp,
unsigned nr_wait)
{
- io_loop_wait_start(ctx, nr_wait);
+ io_cq_wait_arm(ctx, nr_wait);
if (unlikely(io_local_work_pending(ctx) ||
io_loop_nr_cqes(ctx, lp) <= 0) ||
diff --git a/io_uring/tw.c b/io_uring/tw.c
index f9affd68dd263..98e3b1bc61b4b 100644
--- a/io_uring/tw.c
+++ b/io_uring/tw.c
@@ -165,7 +165,7 @@ void io_req_local_work_add(struct io_kiocb *req, unsigned flags)
/*
* The xchg() in mpscq_push() implies a full barrier, which pairs with
- * the barrier in set_current_state() on the io_cqring_wait() side. This
+ * the barrier in io_cq_wait_arm() on the io_cqring_wait() side. This
* ensures that either we see the updated ->cq_wait_nr, or waiters going
* to sleep will observe the work added to the list, which is similar to
* the wait/wake task state sync.
diff --git a/io_uring/wait.c b/io_uring/wait.c
index 967be6ee12762..62f0101321000 100644
--- a/io_uring/wait.c
+++ b/io_uring/wait.c
@@ -267,8 +267,7 @@ int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, u32 flags,
unsigned long check_cq;
if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) {
- atomic_set(&ctx->cq_wait_nr, nr_wait);
- set_current_state(TASK_INTERRUPTIBLE);
+ io_cq_wait_arm(ctx, nr_wait);
} else {
prepare_to_wait_exclusive(&ctx->cq_wait, &iowq.wq,
TASK_INTERRUPTIBLE);
diff --git a/io_uring/wait.h b/io_uring/wait.h
index b7b9c46b1b013..eb5ae8a6fc942 100644
--- a/io_uring/wait.h
+++ b/io_uring/wait.h
@@ -14,6 +14,21 @@
*/
#define IO_CQ_WAKE_INIT (-1)
+/*
+ * Start a wait cycle of the current task. The add that uses up ->cq_wait_nr
+ * may be one that queued its entry long ago and only now gets to look at the
+ * count. As nobody else wakes us after that, it has to find us sleeping, hence
+ * the task state must be visible before the count is. The barrier pairs with
+ * the xchg() in mpscq_push(), see io_req_local_work_add().
+ */
+static inline void io_cq_wait_arm(struct io_ring_ctx *ctx, int nr_wait)
+{
+ __set_current_state(TASK_INTERRUPTIBLE);
+ atomic_set_release(&ctx->cq_wait_nr, nr_wait);
+ /* order the above against looking at the work list */
+ smp_mb();
+}
+
struct ext_arg {
size_t argsz;
struct timespec64 ts;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 024/547] io_uring/cancel: rearm local work wake up before sleep
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 023/547] io_uring: dont lose the DEFER_TASKRUN wake up Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 025/547] io_uring/mpscq: disable preemption while pushing Greg Kroah-Hartman
` (531 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 76a82c666abf155ad52d5f41043eac77dd3e41d8 ]
io_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next
io_req_local_work_add() wakes the cancelling task. The add that takes the
count to zero is the only one that wakes, later ones see a count <= 0 and
return. io_uring_cancel_generic() however only becomes
TASK_INTERRUPTIBLE much later, so the one wake up can be spent on a
running task. That is fine as long as the entry of that add is still
queued, as the io_local_work_pending() check then skips the sleep. It is
not if the add was delayed after queueing its entry:
CPU0 (submitter in exec or exit) CPU1 (io_req_local_work_add)
mpscq_push(req A)
io_uring_try_cancel_requests()
io_run_local_work() // runs req A
io_uring_try_cancel_requests()
atomic_set(&ctx->cq_wait_nr, 1)
atomic_read(&ctx->cq_wait_nr) == 1
count taken, wake_up_state()
// task is running, no-op
prepare_to_wait(TASK_INTERRUPTIBLE)
io_local_work_pending() == false
schedule()
mpscq_push(req B)
cq_wait_nr <= 0, return
Only the sleeping task can run req B, so it is stuck in execve() until a
signal happens to wake it. An exiting task doesn't even get that.
Arm the count again once the task state is set and before the work list
is checked, for the rings whose local work this task is the one to run.
Fixes: d46ab2c98aba ("io_uring: switch local task_work to a mpscq")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-8-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/cancel.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index 4f706aff14fc2..03b1f1f3fad16 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -636,8 +636,18 @@ __cold void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd)
io_uring_drop_tctx_refs(current);
/* only skip the sleep for local work this task may run */
xa_for_each(&tctx->xa, index, node) {
- if (io_local_work_pending(node->ctx) &&
- io_allowed_defer_tw_run(node->ctx))
+ if (!(node->ctx->flags & IORING_SETUP_DEFER_TASKRUN) ||
+ !io_allowed_defer_tw_run(node->ctx))
+ continue;
+ /*
+ * The wake up io_uring_try_cancel_requests() asked for
+ * may have been issued while we were still running. Ask
+ * again now that it can't be missed.
+ */
+ atomic_set(&node->ctx->cq_wait_nr, 1);
+ /* pairs with the xchg() in mpscq_push() */
+ smp_mb();
+ if (io_local_work_pending(node->ctx))
goto end_wait;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 025/547] io_uring/mpscq: disable preemption while pushing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 024/547] io_uring/cancel: rearm local work wake up before sleep Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 026/547] io_uring/io-wq: dont go to sleep on pending work Greg Kroah-Hartman
` (530 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 68a95c3968895cd198f42baadb23e635fecc5a66 ]
A push makes the node the new tail, and then links it to its predecessor.
In between the queue isn't empty, but mpscq_pop() can't get at the node.
The consumers deal with that by trying again, with a cond_resched() in
the loop to give a preempted producer the chance to finish.
cond_resched() doesn't do that if the consumer has a higher priority than
the producer and both have to use the same CPU:
producer (SCHED_OTHER) consumer (SCHED_FIFO), same CPU
io_req_local_work_add()
mpscq_push()
prev = xchg(&q->tail, node)
<preempted> io_cqring_wait()
__io_run_local_work()
again:
cond_resched() // nothing to do
mpscq_pop() // NULL
// work pending, no events yet
goto again
The producer can be any task that is able to queue task_work for the
ring: an io-wq worker, or somebody who sends a message with
IORING_OP_MSG_RING. The consumer spins, holding ->uring_lock, until the
scheduler takes pity on the fair class, which takes about a second with
the default settings of the fair server, and forever without it. The
loops in tctx_task_work_run() and io_cancel_local_task_work() have the
same problem.
Don't allow preemption between the two steps. That bounds the time the
window is open on the CPU of the producer by what interrupts take, and a
consumer that waits for that is on another CPU. The cost is a
preempt_disable()/preempt_enable() pair per push.
Fixes: 50cb44bd0d5f ("io_uring/mpscq: add lockless multi-producer, single-consumer FIFO queue")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-9-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/mpscq.h | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/io_uring/mpscq.h b/io_uring/mpscq.h
index f910526766fd8..da9474497cc8e 100644
--- a/io_uring/mpscq.h
+++ b/io_uring/mpscq.h
@@ -25,9 +25,10 @@
* its predecessor. In between, the tail end of the queue is not yet reachable
* from the head. mpscq_pop() detects this and returns NULL, while mpscq_empty()
* reports false. The consumer must not treat such a NULL as "queue empty" - it
- * should retry later. The window is two instructions wide, but a producer can
- * be preempted inside it, so the consumer must not spin on it while holding
- * resources the producer might need to make progress.
+ * should retry later. The window is two instructions wide and the producer
+ * can't be preempted inside it, but it can be interrupted, so the consumer must
+ * not spin on it while holding resources the producer might need to make
+ * progress.
*
* The consumer side only supports a single consumer at a time, callers must
* provide their own serialization for it. The stub node is what allows the
@@ -69,6 +70,12 @@ static inline bool mpscq_push(struct mpscq *q, struct llist_node *node)
struct llist_node *prev;
node->next = NULL;
+ /*
+ * All the consumer can do about a node that isn't linked yet is to try
+ * again. If it is what preempted us, and we don't get to run as long
+ * as it does, that never ends.
+ */
+ preempt_disable();
/*
* xchg() implies a full barrier, so the initialization of the
* entry (including ->next above) is visible before the node can
@@ -77,6 +84,7 @@ static inline bool mpscq_push(struct mpscq *q, struct llist_node *node)
*/
prev = xchg(&q->tail, node);
WRITE_ONCE(prev->next, node);
+ preempt_enable();
return prev == &q->stub;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 026/547] io_uring/io-wq: dont go to sleep on pending work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 025/547] io_uring/mpscq: disable preemption while pushing Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 027/547] io_uring/io-wq: dont strand work when a worker exits Greg Kroah-Hartman
` (529 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit f19c38feb96802ee53a99649d740d2bf630bcce7 ]
io_wq_enqueue() wakes a worker off the free list. If there is none it
creates one, unless ->nr_running says that a worker is running. That
relies on whoever takes ->nr_running to zero to check for pending work,
which io_wq_dec_running() no longer does for a worker without
->cur_work, on the grounds that an idle worker is either woken right
away or someone else has created a worker. Neither has to be the case:
worker A (idle) worker B (idle) io_wq_enqueue()
woken for work 1
woken (e.g. timeout) takes work 1
work list is empty
queues work 2
B is first on the free
list: wake_up_process(B)
leaves the free list
work 1 blocks
nr_running 2 -> 1
schedule_timeout()
nr_running 1 -> 0
->cur_work == NULL
Work 2 isn't looked at until work 1 is done or A's idle timeout fires,
five seconds later. ->cur_work is also NULL while a worker blocks on
->uring_lock in io_wq_put_work(), with the same result if it was the
only one running.
Let the idle worker leave ->nr_running by itself before it takes its last
look at the work list. Both that and queueing work are done under
acct->lock, so either the worker sees the work, or the enqueue side sees
that it can't count on this worker. This doesn't bring back the request
for a new worker which the check was meant to avoid, and as idle workers
don't get to io_wq_dec_running() any more, the check can go.
Fixes: 8343cae362e1 ("io_uring/io-wq: ignore non-busy worker going to sleep")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-10-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io-wq.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 6a59994d4bd5e..38fcccf389936 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -467,11 +467,9 @@ static void io_wq_dec_running(struct io_worker *worker)
if (!atomic_dec_and_test(&acct->nr_running))
return;
- if (!worker->cur_work)
- return;
if (!io_acct_run_queue(acct))
return;
- if (io_wq_hash_defer(worker->cur_work, acct)) {
+ if (worker->cur_work && io_wq_hash_defer(worker->cur_work, acct)) {
raw_spin_unlock(&acct->lock);
return;
}
@@ -747,6 +745,19 @@ static int io_wq_worker(void *data)
raw_spin_unlock(&acct->workers_lock);
if (io_run_task_work())
continue;
+ /*
+ * io_wq_enqueue() leaves new work to us for as long as we are
+ * accounted as running. Get out of ->nr_running before taking
+ * the last look at the work list, rather than when scheduling
+ * out. No need to ask for another worker then, we can do it.
+ */
+ clear_bit(IO_WORKER_F_RUNNING, &worker->flags);
+ atomic_dec(&acct->nr_running);
+ if (io_acct_run_queue(acct)) {
+ io_wq_worker_running(current);
+ io_worker_handle_work(acct, worker);
+ continue;
+ }
ret = schedule_timeout(WORKER_IDLE_TIMEOUT);
if (signal_pending(current)) {
struct ksignal ksig;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 027/547] io_uring/io-wq: dont strand work when a worker exits
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 026/547] io_uring/io-wq: dont go to sleep on pending work Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 028/547] io_uring/io-wq: dont exit with a creation pending Greg Kroah-Hartman
` (528 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit ad41f325be1271b22d99353819c90f0d5e45acc8 ]
A worker exits if its idle timeout fired and it isn't the last one, if
its affinity was changed, or if the wq is marked exit-on-idle. It decides
so after it found the work list empty, and until io_worker_exit() is
through it stays on the free list and in ->nr_running:
worker io_wq_enqueue()
io_acct_run_queue() == false
queues work
io_acct_activate_free_worker()
wake_up_process(worker)
// found one, nothing to create
acct->nr_workers--
break
io_worker_exit()
Nobody is going to look at the work. If other workers exist, it has to
wait until one of them finishes what it is blocked on or hits its idle
timeout. If not, which is possible for the affinity and the exit-on-idle
case, it sits there until something else is queued. For exit-on-idle it
takes a task that closes its last ring and sets up a new one while the
workers are on their way out.
Make the worker take itself off the free list when it gives up its
->nr_workers slot, then leave ->nr_running, and only then take the final
look at the work list. That look and queueing work are both done under
acct->lock, so either the worker sees the work and stays, or the enqueue
side sees that the worker is gone and wakes or creates another one. If it
wants to stay and finds that its slot has been taken, a worker has been
created in its place, which is going to look at the work list, and it can
leave after all.
Fixes: 38aa434ab933 ("io_uring/io-wq: add exit-on-idle state")
Fixes: 05c5f4ee4da7 ("io-wq: get rid of FIXED worker flag")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-11-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io-wq.c | 36 +++++++++++++++++++++++++++++++++++-
1 file changed, 35 insertions(+), 1 deletion(-)
diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 38fcccf389936..4230a8ca7d8a3 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -699,6 +699,35 @@ static void io_worker_handle_work(struct io_wq_acct *acct,
} while (1);
}
+/*
+ * The worker has decided to exit, and has given up its ->nr_workers slot and
+ * its place on the free list. io_wq_enqueue() may have picked it from that
+ * list, or seen it running, after it last looked at the work list. Leave
+ * ->nr_running as well and check again. Returns false if the worker has to
+ * stay.
+ */
+static bool io_worker_retire(struct io_wq_acct *acct, struct io_worker *worker)
+{
+ /* turns io_wq_dec_running() and the scheduler hooks into no-ops */
+ clear_bit(IO_WORKER_F_UP, &worker->flags);
+ atomic_dec(&acct->nr_running);
+ if (!io_acct_run_queue(acct))
+ return true;
+ raw_spin_unlock(&acct->lock);
+
+ raw_spin_lock(&acct->workers_lock);
+ if (acct->nr_workers >= acct->max_workers) {
+ /* a worker was created in our place, the work is its business */
+ raw_spin_unlock(&acct->workers_lock);
+ return true;
+ }
+ acct->nr_workers++;
+ raw_spin_unlock(&acct->workers_lock);
+ atomic_inc(&acct->nr_running);
+ set_bit(IO_WORKER_F_UP, &worker->flags);
+ return false;
+}
+
static int io_wq_worker(void *data)
{
struct io_worker *worker = data;
@@ -736,9 +765,14 @@ static int io_wq_worker(void *data)
if ((last_timeout && (exit_mask || acct->nr_workers > 1)) ||
test_bit(IO_WQ_BIT_EXIT_ON_IDLE, &wq->state)) {
acct->nr_workers--;
+ if (test_and_clear_bit(IO_WORKER_F_FREE, &worker->flags))
+ hlist_nulls_del_init_rcu(&worker->nulls_node);
raw_spin_unlock(&acct->workers_lock);
__set_current_state(TASK_RUNNING);
- break;
+ if (io_worker_retire(acct, worker))
+ break;
+ last_timeout = false;
+ continue;
}
last_timeout = false;
__io_worker_idle(acct, worker);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 028/547] io_uring/io-wq: dont exit with a creation pending
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 027/547] io_uring/io-wq: dont strand work when a worker exits Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 029/547] io_uring/io-wq: let cancel find picked up hashed work Greg Kroah-Hartman
` (527 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit e231d2e8f80d3649ecd3851b7f2abdfbe606c04b ]
A worker that is the last one to go to sleep while work is pending asks
for another worker. io_wq_dec_running() bumps ->nr_running on behalf of
the new worker and queues create_worker_cb() as task_work for the owner
of the io-wq. Until that has run, everybody else takes it that a worker
is running which is going to look after the work list: io_wq_enqueue()
doesn't create one, and other workers that go to sleep don't find
themselves to be the last.
If the worker that made the request exits, io_worker_exit() cancels the
task_work, and io_worker_cancel_cb() drops ->nr_running without a look at
the work list:
worker A worker B io_wq_enqueue()
blocks, work is pending
nr_running++
queues create_worker_cb()
wakes, handles the work
idle timeout, decides to exit
picks up work 1
queues work 2
B is on the free list
still: wakes B
work 1 blocks
nr_running 2 -> 1
io_worker_exit()
io_worker_cancel_cb()
nr_running 1 -> 0
Work 2 has to wait for work 1, although there is room for more workers.
It takes an owner that doesn't get around to run its task_work for the
time of the idle timeout, less if the worker exits because its affinity
was changed or the io-wq is marked exit-on-idle.
Let the worker stay around until its request has been dealt with. Only
the worker itself sets ->create_state, so it can't be set behind its
back once it has decided to leave.
Fixes: 1d5f5ea7cb7d ("io-wq: remove worker to owner tw dependency")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-12-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io-wq.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 4230a8ca7d8a3..0120ec40effad 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -761,9 +761,13 @@ static int io_wq_worker(void *data)
* idle-exit, drop the worker as well. This is used to avoid
* keeping io-wq workers around for tasks that no longer have
* any active io_uring instances.
+ * Not as long as a request of ours for another worker is
+ * pending, though. It is accounted as a running worker, which
+ * others rely on, and io_worker_exit() would cancel it.
*/
- if ((last_timeout && (exit_mask || acct->nr_workers > 1)) ||
- test_bit(IO_WQ_BIT_EXIT_ON_IDLE, &wq->state)) {
+ if (((last_timeout && (exit_mask || acct->nr_workers > 1)) ||
+ test_bit(IO_WQ_BIT_EXIT_ON_IDLE, &wq->state)) &&
+ !test_bit(0, &worker->create_state)) {
acct->nr_workers--;
if (test_and_clear_bit(IO_WORKER_F_FREE, &worker->flags))
hlist_nulls_del_init_rcu(&worker->nulls_node);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 029/547] io_uring/io-wq: let cancel find picked up hashed work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 028/547] io_uring/io-wq: dont exit with a creation pending Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 030/547] io_uring/poll: dont lose a cancel as io-wq arms poll Greg Kroah-Hartman
` (526 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit e9efeb4fc97b0879512a3c3b995ed448f2487e12 ]
io_get_next_work() takes all the work items that share a hash off the
work list in one go, and the worker runs them one after the other. Only
the one it is working on is visible as ->cur_work. The others are neither
on the list nor current, so io_wq_cancel_cb() can't find them.
IORING_OP_ASYNC_CANCEL and IORING_REGISTER_SYNC_CANCEL return -ENOENT for
a request that has not even been started, e.g. a buffered write queued
behind another write to the same file that is blocked, and the request is
carried out. The cancellation done for a task or ring that goes away gets
there in the end, as it keeps trying, but it has to wait for each item to
become current.
Keep a pointer to the remainder of the chain next to ->cur_work, and have
io_wq_worker_cancel() look at it. The items on it belong to the worker,
which needs ->lock to move on to the next one. Matching work is flagged
with IO_WQ_WORK_CANCEL and fails with -ECANCELED when its turn comes. The
worker isn't signalled for it, that would interrupt the unrelated work it
is busy with. As the request isn't gone yet, it is reported like running
work, with -EALREADY.
Fixes: 86f3cd1b589a ("io-wq: handle hashed writes in chains")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-13-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io-wq.c | 35 +++++++++++++++++++++++++++++------
1 file changed, 29 insertions(+), 6 deletions(-)
diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 0120ec40effad..32c830d33a4da 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -56,6 +56,8 @@ struct io_worker {
struct io_wq_acct *acct;
struct io_wq_work *cur_work;
+ /* rest of the hashed chain ->cur_work was taken off the list with */
+ struct io_wq_work *next_work;
raw_spinlock_t lock;
struct completion ref_done;
@@ -581,6 +583,17 @@ static struct io_wq_work *io_get_next_work(struct io_wq_acct *acct,
return NULL;
}
+static void __io_assign_current_work(struct io_worker *worker,
+ struct io_wq_work *work)
+{
+ raw_spin_lock(&worker->lock);
+ worker->cur_work = work;
+ /* stays valid while in between two items of a chain */
+ if (work)
+ worker->next_work = wq_next_work(work);
+ raw_spin_unlock(&worker->lock);
+}
+
static void io_assign_current_work(struct io_worker *worker,
struct io_wq_work *work)
{
@@ -589,9 +602,7 @@ static void io_assign_current_work(struct io_worker *worker,
cond_resched();
}
- raw_spin_lock(&worker->lock);
- worker->cur_work = work;
- raw_spin_unlock(&worker->lock);
+ __io_assign_current_work(worker, work);
}
/*
@@ -622,9 +633,7 @@ static void io_worker_handle_work(struct io_wq_acct *acct,
* work list, but isn't yet discoverable as the
* current work item for this worker.
*/
- raw_spin_lock(&worker->lock);
- worker->cur_work = work;
- raw_spin_unlock(&worker->lock);
+ __io_assign_current_work(worker, work);
}
raw_spin_unlock(&acct->lock);
@@ -1175,6 +1184,7 @@ static bool __io_wq_worker_cancel(struct io_worker *worker,
static bool io_wq_worker_cancel(struct io_worker *worker, void *data)
{
struct io_cb_cancel_data *match = data;
+ struct io_wq_work *work;
/*
* Hold the lock to avoid ->cur_work going out of scope, caller
@@ -1183,6 +1193,19 @@ static bool io_wq_worker_cancel(struct io_worker *worker, void *data)
raw_spin_lock(&worker->lock);
if (__io_wq_worker_cancel(worker, match, worker->cur_work))
match->nr_running++;
+ /*
+ * Hashed work is taken off the work list a chain at a time, what the
+ * worker hasn't started yet can only be found here. It doesn't move on
+ * without the lock. Just mark the work, it fails once it is its turn.
+ */
+ for (work = worker->next_work; work; work = wq_next_work(work)) {
+ if (match->nr_running && !match->cancel_all)
+ break;
+ if (match->fn(work, match->data)) {
+ atomic_or(IO_WQ_WORK_CANCEL, &work->flags);
+ match->nr_running++;
+ }
+ }
raw_spin_unlock(&worker->lock);
return match->nr_running && !match->cancel_all;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 030/547] io_uring/poll: dont lose a cancel as io-wq arms poll
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 029/547] io_uring/io-wq: let cancel find picked up hashed work Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 031/547] io_uring: dont lose a cancel as io-wq parks a request Greg Kroah-Hartman
` (525 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 6d2d4c2530e95ff6ddeb98195d49d99dbca14369 ]
A request on a pollable file that was forced to io-wq is issued without
blocking there. If that ends in -EAGAIN, io_wq_submit_work() arms poll
for it and returns. It looks at IO_WQ_WORK_CANCEL once, before it issues
the request.
Somebody who wants to cancel the request in between finds it running:
io-wq worker io_try_cancel()
io_wq_submit_work()
IO_WQ_WORK_CANCEL isn't set
io_issue_sqe() = -EAGAIN
io_async_cancel_one()
sets IO_WQ_WORK_CANCEL
signals the worker
= -EALREADY
io_poll_cancel() = -ENOENT
...
= -ENOENT
io_arm_poll_handler() = IO_APOLL_OK
return
Nobody looks at the flag again, and the signal doesn't matter to a
worker that doesn't sleep. The request is armed as if nothing had
happened:
- a linked timeout completes with -ENOENT, and the request it was
meant to limit waits for as long as it takes.
- IORING_OP_ASYNC_CANCEL returns -EALREADY, and the request stays.
- IORING_REGISTER_SYNC_CANCEL waits for the request to complete if it
gets -EALREADY. Since commit 5623eb1ed035 ("io_uring/tctx: add
separate lock for list of tctx's in ctx") it doesn't sleep but spins,
so its next attempt finds the armed poll.
The same goes for a multishot poll, recv or accept that is armed from
io-wq.
With a read of an empty pipe, IOSQE_ASYNC, and a linked timeout of 5ms
or a cancel in the same submission, in a guest that is slow enough (TCG,
KASAN), the request is lost in 21 of 24 rounds of 40 or 100 attempts.
While it arms poll from io-wq, __io_arm_poll_handler() owns the request.
Look at the flag once the request is in the hash table. The table is
searched and the request is added with ->uring_lock held, and the flag is
set before the search. So either the search finds the request, or it
came first and the flag is seen. With the request marked as cancelled, the
task work that is queued, right away or because ownership can't be
released, fails it with -ECANCELED.
What the canceller is told doesn't change. In this window a linked timeout
still completes with -ENOENT rather than -ETIME, a cancel request with
-EALREADY, and one with IORING_ASYNC_CANCEL_ALL or _ANY with a count that
doesn't include the request. But the request is cancelled, so what is new
is a request that completes with -ECANCELED after such a result.
This doesn't help in two cases:
- IORING_ASYNC_CANCEL_ALL and _ANY, if the work is flagged after the
test added here, while io-wq still has it as the current work of the
worker. io_cancel_cb() stamps it with the sequence of the cancel, so the
search of the hash table on behalf of the same cancel takes it for
done and skips it.
- requests that are parked elsewhere by io-wq, like IORING_OP_FUTEX_WAIT
and IORING_OP_WAITID. They have the same problem.
Fixes: 90fa02883f06 ("io_uring: implement async hybrid mode for pollable requests")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-14-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/poll.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/io_uring/poll.c b/io_uring/poll.c
index 0ad9c00efdea9..3e443b187eae0 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -626,6 +626,18 @@ static int __io_arm_poll_handler(struct io_kiocb *req,
io_poll_add_hash(req, issue_flags);
+ /*
+ * Whoever tried to cancel the request while io-wq was running it has
+ * flagged the work item. If it searched the hash table before the
+ * request got there it found nothing, and it won't come back. Both
+ * the search and the insertion are done with ->uring_lock held, and
+ * the flag is set before the search. If the search came first,
+ * the flag is visible by now.
+ */
+ if (ipt->owning &&
+ (atomic_read(&req->work.flags) & IO_WQ_WORK_CANCEL))
+ io_poll_mark_cancelled(req);
+
if (mask && (poll->events & EPOLLET) &&
io_poll_can_finish_inline(req, ipt)) {
__io_poll_execute(req, mask, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 031/547] io_uring: dont lose a cancel as io-wq parks a request
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 030/547] io_uring/poll: dont lose a cancel as io-wq arms poll Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 032/547] io_uring/cancel: dont forget that the work was running Greg Kroah-Hartman
` (524 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 5cb049d2203d7a81a1c1a737c8df4575e71078e3 ]
IORING_OP_FUTEX_WAIT, IORING_OP_FUTEX_WAITV and IORING_OP_WAITID don't
block. They put the request on a list of the ring, where a wake up or a
cancellation finds it, and return IOU_ISSUE_SKIP_COMPLETE. They do so as
well if they are run by io-wq, e.g. because of IOSQE_ASYNC.
io_wq_submit_work() looks at IO_WQ_WORK_CANCEL once, before it issues the
request. Somebody who wants to cancel the request after that, and before
it is on the list, finds it running:
io-wq worker io_try_cancel()
io_wq_submit_work()
IO_WQ_WORK_CANCEL isn't set
io_async_cancel_one()
sets IO_WQ_WORK_CANCEL
signals the worker
= -EALREADY
...
io_futex_cancel() = -ENOENT
...
io_futex_wait()
adds the request to ->futex_list
= IOU_ISSUE_SKIP_COMPLETE
Nobody looks at the flag again. IORING_OP_ASYNC_CANCEL returns -EALREADY
and the request stays.
It is the problem that "io_uring/poll: don't lose a cancel as io-wq arms
poll" deals with for poll.
Look at the flag once the request is on the list, and cancel it if it is
set. The lists are searched and the requests are added with ->uring_lock
held, and the flag is set before the search. So either the search finds
the request, or it came first and the flag is seen.
What the canceller is told doesn't change, see the other patch, also for
IORING_ASYNC_CANCEL_ALL and _ANY.
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Fixes: 8f350194d5cf ("io_uring: add support for vectored futex waits")
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-15-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/futex.c | 4 ++++
io_uring/io_uring.h | 17 +++++++++++++++++
io_uring/waitid.c | 2 ++
3 files changed, 23 insertions(+)
diff --git a/io_uring/futex.c b/io_uring/futex.c
index eaee14242a3a3..64909a2a8c886 100644
--- a/io_uring/futex.c
+++ b/io_uring/futex.c
@@ -283,6 +283,8 @@ int io_futexv_wait(struct io_kiocb *req, unsigned int issue_flags)
*/
__set_current_state(TASK_RUNNING);
hlist_add_head(&req->hash_node, &ctx->futex_list);
+ if (io_wq_cancel_seen(req, issue_flags))
+ __io_futex_cancel(req);
} else {
iof->futexv_unqueued = 1;
if (woken != -1)
@@ -323,6 +325,8 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
&ifd->q, NULL, NULL);
if (!ret) {
hlist_add_head(&req->hash_node, &ctx->futex_list);
+ if (io_wq_cancel_seen(req, issue_flags))
+ __io_futex_cancel(req);
io_ring_submit_unlock(ctx, issue_flags);
return IOU_ISSUE_SKIP_COMPLETE;
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 71aa30186a667..659deb13c6680 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -412,6 +412,23 @@ static inline void io_ring_submit_lock(struct io_ring_ctx *ctx,
lockdep_assert_held(&ctx->uring_lock);
}
+/*
+ * For a handler that is run by io-wq and parks the request on a list where
+ * cancellations find it, rather than completing it. Whoever tried to cancel
+ * the request before that found it running. It has flagged the work item,
+ * has searched the list in vain, and won't come back. To be called with
+ * ->uring_lock held, which the search needs as well, once the request is on
+ * the list: if the search came first, the flag is visible.
+ */
+static inline bool io_wq_cancel_seen(struct io_kiocb *req,
+ unsigned int issue_flags)
+{
+ lockdep_assert_held(&req->ctx->uring_lock);
+
+ return (issue_flags & IO_URING_F_IOWQ) &&
+ (atomic_read(&req->work.flags) & IO_WQ_WORK_CANCEL);
+}
+
static inline void io_commit_cqring(struct io_ring_ctx *ctx)
{
/* order cqe stores with ring update */
diff --git a/io_uring/waitid.c b/io_uring/waitid.c
index f9211446efd44..172cf770b29b2 100644
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -352,6 +352,8 @@ int io_waitid(struct io_kiocb *req, unsigned int issue_flags)
* a waitqueue callback, or if someone cancels it.
*/
if (!io_waitid_drop_issue_ref(req)) {
+ if (io_wq_cancel_seen(req, issue_flags))
+ __io_waitid_cancel(req, true);
io_ring_submit_unlock(ctx, issue_flags);
return IOU_ISSUE_SKIP_COMPLETE;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 032/547] io_uring/cancel: dont forget that the work was running
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 031/547] io_uring: dont lose a cancel as io-wq parks a request Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 033/547] io_uring/cancel: recognize "no timeout" on 32-bit Greg Kroah-Hartman
` (523 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 8aa0e5db4845fb5ac11abe40d7b1cac0656c3ee3 ]
If the request to be cancelled is being run by io-wq,
io_async_cancel_one() flags the work, signals the worker and returns
-EALREADY. Since commit ccbf726171b7 ("io_uring: perform poll removal even
if async work removal is successful") io_try_cancel() goes on regardless,
as poll may be armed for the request. If it isn't, and nothing else turns
up, the result is the -ENOENT of the last search.
__io_async_cancel() makes up for that. On -ENOENT it tries the io-wq of
every task that uses the ring, and that of the caller is one of them. So
the work is found a second time, and the result is -EALREADY after all.
Unless the worker is done with it by then. If the work is flagged before
io_wq_submit_work() looks at IO_WQ_WORK_CANCEL, all the worker does is to
queue the request to be failed by task work. Then it isn't anywhere to be
found until the task work has run, and
- IORING_REGISTER_SYNC_CANCEL returns -ENOENT,
- IORING_OP_ASYNC_CANCEL completes with -ENOENT,
for a request that they have just cancelled, and that completes with
-ECANCELED.
With a read of an empty pipe, IOSQE_ASYNC, and a sync cancel right behind
it, 1 to 3 of 1,000,000 calls return -ENOENT, and 50 to 110 with
IORING_SETUP_DEFER_TASKRUN (4 CPUs, KVM). Nothing is written to the pipe,
and all of these reads end with -ECANCELED.
Remember that the work was found. IORING_OP_ASYNC_CANCEL completes with
-EALREADY, as it does if the worker is a bit slower. For
IORING_REGISTER_SYNC_CANCEL it means to try again, which ends with 0.
The result of a linked timeout, which calls io_try_cancel() by itself,
and the number that is returned for IORING_ASYNC_CANCEL_ALL and _ANY don't
change.
Fixes: ccbf726171b7 ("io_uring: perform poll removal even if async work removal is successful")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-16-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/cancel.c | 13 ++++++++++++-
io_uring/cancel.h | 2 ++
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index 03b1f1f3fad16..e9988a9dbb144 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -117,6 +117,8 @@ int io_try_cancel(struct io_uring_task *tctx, struct io_cancel_data *cd,
*/
if (!ret)
return 0;
+ if (ret == -EALREADY)
+ cd->running = true;
ret = io_poll_cancel(ctx, cd, issue_flags);
if (ret != -ENOENT)
@@ -180,6 +182,7 @@ static int __io_async_cancel(struct io_cancel_data *cd,
struct io_tctx_node *node;
int ret, nr = 0;
+ cd->running = false;
do {
ret = io_try_cancel(tctx, cd, issue_flags);
if (ret == -ENOENT)
@@ -204,7 +207,15 @@ static int __io_async_cancel(struct io_cancel_data *cd,
}
mutex_unlock(&ctx->tctx_lock);
io_ring_submit_unlock(ctx, issue_flags);
- return all ? nr : ret;
+ if (all)
+ return nr;
+ /*
+ * The worker may be done with the work that was found running, and
+ * flagged, above. That isn't the same as not having found it.
+ */
+ if (ret == -ENOENT && cd->running)
+ ret = -EALREADY;
+ return ret;
}
int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)
diff --git a/io_uring/cancel.h b/io_uring/cancel.h
index 1b201a0943030..e03a6fb0b7f95 100644
--- a/io_uring/cancel.h
+++ b/io_uring/cancel.h
@@ -11,6 +11,8 @@ struct io_cancel_data {
u8 opcode;
u32 flags;
int seq;
+ /* io_try_cancel() has found it being run by io-wq, and flagged it */
+ bool running;
};
int io_async_cancel_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 033/547] io_uring/cancel: recognize "no timeout" on 32-bit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 032/547] io_uring/cancel: dont forget that the work was running Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 034/547] io_uring/cancel: let CANCEL_ALL find parked requests Greg Kroah-Hartman
` (522 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 3774e4d4c8533da2caae95556c4d635c7c4f45b8 ]
IORING_REGISTER_SYNC_CANCEL waits without a limit if both fields of
io_uring_sync_cancel_reg::timeout are -1. io_sync_cancel() compares them
with -1UL. They are of type long long. With a long of 32 bits -1UL is
4294967295, which is what it stays when it is converted for the
comparison, and the fields are never equal to it.
So { -1, -1 } is taken for a timeout. ktime_set() takes the nanoseconds as
an unsigned long, so what becomes of it is -1s + 4294967295ns = 3.29s.
If the request is being run by io-wq and can't be interrupted, the call
returns -ETIME after that time, rather than waiting for the request to be
gone. On i386, with a buffered read from a null_blk device that takes 4s
to complete a request, IOSQE_ASYNC, that is what each call does.
Fixes: 78a861b94959 ("io_uring: add sync cancelation API through io_uring_register()")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-17-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/cancel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index e9988a9dbb144..9732002449b94 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -319,7 +319,7 @@ int io_sync_cancel(struct io_ring_ctx *ctx, void __user *arg)
if (ret != -EALREADY)
goto out;
- if (sc.timeout.tv_sec != -1UL || sc.timeout.tv_nsec != -1UL) {
+ if (sc.timeout.tv_sec != -1 || sc.timeout.tv_nsec != -1) {
struct timespec64 ts = {
.tv_sec = sc.timeout.tv_sec,
.tv_nsec = sc.timeout.tv_nsec
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 034/547] io_uring/cancel: let CANCEL_ALL find parked requests
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 033/547] io_uring/cancel: recognize "no timeout" on 32-bit Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 035/547] io_uring: wake ring pollers for local task_work Greg Kroah-Hartman
` (521 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit fe6ca13c98b1223f6005f32913ebd32e4df64b77 ]
A cancellation with IORING_ASYNC_CANCEL_ALL or _ANY goes on until it finds
nothing more. A request may stay where it was found for a while after it
has been cancelled, so each one that matches is stamped with the sequence
number of the cancellation, and is skipped from then on.
io_cancel_cb() does so for io-wq work as well. There is no need to:
pending work is taken off the list, and the workers are looked at once per
call. And it does harm. A request that is run by io-wq may be parked
while it still is the current work of the worker: poll gets armed for it,
or it is put on ->futex_list or ->waitid_list.
io-wq worker io_try_cancel()
io_wq_submit_work()
io_arm_poll_handler()
io_poll_add_hash()
io_async_cancel_one()
io_cancel_cb()
stamps the request
sets IO_WQ_WORK_CANCEL
= -EALREADY
io_poll_cancel()
skips the request
= -ENOENT
io_assign_current_work(NULL)
The flag comes too late for the worker to see it, and the search that
would have found the request takes it for done. The cancellation returns,
and the request stays.
With a multishot poll, IOSQE_ASYNC, and IORING_OP_ASYNC_CANCEL with
IORING_ASYNC_CANCEL_ALL up to 63us later, that happens to 4 of 1,000
requests (4 CPUs, KVM).
Take the stamp off again if the work matches. If the request is found
on one of the lists it gets a new one, and io_cancel_cb() doesn't match it
a second time.
__io_async_cancel() tries the io-wq of the caller twice. So far the stamp
has kept it from counting work that is running there the second time.
Skip it instead, so that the number that is returned stays the same.
Fixes: 8e29da69fead ("io_uring: add support for IORING_ASYNC_CANCEL_ALL")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-18-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/cancel.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index 9732002449b94..75a21ecfe69c8 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -72,7 +72,16 @@ static bool io_cancel_cb(struct io_wq_work *work, void *data)
struct io_kiocb *req = container_of(work, struct io_kiocb, work);
struct io_cancel_data *cd = data;
- return io_cancel_req_match(req, cd);
+ if (!io_cancel_req_match(req, cd))
+ return false;
+ /*
+ * Pending work is gone once it has matched. Work that is running may
+ * park the request where the same cancellation looks next. Don't make
+ * it skip the request as one that it has dealt with.
+ */
+ if (cd->flags & (IORING_ASYNC_CANCEL_ALL | IORING_ASYNC_CANCEL_ANY))
+ req->cancel_seq_set = false;
+ return true;
}
static int io_async_cancel_one(struct io_uring_task *tctx,
@@ -198,6 +207,9 @@ static int __io_async_cancel(struct io_cancel_data *cd,
mutex_lock(&ctx->tctx_lock);
ret = -ENOENT;
list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
+ /* has been done above, don't count what is running there */
+ if (all && node->task->io_uring == tctx)
+ continue;
ret = io_async_cancel_one(node->task->io_uring, cd);
if (ret != -ENOENT) {
if (!all)
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 035/547] io_uring: wake ring pollers for local task_work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 034/547] io_uring/cancel: let CANCEL_ALL find parked requests Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 036/547] io_uring/wait: look at all CQ waiters on wake up Greg Kroah-Hartman
` (520 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit b88902d8745a701d24275d012f0830e3628e2a22 ]
With IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and
only become CQEs when the submitter enters the kernel to wait for events.
For an application that finds out via poll() or epoll on the ring fd when
it is time to do that, io_uring_poll() reports EPOLLIN if local work is
pending.
That only helps if the work is there at the time of the call. When
DEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(),
which took care of tasks sleeping in poll() as well. Then polling got a
wait queue of its own, ->poll_wq, and the wake up in
io_req_local_work_add() was replaced by waking the submitter directly.
Since then ->poll_wq is only woken when CQEs are committed, which for
such a ring is done by the very task that is waiting to be told to:
submitter completion
poll(ring_fd)
io_uring_poll() // nothing yet
schedule()
io_req_local_work_add()
// ->cq_wait_nr: nobody waits
// sleeps on
Wake ->poll_wq when the first entry is put on the work list. Like for the
eventfd, that must not be done right away if the work is queued from a
wake up handler, as the chain of wake ups could get back to the wait
queue whose lock is held. Use an RCU callback in that case, with a
reference to the ring.
Fixes: 130bd686d9be ("io_uring: waitqueue-less cq waiting")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-19-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/io_uring_types.h | 3 +++
io_uring/tw.c | 34 ++++++++++++++++++++++++++++++++++
2 files changed, 37 insertions(+)
diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h
index e90e5b5dd70ab..c5edf6246a4b4 100644
--- a/include/linux/io_uring_types.h
+++ b/include/linux/io_uring_types.h
@@ -519,6 +519,9 @@ struct io_ring_ctx {
u32 iowq_limits[2];
struct callback_head poll_wq_task_work;
+ /* deferred ->poll_wq wake up for local task_work */
+ struct rcu_head poll_wq_rcu;
+ atomic_t poll_wq_rcu_pending;
struct list_head defer_list;
unsigned nr_drained;
/* drain request dispatched from ->defer_list, until it completes */
diff --git a/io_uring/tw.c b/io_uring/tw.c
index 98e3b1bc61b4b..0b5066f972245 100644
--- a/io_uring/tw.c
+++ b/io_uring/tw.c
@@ -148,6 +148,37 @@ static void io_ctx_mark_taskrun(struct io_ring_ctx *ctx)
}
}
+static void io_poll_wq_wake_rcu(struct rcu_head *rcu)
+{
+ struct io_ring_ctx *ctx = container_of(rcu, struct io_ring_ctx,
+ poll_wq_rcu);
+
+ atomic_set(&ctx->poll_wq_rcu_pending, 0);
+ io_poll_wq_wake(ctx);
+ percpu_ref_put(&ctx->refs);
+}
+
+/*
+ * io_uring_poll() reports pending local work as EPOLLIN, as it takes a trip to
+ * the kernel to turn it into CQEs. Let those know who are asleep already.
+ */
+static void io_local_work_wake_poll(struct io_ring_ctx *ctx, unsigned int flags)
+{
+ if (!(flags & IOU_F_TWQ_IN_WAKE)) {
+ io_poll_wq_wake(ctx);
+ return;
+ }
+ /*
+ * Called from a wake up handler with some wait queue lock held, this
+ * one could lead back to it. Do it from a clean context.
+ */
+ if (!wq_has_sleeper(&ctx->poll_wq) ||
+ atomic_xchg(&ctx->poll_wq_rcu_pending, 1))
+ return;
+ percpu_ref_get(&ctx->refs);
+ call_rcu_hurry(&ctx->poll_wq_rcu, io_poll_wq_wake_rcu);
+}
+
void io_req_local_work_add(struct io_kiocb *req, unsigned flags)
{
struct io_ring_ctx *ctx = req->ctx;
@@ -174,6 +205,9 @@ void io_req_local_work_add(struct io_kiocb *req, unsigned flags)
io_ctx_mark_taskrun(ctx);
if (data_race(ctx->int_flags) & IO_RING_F_HAS_EVFD)
io_eventfd_signal(ctx, false, flags & IOU_F_TWQ_IN_WAKE);
+ /* whoever sets the flag wakes ->poll_wq afterwards */
+ if (data_race(ctx->int_flags) & IO_RING_F_POLL_ACTIVATED)
+ io_local_work_wake_poll(ctx, flags);
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 036/547] io_uring/wait: look at all CQ waiters on wake up
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 035/547] io_uring: wake ring pollers for local task_work Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 037/547] io_uring/poll: drop stale double poll entry on rearm Greg Kroah-Hartman
` (519 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 356f92f2412686f822383b784fa102924407457a ]
io_wake_function() returns -1 if the waiter it is called for doesn't have
enough events yet, which makes __wake_up_common() stop walking the wait
queue. That assumes that the waiters behind it can't be satisfied either.
Each waiter has its own target though, computed from the min_complete it
passed in:
thread A: io_uring_enter(GETEVENTS, min_complete = 10) // queued first
thread B: io_uring_enter(GETEVENTS, min_complete = 1)
one CQE is posted: A isn't woken, and B isn't even considered
B keeps sleeping with the event it asked for sitting in the CQ ring, until
A's demand is met or a timeout or signal ends the wait.
Return 0 to carry on with the next waiter. Only waiters whose condition
is met are woken, like before.
Fixes: bda521624e75 ("io_uring: make CQ ring wakeups be more efficient")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-20-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/wait.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/io_uring/wait.c b/io_uring/wait.c
index 62f0101321000..078fa8b076a99 100644
--- a/io_uring/wait.c
+++ b/io_uring/wait.c
@@ -27,7 +27,8 @@ static int io_wake_function(struct wait_queue_entry *curr, unsigned int mode,
*/
if (io_should_wake(iowq) || io_has_work(iowq->ctx))
return autoremove_wake_function(curr, mode, wake_flags, key);
- return -1;
+ /* keep going, a waiter further down may be content with less */
+ return 0;
}
int io_run_task_work_sig(struct io_ring_ctx *ctx)
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 037/547] io_uring/poll: drop stale double poll entry on rearm
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 036/547] io_uring/wait: look at all CQ waiters on wake up Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 038/547] io_uring/futex: allocate private hash before waiting Greg Kroah-Hartman
` (518 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit f2dbe87968a3aef74a11c025776d293b80964d3f ]
A file that uses two wait queues for poll, e.g. a tty, gets a second
io_poll entry, which IORING_OP_POLL_ADD keeps in ->async_data until the
request is freed. io_poll_add() can run more than once for a request
though: IORING_OP_POLL_REMOVE with one of the update flags disarms and
rearms it, and io_poll_task_func() reissues it if a wake up turns out to
be spurious. The second poll_wait() of the new round then finds
*poll_ptr set, with ->head cleared by the disarm, and __io_queue_proc()
fails what it takes for a third wait queue with -EINVAL.
For an update that means that the poll request is completed with
-ECANCELED, while the update itself reports success. For a spurious wake
up, e.g. tcsetattr() on the polled tty, the poll request fails with
-EINVAL.
Free the old entry and clear the poll flags before arming, which is what
io_arm_apoll() does for internal polling. All entries have been removed
from their wait queues at that point.
Fixes: b69de288e913 ("io_uring: allow events and user_data update of running poll requests")
Fixes: 6e5aedb9324a ("io_uring/poll: attempt request issue after racy poll wakeup")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-21-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/poll.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/io_uring/poll.c b/io_uring/poll.c
index 3e443b187eae0..4f04bda42f7ff 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -927,6 +927,15 @@ int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
ipt.pt._qproc = io_poll_queue_proc;
+ /*
+ * A poll update or a spurious wake up arms the request again. Forget
+ * the entries of the previous round like io_arm_apoll() does, a stale
+ * second entry would be taken for a third wait queue.
+ */
+ if (req_has_async_data(req))
+ io_req_async_data_free(req);
+ req->flags &= ~(REQ_F_SINGLE_POLL | REQ_F_DOUBLE_POLL);
+
ret = __io_arm_poll_handler(req, poll, &ipt, poll->events, issue_flags);
if (ret > 0) {
io_req_set_res(req, ipt.result_mask, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 038/547] io_uring/futex: allocate private hash before waiting
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 037/547] io_uring/poll: drop stale double poll entry on rearm Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 039/547] io_uring: drop the CQE cache if a refill fails Greg Kroah-Hartman
` (517 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 3eff68bce25584cded3fb6ec033ff9a1c9913d04 ]
The futex code relies on there being no private futex waiters by the time
the first private hash of a mm is installed: __futex_pivot_hash() moves
the waiters from the previous private hash to the new one, but it does not
look for them in the global hash which is used as long as there is no
private hash. That is why every clone(CLONE_VM) allocates it up front: a
task which is alone in its mm cannot block in futex_wait() and create a
thread or invoke prctl(PR_FUTEX_HASH) at the same time.
IORING_OP_FUTEX_WAIT and IORING_OP_FUTEX_WAITV do not block the submitter
though:
io_uring_enter()
io_futex_wait()
futex_wait_setup() // no private hash: queued in the global hash
pthread_create()
futex_hash_allocate_default()
__futex_pivot_hash() // first private hash, nothing is moved
futex(FUTEX_WAKE_PRIVATE)
futex_hash() // private hash: no waiter
The wakeup is lost and the request only completes when it is cancelled.
prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS, n) instead of
pthread_create() has the same effect.
Allocate the default private hash when a wait request on a private futex
is prepared, which happens in the context of the submitter. This is a RCU
protected pointer check once the hash exists. A failure to allocate it
fails the request with -ENOMEM.
Fixes: 80367ad01d93 ("futex: Add basic infrastructure for local task local hash")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-22-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/futex.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/io_uring/futex.c b/io_uring/futex.c
index 64909a2a8c886..9203998654ffb 100644
--- a/io_uring/futex.c
+++ b/io_uring/futex.c
@@ -152,6 +152,24 @@ int io_futex_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
return 0;
}
+/*
+ * A wait on a private futex does not block the submitter. Even a single
+ * threaded task can go on and have the mm private hash installed by clone()
+ * or prctl(), which does not pick up waiters from the global hash. Make
+ * sure the private hash exists before the first waiter is queued.
+ */
+static int io_futex_prep_private(struct io_kiocb *req)
+{
+ int ret = futex_hash_allocate_default();
+
+ if (unlikely(ret))
+ return ret;
+
+ /* inflight tracking only needed for mm private hash */
+ io_req_track_inflight(req);
+ return 0;
+}
+
int io_futex_wait_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
{
struct io_futex *iof = io_kiocb_to_cmd(req, struct io_futex);
@@ -161,9 +179,8 @@ int io_futex_wait_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
if (unlikely(ret))
return ret;
- /* inflight tracking only needed for mm private hash */
if (!(iof->futex_flags & FLAGS_SHARED))
- io_req_track_inflight(req);
+ return io_futex_prep_private(req);
return 0;
}
@@ -213,10 +230,13 @@ int io_futexv_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
return ret;
}
- /* inflight tracking only needed for mm private hash */
for (i = 0; i < iof->futex_nr; i++) {
if (!(ifd->futexv[i].w.flags & FLAGS_SHARED)) {
- io_req_track_inflight(req);
+ ret = io_futex_prep_private(req);
+ if (ret) {
+ kfree(ifd);
+ return ret;
+ }
break;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 039/547] io_uring: drop the CQE cache if a refill fails
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 038/547] io_uring/futex: allocate private hash before waiting Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 040/547] io_uring: dont split 128b SQEs at the SQPOLL cap Greg Kroah-Hartman
` (516 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leonid Ovchinnikov, Josef Bacik,
Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 78f9c9cffef02a290b6e97672aaa9c75df0d21da ]
->cqe_cached and ->cqe_sentinel delimit the CQ entries which can be
handed out without looking at the ring. io_get_cqe_overflow() only calls
io_cqe_cache_refill() if that range is too small. Without
IORING_SETUP_CQE_MIXED too small means empty. With it, a 32b CQE needs
two entries, and one may be left. If the refill then fails, the entry
stays in the cache, and the next 16b CQE gets it without any checks.
That CQE overtakes the 32b one, which went to the overflow list. The test
for IO_CHECK_CQ_OVERFLOW_BIT, which is there to prevent that, is part of
the refill:
CQ ring with 4 entries, head == 0
16b CQE, 32b CQE tail == 3, one entry cached
32b CQE no room, the CQE overflows
16b CQE written to entry 3, ahead of the 32b CQE
Forget about the rest of the cache when it is refilled.
Fixes: e26dca67fde1 ("io_uring: add support for IORING_SETUP_CQE_MIXED")
Reported-by: Leonid Ovchinnikov <teiny.work@gmail.com>
Closes: https://lore.kernel.org/io-uring/CAECZYD5OMD9vMTzjteFMMP40Dn+SWKj9SFj=43U6uO3XMnxJbw@mail.gmail.com/
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-23-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 19f79e53c4d37..020ea9b01f986 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -735,6 +735,13 @@ bool io_cqe_cache_refill(struct io_ring_ctx *ctx, bool overflow, bool cqe32)
if (!overflow && (ctx->check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT)))
return false;
+ /*
+ * A single entry may be left if a 32b CQE is asked for. It must not be
+ * handed out later on if this fails, as the CQE is going to overflow.
+ */
+ ctx->cqe_cached = NULL;
+ ctx->cqe_sentinel = NULL;
+
/*
* Post dummy CQE if a 32b CQE is needed and there's only room for a
* 16b CQE before the ring wraps.
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 040/547] io_uring: dont split 128b SQEs at the SQPOLL cap
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 039/547] io_uring: drop the CQE cache if a refill fails Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 041/547] io_uring/register: dont wrap 32b CQEs when resizing Greg Kroah-Hartman
` (515 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 79956bb39b4d372eb146955ea159ecb6fba37f5b ]
If an SQPOLL thread serves more than one ring, __io_sq_thread() submits
no more than IORING_SQPOLL_CAP_ENTRIES_VALUE entries per ring and round,
for fairness. On a ring with IORING_SETUP_SQE_MIXED the cap may fall
between the two entries of a 128b SQE. io_init_req() finds that just one
entry is left of what it was asked to submit and fails the request with
-EINVAL, although the second entry is sitting in the SQ ring.
In the next round the second entry is taken for an SQE of its own, so on
top of the failed request the application gets whatever its payload
amounts to when it is read as an SQE.
The application has done nothing wrong, and it can't know where the cap
is going to be applied. For SQPOLL, let the request have its second entry
if the SQ ring holds it, in excess of the number of entries that were to
be submitted.
Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-24-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 020ea9b01f986..9796283508b83 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1807,17 +1807,27 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
* A 128b op on a non-128b SQ requires mixed SQE support as
* well as 2 contiguous entries.
*/
- if (!(ctx->flags & IORING_SETUP_SQE_MIXED) || *left < 2 ||
+ if (!(ctx->flags & IORING_SETUP_SQE_MIXED) ||
(unsigned)(sqe - ctx->sq_sqes) >= ctx->sq_entries - 1)
return io_init_fail_req(req, -EINVAL);
+ if (*left >= 2) {
+ /*
+ * A 128b operation on a mixed SQ uses two entries, so
+ * we have to increment the head and cached refs, and
+ * decrement what's left.
+ */
+ current->io_uring->cached_refs++;
+ (*left)--;
+ } else if (!(ctx->flags & IORING_SETUP_SQPOLL) ||
+ !__io_sqring_entries(ctx)) {
+ return io_init_fail_req(req, -EINVAL);
+ }
/*
- * A 128b operation on a mixed SQ uses two entries, so we have
- * to increment the head and cached refs, and decrement what's
- * left.
+ * else: the SQPOLL thread caps the number of entries it submits
+ * in one go, which is none of the application's business. Take
+ * the 2nd entry on top.
*/
- current->io_uring->cached_refs++;
ctx->cached_sq_head++;
- (*left)--;
}
if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 041/547] io_uring/register: dont wrap 32b CQEs when resizing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 040/547] io_uring: dont split 128b SQEs at the SQPOLL cap Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 042/547] io_uring/register: handle index wrap " Greg Kroah-Hartman
` (514 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 0edf1930b8ed3c398d3cbdbafd8f72dbd1a3d9e4 ]
On an IORING_SETUP_CQE_MIXED ring, a 32b CQE uses two contiguous CQ
entries and is never allowed to wrap the end of the ring. When posting,
io_cqe_cache_refill() inserts a dummy IORING_CQE_F_SKIP entry if only
one entry is left before the ring wraps, and the application relies on
that to read a 32b CQE as one contiguous 32 byte slot.
io_register_resize_rings() copies pending CQEs to the new ring one 16b
entry at a time, placing entry i at i & (new_entries - 1). When the CQ
ring is shrunk, a pending 32b CQE that was contiguous in the old ring
can land with its first half on the last entry of the new ring and its
second half on entry 0. For example, with 8 old entries, 4 new entries
and a 32b CQE at index 3, the halves end up at entries 3 and 0. The
application then reads the extra data of that CQE from past the end of
the CQ array, and the CQE content it sees is wrong.
This was found by code inspection and has not been reproduced.
Fix by failing the resize with -EOVERFLOW if a pending 32b CQE would
wrap the new ring, the same way the resize fails when the pending CQEs
don't fit.
Fixes: e26dca67fde1 ("io_uring: add support for IORING_SETUP_CQE_MIXED")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-25-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/register.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/io_uring/register.c b/io_uring/register.c
index dab3eb4258dff..d7e9963ab9b02 100644
--- a/io_uring/register.c
+++ b/io_uring/register.c
@@ -505,6 +505,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
struct io_uring_params *p = &config.p;
struct io_rings_layout *rl = &config.layout;
u32 *o_sq_array, *n_sq_array = NULL;
+ bool cqe32_tail = false;
int ret;
memset(&config, 0, sizeof(config));
@@ -654,6 +655,21 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
src_mask = (ctx->cq_entries << 1) - 1;
dst_mask = (p->cq_entries << 1) - 1;
}
+ /*
+ * A 32b CQE on a CQE_MIXED ring takes two contiguous entries
+ * and must not wrap. A smaller ring may place it on the last
+ * entry, fail the resize if that happens.
+ */
+ if (ctx->flags & IORING_SETUP_CQE_MIXED) {
+ if (cqe32_tail) {
+ cqe32_tail = false;
+ } else if (READ_ONCE(o.rings->cqes[index & src_mask].flags) &
+ IORING_CQE_F_32) {
+ if ((index & dst_mask) == dst_mask)
+ goto overflow;
+ cqe32_tail = true;
+ }
+ }
memcpy(&n.rings->cqes[index & dst_mask], &o.rings->cqes[index & src_mask], cq_size);
}
WRITE_ONCE(n.rings->cq.head, old_head);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 042/547] io_uring/register: handle index wrap when resizing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 041/547] io_uring/register: dont wrap 32b CQEs when resizing Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 043/547] io_uring/register: keep 128b SQEs intact on resize Greg Kroah-Hartman
` (513 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit e8dee8d5498c710a22a84076d8ecb661627032b4 ]
The ring heads and tails are free running 32-bit counters.
io_register_resize_rings() takes that into account when it checks whether
the pending entries fit into the new rings, but then copies them with
for (i = old_head; i < tail; i++)
If the tail has wrapped and the head hasn't, that copies nothing. The new
rings get the old head and tail, so the application finds whatever is in
the freshly allocated memory, zeroes, in place of the CQEs it hasn't
reaped yet, or the kernel in place of the SQEs that have not been
submitted yet. A ring that completes a million requests per second gets
there after little more than an hour.
Loop until the tail is reached, the number of iterations has been bounded
by the size of the new ring at that point.
Fixes: 79cfe9e59c2a ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-26-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/register.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/io_uring/register.c b/io_uring/register.c
index d7e9963ab9b02..bce4473dc2ddb 100644
--- a/io_uring/register.c
+++ b/io_uring/register.c
@@ -604,7 +604,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
old_head = READ_ONCE(o.rings->sq.head);
if (tail - old_head > p->sq_entries)
goto overflow;
- for (i = old_head; i < tail; i++) {
+ for (i = old_head; i != tail; i++) {
unsigned int dst, src;
size_t sq_size;
@@ -641,7 +641,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
ret = -EOVERFLOW;
goto out;
}
- for (i = old_head; i < tail; i++) {
+ for (i = old_head; i != tail; i++) {
unsigned index, dst_mask, src_mask;
size_t cq_size;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 043/547] io_uring/register: keep 128b SQEs intact on resize
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 042/547] io_uring/register: handle index wrap " Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 044/547] io_uring/fdinfo: fix CQE dump of CQE32 rings Greg Kroah-Hartman
` (512 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 0feb5bcd2d4261d656729892aef4d643461ea5ac ]
On a ring with IORING_SETUP_SQE_MIXED a 128b SQE takes two entries that
have to be contiguous in memory, io_init_req() fails it with -EINVAL if
it starts on the last entry of the SQ ring. The entry a pending SQE ends
up in after IORING_REGISTER_RESIZE_RINGS depends on the size of the new
ring, and nothing takes care of that. With four entries instead of eight,
a 128b SQE which was fine in entries 3 and 4 is split up between entry 3
and entry 0. The resize succeeds, and the request fails later on.
If the ring has an SQ array, the second half is also taken from the
wrong place unless the array happens to map the following index to the
following entry. The submission side doesn't look at the array for the
second half.
Do what is done for 32b CQEs on IORING_SETUP_CQE_MIXED rings: fail the
resize with -EOVERFLOW if a 128b SQE would wrap. And copy the second half
from where it is.
Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-27-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/register.c | 34 +++++++++++++++++++++++++++++++++-
1 file changed, 33 insertions(+), 1 deletion(-)
diff --git a/io_uring/register.c b/io_uring/register.c
index bce4473dc2ddb..2ce36623e25a6 100644
--- a/io_uring/register.c
+++ b/io_uring/register.c
@@ -496,6 +496,17 @@ static void io_register_free_rings(struct io_ring_ctx *ctx,
IORING_SETUP_CQE32 | IORING_SETUP_NO_MMAP | \
IORING_SETUP_CQE_MIXED | IORING_SETUP_SQE_MIXED)
+static bool io_sqe_is_128(struct io_ring_ctx *ctx,
+ const struct io_uring_sqe *sqe)
+{
+ u8 opcode = READ_ONCE(sqe->opcode);
+
+ if (!(ctx->flags & IORING_SETUP_SQE_MIXED) || opcode >= IORING_OP_LAST)
+ return false;
+ opcode = array_index_nospec(opcode, IORING_OP_LAST);
+ return io_issue_defs[opcode].is_128;
+}
+
static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
{
struct io_ctx_config config;
@@ -506,6 +517,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
struct io_rings_layout *rl = &config.layout;
u32 *o_sq_array, *n_sq_array = NULL;
bool cqe32_tail = false;
+ unsigned int sqe128_src = 0;
int ret;
memset(&config, 0, sizeof(config));
@@ -605,12 +617,19 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
if (tail - old_head > p->sq_entries)
goto overflow;
for (i = old_head; i != tail; i++) {
+ bool sqe128_tail = sqe128_src;
unsigned int dst, src;
size_t sq_size;
dst = i & (p->sq_entries - 1);
src = i & (ctx->sq_entries - 1);
- if (n_sq_array) {
+ if (sqe128_tail) {
+ /* it follows the first half, whatever the array says */
+ src = sqe128_src;
+ sqe128_src = 0;
+ if (n_sq_array)
+ WRITE_ONCE(n_sq_array[dst], dst);
+ } else if (n_sq_array) {
src = READ_ONCE(o_sq_array[src]);
if (unlikely(src >= ctx->sq_entries)) {
WRITE_ONCE(n_sq_array[dst], UINT_MAX);
@@ -619,6 +638,19 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
WRITE_ONCE(n_sq_array[dst], dst);
}
+ /*
+ * A 128b SQE on a SQE_MIXED ring takes two contiguous entries
+ * and must not wrap. A smaller ring may place it on the last
+ * entry, fail the resize if that happens.
+ */
+ if (!sqe128_tail && i + 1 != tail &&
+ src < ctx->sq_entries - 1 &&
+ io_sqe_is_128(ctx, &o.sq_sqes[src])) {
+ if (dst == p->sq_entries - 1)
+ goto overflow;
+ sqe128_src = src + 1;
+ }
+
sq_size = sizeof(struct io_uring_sqe);
if (ctx->flags & IORING_SETUP_SQE128) {
dst <<= 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 044/547] io_uring/fdinfo: fix CQE dump of CQE32 rings
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 043/547] io_uring/register: keep 128b SQEs intact on resize Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 045/547] io_uring/timeout: dont skip over reached sequences Greg Kroah-Hartman
` (511 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin,
Claude Fable 5.1
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
Commit e4507a62c247081fffe299622c04c6f7c3d98e92 upstream.
Since the CQ ring dump was changed to deal with IORING_SETUP_CQE_MIXED, a
32b CQE is taken to occupy two entries of the ring. That is how it works
for mixed rings. With IORING_SETUP_CQE32 each entry has twice the size:
head and tail count 32b CQEs, and entry n is found at cqes[n << 1].
For such rings the dump reads cqes[n], and skips every other entry. It
shows half of the pending CQEs at best, and what it shows is taken from
the wrong place unless the head happens to be at the start of the ring.
The extra data of the last entry isn't shown at all, as the check that
keeps the dump of a mixed ring from reading beyond the array is applied to
these rings as well.
[ 7.2: without the last-slot check, which 7.2 does not have ]
Fixes: 82ceb7fcc5ff ("io_uring/fdinfo: handle mixed sized CQEs")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-28-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/fdinfo.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 3ae4804765b94..30027fd460455 100644
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -154,11 +154,17 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
cq_entries = min(cq_tail - cq_head, ctx->cq_entries);
for (i = 0; i < cq_entries; i++) {
struct io_uring_cqe *cqe;
- bool cqe32 = false;
+ bool cqe32 = false, two_entries = false;
- cqe = &r->cqes[(cq_head & cq_mask)];
- if (cqe->flags & IORING_CQE_F_32 || ctx->flags & IORING_SETUP_CQE32)
+ if (ctx->flags & IORING_SETUP_CQE32) {
+ /* all entries have twice the size */
+ cqe = &r->cqes[(cq_head & cq_mask) << 1];
cqe32 = true;
+ } else {
+ cqe = &r->cqes[(cq_head & cq_mask)];
+ two_entries = cqe->flags & IORING_CQE_F_32;
+ cqe32 = two_entries;
+ }
seq_printf(m, "%5u: user_data:%llu, res:%d, flags:%x",
cq_head & cq_mask, cqe->user_data, cqe->res,
cqe->flags);
@@ -167,7 +173,7 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
cqe->big_cqe[0], cqe->big_cqe[1]);
seq_printf(m, "\n");
cq_head++;
- if (cqe32) {
+ if (two_entries) {
cq_head++;
i++;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 045/547] io_uring/timeout: dont skip over reached sequences
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 044/547] io_uring/fdinfo: fix CQE dump of CQE32 rings Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 046/547] io_uring/timeout: keep repeat count on multishot update Greg Kroah-Hartman
` (510 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit c6c0b3eba88c3b13ca11ea112404982e86d58f7a ]
io_flush_timeouts() copes with the wrap of the CQ sequence by looking at
the distance from ->cq_last_tm_flush. That relies on the target of each
pending timeout being at or ahead of the last flush.
io_timeout() breaks that. It sets ->cq_last_tm_flush to the current
sequence, on the assumption that nothing has been posted since the last
flush. That isn't true. A multishot request posts its CQEs right when it
is issued or retried, but they are committed, and the timeouts flushed,
at the end of the submission or task_work run:
X: IORING_OP_TIMEOUT, off == 1 target_seq == N + 1
io_submit_sqes()
multishot recv, posts two CQEs sequence == N + 2
Y: IORING_OP_TIMEOUT, off == 100 ->cq_last_tm_flush = N + 2
io_flush_timeouts()
X: events_needed = N + 1 - (N + 2) // 0xffffffff
events_got = 0 // not yet
X isn't completed although the completions it was waiting for have
happened, only its timer can end it now. And as the list is sorted and
the walk ends at the first timeout that isn't due, it gets in the way of
the ones behind it. The insertion sort has the same problem, it measures
the distance of the pending targets from the current sequence.
->cq_last_tm_flush only needs to be brought up to date if no timeout is
waiting for a sequence, as io_flush_timeouts() isn't called before the
first one is set up. Otherwise it is current enough. Timeouts with a
sequence come first in the list, so looking at the first entry will do.
Use the last flush as the base for the insertion sort as well.
Fixes: f010505b78a4 ("io_uring: flush timeouts that should already have expired")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-29-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index c4dd26cf342da..fbf0ba1ba7f9f 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -645,8 +645,9 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
struct io_timeout *timeout = io_kiocb_to_cmd(req, struct io_timeout);
struct io_ring_ctx *ctx = req->ctx;
struct io_timeout_data *data = req->async_data;
+ struct io_timeout *first;
struct list_head *entry;
- u32 tail, off = timeout->off;
+ u32 tail, base, off = timeout->off;
raw_spin_lock_irq(&ctx->timeout_lock);
@@ -663,11 +664,17 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
tail = data_race(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
timeout->target_seq = tail + off;
- /* Update the last seq here in case io_flush_timeouts() hasn't.
- * This is safe because ->completion_lock is held, and submissions
- * and completions are never mixed in the same ->completion_lock section.
+ /*
+ * Update the last seq here in case io_flush_timeouts() hasn't, it only
+ * gets called once sequences are in use. Leave it alone if there are
+ * timeouts waiting for one. CQEs may have been posted since the last
+ * flush, and a target that has been reached must not fall behind it.
*/
- ctx->cq_last_tm_flush = tail;
+ first = list_first_entry_or_null(&ctx->timeout_list, struct io_timeout,
+ list);
+ if (!first || io_is_timeout_noseq(cmd_to_io_kiocb(first)))
+ ctx->cq_last_tm_flush = tail;
+ base = ctx->cq_last_tm_flush;
/*
* Insertion sort, ensuring the first entry in the list is always
@@ -679,8 +686,8 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
if (io_is_timeout_noseq(nxt))
continue;
- /* nxt.seq is behind @tail, otherwise would've been completed */
- if (off >= nextt->target_seq - tail)
+ /* no target is behind the last flush, see io_flush_timeouts() */
+ if (timeout->target_seq - base >= nextt->target_seq - base)
break;
}
add:
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 046/547] io_uring/timeout: keep repeat count on multishot update
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 045/547] io_uring/timeout: dont skip over reached sequences Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 047/547] io_uring/timeout: use the right clock for ABS updates Greg Kroah-Hartman
` (509 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 3dc2a32cd356ee382aa4a8c7d844c53b2c0ad83b ]
IORING_TIMEOUT_UPDATE clears ->off of the timeout it updates, to turn a
timeout that waits for a number of completions into a pure one. For a
multishot timeout ->off isn't a sequence though, it tells whether the
number of repeats is limited: io_timeout_finish() only looks at
->repeats if ->off is set.
A multishot timeout that was set up to fire N times hence fires forever
once its interval has been updated. Leave ->off alone for those, they are
never treated as sequence timeouts anyway.
Fixes: ea97f6c8558e ("io_uring: add support for multishot timeouts")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-30-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index fbf0ba1ba7f9f..38ee4e966e8e7 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -475,8 +475,10 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data,
if (IS_ERR(req))
return PTR_ERR(req);
- timeout->off = 0; /* noseq */
data = req->async_data;
+ /* for a multishot request this isn't a sequence, keep the repeats */
+ if (!(data->flags & IORING_TIMEOUT_MULTISHOT))
+ timeout->off = 0; /* noseq */
data->time = time;
list_add_tail(&timeout->list, &ctx->timeout_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 047/547] io_uring/timeout: use the right clock for ABS updates
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 046/547] io_uring/timeout: keep repeat count on multishot update Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 048/547] io_uring/wait: no early -ETIME if min_wait finds work Greg Kroah-Hartman
` (508 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit dad82eb1805d76c555224e4030319e3844642b64 ]
io_parse_user_time() converts an absolute time from the time namespace of
the caller to the host's view, for the clock given by the flags. The
flags of IORING_TIMEOUT_UPDATE and IORING_LINK_TIMEOUT_UPDATE can't name
a clock, the updated timer keeps running on the clock the timeout was
set up with. So the time is always converted as if it was
CLOCK_MONOTONIC.
In a time namespace with a monotonic offset, that moves the new expiry of
a CLOCK_REALTIME timeout by that offset, although the clock isn't
affected by time namespaces at all, and the one of a CLOCK_BOOTTIME
timeout by the difference between the two offsets.
Do the conversion when the timeout has been looked up and its clock is
known. The update is run by the submitter, its SQPOLL thread or one of
its io-wq workers, all of which share the time namespace.
Fixes: 9cc6bac1bebf ("io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-31-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 38ee4e966e8e7..2385adae72e01 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -458,6 +458,8 @@ static int io_linked_timeout_update(struct io_ring_ctx *ctx, __u64 user_data,
io = req->async_data;
if (hrtimer_try_to_cancel(&io->timer) == -1)
return -EALREADY;
+ if (mode == HRTIMER_MODE_ABS)
+ ts = timens_ktime_to_host(io_timeout_get_clock(io), ts);
hrtimer_setup(&io->timer, io_link_timeout_fn, io_timeout_get_clock(io), mode);
hrtimer_start(&io->timer, ts, mode);
return 0;
@@ -479,6 +481,8 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data,
/* for a multishot request this isn't a sequence, keep the repeats */
if (!(data->flags & IORING_TIMEOUT_MULTISHOT))
timeout->off = 0; /* noseq */
+ if (mode == HRTIMER_MODE_ABS)
+ time = timens_ktime_to_host(io_timeout_get_clock(data), time);
data->time = time;
list_add_tail(&timeout->list, &ctx->timeout_list);
@@ -511,7 +515,12 @@ int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
IORING_TIMEOUT_ABS |
IORING_TIMEOUT_IMMEDIATE_ARG))
return -EINVAL;
- ret = io_parse_user_time(&tr->time, READ_ONCE(sqe->addr2), tr->flags);
+ /*
+ * The clock is that of the timeout to update, an absolute time
+ * is converted to the host's view once that has been found.
+ */
+ ret = io_parse_user_time(&tr->time, READ_ONCE(sqe->addr2),
+ tr->flags & ~IORING_TIMEOUT_ABS);
if (ret)
return ret;
} else if (tr->flags) {
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 048/547] io_uring/wait: no early -ETIME if min_wait finds work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 047/547] io_uring/timeout: use the right clock for ABS updates Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 049/547] io_uring/napi: make stale entries time out after 60s Greg Kroah-Hartman
` (507 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 83cce67298ab1f4d2e9205a49f56975475cdb154 ]
When the min wait time is over and there is work to run, which for
DEFER_TASKRUN includes task_work that was queued lazily and didn't wake
the waiter, io_cqring_min_timer_wakeup() ends the wait via
io_cqring_timer_wakeup(). That flags it as timed out. io_cqring_wait()
runs the work, leaves the loop, and returns 0 if the CQ ring holds
something.
Running task_work doesn't have to result in a CQE, though. A poll wake up
can turn out to be spurious, for instance if somebody else has read the
data by the time the request is retried. The application then gets -ETIME
once the min wait time has passed, no matter how far away the timeout it
asked for is.
Wake the task without declaring a timeout. From now on a single CQE
satisfies the wait, like in the case where the timer is switched over to
the normal timeout. If running the work doesn't post one, the loop in
io_cqring_wait() goes back to sleep with the normal timeout.
Fixes: 1100c4a2656d ("io_uring: add support for batch wait timeout")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-32-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/wait.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/io_uring/wait.c b/io_uring/wait.c
index 078fa8b076a99..fb1c082993a7e 100644
--- a/io_uring/wait.c
+++ b/io_uring/wait.c
@@ -78,9 +78,16 @@ static enum hrtimer_restart io_cqring_min_timer_wakeup(struct hrtimer *timer)
if (iowq->timeout == KTIME_MAX ||
ktime_compare(iowq->min_timeout, iowq->timeout) >= 0)
goto out_wake;
- /* work we may need to run, wake function will see if we need to wake */
- if (io_has_work(ctx))
- goto out_wake;
+ /*
+ * Work we need to run. It isn't known if that is going to post a CQE,
+ * so this isn't a timeout. Carry on with the normal one if it doesn't.
+ */
+ if (io_has_work(ctx)) {
+ iowq->min_timeout = 0;
+ iowq->cq_tail = iowq->cq_min_tail + 1;
+ wake_up_process(iowq->wq.private);
+ return HRTIMER_NORESTART;
+ }
/* got events since we started waiting, min timeout is done */
scoped_guard(rcu) {
struct io_rings *rings = io_get_rings(ctx);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 049/547] io_uring/napi: make stale entries time out after 60s
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 048/547] io_uring/wait: no early -ETIME if min_wait finds work Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 050/547] io_uring/napi: dont busy poll past an expired timeout Greg Kroah-Hartman
` (506 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 9c151648780d89e5446e5f89f3fa2e416c3bb911 ]
With dynamic tracking a NAPI id that hasn't been seen for a minute is
meant to be dropped from the list the ring busy polls. The timeout is
added to jiffies, but it is defined as 60 * SEC_CONVERSION, and
SEC_CONVERSION isn't the number of jiffies in a second. It is the
internal factor of __timespec64_to_jiffies(), HZ scaled up by
SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the
timeout at about eight years. On 32-bit the multiplication overflows.
So entries are never removed, and every id that a socket of the ring
ever had keeps being polled on each wait.
Fixes: 8d0c12a80cde ("io-uring: add napi busy poll support")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-33-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/napi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/napi.c b/io_uring/napi.c
index ca1c814fa73a2..53d7623e4d237 100644
--- a/io_uring/napi.c
+++ b/io_uring/napi.c
@@ -6,7 +6,7 @@
#ifdef CONFIG_NET_RX_BUSY_POLL
/* Timeout for cleanout of stale entries. */
-#define NAPI_TIMEOUT (60 * SEC_CONVERSION)
+#define NAPI_TIMEOUT (60 * HZ)
struct io_napi_entry {
unsigned int napi_id;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 050/547] io_uring/napi: dont busy poll past an expired timeout
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 049/547] io_uring/napi: make stale entries time out after 60s Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 051/547] io_uring/zcrx: fix buffer offsets in areas above 4GB Greg Kroah-Hartman
` (505 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 21ed976c12f6b77d7ea028a4fe9a08e69a56179f ]
__io_napi_busy_loop() caps the busy poll time to what is left until the
timeout of the wait. The difference is negative if the timeout has passed
already, which is what an application gets if it uses
IORING_ENTER_ABS_TIMER with a time that isn't in the future any more. The
min_t(u64, ...) turns that into a huge value, so the cap has no effect
and the wait, which should return right away, spins for the full busy
poll time first.
Fixes: d5cce407e4f5 ("io_uring/napi: postpone napi timeout adjustment")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-34-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/napi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/io_uring/napi.c b/io_uring/napi.c
index 53d7623e4d237..7e698720cd51a 100644
--- a/io_uring/napi.c
+++ b/io_uring/napi.c
@@ -378,6 +378,8 @@ void __io_napi_busy_loop(struct io_ring_ctx *ctx, struct io_wait_queue *iowq)
if (iowq->timeout != KTIME_MAX) {
ktime_t dt = ktime_sub(iowq->timeout, io_get_time(ctx));
+ /* an absolute timeout may have passed already */
+ dt = max_t(ktime_t, dt, 0);
iowq->napi_busy_poll_dt = min_t(u64, iowq->napi_busy_poll_dt, dt);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 051/547] io_uring/zcrx: fix buffer offsets in areas above 4GB
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 050/547] io_uring/napi: dont busy poll past an expired timeout Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 052/547] io_uring/kbuf: handle index wrap in last buffer check Greg Kroah-Hartman
` (504 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit ab4536bf2e5617b04f2d9396f06393c7bbfb071d ]
io_zcrx_queue_cqe() computes the offset of the buffer in its area from
net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits
and only the result is widened to the u64 that goes into the CQE. An area
can be up to 1TB in size. For every niov beyond the first 4GB the CQE
points the application at a buffer 4GB, or a multiple of that, below the
one which has the data. It reads the wrong data, and then returns a
buffer it doesn't own via the refill queue while the real one is never
given back.
Fixes: 11ed914bbf94 ("io_uring/zcrx: add io_recvzc request")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-35-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/zcrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index cc9df7e64a407..6d7abb1636e7f 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -1645,7 +1645,7 @@ static bool io_zcrx_queue_cqe(struct io_kiocb *req, struct net_iov *niov,
cqe->flags |= IORING_CQE_F_32;
area = io_zcrx_iov_to_area(niov);
- offset = off + (net_iov_idx(niov) << ifq->niov_shift);
+ offset = off + ((u64)net_iov_idx(niov) << ifq->niov_shift);
rcqe = (struct io_uring_zcrx_cqe *)(cqe + 1);
rcqe->off = offset + zcrx_area_id_to_token(area->area_id);
rcqe->__pad = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 052/547] io_uring/kbuf: handle index wrap in last buffer check
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 051/547] io_uring/zcrx: fix buffer offsets in areas above 4GB Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 053/547] io_uring/sqpoll: let the thread sleep on disabled rings Greg Kroah-Hartman
` (503 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 6e773b5161506a4d0e739eb3aa4667d28f20219c ]
io_ring_buffer_select() flags the request with REQ_F_BL_EMPTY if it takes
the last buffer of the ring. Head and tail are 16-bit counters, but
"head + 1" is computed as an int. If head is 65535 and tail has wrapped
to 0, that compares 65536 to 0 and the flag isn't set.
A bundle receive relies on the flag to tell that there is no point in
trying to get more data. Without it, it goes for another round, finds no
buffer, and the request, which has received data, is marked as failed on
account of the -ENOBUFS. That severs a link, and ends a multishot.
Fixes: c3f9109dbc9e ("io_uring/kbuf: flag request if buffer pool is empty after buffer pick")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-36-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/kbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 6e2facf34bfa6..c9641b6ccc8ff 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -204,7 +204,7 @@ static struct io_br_sel io_ring_buffer_select(struct io_kiocb *req, size_t *len,
if (unlikely(tail == head))
return sel;
- if (head + 1 == tail)
+ if ((__u16)(head + 1) == tail)
req->flags |= REQ_F_BL_EMPTY;
buf = io_ring_head_to_buf(br, head, bl->mask);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 053/547] io_uring/sqpoll: let the thread sleep on disabled rings
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 052/547] io_uring/kbuf: handle index wrap in last buffer check Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 054/547] io_uring/openclose: keep the lock in io_pipe_fixed() Greg Kroah-Hartman
` (502 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit d492dcbb3b81c1c2d0aabef41fa1307093f3a556 ]
__io_sq_thread() doesn't submit anything as long as the ring has
IORING_SETUP_R_DISABLED set. The check that keeps the SQPOLL thread from
going to sleep while the SQ ring holds entries doesn't know about that.
If an application fills in SQEs first and enables the ring later, the
thread finds that there is work each time it is about to sleep, goes
around, doesn't submit it, and so on. It uses up a CPU until the ring
gets enabled.
Entries in the SQ ring of a disabled ring are no reason to stay awake.
io_register_enable_rings() clears the flag and then wakes the thread, and
the flag is looked at after prepare_to_wait(), so the thread can't miss
that.
Fixes: 0298ef969a11 ("io_uring: clean R_DISABLED startup mess")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-37-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/sqpoll.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index ad42e8eb10029..ee97808a065a9 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -385,6 +385,13 @@ static int io_sq_thread(void *data)
*/
smp_mb__after_atomic();
+ /*
+ * Nothing gets submitted before the ring is
+ * enabled, which comes with a wake up.
+ */
+ if (READ_ONCE(ctx->flags) & IORING_SETUP_R_DISABLED)
+ continue;
+
if (io_sqring_entries(ctx)) {
needs_sched = false;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 054/547] io_uring/openclose: keep the lock in io_pipe_fixed()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 053/547] io_uring/sqpoll: let the thread sleep on disabled rings Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 055/547] io_uring: dont pass restart error codes to userspace Greg Kroah-Hartman
` (501 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit a3d7ee11289f657aa9af826d8f0844221292a27a ]
io_pipe_fixed() installs both ends of the pipe in the fixed file table,
drops ->uring_lock, and copies the slot numbers to the application. If
that faults, it takes the lock again and removes whatever is in these
slots.
If the request is run by io-wq the lock really is dropped in between, and
the slots are visible to everybody else. By the time the error path gets
to them, they may have been closed and reused, by IORING_OP_CLOSE and a
direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is
removed from the table that has nothing to do with the failed request.
Do the copy with the lock held. Faulting in user memory under
->uring_lock is fine, the registration paths do it all the time.
Fixes: 53db8a71ecb4 ("io_uring: add support for IORING_OP_PIPE")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-38-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/openclose.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/io_uring/openclose.c b/io_uring/openclose.c
index c71242915dade..24cf3ce2e2bc3 100644
--- a/io_uring/openclose.c
+++ b/io_uring/openclose.c
@@ -375,13 +375,16 @@ static int io_pipe_fixed(struct io_kiocb *req, struct file **files,
fds[1] = alloc_slot ? ret : slot - 1;
files[1] = NULL;
- io_ring_submit_unlock(ctx, issue_flags);
-
- if (!copy_to_user(p->fds, fds, sizeof(fds)))
+ /*
+ * Hang on to the lock. If this fails, the slots have to be cleared, and
+ * they must still hold what was put there.
+ */
+ if (!copy_to_user(p->fds, fds, sizeof(fds))) {
+ io_ring_submit_unlock(ctx, issue_flags);
return 0;
+ }
ret = -EFAULT;
- io_ring_submit_lock(ctx, issue_flags);
err:
if (fds[0] != -1)
io_fixed_fd_remove(ctx, fds[0]);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 055/547] io_uring: dont pass restart error codes to userspace
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 054/547] io_uring/openclose: keep the lock in io_pipe_fixed() Greg Kroah-Hartman
@ 2026-11-04 21:03 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 056/547] io_uring/net: dont retry recv on uncommitted buffers Greg Kroah-Hartman
` (500 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit e1a64bc64897f4c2fe460922c345f2ed8f889b5f ]
-ERESTARTSYS and friends are instructions for the system call exit code,
which either restarts the call or turns them into -EINTR. They are not
supposed to be seen by applications. A request isn't a system call,
nobody looks at what it returns before that is put into a CQE.
The read/write and the networking opcodes convert these codes to -EINTR
by hand. The others don't. An io-wq worker that is blocked in the open of
a FIFO, a tty or some other device, or in a splice from an empty pipe,
and that gets interrupted because the request is cancelled, completes it
with -512:
IORING_OP_OPENAT, IOSQE_ASYNC // FIFO without a writer
IORING_OP_ASYNC_CANCEL // -EALREADY, worker is signalled
CQE of the open: res == -512
There are more candidates, like whatever a file system or driver returns
from ->flush(), ->fsync(), ->fallocate() or ->uring_cmd(), or breaking a
lease or delegation.
Take care of it in io_issue_sqe(), which all of them go through. The
helper is moved from rw.c as is. The cost is a compare and a branch that
is not taken per request.
Fixes: 15b71abe7b52 ("io_uring: add support for IORING_OP_OPENAT")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-39-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.c | 5 +++++
io_uring/io_uring.h | 18 ++++++++++++++++++
io_uring/rw.c | 18 ------------------
3 files changed, 23 insertions(+), 18 deletions(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 9796283508b83..7cade81d332a8 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1454,6 +1454,9 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags)
ret = __io_issue_sqe(req, issue_flags, def);
if (ret == IOU_COMPLETE) {
+ /* not all handlers take care of the internal restart codes */
+ if (unlikely(req->cqe.res <= -ERESTARTSYS))
+ req->cqe.res = io_fixup_restart_res(req->cqe.res);
if (issue_flags & IO_URING_F_COMPLETE_DEFER)
io_req_complete_defer(req);
else
@@ -1468,6 +1471,8 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags)
if (req->flags & REQ_F_IOPOLL)
io_iopoll_req_issued(req, issue_flags);
}
+ if (unlikely(ret <= -ERESTARTSYS))
+ ret = io_fixup_restart_res(ret);
return ret;
}
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 659deb13c6680..22374bf536a04 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -350,6 +350,24 @@ static inline void io_req_set_res32(struct io_kiocb *req, s32 res, u32 cflags,
req->big_cqe.extra2 = extra2;
}
+static inline ssize_t io_fixup_restart_res(ssize_t ret)
+{
+ switch (ret) {
+ case -ERESTARTSYS:
+ case -ERESTARTNOINTR:
+ case -ERESTARTNOHAND:
+ case -ERESTART_RESTARTBLOCK:
+ /*
+ * We can't just restart the syscall, since previously
+ * submitted sqes may already be in progress. Just fail
+ * this IO with EINTR.
+ */
+ return -EINTR;
+ default:
+ return ret;
+ }
+}
+
static inline void *io_uring_alloc_async_data(struct io_alloc_cache *cache,
struct io_kiocb *req)
{
diff --git a/io_uring/rw.c b/io_uring/rw.c
index 432820f862514..b21daa3cfa5c2 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -610,24 +610,6 @@ static void io_complete_rw_iopoll(struct kiocb *kiocb, long res)
smp_store_release(&req->iopoll_completed, 1);
}
-static inline ssize_t io_fixup_restart_res(ssize_t ret)
-{
- switch (ret) {
- case -ERESTARTSYS:
- case -ERESTARTNOINTR:
- case -ERESTARTNOHAND:
- case -ERESTART_RESTARTBLOCK:
- /*
- * We can't just restart the syscall, since previously
- * submitted sqes may already be in progress. Just fail
- * this IO with EINTR.
- */
- return -EINTR;
- default:
- return ret;
- }
-}
-
static inline void io_rw_done(struct io_kiocb *req, ssize_t ret)
{
struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 056/547] io_uring/net: dont retry recv on uncommitted buffers
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-11-04 21:03 ` [PATCH 7.3 055/547] io_uring: dont pass restart error codes to userspace Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 057/547] io_uring/timeout: no ABS update of multishot timeouts Greg Kroah-Hartman
` (499 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 8444de681a179e41a4eb92d5bbe770a0677074a6 ]
Commit 41b70df5b38b ("io_uring/net: commit partial buffers on retry")
commits ring provided buffers when a receive is going to be retried after
a partial transfer, so that another request using the same buffer group
can't be handed the memory the first one keeps receiving into. It commits
the number of bytes received so far. That does the job for a single
buffer which is consumed as a whole, but the request hangs on to all it
has mapped:
- For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed.
The rest of the buffer stays at the head of the ring.
- For a bundle only the buffers which hold these bytes are consumed, the
others that were peeked stay in the ring.
In both cases the next receive with that buffer group gets memory that
the retried request is still going to write to, and whoever comes last
overwrites the data of the other. What the retry fills isn't committed at
all, as the buffer list isn't known any more at that point. So the kernel
hands it out again later on, while the CQE tells the application that it
was used, and for an incremental buffer that it is done with.
The remainder can't be committed in advance: if the request ends up
receiving less, there is no way to tell the application that more was
consumed than the CQE accounts for. Complete the request with what it has
got instead of retrying it. MSG_WAITALL is no longer honoured for
receives into incremental buffers or multi buffer bundles, they can
return a short count, with the request marked as failed like for other
short MSG_WAITALL transfers.
Fixes: 41b70df5b38b ("io_uring/net: commit partial buffers on retry")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-40-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/net.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/io_uring/net.c b/io_uring/net.c
index c82ea46cf53f8..eeab88e77fd81 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -480,6 +480,24 @@ static int io_bundle_nbufs(struct io_async_msghdr *kmsg, int ret)
return nbufs;
}
+/*
+ * A receive that is retried after a partial transfer keeps writing to what it
+ * has mapped. io_net_kbuf_recyle() only commits what was filled so far, which
+ * takes a buffer out of circulation if it's a single one that is consumed as a
+ * whole. The tail of an incrementally consumed buffer, or the yet unused
+ * buffers of a bundle, would be up for grabs. They can't be committed in
+ * advance either, the CQE has no way to tell if they end up not being used.
+ */
+static bool io_net_kbuf_can_retry(struct io_kiocb *req,
+ struct io_buffer_list *bl,
+ struct io_async_msghdr *kmsg)
+{
+ /* not ring provided, or committed at selection time */
+ if (!(req->flags & REQ_F_BUFFERS_COMMIT))
+ return true;
+ return !(bl->flags & IOBL_INC) && iter_is_ubuf(&kmsg->msg.msg_iter);
+}
+
static int io_net_kbuf_recyle(struct io_kiocb *req, struct io_buffer_list *bl,
struct io_async_msghdr *kmsg, int len)
{
@@ -1091,7 +1109,8 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags)
io_kbuf_recycle(req, sel.buf_list, issue_flags);
return IOU_RETRY;
}
- if (ret > 0 && io_net_retry(sock, flags)) {
+ if (ret > 0 && io_net_retry(sock, flags) &&
+ io_net_kbuf_can_retry(req, sel.buf_list, kmsg)) {
sr->done_io += ret;
return io_net_kbuf_recyle(req, sel.buf_list, kmsg, ret);
}
@@ -1254,7 +1273,8 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
io_kbuf_recycle(req, sel.buf_list, issue_flags);
return IOU_RETRY;
}
- if (ret > 0 && io_net_retry(sock, flags)) {
+ if (ret > 0 && io_net_retry(sock, flags) &&
+ io_net_kbuf_can_retry(req, sel.buf_list, kmsg)) {
sr->len -= ret;
sr->buf += ret;
sr->done_io += ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 057/547] io_uring/timeout: no ABS update of multishot timeouts
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 056/547] io_uring/net: dont retry recv on uncommitted buffers Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 058/547] io_uring/timeout: dont end a linked timeout with 1 Greg Kroah-Hartman
` (498 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit b088ae34d4da730dc647261b893a6eb622fe5e1f ]
IORING_TIMEOUT_MULTISHOT can't be combined with IORING_TIMEOUT_ABS, prep
rejects that, as the request is armed again with the same value each time
it fires. IORING_TIMEOUT_UPDATE doesn't check and takes an absolute time
for a multishot timeout. The first expiry is as asked for, but
io_timeout_complete() then arms the timer with ->mode of the original
request, i.e. it uses the absolute time as the interval. With
CLOCK_MONOTONIC the next expiry is an uptime away, with CLOCK_REALTIME
more than fifty years.
Fail such an update with -EINVAL, and do so before the timeout is
touched.
Fixes: ea97f6c8558e ("io_uring: add support for multishot timeouts")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-41-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 38 ++++++++++++++++++++++++++------------
1 file changed, 26 insertions(+), 12 deletions(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 2385adae72e01..75c5d22c1d7f1 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -321,22 +321,29 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer)
return HRTIMER_NORESTART;
}
-static struct io_kiocb *io_timeout_extract(struct io_ring_ctx *ctx,
- struct io_cancel_data *cd)
+static struct io_kiocb *io_timeout_find(struct io_ring_ctx *ctx,
+ struct io_cancel_data *cd)
__must_hold(&ctx->timeout_lock)
{
struct io_timeout *timeout;
- struct io_timeout_data *io;
- struct io_kiocb *req = NULL;
list_for_each_entry(timeout, &ctx->timeout_list, list) {
- struct io_kiocb *tmp = cmd_to_io_kiocb(timeout);
+ struct io_kiocb *req = cmd_to_io_kiocb(timeout);
- if (io_cancel_req_match(tmp, cd)) {
- req = tmp;
- break;
- }
+ if (io_cancel_req_match(req, cd))
+ return req;
}
+ return NULL;
+}
+
+static struct io_kiocb *io_timeout_extract(struct io_ring_ctx *ctx,
+ struct io_cancel_data *cd)
+ __must_hold(&ctx->timeout_lock)
+{
+ struct io_kiocb *req = io_timeout_find(ctx, cd);
+ struct io_timeout *timeout;
+ struct io_timeout_data *io;
+
if (!req)
return ERR_PTR(-ENOENT);
@@ -470,14 +477,21 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data,
__must_hold(&ctx->timeout_lock)
{
struct io_cancel_data cd = { .ctx = ctx, .data = user_data, };
- struct io_kiocb *req = io_timeout_extract(ctx, &cd);
+ struct io_kiocb *req = io_timeout_find(ctx, &cd);
struct io_timeout *timeout = io_kiocb_to_cmd(req, struct io_timeout);
struct io_timeout_data *data;
- if (IS_ERR(req))
- return PTR_ERR(req);
+ if (!req)
+ return -ENOENT;
data = req->async_data;
+ /* multishot requests only make sense with rel values */
+ if ((data->flags & IORING_TIMEOUT_MULTISHOT) && mode == HRTIMER_MODE_ABS)
+ return -EINVAL;
+
+ req = io_timeout_extract(ctx, &cd);
+ if (IS_ERR(req))
+ return PTR_ERR(req);
/* for a multishot request this isn't a sequence, keep the repeats */
if (!(data->flags & IORING_TIMEOUT_MULTISHOT))
timeout->off = 0; /* noseq */
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 058/547] io_uring/timeout: dont end a linked timeout with 1
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 057/547] io_uring/timeout: no ABS update of multishot timeouts Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 059/547] io_uring: look up the file before queueing to io-wq Greg Kroah-Hartman
` (497 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit c74193430febdd120e35936dda3e5aeec3a54405 ]
A linked timeout that fires cancels the request it is linked to, and
completes with -ETIME if that worked out:
ret = io_try_cancel(req->tctx, &cd, 0);
...
io_req_set_res(req, ret ?: -ETIME, 0);
io_try_cancel() returns 0 or an error, except for requests that are parked
on ->futex_list or ->waitid_list. io_futex_cancel() and io_waitid_cancel()
return the number of requests that they have cancelled, and
io_try_cancel() hands it on.
So the linked timeout of an IORING_OP_FUTEX_WAIT, IORING_OP_FUTEX_WAITV or
IORING_OP_WAITID that it has cancelled completes with 1, each time.
The waitid test of liburing checks for that 1, and has to be changed to
expect -ETIME, which is what the linked timeout of any other request
completes with.
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-42-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 75c5d22c1d7f1..43a40bda7735c 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -393,6 +393,9 @@ static void io_req_task_link_timeout(struct io_tw_req tw_req, io_tw_token_t tw)
};
ret = io_try_cancel(req->tctx, &cd, 0);
+ /* a number of requests for futex and waitid */
+ if (ret > 0)
+ ret = 0;
} else {
ret = -ECANCELED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 059/547] io_uring: look up the file before queueing to io-wq
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 058/547] io_uring/timeout: dont end a linked timeout with 1 Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 060/547] io_uring/timeout: dont put a sequence target behind the last flush Greg Kroah-Hartman
` (496 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 98bc044d5a5374f8d3605fe55a8e2df6d6fc3f82 ]
io_prep_async_work() decides by the file of a request what kind of work
it is for io-wq. I/O on regular files and block devices is bounded work,
limited to min(SQ entries, 4 * CPUs) workers, for anything else that may
block indefinitely the limit is RLIMIT_NPROC. Writes to a regular file
are hashed by the inode, so that they are run one after the other instead
of having a bunch of workers fight for the inode lock.
Since the file is only assigned when a request is issued, a request that
is queued without an attempt to issue it, REQ_F_FORCE_ASYNC, doesn't have
one at that point. io_prep_async_work() takes that for "not a regular
file or block device":
- Reads and writes end up as unbound work. 32 reads with IOSQE_ASYNC from
a slow block device on a ring with 4 SQ entries get 32 workers, not 4.
- Writes aren't hashed. Four buffered writes to one file get four
workers, three of which do nothing but wait for the lock.
The late assignment is for the benefit of links, where a request may use
a fixed file that one of its predecessors installs. By the time a request
gets to io_queue_iowq() these are done, it is as good as issued. Assign
the file there.
io_assign_file() moves up and is forced inline. With a third caller the
compiler may stop inlining it, and every request that is issued would
pay for a call.
IORING_OP_SPLICE is left as it is, unbound and not hashed. The file of
the request is where it writes to, which says nothing about how long it
takes: a splice from an empty pipe or a socket into a regular file waits
for its input. As bounded work, four of these on a ring with 4 SQ entries
keep all other bounded work of the task from running, and as hashed work
one of them blocks all writes to that file.
REQ_F_FORCE_ASYNC is not only set for IOSQE_ASYNC. What changes, and
brings back what was the case before the file assignment was deferred:
- Requests with IOSQE_ASYNC or IOSQE_IO_DRAIN, and all requests that are
submitted while a drain is active: reads and writes on regular files
and block devices count against the limit for bounded workers, including
the one set with IORING_REGISTER_IOWQ_MAX_WORKERS, so fewer of them run
at the same time.
- Of these, writes to one regular file are run one at a time, unless they
are O_DIRECT and the filesystem has FOP_DIO_PARALLEL_WRITE.
- IORING_OP_FALLOCATE and IORING_OP_FTRUNCATE, which always go to io-wq,
are run one at a time per file, and in turn with these writes.
- The descriptor or the fixed file slot is looked up when the request is
queued, not when a worker gets around to it, so closing or replacing it
in between no longer has an effect on the request.
Fixes: 6bf9c47a3989 ("io_uring: defer file assignment")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-43-c1556f5d7bf5@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.c | 43 +++++++++++++++++++++++++++++--------------
1 file changed, 29 insertions(+), 14 deletions(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 7cade81d332a8..3d715536df72e 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -407,17 +407,46 @@ static void io_prep_async_link(struct io_kiocb *req)
}
}
+/* Called for every request that is issued: keep it inline */
+static __always_inline bool io_assign_file(struct io_kiocb *req,
+ const struct io_issue_def *def,
+ unsigned int issue_flags)
+{
+ if (req->file || !def->needs_file)
+ return true;
+
+ if (req->flags & REQ_F_FIXED_FILE)
+ req->file = io_file_get_fixed(req, req->cqe.fd, issue_flags);
+ else
+ req->file = io_file_get_normal(req, req->cqe.fd);
+
+ return !!req->file;
+}
+
void io_queue_iowq(struct io_kiocb *req)
{
struct io_uring_task *tctx = req->tctx;
BUG_ON(!tctx);
+ lockdep_assert_held(&req->ctx->uring_lock);
if ((current->flags & PF_KTHREAD) || !tctx->io_wq) {
io_req_task_queue_fail(req, -ECANCELED);
return;
}
+ /*
+ * The file is looked up as late as possible, as it may be the result
+ * of an earlier request of the link. This one is up now, and what kind
+ * of work it is depends on the file. If that fails, leave the error
+ * handling to the worker.
+ *
+ * Not for a splice: whatever it writes to, it may wait for its input
+ * for ever. It has to remain unbound work that isn't hashed.
+ */
+ if (req->opcode != IORING_OP_SPLICE)
+ io_assign_file(req, &io_issue_defs[req->opcode], 0);
+
/* init ->work of the whole link before punting */
io_prep_async_link(req);
@@ -1394,20 +1423,6 @@ static __cold void io_drain_req(struct io_kiocb *req)
ctx->int_flags &= ~IO_RING_F_DRAIN_ACTIVE;
}
-static bool io_assign_file(struct io_kiocb *req, const struct io_issue_def *def,
- unsigned int issue_flags)
-{
- if (req->file || !def->needs_file)
- return true;
-
- if (req->flags & REQ_F_FIXED_FILE)
- req->file = io_file_get_fixed(req, req->cqe.fd, issue_flags);
- else
- req->file = io_file_get_normal(req, req->cqe.fd);
-
- return !!req->file;
-}
-
#define REQ_ISSUE_SLOW_FLAGS (REQ_F_CREDS | REQ_F_ARM_LTIMEOUT)
static inline int __io_issue_sqe(struct io_kiocb *req,
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 060/547] io_uring/timeout: dont put a sequence target behind the last flush
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 059/547] io_uring: look up the file before queueing to io-wq Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 061/547] io_uring/timeout: dont flush with the sequence " Greg Kroah-Hartman
` (495 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit fdfce905a58edea053ee7b68b5bd4348dd1b36e0 ]
io_timeout_fn() and io_kill_timeout() bump ->cq_timeouts when a timeout
fires, but its CQE is only posted later from task_work. Until then the
sequence io_timeout() computes is one below the last flush per fired
timeout. Now that ->cq_last_tm_flush is kept while sequence timeouts are
pending, a timeout armed in that window with a small offset gets a target
behind the base. Its distance from the base wraps, and it's never
completed by events, only by its timer. With DEFER_TASKRUN that window
is as wide as the application makes it, as submission runs before the
local task_work.
Nothing but those in flight CQEs separates the two, so use the last
flush as the base for the target when the sequence is behind it.
Fixes: c6c0b3eba88c ("io_uring/timeout: don't skip over reached sequences")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 43a40bda7735c..05e6c07c98b53 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -690,7 +690,6 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
}
tail = data_race(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
- timeout->target_seq = tail + off;
/*
* Update the last seq here in case io_flush_timeouts() hasn't, it only
@@ -704,6 +703,15 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
ctx->cq_last_tm_flush = tail;
base = ctx->cq_last_tm_flush;
+ /*
+ * A fired timeout bumps ->cq_timeouts before its CQE is posted, which
+ * leaves the sequence behind the last flush until it is. Nothing else
+ * separates the two then, so count from the flush.
+ */
+ if ((s32)(tail - base) < 0)
+ tail = base;
+ timeout->target_seq = tail + off;
+
/*
* Insertion sort, ensuring the first entry in the list is always
* the one we need first.
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 061/547] io_uring/timeout: dont flush with the sequence behind the last flush
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 060/547] io_uring/timeout: dont put a sequence target behind the last flush Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 062/547] io_uring/timeout: dont lose a cancel as io-wq arms a timeout Greg Kroah-Hartman
` (494 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit 85f85d573ffa7772e1ad4504d0cec5113a5c5cf1 ]
io_flush_timeouts() measures the events since the last flush as the
distance of the current sequence from ->cq_last_tm_flush. A fired
timeout bumps ->cq_timeouts before its CQE is posted, so until it is
the sequence can be behind the last flush, and the distance wraps:
last flush: seq 100, cq_last_tm_flush = 100
Y: IORING_OP_TIMEOUT, off 50, target_seq 150
pure timeout A fires, cq_timeouts = 1
task_work posts A's CQE, cached_cq_tail = 101
pure timeout B fires before the flush, cq_timeouts = 2
io_flush_timeouts(): seq = 99, events_got = 0xffffffff
Y, and every sequence timeout behind it, is ended with -ETIME although
no event happened. Two timeouts expiring close together is all it takes,
a completion with IOSQE_CQE_SKIP_SUCCESS after a single one does it too.
Nothing but those in flight CQEs separates the two, so count from the
last flush when the sequence is behind it, as io_timeout() does.
Fixes: f010505b78a4 ("io_uring: flush timeouts that should already have expired")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 05e6c07c98b53..0eb0e64e3081b 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -171,6 +171,14 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx)
raw_spin_lock_irq(&ctx->timeout_lock);
seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
+ /*
+ * A fired timeout bumps ->cq_timeouts before its CQE is posted, which
+ * leaves the sequence behind the last flush until it is. No event has
+ * happened then, see io_timeout().
+ */
+ if ((s32)(seq - ctx->cq_last_tm_flush) < 0)
+ seq = ctx->cq_last_tm_flush;
+
list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) {
struct io_kiocb *req = cmd_to_io_kiocb(timeout);
u32 events_needed, events_got;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 062/547] io_uring/timeout: dont lose a cancel as io-wq arms a timeout
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 061/547] io_uring/timeout: dont flush with the sequence " Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 063/547] exec: cancel io_uring requests before de_thread() Greg Kroah-Hartman
` (493 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit 89f193dc3ef462059387e9691bf6af4b1808379a ]
An IORING_OP_TIMEOUT run by io-wq, because of IOSQE_ASYNC, has the same
problem as poll, futex and waitid. io_wq_submit_work() looks at
IO_WQ_WORK_CANCEL once, before it issues the request. A cancel in between
flags the work, gets -EALREADY, and searches ->timeout_list in vain,
while the worker then adds the request and starts the timer:
io-wq worker io_try_cancel()
io_wq_submit_work()
IO_WQ_WORK_CANCEL isn't set
io_async_cancel_one()
sets IO_WQ_WORK_CANCEL
= -EALREADY
io_timeout_cancel() = -ENOENT
io_timeout()
adds the request to ->timeout_list
hrtimer_start()
= IOU_ISSUE_SKIP_COMPLETE
Nobody looks at the flag again, and the timeout runs its course. At ring
exit, io_uring_try_cancel_requests() cancels io-wq work and then kills
the timeouts the same way, so an exiting task can get stuck for the full
duration of such a timeout.
Look at the flag under ->timeout_lock, which the search takes as well,
and fail the request if it is set. If the search came first, the flag is
visible. If it comes later, it finds the request on the list.
Fixes: ce35a47a3a02 ("io_uring: add IOSQE_ASYNC")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.h | 14 ++++++++++----
io_uring/timeout.c | 7 +++++++
2 files changed, 17 insertions(+), 4 deletions(-)
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 22374bf536a04..2d6b2158605ad 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -435,16 +435,22 @@ static inline void io_ring_submit_lock(struct io_ring_ctx *ctx,
* cancellations find it, rather than completing it. Whoever tried to cancel
* the request before that found it running. It has flagged the work item,
* has searched the list in vain, and won't come back. To be called with
- * ->uring_lock held, which the search needs as well, once the request is on
- * the list: if the search came first, the flag is visible.
+ * the lock the search takes held: if the search came first, the flag is
+ * visible. For most lists that is ->uring_lock, timeouts use ->timeout_lock.
*/
+static inline bool __io_wq_cancel_seen(struct io_kiocb *req,
+ unsigned int issue_flags)
+{
+ return (issue_flags & IO_URING_F_IOWQ) &&
+ (atomic_read(&req->work.flags) & IO_WQ_WORK_CANCEL);
+}
+
static inline bool io_wq_cancel_seen(struct io_kiocb *req,
unsigned int issue_flags)
{
lockdep_assert_held(&req->ctx->uring_lock);
- return (issue_flags & IO_URING_F_IOWQ) &&
- (atomic_read(&req->work.flags) & IO_WQ_WORK_CANCEL);
+ return __io_wq_cancel_seen(req, issue_flags);
}
static inline void io_commit_cqring(struct io_ring_ctx *ctx)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 0eb0e64e3081b..ca03cb95ad8dd 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -687,6 +687,13 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
raw_spin_lock_irq(&ctx->timeout_lock);
+ /* the list is searched under ->timeout_lock, see io_wq_cancel_seen() */
+ if (__io_wq_cancel_seen(req, issue_flags)) {
+ raw_spin_unlock_irq(&ctx->timeout_lock);
+ io_req_task_queue_fail(req, -ECANCELED);
+ return IOU_ISSUE_SKIP_COMPLETE;
+ }
+
/*
* sqe->off holds how many events that need to occur for this
* timeout event to be satisfied. If it isn't set, then this is
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 063/547] exec: cancel io_uring requests before de_thread()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 062/547] io_uring/timeout: dont lose a cancel as io-wq arms a timeout Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 064/547] fork: move the coredump and exec checks into create_io_thread() Greg Kroah-Hartman
` (492 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleg Nesterov, Jens Axboe,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit b42c85c20d84ff3e4f0f027d6596c3b3b4a20657 ]
begin_new_exec() cancels the exec'ing thread's io_uring requests after
de_thread() made it the only thread in the thread-group. Now
io_uring_task_cancel() runs task work after. If it runs a
create_worker_cb() item then a io-wq queued on the thread before the
exec creates a new io-wq worker thread.
Said thread joins the thread-group which de_thread() just took down. The
io-iwq sticks around until it notices that its workqueue is dying. But
code after de_thread() relies on being single-threaded.
Move io_uring_task_cancel() before de_thread() but behind the point of
no return. Any worker created during task work run from
io_uring_task_cancel() is just a sibling thread that de_thread() will
take down and reap.
Once io_uring_task_cancel() returned the thread has neither a task
context nor a workqueue left so nothing can add a thread behind
de_thread()'s back anymore.
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/aq0_lvHDViIpX_Mu@redhat.com
Fixes: 3bfe6106693b ("io-wq: fork worker threads from original task")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-12-8e4adb1619e6@kernel.org
Acked-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exec.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1160,6 +1160,13 @@ int begin_new_exec(struct linux_binprm *
*/
bprm->point_of_no_return = true;
+ /*
+ * Cancel any io_uring activity across execve. This runs task work
+ * that may still create an io-wq worker, so do it while de_thread()
+ * can still zap it.
+ */
+ io_uring_task_cancel();
+
/* Make this the only thread in the thread group */
retval = de_thread(me);
if (retval)
@@ -1176,10 +1183,6 @@ int begin_new_exec(struct linux_binprm *
/* see the comment in check_unsafe_exec() */
current->fs->in_exec = 0;
- /*
- * Cancel any io_uring activity across execve
- */
- io_uring_task_cancel();
/* Ensure the files table is not shared. */
retval = unshare_files();
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 064/547] fork: move the coredump and exec checks into create_io_thread()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 063/547] exec: cancel io_uring requests before de_thread() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 065/547] fork: dont create io threads once PF_POSTCOREDUMP is set Greg Kroah-Hartman
` (491 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleg Nesterov,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit e760200370e4de054b6b5f568a7faa911e2956bb ]
Only a PF_USER_WORKER thread returns from get_signal() after a fatal
signal and can go on to create a thread. get_signal() sets PF_SIGNALED
before it dumps core and before it lets a PF_USER_WORKER thread return.
That flags sticks.
The exec'ing thread itself is never signaled. But it doesn't need the check
anyway as we moved cancellation of io_uring requests before de_thread().
create_io_thread() is the only way a signaled thread creates another
one. vhost_task_create() is reached from ioctls alone.
io_should_retry_thread() doesn't retry -EINTR, so io-wq callers give up
the same way they did when copy_process() refused.
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/aq0VLTyxNatFmLOK@redhat.com
Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-13-8e4adb1619e6@kernel.org
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Stable-dep-of: 1f978881ce6c ("fork: don't create io threads once PF_POSTCOREDUMP is set")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/fork.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2718,6 +2718,10 @@ struct task_struct *create_io_thread(int
.user_worker = 1,
};
+ /* A creator past its fatal signal gets no thread. */
+ if (current->flags & PF_SIGNALED)
+ return ERR_PTR(-EINTR);
+
return copy_process(NULL, 0, node, &args);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 065/547] fork: dont create io threads once PF_POSTCOREDUMP is set
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 064/547] fork: move the coredump and exec checks into create_io_thread() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 066/547] clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks Greg Kroah-Hartman
` (490 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleg Nesterov,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 1f978881ce6c9ac4f4d4a7b6a6e52339eadcd350 ]
zap_process() skips every thread that already has PF_POSTCOREDUMP set.
Such a thread is past synchronize_group_exit(), so a coredump can't
catch it anymore. It isn't counted in core_state->threads_remaining and
it isn't sent SIGKILL.
do_exit() sets PF_POSTCOREDUMP in synchronize_group_exit() and calls
io_uring_files_cancel() right after that. The cancellation runs task
work and a create_worker_cb() that io-wq queued before the exit creates
a new io-wq worker from there. If another thread started a coredump in
the meantime that worker joins a thread-group which is already being
dumped. zap_process() never saw it so it was never counted. But when it
exits it sees signal->core_state in synchronize_group_exit() and
decrements threads_remaining like any other thread.
So the count reaches zero one thread early and the dumper leaves
coredump_wait_inactive() while a thread it counted is still running.
The task has no fatal signal pending because zap_process() deliberately
didn't send it one, and it never went through get_signal() so it doesn't
have PF_SIGNALED either.
Refuse to create an io thread when the creator has PF_POSTCOREDUMP.
That costs nothing. io_uring_files_cancel() raises IO_WQ_BIT_EXIT
before it runs any task work, so a worker created from there only ever
gets to exit again, and io_should_retry_thread() doesn't retry -EINTR.
Clearing PF_POSTCOREDUMP for the new thread in copy_process() was the
other option. It makes the worker a thread like any other, but it only
helps while the dump hasn't started. A worker born after zap_process()
has run is invisible to it whatever its flags say and still decrements
threads_remaining on the way out. Refusing to create it covers both, and
then no task is ever born with the flag, so there is nothing to clear.
Moving io_uring_files_cancel() ahead of synchronize_group_exit() closes
the same window. It runs the cancellation, and whatever that can block
on, before the thread announces itself to the dumper. A thread that
blocks there never reaches coredump_task_exit() at all, so the dumper
ends up waiting for a thread that never parks. Refusing the creation
leaves the cancellation where it is. But it's very ugly to run io_uring
work even before we did all the generic exit work.
Fixes: 92307383082d ("coredump: Don't perform any cleanups before dumping core")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-14-8e4adb1619e6@kernel.org
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/fork.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2718,8 +2718,8 @@ struct task_struct *create_io_thread(int
.user_worker = 1,
};
- /* A creator past its fatal signal gets no thread. */
- if (current->flags & PF_SIGNALED)
+ /* A creator past its fatal signal or its coredump point gets no thread. */
+ if (current->flags & (PF_SIGNALED | PF_POSTCOREDUMP))
return ERR_PTR(-EINTR);
return copy_process(NULL, 0, node, &args);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 066/547] clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 065/547] fork: dont create io threads once PF_POSTCOREDUMP is set Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 067/547] ALSA: line6: Clear prev_fbuf on capture buffer release Greg Kroah-Hartman
` (489 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biju Das, Geert Uytterhoeven
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
commit e018c27e6052ec58de3c1e7b340521ef162a8b81 upstream.
Add CLK_SET_RATE_PARENT flag to the sel_eth0_tx and sel_eth1_tx mux
clocks so that rate-setting requests on these clocks propagate up to
their parent clocks. Without this flag, a clk_set_rate() call on the
downstream GBETH clocks has no effect on the actual PLL/divider chain
feeding the TX clock, leaving the requested rate unapplied.
Fixes: d55a0dfec40b ("clk: renesas: r9a08g046: Add GBETH clocks and resets")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260914165026.184612-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/renesas/r9a08g046-cpg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/clk/renesas/r9a08g046-cpg.c
+++ b/drivers/clk/renesas/r9a08g046-cpg.c
@@ -277,10 +277,12 @@ static const struct cpg_core_clk r9a08g0
DEF_MUX(".sel_rspi0", CLK_SEL_RSPI0, G3L_SEL_RSPI0, sel_rsci_rspi),
DEF_MUX(".sel_rspi1", CLK_SEL_RSPI1, G3L_SEL_RSPI1, sel_rsci_rspi),
DEF_MUX(".sel_rspi2", CLK_SEL_RSPI2, G3L_SEL_RSPI2, sel_rsci_rspi),
- DEF_MUX(".sel_eth0_tx", CLK_SEL_ETH0_TX, G3L_SEL_ETH0_TX, sel_eth0_tx),
+ DEF_MUX_FLAGS(".sel_eth0_tx", CLK_SEL_ETH0_TX, G3L_SEL_ETH0_TX, sel_eth0_tx,
+ CLK_SET_RATE_PARENT),
DEF_MUX(".sel_eth0_rx", CLK_SEL_ETH0_RX, G3L_SEL_ETH0_RX, sel_eth0_rx),
DEF_MUX(".sel_eth0_rm", CLK_SEL_ETH0_RM, G3L_SEL_ETH0_RM, sel_eth0_rm),
- DEF_MUX(".sel_eth1_tx", CLK_SEL_ETH1_TX, G3L_SEL_ETH1_TX, sel_eth1_tx),
+ DEF_MUX_FLAGS(".sel_eth1_tx", CLK_SEL_ETH1_TX, G3L_SEL_ETH1_TX, sel_eth1_tx,
+ CLK_SET_RATE_PARENT),
DEF_MUX(".sel_eth1_rx", CLK_SEL_ETH1_RX, G3L_SEL_ETH1_RX, sel_eth1_rx),
DEF_MUX(".sel_eth1_rm", CLK_SEL_ETH1_RM, G3L_SEL_ETH1_RM, sel_eth1_rm),
DEF_DIV(".div_eth0_tr", CLK_ETH0_TR, CLK_PLL6, G3L_SDIV_ETH_A, dtable_4_200),
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 067/547] ALSA: line6: Clear prev_fbuf on capture buffer release
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 066/547] clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 068/547] Bluetooth: forget a peers RPA once it advertises its identity address Greg Kroah-Hartman
` (488 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bin Yu, Cheng Wen, YuanZhe Liu,
Takashi Iwai
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
commit aa118c8f61d59387961d58ffae831c5259a9f222 upstream.
A KASAN slab-use-after-free read was reported in submit_audio_out_urb()
when generating an impulse test signal:
BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]
BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249
Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785
Allocated by task 11:
kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144
line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158
line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329
line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728
Freed by task 7785:
kfree+0xf8/0x390 mm/slub.c:6566
line6_buffer_release sound/usb/line6/pcm.c:176 [inline]
line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170
__line6_pcm_release sound/usb/line6/pcm.c:305 [inline]
line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313
snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183
line6pcm->prev_fbuf points into the capture PCM stream buffer
(line6pcm->in.buffer), which is updated during audio_in_callback() to
feed rate synchronization, software monitoring, and impulse test signal
generation on playback side.
When all capture streams are closed, line6_buffer_release() frees
pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf.
If playback is subsequently started (e.g. via impulse test signal
volume control snd_line6_impulse_volume_put()), submit_audio_out_urb()
dereferences the stale pointer line6pcm->prev_fbuf under in.lock,
resulting in a slab-use-after-free read.
Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing
the capture stream buffer under in.lock, ensuring that no stale buffer
pointer can be accessed by submit_audio_out_urb().
Fixes: 63e20df1e5b2 ("ALSA: line6: Reorganize PCM stream handling")
Cc: stable@vger.kernel.org
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
Link: https://patch.msgid.link/20261013063554.571-1-25031212351@stu.xidian.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/line6/pcm.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -173,6 +173,14 @@ static void line6_buffer_release(struct
clear_bit(type, &pstr->opened);
if (!pstr->opened) {
line6_wait_clear_audio_urbs(line6pcm, pstr);
+ if (pstr == &line6pcm->in) {
+ /* prev_fbuf points into the capture buffer we are about
+ * to free; drop it while no capture URB is in flight.
+ */
+ guard(spinlock_irqsave)(&line6pcm->in.lock);
+ line6pcm->prev_fbuf = NULL;
+ line6pcm->prev_fsize = 0;
+ }
kfree(pstr->buffer);
pstr->buffer = NULL;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 068/547] Bluetooth: forget a peers RPA once it advertises its identity address
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 067/547] ALSA: line6: Clear prev_fbuf on capture buffer release Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 069/547] wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask Greg Kroah-Hartman
` (487 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Radek Podgorny,
Luiz Augusto von Dentz
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radek Podgorny <radek@podgorny.cz>
commit 3889a5fcd091d2154861c19e9c581f9f04aabd0e upstream.
hci_connect_le() dials the RPA cached in the peer's IRK whenever one is
set, on the assumption that a peer holding an IRK is on air with a
resolvable private address. A peer that stops using privacy breaks that
assumption: it advertises its identity address, the cached RPA keeps the
value it had before the change, and the host aims at an address the peer
has abandoned.
Nothing clears the cache. hci_find_irk_by_rpa() refreshes irk->rpa each
time an advertisement resolves, so it tracks rotation, but a peer that
stops sending RPAs stops producing the reports that would update it, and
the stale address then survives until the adapter is powered off.
On the path that creates the connection object this is currently masked:
__hci_conn_add() resolves the cached RPA back to the identity address, so
that is what goes on air. It is not masked on the reuse branch, which
copies the swapped address straight into an existing conn->dst, and the
next patch removes the conversion for the case where the controller
cannot translate an identity address, so the stale RPA would be dialled
there too.
Clear the cached RPA when the peer is seen on its identity address.
hci_find_irk_by_addr() only matches public and static random addresses,
so an unresolved RPA belonging to some other device cannot reach this
path.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Radek Podgorny <radek@podgorny.cz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6311,6 +6311,15 @@ static void process_adv_report(struct hc
if (irk) {
bdaddr = &irk->bdaddr;
bdaddr_type = irk->addr_type;
+ } else {
+ /* The peer is on air with its identity address, so whatever
+ * RPA is cached for it has been abandoned. Drop it, or
+ * hci_connect_le() would swap it back in and dial an address
+ * the peer no longer answers.
+ */
+ irk = hci_find_irk_by_addr(hdev, bdaddr, bdaddr_type);
+ if (irk)
+ bacpy(&irk->rpa, BDADDR_ANY);
}
bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 069/547] wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 068/547] Bluetooth: forget a peers RPA once it advertises its identity address Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 070/547] ARM: 9524/1: mm: align hugetlb mappings to the huge page size Greg Kroah-Hartman
` (486 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ck.chang, Felix Fietkau,
Chris Marshall
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: ck.chang <ck.chang@mediatek.com>
commit c182bfe944eb275f7526cc326f81229b0e974a0c upstream.
mt7925_irq_map sets wm2_complete_mask, but mt7925_dma_layout has no
tx done ring, so the MT_RXQ_MCU_WA queue and its NAPI are never set up.
On a chip reset, mt7925e_mac_reset() calls napi_disable() on that NAPI
and crashes:
BUG: kernel NULL pointer dereference, address: 0000000000000a40
Workqueue: mt76 mt7925_mac_reset_work [mt7925_common]
RIP: 0010:mutex_lock+0x1c/0x50
Call Trace:
napi_disable+0x1d/0x50
mt7925e_mac_reset+0x327/0x420 [mt7925e]
mt7925_mac_reset_work+0x9a/0x1a0 [mt7925_common]
Remove the WM2 mask from mt7925_irq_map and from
MT7925_INT_RX_DONE_ALL.
Fixes: c4edf9e3e0e5 ("wifi: mt76: mt7925: replace shared rx irq masks with per-chip definitions")
Signed-off-by: ck.chang <ck.chang@mediatek.com>
Link: https://patch.msgid.link/20260805092409.1489401-1-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Cc: Chris Marshall <deepspace69@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 1 -
drivers/net/wireless/mediatek/mt76/mt7925/regs.h | 3 +--
2 files changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -493,7 +493,6 @@ static const struct mt792x_irq_map mt792
.all_complete_mask = MT7925_INT_RX_DONE_ALL,
.data_complete_mask = MT7925_INT_RX_DONE_DATA,
.wm_complete_mask = MT7925_INT_RX_DONE_WM,
- .wm2_complete_mask = MT_INT_RX_DONE_WM2,
},
};
--- a/drivers/net/wireless/mediatek/mt76/mt7925/regs.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/regs.h
@@ -48,8 +48,7 @@
#define MT7925_INT_RX_DONE_DATA HOST_RX_DONE_INT_ENA2
#define MT7925_INT_RX_DONE_WM HOST_RX_DONE_INT_ENA0
#define MT7925_INT_RX_DONE_ALL (MT7925_INT_RX_DONE_DATA | \
- MT7925_INT_RX_DONE_WM | \
- MT_INT_RX_DONE_WM2)
+ MT7925_INT_RX_DONE_WM)
#define MT7927_INT_RX_DONE_DATA MT7927_RX_DONE_INT_ENA4
#define MT7927_INT_RX_DONE_WM MT7927_RX_DONE_INT_ENA6
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 070/547] ARM: 9524/1: mm: align hugetlb mappings to the huge page size
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 069/547] wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 071/547] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key() Greg Kroah-Hartman
` (485 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song, Karl Mehltretter,
Russell King
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit 1eb87d8f77379d4e4b279487b8c859fb64bd1afb upstream.
mmap(MAP_HUGETLB) on 32-bit Arm can return an address which is not
aligned to the huge page size. In a QEMU virt guest, unmapping the VMA
then hits the alignment check in __unmap_hugepage_range():
kernel BUG at mm/hugetlb.c:5213!
Internal error: Oops - BUG: 0 [#1] SMP ARM
PC is at __unmap_hugepage_range+0x540/0x584
LR is at __zap_vma_range+0x13a0/0x1410
Commit 7bd3f1e1a9ae ("mm: make hugetlb mappings go through
mm_get_unmapped_area_vmflags") made hugetlb mappings use the
architecture's arch_get_unmapped_area(). The generic implementations
handle hugetlb alignment, but the Arm implementations only account for
the optional SHMLBA cache-colouring constraint. A 4 KiB-page kernel can
therefore align the mapping to 4 KiB or 16 KiB instead of the required
2 MiB.
Set the alignment mask from the file's hstate for hugetlb mappings in
both Arm implementations. Huge-page alignment also satisfies the
SHMLBA constraint.
Assisted-by: LLM
Fixes: 7bd3f1e1a9ae ("mm: make hugetlb mappings go through mm_get_unmapped_area_vmflags")
Cc: stable@vger.kernel.org
Acked-by: Muchun Song <muchun.song@linux.dev>
Link: https://lore.kernel.org/r/20260901085740.66283-1-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/mmap.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -11,6 +11,7 @@
#include <linux/io.h>
#include <linux/personality.h>
#include <linux/random.h>
+#include <linux/hugetlb.h>
#include <asm/cachetype.h>
#define COLOUR_ALIGN(addr,pgoff) \
@@ -72,7 +73,10 @@ arch_get_unmapped_area(struct file *filp
info.length = len;
info.low_limit = mm->mmap_base;
info.high_limit = TASK_SIZE;
- info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
+ if (filp && is_file_hugepages(filp))
+ info.align_mask = huge_page_mask_align(filp);
+ else
+ info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
info.align_offset = pgoff << PAGE_SHIFT;
return vm_unmapped_area(&info);
}
@@ -123,7 +127,10 @@ arch_get_unmapped_area_topdown(struct fi
info.length = len;
info.low_limit = FIRST_USER_ADDRESS;
info.high_limit = mm->mmap_base;
- info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
+ if (filp && is_file_hugepages(filp))
+ info.align_mask = huge_page_mask_align(filp);
+ else
+ info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
info.align_offset = pgoff << PAGE_SHIFT;
addr = vm_unmapped_area(&info);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 071/547] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 070/547] ARM: 9524/1: mm: align hugetlb mappings to the huge page size Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 072/547] ceph: fail readdir when the MDS reply carries no dirfrag Greg Kroah-Hartman
` (484 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Eric Biggers, Baokun Li,
Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun@linux.alibaba.com>
commit c8c53d669d4e45b3a804013251a34387d7e11bfb upstream.
Sashiko reported a possible NULL pointer dereference, triggered by the
following flow:
dm-inlinecrypt ctor # first use of the fallback
├─ blk_crypto_init_key() # succeeds, ctx->key.size != 0
├─ blk_crypto_start_using_key()
│ ├─ hw-wrapped key: -EOPNOTSUPP
│ │ # profile never allocated (NULL)
│ └─ raw key: fallback_start_using_mode()
│ └─ blk_crypto_fallback_init() fails
│ └─ kfree(profile) # not NULLed
├─ goto bad
└─ inlinecrypt_dtr() # evicts whenever key.size is set
└─ blk_crypto_evict_key()
└─ blk_crypto_config_supported_natively() = false
└─ blk_crypto_fallback_evict_key()
└─ __blk_crypto_evict_key(blk_crypto_fallback_profile)
└─ profile->num_slots # BOOM!!!
This issue can be reproduced using the following commands:
dd if=/dev/zero of=/tmp/backing bs=1M count=64
LOOP=$(losetup -f --show /tmp/backing)
SZ=$(blockdev --getsz $LOOP)
KEY=$(head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n')
dmsetup create ic --table "0 $SZ inlinecrypt aes-xts-plain64 \
$KEY 0 $LOOP 0 1 keytype:hw-wrapped"
And the following oops is triggered:
==================================================================
blk-crypto: loop0: no support for wrapped keys
Oops: general protection fault, probably for non-canonical address
0xdffffc000000000b: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 5 UID: 0 PID: 901 Comm: dmsetup 7.3.0-rc3 #1 PREEMPT(lazy)
RIP: 0010:__blk_crypto_evict_key+0x2e/0x3b0
Call Trace:
blk_crypto_evict_key+0x24c/0x320
inlinecrypt_dtr+0xf6/0x160
inlinecrypt_ctr+0x2d3/0xbd0
dm_table_add_target+0x661/0xf40
table_load+0x1c4/0x490
ctl_ioctl+0x32f/0x5f0
dm_ctl_ioctl+0xe/0x20
==================================================================
dm-inlinecrypt is the only caller that can evict a key that was never
started, as fscrypt frees such a key without evicting it.
Fix this by returning early from blk_crypto_fallback_evict_key() when
tfms_inited[] is not set for the key's mode. tfms_inited[] is only set
after blk_crypto_fallback_init() has successfully initialized the
profile, so the crash above is no longer reachable.
The bug has been latent since commit c984ff1423ae ("blk-crypto:
dynamically allocate fallback profile") was merged in v6.5, and only
became actually triggerable when commit e7f57d2c47e2 ("dm-inlinecrypt:
add target for inline block device encryption") was merged in v7.2.
Fixes: c984ff1423ae ("blk-crypto: dynamically allocate fallback profile")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://patch.msgid.link/sashiko-outbox-167341@kernel.org
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20261014155131.GB322435@quark
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20261023081908.3505413-1-libaokun@linux.alibaba.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-crypto-fallback.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/block/blk-crypto-fallback.c
+++ b/block/blk-crypto-fallback.c
@@ -524,6 +524,12 @@ bool blk_crypto_fallback_bio_prep(struct
int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key)
{
+ /*
+ * Pairs with smp_store_release() in
+ * blk_crypto_fallback_start_using_mode()
+ */
+ if (!smp_load_acquire(&tfms_inited[key->crypto_cfg.crypto_mode]))
+ return 0;
return __blk_crypto_evict_key(blk_crypto_fallback_profile, key);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 072/547] ceph: fail readdir when the MDS reply carries no dirfrag
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 071/547] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 073/547] fuse: dont BUG when the copy buffer is exhausted Greg Kroah-Hartman
` (483 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuanfu Xie, Alex Markuze,
Ilya Dryomov
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
commit 728c856d7da04fb79f7aa00e974ffb6f55e55995 upstream.
A ceph mount oopses in ceph_readdir() when the MDS answers a READDIR
request with a reply whose extra blob is empty. parse_reply_info()
skips reply blobs whose length is zero, so parse_reply_info_readdir()
never runs, r_reply_info.dir_dir stays NULL, and the reply still
parses as successful. ceph_mdsc_do_request() returns 0 and
ceph_readdir() then reads rinfo->dir_dir->frag with no NULL check:
/* extra */
ceph_decode_32_safe(&p, end, len, bad);
if (len > 0) {
...
err = parse_reply_info_extra(&p, p + len, req, features, s);
...
}
The oops on v7.3.0-rc4-00537-ga3ff15db6820, one getdents64(2) on the
mount root after an ms_mode=legacy mount, trimmed:
BUG: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 266 Comm: ls Tainted: G N 7.3.0-rc4-00537-ga3ff15db6820 #1 PREEMPT(lazy)
RIP: 0010:ceph_readdir+0xbff/0x3ea0
Call Trace:
<TASK>
? __pfx_ceph_readdir+0x10/0x10
wrap_directory_iterator+0xa2/0xe0
iterate_dir+0x1da/0x5d0
__x64_sys_getdents64+0x13b/0x2a0
do_syscall_64+0xdd/0x4a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
The unconditional frag read came in with 81c6aea5275ea ("ceph: handle
frag mismatch between readdir request and reply"), so the bug is old.
Treat a reply with no dirfrag as a protocol violation: warn once,
drop the request and return -EIO, the same way ceph_readdir() already
handles the two malformed-reply cases later in the function.
Tested on v7.3.0-rc4-00537-ga3ff15db6820 (KASAN). Unpatched, the
getdents64(2) above takes the machine down (oops=panic) on the first
READDIR reply. With the patch it warns once and getdents64(2)
returns -EIO, no oops, no hang. A conformant reply for an empty
directory — dirfrag present, zero entries, FRAG_END|FRAG_COMPLETE —
still lists "." and ".." and returns EOF on both kernels, so normal
readdir behavior is unchanged. The oops is still present in
v7.3-rc5 (72d3fcf802c45).
Cc: stable@vger.kernel.org
Fixes: 81c6aea5275ea ("ceph: handle frag mismatch between readdir request and reply")
Signed-off-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/dir.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -466,6 +466,10 @@ more:
(int)req->r_reply_info.hash_order);
rinfo = &req->r_reply_info;
+ if (WARN_ON_ONCE(!rinfo->dir_dir)) {
+ ceph_mdsc_put_request(req);
+ return -EIO;
+ }
if (le32_to_cpu(rinfo->dir_dir->frag) != frag) {
frag = le32_to_cpu(rinfo->dir_dir->frag);
if (!rinfo->hash_order) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 073/547] fuse: dont BUG when the copy buffer is exhausted
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 072/547] ceph: fail readdir when the MDS reply carries no dirfrag Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 074/547] kcov: ignore an out-of-range comparison count in write_comp_data() Greg Kroah-Hartman
` (482 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Joanne Koong, Xiang Mei,
Miklos Szeredi
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit c1338aae7b4054e26f322155423f6aba90aeea23 upstream.
fuse_copy_fill() hits BUG_ON(!err) once the iterator backing the copy
runs out of pages. Over io-uring the amount copied is not bounded by the
payload buffer the server registered, so an unprivileged user can drain
the iterator and panic the host - mount a FUSE filesystem with small
payload buffers, then setxattr() a larger value:
kernel BUG at fs/fuse/dev.c:1064!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 148 Comm: exploit Not tainted 7.3.0-rc1 #2
RIP: 0010:fuse_copy_fill (fs/fuse/dev.c:1033)
Call Trace:
<TASK>
fuse_copy_args (fs/fuse/dev.c:1354 fs/fuse/dev.c:1380)
fuse_uring_args_to_ring (fs/fuse/dev_uring.c:891)
fuse_uring_prepare_send (fs/fuse/dev_uring.c:940 fs/fuse/dev_uring.c:1057)
fuse_uring_send_in_task (fs/fuse/dev_uring.c:1745)
tctx_task_work_run (io_uring/tw.c:96)
tctx_task_work (io_uring/tw.c:133)
task_work_run (kernel/task_work.c:233)
io_run_task_work (io_uring/tw.h:84)
io_cqring_wait (io_uring/wait.c:278)
__do_sys_io_uring_enter (io_uring/io_uring.c:2676)
do_syscall_64 (arch/x86/entry/syscall_64.c:61)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The reply path can drain it the same way, via the server-supplied
payload_sz in fuse_uring_copy_from_ring().
Return -EIO instead. All three fuse_copy_fill() callers already
propagate the error.
Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Suggested-by: Joanne Koong <joannelkoong@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1061,7 +1061,8 @@ static int fuse_copy_fill(struct fuse_co
err = iov_iter_get_pages2(cs->iter, &page, PAGE_SIZE, 1, &off);
if (err < 0)
return err;
- BUG_ON(!err);
+ if (!err)
+ return -EIO;
cs->len = err;
cs->offset = off;
cs->pg = page;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 074/547] kcov: ignore an out-of-range comparison count in write_comp_data()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 073/547] fuse: dont BUG when the copy buffer is exhausted Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 075/547] kcsan: Avoid division by zero in kcsan_prandom_u32_max() Greg Kroah-Hartman
` (481 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fang Xieyan, Andrew Morton,
Alexander Potapenko, Andrey Konovalov, Dmitry Vyukov, Marco Elver,
Victor Chibotaru
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fang Xieyan <fangxy@xiaopeng.com>
commit f5263bee9eb84d2388fd7555a18d518e17226894 upstream.
write_comp_data() reads the comparison record count from area[0] and uses
it to index the coverage buffer:
area = (u64 *)t->kcov_area;
max_pos = t->kcov_size * sizeof(unsigned long);
count = READ_ONCE(area[0]);
/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
start_index = 1 + count * KCOV_WORDS_PER_CMP;
end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
if (likely(end_pos <= max_pos)) {
The buffer is mmap'd writable into the collecting process, so count is
under its control and end_pos <= max_pos is its only bound. A count that
wraps the u64 multiply leaves end_pos below max_pos, so the check passes
while the record store lands 24 bytes before the buffer, in the unmapped
vmalloc guard page, and faults:
BUG: unable to handle page fault for address: ffa0000000b60fe8
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] SMP KASAN NOPTI
RIP: 0010:write_comp_data+0x7e/0xa0
...
Kernel panic - not syncing: Fatal exception
Bound count first: only max_pos / (sizeof(u64) * KCOV_WORDS_PER_CMP)
records fit, so a larger count is not a valid index and is dropped.
kcov_move_area() bounds the same untrusted count this way, and no count
the end_pos <= max_pos check accepts reaches that limit, so no valid
record is lost.
kcov is a root-only debugfs file (debugfs_create_file_unsafe("kcov", 0600,
...)) and write_comp_data() exists only under
CONFIG_KCOV_ENABLE_COMPARISONS, so this is a local, debug-kernel
robustness fix: the process corrupts its own buffer and the kernel oopses.
It crosses no privilege boundary. Additional details at [1]
Link: https://lore.kernel.org/20260917104306.22145-1-fangxy@xiaopeng.com [1]
Fixes: ded97d2c2b2c ("kcov: support comparison operands collection")
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alexander Potapenko <glider@google.com>
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Victor Chibotaru <tchibo@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/kcov.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -253,6 +253,14 @@ static void notrace write_comp_data(u64
count = READ_ONCE(area[0]);
+ /*
+ * area[0] is writable by the collecting process, so count cannot be
+ * trusted. Bound it to the records that fit, as kcov_move_area()
+ * does, so the end_pos multiply below cannot wrap past its check.
+ */
+ if (count >= max_pos / (sizeof(u64) * KCOV_WORDS_PER_CMP))
+ return;
+
/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
start_index = 1 + count * KCOV_WORDS_PER_CMP;
end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 075/547] kcsan: Avoid division by zero in kcsan_prandom_u32_max()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 074/547] kcov: ignore an out-of-range comparison count in write_comp_data() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 076/547] ksmbd: serialize directory emptiness checks with readdir Greg Kroah-Hartman
` (480 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marco Elver, Andrea Parri
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
commit 99b6fcce87037cfb6b5e177848342e97f5141205 upstream.
KCSAN's skip_watch, udelay_task and udelay_interrupt parameters can be
changed at runtime through /sys/module/kcsan/parameters/, where 0 means
watching every access or not delaying at all. With the default
CONFIG_KCSAN_SKIP_WATCH_RANDOMIZE=y and CONFIG_KCSAN_DELAY_RANDOMIZE=y,
writing 0 to any of them makes the next watchpoint setup divide by zero:
# echo 0 > /sys/module/kcsan/parameters/udelay_task
Oops: divide error: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 93 Comm: sh Not tainted 7.3.0-rc5 #3 PREEMPT(lazy)
RIP: 0010:kcsan_setup_watchpoint+0x1b5/0x410
Code: ... 65 89 05 ad 8d 98 02 d3 ee <f7> f6 29 d7 e8 22 0e 0f 01 ...
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
...
__show_trace_log_lvl+0x1bd/0x315
__die_body.cold+0x19/0x2b
die+0x34/0x50
...
BUG: TASK stack guard page was hit at ffffd3ab001fbfe8 (...)
reset_kcsan_skip() and delay_access() pass these values unchecked to
kcsan_prandom_u32_max(), which returns "state % ep_ro". delay_access()
halves the delay for compound and assert accesses, so
udelay_interrupt=1 is enough there.
The oops path runs instrumented code, which faults again until the stack
overflows. With skip_watch=0 the guest hangs without printing anything.
The division came in with commit 71a076f4a61a ("kcsan: Rewrite
kcsan_prandom_u32_max() without prandom_u32_state()"). Before it, the
helper scaled the random value with a multiply-shift, which yields 0 for
ep_ro == 0. Go back to that via reciprocal_scale().
Tested in an x86-64 KCSAN guest with virtme-ng: after this patch,
writing 0 to each parameter, or 1 to udelay_interrupt, no longer
oopses. skip_watch=0 now watches every access, which is very slow with
the default delays but completes when they are set to 0.
Fixes: 71a076f4a61a ("kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Marco Elver <elver@google.com>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/kcsan/core.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -290,8 +290,9 @@ should_watch(struct kcsan_ctx *ctx, cons
}
/*
- * Returns a pseudo-random number in interval [0, ep_ro). Simple linear
- * congruential generator, using constants from "Numerical Recipes".
+ * Returns a pseudo-random number in interval [0, ep_ro), or 0 if ep_ro is 0,
+ * which the runtime-tunable callers may pass. Simple linear congruential
+ * generator, using constants from "Numerical Recipes".
*/
static u32 kcsan_prandom_u32_max(u32 ep_ro)
{
@@ -300,7 +301,7 @@ static u32 kcsan_prandom_u32_max(u32 ep_
state = 1664525 * state + 1013904223;
this_cpu_write(kcsan_rand_state, state);
- return state % ep_ro;
+ return reciprocal_scale(state, ep_ro);
}
static inline void reset_kcsan_skip(void)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 076/547] ksmbd: serialize directory emptiness checks with readdir
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 075/547] kcsan: Avoid division by zero in kcsan_prandom_u32_max() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 077/547] libceph: bound mon_command ack decode to front len Greg Kroah-Hartman
` (479 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yongjun Gwon, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjun Gwon <d3bugee@gmail.com>
commit 7220980b2423d06a0604516129bfa4cec8a697ae upstream.
SMB2 QUERY_DIRECTORY holds fp->readdir_lock while it calls iterate_dir()
on fp->filp. An SMB2 SET_INFO request with FILE_DISPOSITION_INFORMATION
can resolve the same FileId and call ksmbd_vfs_empty_dir() on the same
filp without that lock.
iterate_dir()'s inode read lock permits concurrent readers and does not
serialize per-file iterator state. ext4 stores its dx readdir cursor and
fname RB tree in file->private_data. Concurrent reset or refill can
therefore free a fname node while the other worker still traverses it or
retains its RB-tree link, resulting in use-after-free accesses.
An authenticated SMB client with list and delete rights on a directory in
a writable KSMBD share backed by ext4 can trigger this when the directory
takes the dx readdir path. The client overlaps an SMB2 QUERY_DIRECTORY
request with an SMB2 SET_INFO request carrying FILE_DISPOSITION_INFORMATION
on one live FileId.
In one x86_64 SMP KASAN multi-shot guest using ksmbd-for-next at
171df27077fb, the unmodified kernel reported a cross-worker use-after-free
before a panic. The first report's access and free stacks show the two
request paths directly (trimmed):
BUG: KASAN: slab-use-after-free in ext4_htree_store_dirent+0x488/0x550
Read of size 8 by task kworker/2:0/29
Workqueue: ksmbd-io handle_ksmbd_work
Call Trace:
ext4_htree_store_dirent+0x488/0x550
htree_dirblock_to_tree+0x535/0x990
ext4_htree_fill_tree+0x319/0xba0
ext4_readdir+0x175a/0x2f40
iterate_dir+0x1b6/0x630
smb2_query_dir+0x1003/0x1cc0
Freed by task 279:
free_rb_tree_fname+0x67/0xc0
ext4_readdir+0x13a9/0x2f40
iterate_dir+0x1b6/0x630
ksmbd_vfs_empty_dir+0xa2/0x100
smb2_set_info+0x2ffa/0x45d0
Take fp->readdir_lock across the entire emptiness check. This places both
iterators over that handle's filp in the same lock domain while
preserving the disposition status handling. The exact code change
completed a warning-free x86_64 KASAN bzImage build. Tracing three request
pairs showed that the two iterate_dir() calls no longer overlapped and the
expected statuses were preserved. A further 1,600 reproducer iterations
completed with expected statuses and no KASAN report, Oops, or panic.
The reproducer and complete guest configuration are available privately
to maintainers on request.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yongjun Gwon <d3bugee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8324,6 +8324,7 @@ static int set_file_disposition_info(str
struct smb2_file_disposition_info *file_info)
{
struct inode *inode;
+ int err;
if (!(fp->daccess & FILE_DELETE_LE)) {
pr_err("no right to delete : 0x%x\n", fp->daccess);
@@ -8338,9 +8339,13 @@ static int set_file_disposition_info(str
if (ksmbd_has_stream_without_delete_share(fp))
return -ESHARE;
- if (S_ISDIR(inode->i_mode) && !ksmbd_stream_fd(fp) &&
- ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY)
- return -EBUSY;
+ if (S_ISDIR(inode->i_mode) && !ksmbd_stream_fd(fp)) {
+ mutex_lock(&fp->readdir_lock);
+ err = ksmbd_vfs_empty_dir(fp);
+ mutex_unlock(&fp->readdir_lock);
+ if (err == -ENOTEMPTY)
+ return -EBUSY;
+ }
smb_break_all_levII_oplock_for_delete(work, fp);
ksmbd_fd_set_delete_pending(fp);
} else {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 077/547] libceph: bound mon_command ack decode to front len
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 076/547] ksmbd: serialize directory emptiness checks with readdir Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 078/547] media: cx88: Disable PCI device on MPEG initialization failure Greg Kroah-Hartman
` (478 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+25860fb17af97289, Xiang Mei,
Alex Markuze, Ilya Dryomov
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 62b41a16d8603d4d809fda212f15c3e9c783a82b upstream.
handle_command_ack() bounds the decode with msg->front_alloc_len, the size
of the reply buffer, instead of msg->front.iov_len, the number of bytes the
monitor sent. mon_alloc_msg() routes every CEPH_MSG_MON_COMMAND_ACK to
get_generic_reply(), which returns the preallocated ->reply of whichever
generic request carries the same tid, so the buffer keeps its fixed size
however short the reply is. An ack with hdr.front_len below sizeof(struct
ceph_mon_request_header) + sizeof(u32), including 0, still passes
ceph_decode_need(), and ceph_decode_32() returns four bytes that were never
received: uninitialized slab memory, stale bytes of an earlier message, or
bytes the peer planted by sending a reply that lands in the same buffer and
is then rejected. The read stays within the allocation, so KASAN does not
flag it.
req->result reaches userspace through ceph_monc_do_statfs(),
ceph_monc_get_version() and ceph_monc_blocklist_add(); rbd hands it back
from write() on /sys/bus/rbd/add_single_major, and rbd_get_client() passes
it to ERR_PTR() unchecked, which faults:
rbd: failed to get latest osdmap: -186318427
BUG: unable to handle page fault for address: fffffbfffe9ca034
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:do_rbd_add (drivers/block/rbd.c:7105)
Call Trace:
...
kernfs_fop_write_iter (fs/kernfs/file.c:345)
vfs_write (fs/read_write.c:595 fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception
Use msg->front.iov_len, matching handle_subscribe_ack(),
handle_statfs_reply(), handle_get_version_reply() and handle_auth_reply().
A well-formed ack has front.iov_len >= 22 and is unaffected; a short one
takes the existing bad: path. This applies commit d3c32939fa0e ("libceph:
bound get_version reply decode to front len") to the last decode-side
use of front_alloc_len in this file.
Cc: stable@vger.kernel.org
Fixes: 6305a3b41515 ("libceph: support for blacklisting clients")
Reported-by: co+25860fb17af97289@bugs.sh
Assisted-by: Cursor
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/mon_client.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -943,7 +943,7 @@ static void handle_command_ack(struct ce
{
struct ceph_mon_generic_request *req;
void *p = msg->front.iov_base;
- void *const end = p + msg->front_alloc_len;
+ void *const end = p + msg->front.iov_len;
u64 tid = le64_to_cpu(msg->hdr.tid);
dout("%s msg %p tid %llu\n", __func__, msg, tid);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 078/547] media: cx88: Disable PCI device on MPEG initialization failure
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 077/547] libceph: bound mon_command ack decode to front len Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 079/547] media: em28xx: reject audio endpoint with zero packet size Greg Kroah-Hartman
` (477 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 80494a83223bc972145c23890b083d20651512bd upstream.
cx8802_init_common() enables the PCI device, then returns directly if
DMA mask setup or IRQ registration fails. cx8802_probe() frees the
device and drops the shared core reference without disabling PCI.
Disable the PCI device on both post-enable failures. Preserve -EIO for
a DMA mask failure and the original request_irq() error. Do not call
the full fini helper because the IRQ was not successfully requested.
The successful probe and normal removal paths are unchanged.
These missing error-path disables are present in the initial Git import.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cx88/cx88-mpeg.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/media/pci/cx88/cx88-mpeg.c
+++ b/drivers/media/pci/cx88/cx88-mpeg.c
@@ -392,7 +392,8 @@ static int cx8802_init_common(struct cx8
err = dma_set_mask(&dev->pci->dev, DMA_BIT_MASK(32));
if (err) {
pr_err("Oops: no 32bit PCI DMA ???\n");
- return -EIO;
+ err = -EIO;
+ goto fail_disable_device;
}
dev->pci_rev = dev->pci->revision;
@@ -413,13 +414,17 @@ static int cx8802_init_common(struct cx8
IRQF_SHARED, dev->core->name, dev);
if (err < 0) {
pr_err("can't get IRQ %d\n", dev->pci->irq);
- return err;
+ goto fail_disable_device;
}
cx_set(MO_PCI_INTMSK, core->pci_irqmask);
/* everything worked */
pci_set_drvdata(dev->pci, dev);
return 0;
+
+fail_disable_device:
+ pci_disable_device(dev->pci);
+ return err;
}
static void cx8802_fini_common(struct cx8802_dev *dev)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 079/547] media: em28xx: reject audio endpoint with zero packet size
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 078/547] media: cx88: Disable PCI device on MPEG initialization failure Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 080/547] media: go7007: only set audio_enabled if go7007_snd_init() succeeded Greg Kroah-Hartman
` (476 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+9782320f78c23f40, Xiang Mei,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit aebfe430ba885d2f8fc882d7a6d60a7fdbe535d8 upstream.
em28xx_audio_urb_init() divides by the audio endpoint's wMaxPacketSize
without checking it, so a USB device that declares a zero-sized audio
endpoint divides by zero at probe time.
Reject a zero-sized audio endpoint like a missing one; the caller already
unwinds on a negative return.
Oops: divide error: 0000 [#1] SMP NOPTI
Workqueue: usb_hub_wq hub_event
RIP: 0010:em28xx_audio_init (drivers/media/usb/em28xx/em28xx-audio.c:718)
Call Trace:
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
em28xx_init_dev.isra.0 (drivers/media/usb/em28xx/em28xx-cards.c:3887)
em28xx_usb_probe (drivers/media/usb/em28xx/em28xx-cards.c:4258)
usb_probe_interface (drivers/usb/core/driver.c:396)
...
usb_set_configuration (drivers/usb/core/message.c:2268)
usb_generic_driver_probe (drivers/usb/core/generic.c:250)
usb_probe_device (drivers/usb/core/driver.c:291)
...
usb_new_device (drivers/usb/core/hub.c:2703)
hub_event (drivers/usb/core/hub.c:5961)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Kernel panic - not syncing: Fatal exception
Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus")
Cc: stable@vger.kernel.org
Reported-by: co+9782320f78c23f40@bugs.sh
Closes: https://lore.kernel.org/all/51lCz4R7QyTUKbh4mhXNaNzX0evpk0siOzbh%40bugs.sh/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-audio.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/media/usb/em28xx/em28xx-audio.c
+++ b/drivers/media/usb/em28xx/em28xx-audio.c
@@ -693,6 +693,13 @@ static int em28xx_audio_urb_init(struct
}
ep_size = em28xx_audio_ep_packet_size(udev, ep);
+ if (ep_size == 0) {
+ dev_err(&dev->intf->dev,
+ "Audio endpoint 0x%02x has a zero packet size\n",
+ EM28XX_EP_AUDIO);
+ return -ENODEV;
+ }
+
interval = 1 << (ep->bInterval - 1);
dev_info(&dev->intf->dev,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 080/547] media: go7007: only set audio_enabled if go7007_snd_init() succeeded
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 079/547] media: em28xx: reject audio endpoint with zero packet size Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 081/547] media: usbtv: fix null-pointer dereference on disconnect Greg Kroah-Hartman
` (475 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Mei, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 2eacf058d2dbb0ae3aaf576459da9e5f2b6bbfbd upstream.
go7007_register_encoder() sets go->audio_enabled before calling
go7007_snd_init() and discards its return value. go7007_snd_init()
assigns go->snd_context only on success, so a failed ALSA setup leaves
audio_enabled set with snd_context still NULL. The disconnect path tests
audio_enabled and calls go7007_snd_remove(), which dereferences
snd_context unconditionally.
go7007_snd_init() returns -ENODEV once its never-decremented static card
counter reaches SNDRV_CARDS, so SNDRV_CARDS attach/detach cycles arm the
next attach; no memory pressure is needed.
Set go->audio_enabled only once go7007_snd_init() has succeeded.
Oops: general protection fault, probably for non-canonical address ...
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: usb_hub_wq hub_event
RIP: 0010:go7007_snd_remove (drivers/media/usb/go7007/snd-go7007.c:273)
Call Trace:
go7007_usb_disconnect (drivers/media/usb/go7007/go7007-usb.c:1336)
usb_unbind_interface (drivers/usb/core/driver.c:461)
device_remove (drivers/base/dd.c:618)
device_release_driver_internal (drivers/base/dd.c:1349)
bus_remove_device (drivers/base/bus.c:664)
device_del (drivers/base/core.c:3965)
usb_disable_device (drivers/usb/core/message.c:1478)
usb_disconnect
hub_event (drivers/usb/core/hub.c:5966)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Kernel panic - not syncing: Fatal exception
Cc: stable@vger.kernel.org
Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/go7007/go7007-driver.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -306,10 +306,9 @@ int go7007_register_encoder(struct go700
if (ret < 0)
goto err_free_controls;
- if (go->board_info->flags & GO7007_BOARD_HAS_AUDIO) {
+ if ((go->board_info->flags & GO7007_BOARD_HAS_AUDIO) &&
+ go7007_snd_init(go) == 0)
go->audio_enabled = 1;
- go7007_snd_init(go);
- }
return 0;
err_free_controls:
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 081/547] media: usbtv: fix null-pointer dereference on disconnect
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 080/547] media: go7007: only set audio_enabled if go7007_snd_init() succeeded Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 082/547] net: ipv4: add zero check for snd_cwnd_clamp Greg Kroah-Hartman
` (474 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+37a57a84893052ab6071,
Aleksandr Nogikh, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
commit cb705f75d03e946a4514488beb9e3bac9bcdb2e6 upstream.
A null-pointer dereference can occur in usb_make_path() when called from
usbtv_querycap() (and other ioctl handlers) during device disconnection.
Oops: general protection fault, probably for non-canonical address
0xdffffc000000000a: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
RIP: 0010:usb_make_path include/linux/usb.h:985 [inline]
RIP: 0010:usbtv_querycap+0x9c/0x100
drivers/media/usb/usbtv/usbtv-video.c:612
...
Call Trace:
<TASK>
v4l_querycap+0x236/0x470 drivers/media/v4l2-core/v4l2-ioctl.c:1106
__video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133
video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475
v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
This happens due to a race condition between the USB device disconnect
routine (usbtv_disconnect()) and V4L2 ioctls. When the device is
disconnected, usbtv_disconnect() sets usbtv->udev = NULL without holding
the usbtv->v4l2_lock mutex. Concurrently, an ioctl handler like
usbtv_querycap() can be executing under the v4l2_lock and attempt to use
usbtv->udev, leading to a crash.
To fix this, move the usbtv->udev = NULL assignment into usbtv_video_free()
and protect it with mutex_lock(&usbtv->v4l2_lock). This ensures that no
non-queue ioctl handler can run concurrently with the pointer being
nullified. If an ioctl is already running, the mutex will block the
disconnect path until the ioctl finishes. If an ioctl is blocked waiting
for the lock, it will acquire it after the disconnect routine releases it,
but will then check video_is_registered() (which was cleared by
vb2_video_unregister_device()) and safely return -ENODEV.
Acquiring v4l2_lock after vb2_video_unregister_device() avoids
reintroducing a historical deadlock issue, and usbtv_audio_free() remains
safe as it is called before usbtv_video_free().
Fixes: 65e6a2773d65 ("media: usbtv: Remove useless locks in usbtv_video_free()")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+37a57a84893052ab6071@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37a57a84893052ab6071
Link: https://syzkaller.appspot.com/ai_job?id=5abbe65a-5853-4bc2-9135-5c75f88d51ed
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/usbtv/usbtv-core.c | 2 --
drivers/media/usb/usbtv/usbtv-video.c | 4 ++++
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -139,8 +139,6 @@ static void usbtv_disconnect(struct usb_
usbtv_audio_free(usbtv);
usbtv_video_free(usbtv);
- usbtv->udev = NULL;
-
/* the usbtv structure will be deallocated when v4l2 will be
done using it */
v4l2_device_put(&usbtv->v4l2_dev);
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -966,5 +966,9 @@ void usbtv_video_free(struct usbtv *usbt
vb2_video_unregister_device(&usbtv->vdev);
v4l2_device_disconnect(&usbtv->v4l2_dev);
+ mutex_lock(&usbtv->v4l2_lock);
+ usbtv->udev = NULL;
+ mutex_unlock(&usbtv->v4l2_lock);
+
v4l2_device_put(&usbtv->v4l2_dev);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 082/547] net: ipv4: add zero check for snd_cwnd_clamp
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 081/547] media: usbtv: fix null-pointer dereference on disconnect Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 083/547] net: usb: pegasus: do not advance rx_skb->data on dropped frames Greg Kroah-Hartman
` (473 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, co+71b6509cb791e531,
Kaho Jiang, Paolo Abeni
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaho Jiang <kj2864@nyu.edu>
commit 363c8c79220d0db4d65dcd570529ddda15067cb5 upstream.
When RTAX_CWND is locked, user is able to pass 0 into it.
This could lead to writing 0 to tp->snd_cwnd, leading to a
division by zero error.
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
Call Trace:
<IRQ>
tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
tcp_rcv_established (net/ipv4/tcp_input.c:6685)
tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
__netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
__netif_receive_skb (net/core/dev.c:6410)
process_backlog (net/core/dev.c:6761)
__napi_poll.constprop.0 (net/core/dev.c:7830)
net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
handle_softirqs (kernel/softirq.c:645)
__irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
irq_exit_rcu (kernel/softirq.c:775)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
Fix by checking if user pass in zero as parameter and if lock is present.
Fixes: 814d488c6126 ("tcp: fix the timid additive increase on stretch ACKs")
Cc: stable@vger.kernel.org
Suggested-by: Eric Dumazet <edumazet@kernel.org>
Reported-by: co+71b6509cb791e531@bugs.sh
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261021235732.1313305-2-kj2864@nyu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/metrics.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -60,6 +60,11 @@ static int ip_metrics_convert(struct nla
if (ecn_ca)
metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+ if ((metrics[RTAX_LOCK - 1] & (1 << RTAX_CWND)) && !metrics[RTAX_CWND - 1]) {
+ NL_SET_ERR_MSG(extack, "Locked cwnd metric must be non zero");
+ return -EINVAL;
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 083/547] net: usb: pegasus: do not advance rx_skb->data on dropped frames
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 082/547] net: ipv4: add zero check for snd_cwnd_clamp Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 084/547] nfsd: fix race between client_info_show() and free_client() Greg Kroah-Hartman
` (472 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Jie Law, Simon Horman,
Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
commit bfa09dccf98cf78dd9282259b2140bd1472f5ae9 upstream.
For the 0x8513 chip, read_bulk_callback() skips the 2-byte receive
header by advancing pegasus->rx_skb->data in place. This is done before
the pkt_len > PEGASUS_MTU check, and when that check drops the frame
the good path resubmits the same skb with the advanced rx_skb->data as
the transfer buffer, still PEGASUS_MTU bytes long.
Every frame with an oversized length field therefore moves the receive
buffer two more bytes towards the end of the skb data area. A device
that keeps sending such frames makes the host controller write received
data over skb_shared_info and past the end of the allocation, and the
corrupted skb_shared_info is used when the skb is eventually freed.
With an emulated device sending frames filled with 0x5a on a KASAN
kernel:
BUG: KASAN: slab-out-of-bounds in dummy_timer+0xade/0x3f00 [dummy_hcd]
Write of size 1536 at addr ffff888105821202 by task swapper/1/0
...
Oops: general protection fault, probably for non-canonical address 0xeb4b474b4b4b4b4c: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x5a5a5a5a5a5a5a60-0x5a5a5a5a5a5a5a67]
RIP: 0010:skb_release_data+0x36f/0x800
Only skip the header with skb_reserve() once the frame is going to be
passed up, so the receive buffer always starts at the beginning of the
skb data area. Unlike the old pointer adjustment, skb_reserve() also
moves skb->tail, so the two header bytes now count against the buffer
size: lower the length limit for the 0x8513 accordingly, otherwise a
pkt_len of PEGASUS_MTU - 1 or PEGASUS_MTU would trip skb_over_panic().
Found by code review with LLM assistance and reproduced with an
emulated USB device (raw-gadget + dummy_hcd).
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261021020310.34045-2-law.wei.jie@gt.tech.gov.sg
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/pegasus.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -461,6 +461,7 @@ static void read_bulk_callback(struct ur
u8 *buf = urb->transfer_buffer;
int rx_status, count = urb->actual_length;
int status = urb->status;
+ int rx_offset = 0;
__u16 pkt_len;
if (!pegasus)
@@ -510,7 +511,7 @@ static void read_bulk_callback(struct ur
if (pegasus->chip == 0x8513) {
pkt_len = le32_to_cpu(*(__le32 *)urb->transfer_buffer);
pkt_len &= 0x0fff;
- pegasus->rx_skb->data += 2;
+ rx_offset = 2;
} else {
pkt_len = buf[count - 3] << 8;
pkt_len += buf[count - 4];
@@ -522,13 +523,14 @@ static void read_bulk_callback(struct ur
* If the packet is unreasonably long, quietly drop it rather than
* kernel panicing by calling skb_put.
*/
- if (pkt_len > PEGASUS_MTU)
+ if (pkt_len > PEGASUS_MTU - rx_offset)
goto goon;
/*
* at this point we are sure pegasus->rx_skb != NULL
* so we go ahead and pass up the packet.
*/
+ skb_reserve(pegasus->rx_skb, rx_offset);
skb_put(pegasus->rx_skb, pkt_len);
pegasus->rx_skb->protocol = eth_type_trans(pegasus->rx_skb, net);
netif_rx(pegasus->rx_skb);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 084/547] nfsd: fix race between client_info_show() and free_client()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 083/547] net: usb: pegasus: do not advance rx_skb->data on dropped frames Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 085/547] ocfs2/dlm: drain join handlers before releasing module text Greg Kroah-Hartman
` (471 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Wolff, Ameer Hamza,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ameer Hamza <ameer.hamza@truenas.com>
commit ee62dc03a69ee57855de35da1a8ab53b51d30b32 upstream.
client_info_show() renders /proc/fs/nfsd/clients/<id>/info and walks
clp->cl_sessions under clp->cl_lock to print each session's slot
counts. free_client() tears down the same list without taking
cl_lock, and is the only unlocked mutator of cl_sessions. A reader
can observe a client mid-teardown because get_nfsdfs_clp() pins the
nfs4_client but not its sessions: free_client() frees every session
before calling nfsd_client_rmdir(), so an in-flight seq_file reader
can follow a list_del()'d node whose ->next now holds LIST_POISON1
and take a general protection fault:
Oops: general protection fault, probably for non-canonical address
0xdead00000000014c
CPU: 1 UID: 0 PID: 132488 Comm: cat
RIP: 0010:client_info_show+0x2bf/0x3d0
RAX: dead000000000100
Call Trace:
seq_read_iter+0x12a/0x4b0
seq_read+0xf1/0x130
vfs_read+0xbf/0x350
ksys_read+0x6f/0xf0
do_syscall_64+0x8b/0xcb0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Kernel panic - not syncing: Fatal exception
Detach cl_sessions onto a local reaplist under cl_lock, then free the
sessions after dropping the lock. Removing entries from cl_sessions
under cl_lock matches unhash_session(), and the detach-then-reap shape
matches how __destroy_client() reaps cl_delegations. The sessions
cannot be freed while cl_lock is held, since free_session() calls
nfsd4_del_conns(), which re-acquires it.
Reported-by: Nicholas Wolff <nicholas.wolff@truenas.com>
Fixes: 601c8cb349c2 ("nfsd: add session slot count to /proc/fs/nfsd/clients/*/info")
Cc: stable@vger.kernel.org
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Link: https://patch.msgid.link/20260726124658.1715711-1-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2789,10 +2789,16 @@ void nfsd4_put_client(struct nfs4_client
static void
free_client(struct nfs4_client *clp)
{
- while (!list_empty(&clp->cl_sessions)) {
+ LIST_HEAD(reaplist);
+
+ /* client_info_show() walks cl_sessions under cl_lock */
+ spin_lock(&clp->cl_lock);
+ list_splice_init(&clp->cl_sessions, &reaplist);
+ spin_unlock(&clp->cl_lock);
+ while (!list_empty(&reaplist)) {
struct nfsd4_session *ses;
- ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
- se_perclnt);
+ ses = list_entry(reaplist.next, struct nfsd4_session,
+ se_perclnt);
list_del(&ses->se_perclnt);
WARN_ON_ONCE(atomic_read(&ses->se_ref));
free_session(ses);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 085/547] ocfs2/dlm: drain join handlers before releasing module text
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 084/547] nfsd: fix race between client_info_show() and free_client() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 086/547] ocfs2: drain quorum work before removing the cluster Greg Kroah-Hartman
` (470 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 28f366d84023651e50e32e29931401ba0df3e679 upstream.
The code for a registered DLM handler must remain resident until its
last invocation finishes. dlm_unregister_net_handlers() only removes
dlm_join_handlers from the o2net registry. o2net_handler_get() takes a
kref on the wrapper, but that reference does not pin ocfs2_dlm text.
o2net_process_message() calls nh_func after dropping o2net_handler_lock.
With CONFIG_OCFS2_FS_O2CB=m, ocfs2_dlm can be loaded independently of
ocfs2_stack_o2cb while nodemanager continues handling messages from a
configured, heartbeating peer. If no dependent module or module reference
prevents normal unload, the following ordering is possible:
Receive worker Module unload
-------------- -------------
o2net_handler_get()
take wrapper kref
drop handler lock
<preempted>
dlm_exit()
unregister handlers
release DLM module text
call saved nh_func
in released module text
Use o2net_unregister_and_flush_handler_list() in the shared DLM
unregister helper. It first prevents new lookups, then waits for the
ordered o2net workqueue to drain, including a concurrent destruction of
that queue. The acquired invocation therefore finishes before dlm_exit()
returns and the loader releases the callback code. The same helper
covers partial registration and dlm_init() error unwind before module
memory is released.
Skip the drain when the private join-handler list is empty. Early
dlm_init() failures can reach this helper before any handler has been
published. Partial-registration failure also reaches it a second time
after the first call has already unregistered and drained the list.
Neither case needs to take o2net_wq_mutex or drain unrelated work.
The list is changed only by serialized module init/exit paths; a
nonempty list still uses the full unregister-and-flush helper.
Oops report as below:
Oops: int3: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 54 Comm: kworker/u16:3 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware identification omitted.
Workqueue: o2net o2net_rx_until_empty [ocfs2_nodemanager]
RIP: 0010:0xffffffffc0423871
[Instruction byte dump omitted.]
Register dump omitted.
Call Trace:
<TASK>
? o2net_rx_until_empty+0x19b1/0x3300 [ocfs2_nodemanager]
? __pfx_o2net_rx_until_empty+0x10/0x10 [ocfs2_nodemanager]
? lock_acquire+0x190/0x300
? process_one_work+0x935/0x1b40
? process_one_work+0x834/0x1b40
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
? srso_alias_return_thunk+0x5/0xfbef5
? process_one_work+0x9a8/0x1b40
? __pfx_process_one_work+0x10/0x10
? lock_acquire+0x190/0x300
? lock_is_held_type+0x8f/0x100
? srso_alias_return_thunk+0x5/0xfbef5
? worker_thread+0x65c/0xe40
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0x177/0x220
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_worker_thread+0x10/0x10
? kthread+0x351/0x460
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_kthread+0x10/0x10
? ret_from_fork+0x659/0x940
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x74f/0xf70
? __pfx_kthread+0x10/0x10
? ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in: ocfs2_nodemanager [last unloaded: ocfs2_dlm]
---[ end trace 0000000000000000 ]---
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0076-v6-12de5f4628f57fba3be3@gmail.com
Fixes: 6714d8e86bf4 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmdomain.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -2215,7 +2215,8 @@ static LIST_HEAD(dlm_join_handlers);
static void dlm_unregister_net_handlers(void)
{
- o2net_unregister_handler_list(&dlm_join_handlers);
+ if (!list_empty(&dlm_join_handlers))
+ o2net_unregister_and_flush_handler_list(&dlm_join_handlers);
}
static int dlm_register_net_handlers(void)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 086/547] ocfs2: drain quorum work before removing the cluster
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 085/547] ocfs2/dlm: drain join handlers before releasing module text Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 087/547] ocfs2: pin owning modules for open debugfs files Greg Kroah-Hartman
` (469 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit b584c45b6066fd9799c44ffb9badcb5db351c8a6 upstream.
The configured cluster must remain available until an in-flight quorum
decision has finished using its fencing method. o2quo_make_decision()
drops qs_lock before calling o2quo_fence_self(), which marks heartbeat
regions for unclean stop and then reads
o2nm_single_cluster->cl_fence_method. Cluster removal clears the
singleton without waiting for this independent system-workqueue item.
When a failed-quorum decision overlaps removal of the heartbeat regions,
nodes and cluster through configfs, the worker can be preempted after
marking the regions and resume after the singleton has been cleared:
Quorum worker Configfs removal
select fence; drop qs_lock
o2hb_stop_all_regions()
remove regions; join heartbeat threads
remove nodes; stop o2net
clear singleton; release cluster
read cl_fence_method
The resumed read dereferences NULL instead of applying the configured
fencing method. The heartbeat thread's dependency protects the local
node only until the thread exits, and draining o2net does not wait for
qs_work.
Add o2quo_flush_work() to drain pending or running quorum decisions
before clearing the singleton in o2nm_cluster_group_drop_item(). By
this point the heartbeat regions and nodes have been removed, so their
work publishers are stopped. The worker can finish while the cluster
and its configured fencing method remain available. It does not acquire
the configfs mutex held by the removal path.
Keep o2quo_exit() as the counterpart of o2quo_init() for module teardown
and initialization failure, and have it call the same drain helper.
Cluster removal uses only the explicitly named drain operation.
KASAN report as below:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000011b: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000008d8-0x00000000000008df]
CPU: 0 UID: 0 PID: 72 Comm: kworker/0:2 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events o2quo_make_decision
RIP: 0010:o2quo_fence_self+0x65/0x200
Register dump omitted.
Call Trace:
<TASK>
o2quo_make_decision+0x345/0x3a0
? __pfx_o2quo_make_decision+0x10/0x10
? process_one_work+0x834/0x1b40
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
? srso_alias_return_thunk+0x5/0xfbef5
process_one_work+0x9a8/0x1b40
? __pfx_process_one_work+0x10/0x10
? lock_acquire+0x190/0x300
? lock_is_held_type+0x8f/0x100
? srso_alias_return_thunk+0x5/0xfbef5
worker_thread+0x65c/0xe40
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0x177/0x220
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_worker_thread+0x10/0x10
kthread+0x351/0x460
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_kthread+0x10/0x10
ret_from_fork+0x659/0x940
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x74f/0xf70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0064-v5-e3870bf6571b80b07b52@gmail.com
Fixes: f6656d26d17b ("ocfs2/cluster: Make fence method configurable - v2")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/cluster/nodemanager.c | 3 +++
fs/ocfs2/cluster/quorum.c | 7 ++++++-
fs/ocfs2/cluster/quorum.h | 1 +
3 files changed, 10 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -12,6 +12,7 @@
#include "tcp.h"
#include "nodemanager.h"
#include "heartbeat.h"
+#include "quorum.h"
#include "masklog.h"
#include "sys.h"
@@ -740,6 +741,8 @@ static void o2nm_cluster_group_drop_item
struct o2nm_cluster *cluster = to_o2nm_cluster(item);
BUG_ON(o2nm_single_cluster != cluster);
+ /* Drain quorum work before it loses access to the cluster. */
+ o2quo_flush_work();
o2nm_single_cluster = NULL;
configfs_remove_default_groups(&cluster->cl_group);
--- a/fs/ocfs2/cluster/quorum.c
+++ b/fs/ocfs2/cluster/quorum.c
@@ -318,9 +318,14 @@ void o2quo_init(void)
INIT_WORK(&qs->qs_work, o2quo_make_decision);
}
-void o2quo_exit(void)
+void o2quo_flush_work(void)
{
struct o2quo_state *qs = &o2quo_state;
flush_work(&qs->qs_work);
}
+
+void o2quo_exit(void)
+{
+ o2quo_flush_work();
+}
--- a/fs/ocfs2/cluster/quorum.h
+++ b/fs/ocfs2/cluster/quorum.h
@@ -8,6 +8,7 @@
void o2quo_init(void);
void o2quo_exit(void);
+void o2quo_flush_work(void);
void o2quo_hb_up(u8 node);
void o2quo_hb_down(u8 node);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 087/547] ocfs2: pin owning modules for open debugfs files
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 086/547] ocfs2: drain quorum work before removing the cluster Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 088/547] ocfs2: publish the filecheck owner before adding sysfs attributes Greg Kroah-Hartman
` (468 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton,
Heming Zhao, Joseph Qi, Mark Fasheh, Joel Becker, Kees Cook,
Karl Mehltretter, Christophe JAILLET, Yufan Chen, Mike Rapoport,
Zhang Cen, Christian Brauner, Sunil Mushran, Kurt Hackel,
Jan Kara, Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 26d7e34b4226709084461a07bf28d9066fa96d8c upstream.
The OCFS2 debugfs file operation tables do not set owner. The
full debugfs proxy obtains real_fops with fops_get() at open and
keeps it until final release. Without an owner, this does not acquire
a reference to the module containing the table and its callbacks.
Removing the debugfs entries does not drain retained open files.
An open connected_nodes file can therefore outlive ocfs2_nodemanager
and make full_proxy_release() read real_fops->release from freed
module memory. Heming also reproduced the issue with fs_state and
asked for the other OCFS2 debugfs operation tables to be checked.
Set owner to THIS_MODULE in all eleven explicit debugfs operation
tables: five in ocfs2_nodemanager, four in ocfs2_dlm, and two in
ocfs2. The existing debugfs get/put pair then holds the appropriate
module until final release. Leave the open, read and release callbacks
unchanged. The blockcheck table already sets owner through
DEFINE_DEBUGFS_ATTRIBUTE(), so it needs no change.
The original controlled test used an unloadable OCFS2 module and
case-local probe filters without changing the candidate open, unload
or release logic. Closing a retained connected_nodes file after
normal unload produced:
BUG: unable to handle page fault for address: fffffbfff804cfef
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0xbf/0x190
Call Trace:
<TASK>
__fput+0x39a/0xa60
fput_close_sync+0xff/0x200
__x64_sys_close+0x8c/0xf0
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Modules linked in: [last unloaded: ocfs2_nodemanager]
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0089-v6-f7fda843f80887488145@gmail.com
Fixes: 2309e9e040fe ("ocfs2/net: Add debug interface to o2net")
Fixes: 87d3d3f3931f ("ocfs2/hb: Expose the list of heartbeating nodes via debugfs")
Fixes: 3ba169ccec1c ("ocfs2/cluster: Add new function o2net_fill_node_map()")
Fixes: 50397507e856 ("ocfs2: Expose the file system state via debugfs")
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Fixes: 7209300a9b98 ("ocfs2/dlm: Dumps the purgelist into a debugfs file")
Fixes: d0129aceaecc ("ocfs2/dlm: Dumps the mles into a debugfs file")
Fixes: 4e3d24ed1a12 ("ocfs2/dlm: Dumps the lockres' into a debugfs file")
Fixes: 007dce53a29c ("ocfs2/dlm: Dump the dlm state in a debugfs file")
Fixes: db02754c8a12 ("ocfs2/cluster: Show o2net timing statistics")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Karl Mehltretter <kmehltretter@gmail.com>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Yufan Chen <ericterminal@gmail.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Zhang Cen <rollkingzzc@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Cc: Kurt Hackel <kurt.hackel@oracle.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/cluster/heartbeat.c | 1 +
fs/ocfs2/cluster/netdebug.c | 4 ++++
fs/ocfs2/dlm/dlmdebug.c | 5 +++++
fs/ocfs2/dlmglue.c | 2 ++
fs/ocfs2/super.c | 1 +
5 files changed, 13 insertions(+)
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1443,6 +1443,7 @@ static ssize_t o2hb_debug_read(struct fi
#endif /* CONFIG_DEBUG_FS */
static const struct file_operations o2hb_debug_fops = {
+ .owner = THIS_MODULE,
.open = o2hb_debug_open,
.release = o2hb_debug_release,
.read = o2hb_debug_read,
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -183,6 +183,7 @@ static int nst_fop_release(struct inode
}
static const struct file_operations nst_seq_fops = {
+ .owner = THIS_MODULE,
.open = nst_fop_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -415,6 +416,7 @@ static int stats_fop_open(struct inode *
}
static const struct file_operations stats_seq_fops = {
+ .owner = THIS_MODULE,
.open = stats_fop_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -427,6 +429,7 @@ static int sc_fop_open(struct inode *ino
}
static const struct file_operations sc_seq_fops = {
+ .owner = THIS_MODULE,
.open = sc_fop_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -476,6 +479,7 @@ static ssize_t o2net_debug_read(struct f
}
static const struct file_operations nodes_fops = {
+ .owner = THIS_MODULE,
.open = nodes_fop_open,
.release = o2net_debug_release,
.read = o2net_debug_read,
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -7,6 +7,7 @@
* Copyright (C) 2004, 2008 Oracle. All rights reserved.
*/
+#include <linux/module.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/highmem.h>
@@ -339,6 +340,7 @@ static int debug_purgelist_open(struct i
}
static const struct file_operations debug_purgelist_fops = {
+ .owner = THIS_MODULE,
.open = debug_purgelist_open,
.release = debug_release,
.read = debug_read,
@@ -394,6 +396,7 @@ static int debug_mle_open(struct inode *
}
static const struct file_operations debug_mle_fops = {
+ .owner = THIS_MODULE,
.open = debug_mle_open,
.release = debug_release,
.read = debug_read,
@@ -601,6 +604,7 @@ static int debug_lockres_release(struct
}
static const struct file_operations debug_lockres_fops = {
+ .owner = THIS_MODULE,
.open = debug_lockres_open,
.release = debug_lockres_release,
.read = seq_read,
@@ -794,6 +798,7 @@ static int debug_state_open(struct inode
}
static const struct file_operations debug_state_fops = {
+ .owner = THIS_MODULE,
.open = debug_state_open,
.release = debug_release,
.read = debug_read,
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -7,6 +7,7 @@
* Copyright (C) 2003, 2004 Oracle. All rights reserved.
*/
+#include <linux/module.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/highmem.h>
@@ -3311,6 +3312,7 @@ static int ocfs2_dlm_debug_open(struct i
}
static const struct file_operations ocfs2_dlm_debug_fops = {
+ .owner = THIS_MODULE,
.open = ocfs2_dlm_debug_open,
.release = ocfs2_dlm_debug_release,
.read = seq_read,
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -387,6 +387,7 @@ static ssize_t ocfs2_debug_read(struct f
#endif /* CONFIG_DEBUG_FS */
static const struct file_operations ocfs2_osb_debug_fops = {
+ .owner = THIS_MODULE,
.open = ocfs2_osb_debug_open,
.release = ocfs2_debug_release,
.read = ocfs2_debug_read,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 088/547] ocfs2: publish the filecheck owner before adding sysfs attributes
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 087/547] ocfs2: pin owning modules for open debugfs files Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 089/547] smb: client: do not pass a NULL buf to is_oplock_break() Greg Kroah-Hartman
` (467 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton,
Heming Zhao, Joseph Qi, Mark Fasheh, Joel Becker, Gang He,
Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit e062baf5680845705d21df415c8f0751c96b0792 upstream.
ocfs2_filecheck_create_sysfs() initializes the filecheck allocation before
calling kobject_init_and_add(), but assigns entry->fs_fcheck only after
that call returns. The default attribute group can already be visible
while registration is in progress. A concurrent read can therefore enter
ocfs2_filecheck_attr_show() with a NULL fs_fcheck and try to lock its
fc_lock.
Assign the initialized owner before adding the kobject, so every activated
attribute has valid state. Clear the pointer when addition fails,
preserving the existing teardown guard and error cleanup.
A controlled probe-instrumented test kernel with the original OCFS2
registration ordering produced this Oops during a concurrent sysfs read:
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
RIP: 0010:kasan_byte_accessible+0x15/0x30
Call Trace:
<TASK>
__kasan_check_byte+0x13/0x50
lock_acquire+0x113/0x300
_raw_spin_lock+0x31/0x40
ocfs2_filecheck_attr_show+0x138/0x5f0
ocfs2_filecheck_show+0x5d/0x90
sysfs_kf_seq_show+0x1d3/0x360
seq_read_iter+0x480/0x1110
kernfs_fop_read_iter+0x419/0x5a0
vfs_read+0x7d2/0xc20
ksys_read+0x111/0x200
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Modules linked in:
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0086-v4-1b3a3c5fd05c1fb41df9@gmail.com
Fixes: 5f483c4abb50 ("ocfs2: add kobject for online file check")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Gang He <ghe@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/filecheck.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/filecheck.c
+++ b/fs/ocfs2/filecheck.c
@@ -179,17 +179,20 @@ int ocfs2_filecheck_create_sysfs(struct
fcheck->fc_size = 0;
fcheck->fc_done = 0;
+ /* Publish the initialized owner before activating its sysfs callbacks. */
+ entry->fs_fcheck = fcheck;
entry->fs_kobj.kset = osb->osb_dev_kset;
init_completion(&entry->fs_kobj_unregister);
ret = kobject_init_and_add(&entry->fs_kobj, &ocfs2_ktype_filecheck,
NULL, "filecheck");
if (ret) {
+ /* Mount failure still calls ocfs2_filecheck_remove_sysfs(). */
+ entry->fs_fcheck = NULL;
kobject_put(&entry->fs_kobj);
kfree(fcheck);
return ret;
}
- entry->fs_fcheck = fcheck;
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 089/547] smb: client: do not pass a NULL buf to is_oplock_break()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 088/547] ocfs2: publish the filecheck owner before adding sysfs attributes Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 090/547] smb: client: fix early procfs exposure race Greg Kroah-Hartman
` (466 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zikang Gao, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zikang Gao <2715417602@qq.com>
commit 2225ab306575e424b3dad2ee1be2521c89249d15 upstream.
receive_encrypted_read() sets *num_mids = 1 and never writes the
caller's bufs[]. Offload returns -1 with *num_mids = 0, so the
demultiplex thread skips the frame. The inline decrypt path
returns 0 even when smb2_find_mid() fails.
cifs_demultiplex_thread() then treats mids[i] == NULL as an
oplock break and calls is_oplock_break(bufs[i], server) with
bufs[i] still NULL. smb2_is_valid_oplock_break() reads
hdr.Command at offset 12 and oopses.
A large encrypted READ whose MessageId does not match is enough
to panic cifsd.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range
[0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 100 Comm: cifsd
RIP: smb2_is_valid_oplock_break+0xc8/0x2270 [cifs]
cifs_demultiplex_thread
Kernel panic - not syncing: Fatal exception
Return -1 when inline decrypt finds no mid, and skip
is_oplock_break() plus the unknown-frame dump when bufs[i]
is NULL. receive_encrypted_standard() already assigns
bufs[*num_mids].
Fixes: c42a6abe3012 ("CIFS: Add capability to decrypt big read responses")
Assisted-by: LLM
Signed-off-by: Zikang Gao <2715417602@qq.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/connect.c | 4 +++-
fs/smb/client/smb2ops.c | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1401,12 +1401,14 @@ next_pdu:
mid_execute_callback(server, mids[i]);
release_mid(server, mids[i]);
- } else if (server->ops->is_oplock_break &&
+ } else if (bufs[i] && server->ops->is_oplock_break &&
server->ops->is_oplock_break(bufs[i],
server)) {
smb2_add_credits_from_hdr(bufs[i], server);
cifs_dbg(FYI, "Received oplock break\n");
} else {
+ if (!bufs[i])
+ continue;
cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
atomic_read(&mid_count));
cifs_dump_mem("Received Data is: ", bufs[i],
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5397,6 +5397,7 @@ receive_encrypted_read(struct TCP_Server
*mid = smb2_find_mid(server, buf);
if (*mid == NULL) {
cifs_dbg(FYI, "mid not found\n");
+ rc = -1;
} else {
cifs_dbg(FYI, "mid found\n");
(*mid)->decrypted = true;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 090/547] smb: client: fix early procfs exposure race
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 089/547] smb: client: do not pass a NULL buf to is_oplock_break() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 091/547] thunderbolt: Do not RPM complete unrelated subtrees on unplug Greg Kroah-Hartman
` (465 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fredric Cover, Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredric Cover <fredric.cover.lkernel@gmail.com>
commit 7b1afb631395c958993cda4631002258ef4151ea upstream.
Currently, init_cifs() calls cifs_proc_init() near the beginning of
the function, before INIT_LIST_HEAD, leading to a momentarily
uninitialized, but exposed, procfs. If a userspace process reads this
empty procfs, iterating over a zeroed list_head leads to a NULL
pointer dereference and a kernel oops/panic.
For example, if a delay is added between cifs_proc_init() and
INIT_LIST_HEAD, and a userspace process is polling
/proc/fs/cifs/DebugData, the following oops occurs:
BUG: kernel NULL pointer dereference, address: 0000000000000608
Oops: Oops: 0000 [#1] SMP PTI
CPU: 0 UID: 0 PID: 3477 Comm: cat Not tainted
7.3.0-02212-g4df4d2a577db-dirty #6 PREEMPT(lazy)
RIP: 0010:cifs_debug_data_proc_show+0x103/0xd80 [cifs]
Call Trace:
<TASK>
? seq_read_iter+0x86/0x400
? seq_read_iter+0x86/0x400
seq_read_iter+0x183/0x400
proc_reg_read_iter+0x62/0x90
copy_splice_read+0x215/0x310
splice_file_to_pipe+0xec/0x1c0
do_splice+0x4b8/0x780
__se_sys_splice+0x18f/0x250
do_syscall_64+0x109/0x330
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Fix this by moving cifs_proc_init() down in init_cifs(), ensuring it runs
only after all internal lists, locks, counters, and workqueues are fully
ready, but before registering the filesystem. Update the error cleanup
ladder and exit_cifs() to maintain proper LIFO order.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsfs.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -2021,7 +2021,6 @@ init_cifs(void)
if (rc)
return rc;
- cifs_proc_init();
INIT_LIST_HEAD(&cifs_tcp_ses_list);
/*
* Initialize Global counters
@@ -2070,10 +2069,8 @@ init_cifs(void)
cifsiod_wq = alloc_workqueue("cifsiod",
WQ_FREEZABLE | WQ_MEM_RECLAIM | WQ_PERCPU,
0);
- if (!cifsiod_wq) {
- rc = -ENOMEM;
- goto out_clean_proc;
- }
+ if (!cifsiod_wq)
+ return -ENOMEM;
/*
* Consider in future setting limit!=0 maybe to min(num_of_cores - 1, 3)
@@ -2164,19 +2161,22 @@ init_cifs(void)
if (rc)
goto out_cifs_swn_init;
+ cifs_proc_init();
+
rc = register_filesystem(&cifs_fs_type);
if (rc)
- goto out_init_cifs_idmap;
+ goto out_clean_proc;
rc = register_filesystem(&smb3_fs_type);
if (rc) {
unregister_filesystem(&cifs_fs_type);
- goto out_init_cifs_idmap;
+ goto out_clean_proc;
}
return 0;
-out_init_cifs_idmap:
+out_clean_proc:
+ cifs_proc_clean();
exit_cifs_idmap();
out_cifs_swn_init:
#ifdef CONFIG_CIFS_SWN_UPCALL
@@ -2212,8 +2212,6 @@ out_destroy_decrypt_wq:
destroy_workqueue(decrypt_wq);
out_destroy_cifsiod_wq:
destroy_workqueue(cifsiod_wq);
-out_clean_proc:
- cifs_proc_clean();
return rc;
}
@@ -2223,6 +2221,7 @@ exit_cifs(void)
cifs_dbg(NOISY, "exit_smb3\n");
unregister_filesystem(&cifs_fs_type);
unregister_filesystem(&smb3_fs_type);
+ cifs_proc_clean();
cifs_release_automount_timer();
exit_cifs_idmap();
#ifdef CONFIG_CIFS_SWN_UPCALL
@@ -2245,7 +2244,6 @@ exit_cifs(void)
destroy_workqueue(serverclose_wq);
destroy_workqueue(cfid_put_wq);
destroy_workqueue(cifsiod_wq);
- cifs_proc_clean();
}
MODULE_AUTHOR("Steve French");
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 091/547] thunderbolt: Do not RPM complete unrelated subtrees on unplug
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 090/547] smb: client: fix early procfs exposure race Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 092/547] udf: fix return value for non-recorded-allocated extents in udf_map_block() Greg Kroah-Hartman
` (464 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonathan Gopel, Mika Westerberg
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Gopel <jgopel@gmail.com>
commit 96a8479804e3f7af43e639e9df39f562f1a75fd5 upstream.
When a Thunderbolt device is unplugged, that switch and every switch
subsequent to it on the bus device list is `complete()`d, not just its
child devices. In the case of multiple domains, it may cause, eg, an
attempt to `complete()` the uninitialized domain 1 root switch RPM
completion on unplug of a switch from domain 0 (though ordering is not
guaranteed numerically sorted).
I initially noticed this issue on a Dell XPS9720 when the system would
seem to sporadically not wake after unplugging a Thunderbolt dock. I
tried multiple kernel versions including v7.2.7 and v7.3-rc4 to see if
that resolved the issue, but the issue persisted. Eventually I found
that I could consistently generate a kernel Oops reporting a page fault
at 0xffff_ffff_ffff_fff8 on unplug from one side of the laptop and went
bug hunting. I became suspicious of the `bus_for_each_dev()` walk that I
ultimately ended up changing. To confirm this issue, I did an eBPF trace
of `bus_for_each_dev()`, `complete_rpm()`, and `complete()` while
unplugging in a variety of situations and found that an unplug from
domain 0 tries to `complete_rpm()` domain 1's switch, whose RPM
completion is not initialized and thus is holding a null wait-list
pointer, triggering the page fault.
Here are the key sections of that eBPF trace. Note that HEAD denotes the
completion's own wait-list HEAD:
```
RESCAN_ENTER domain=0
COMPLETE rescan_domain=0 target=0-1 target_domain=0
route=0x1 parent=0-0 unplugged=1
COMPLETION done=0 head=HEAD next=HEAD prev=HEAD
BUS_WALK domain=0 start=0-1 callback=complete_rpm
CALLBACK_ENTER rescan_domain=0 dev=1-0 parent=domain1 is_switch=1
COMPLETE rescan_domain=0 target=1-0 target_domain=1
route=0x0 parent=domain1 unplugged=0
COMPLETION done=0 head=HEAD next=0 prev=0
complete+5
complete_rpm+43
bus_for_each_dev+133
icm_free_unplugged_children+250
icm_rescan_work+42
```
This patch gates the `complete()` on an additional condition - that the
Thunderbolt domain matches the domain of the device that was unplugged.
I only have a single system with multiple Thunderbolt domains - the Dell
XPS9720. I am consistently able to reproduce the Oops on that system.
Since running with this patch, I have not seen the Oops reoccur. I have
also tested it on a Thinkpad X1-Gen12, and that system boots and runs
well with it, but it only has a single Thunderbolt domain, so it does
not exercise the multi-domain failure case.
Fixes: 4f7c2e0d8765 ("thunderbolt: Make sure device runtime resume completes before taking domain lock")
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Gopel <jgopel@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/icm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -2072,7 +2072,7 @@ static int complete_rpm(struct device *d
{
struct tb_switch *sw = tb_to_switch(dev);
- if (sw)
+ if (sw && sw->tb == data)
complete(&sw->rpm_complete);
return 0;
}
@@ -2088,8 +2088,8 @@ static void remove_unplugged_switch(stru
* tb_switch_remove() calls pm_runtime_get_sync() that then waits
* for it.
*/
- complete_rpm(&sw->dev, NULL);
- bus_for_each_dev(&tb_bus_type, &sw->dev, NULL, complete_rpm);
+ complete_rpm(&sw->dev, sw->tb);
+ bus_for_each_dev(&tb_bus_type, &sw->dev, sw->tb, complete_rpm);
tb_switch_remove(sw);
pm_runtime_mark_last_busy(parent);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 092/547] udf: fix return value for non-recorded-allocated extents in udf_map_block()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 091/547] thunderbolt: Do not RPM complete unrelated subtrees on unplug Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 093/547] wwan: wwan_hwsim: Pin module for debugfs file operations Greg Kroah-Hartman
` (463 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Mei, Giorgi Kobakhia, Jan Kara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giorgi Kobakhia <gkobakhi@asu.edu>
commit 0f242ca0878896df30292f4922700a32e8fdd039 upstream.
When someone creates a corrupted UDF filesystem where symlink contains
other extent type than EXT_RECORDED_ALLOCATED, it can leads to a crash
like:
Oops: general protection fault
KASAN: maybe wild-memory-access
RIP: 0010:page_get_link (fs/namei.c:6503)
Call Trace:
vfs_readlink (fs/namei.c:6419)
do_readlinkat (fs/stat.c:583)
__x64_sys_readlink (fs/stat.c:605 fs/stat.c:602 fs/stat.c:602)
This is because in this case udf_map_block() fails to convert return
value of inode_bmap() from 1 to 0. Returned '1' propagates through
udf_bread() all the way up to __page_get_link() where it ends up being
treated as a folio pointer with obvious results.
Move the reset to 0 line outside the if, so udf_map_block() returns either
0 or -errno, even if the extent type is not EXT_RECORDED_ALLOCATED.
Fixes: c226964ec786 ("udf: refactor inode_bmap() to handle error")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Tested-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
Link: https://patch.msgid.link/20260928200445.18722-1-gkobakhi@asu.edu
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -372,8 +372,8 @@ static int udf_map_block(struct inode *i
map->pblk = udf_get_lb_pblock(inode->i_sb, &eloc,
offset);
map->oflags |= UDF_BLK_MAPPED;
- ret = 0;
}
+ ret = 0;
out_read:
up_read(&iinfo->i_data_sem);
brelse(epos.bh);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 093/547] wwan: wwan_hwsim: Pin module for debugfs file operations
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 092/547] udf: fix return value for non-recorded-allocated extents in udf_map_block() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 094/547] xfs: fix integer overflow problem when setting large free areas Greg Kroah-Hartman
` (462 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Viet Dung, Loic Poulain,
Paolo Abeni
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
commit a388f17e23b7e305cb306aafd73bb10d6b8ca452 upstream.
An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, wwan_hwsim_debugfs_portdestroy_fops,
wwan_hwsim_debugfs_portcreate_fops, wwan_hwsim_debugfs_devdestroy_fops,
and wwan_hwsim_debugfs_devcreate_fops in wwan_hwsim.c have no
.owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the wwan_hwsim module. When a userspace
process opens any of these debugfs files, a subsequent module unload
(rmmod wwan_hwsim) can succeed while the file descriptor remains open.
When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():
BUG: unable to handle page fault for address: fffffbfff84f90ef
Oops: 0000 [#2] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0x8e/0x140
Call Trace:
<TASK>
__fput+0x357/0xaa0
fput_close_sync+0xe6/0x1a0
file_close_fd_locked+0x17e/0x2f0
do_close+0x33/0x70
__x64_sys_close+0x44/0x80
do_syscall_64+0xc3/0x590
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
The issue was discovered via manual code audit of wwan_hwsim.c and
reproduced on a Linux 7.3-rc6 test VM with CONFIG_WWAN_HWSIM=m.
Set .owner = THIS_MODULE on all four debugfs file_operations structures
in wwan_hwsim.c so that debugfs pins the module until close has
completed.
Fixes: 9ee23f48f670 ("wwan_hwsim: add debugfs management interface")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20261008130753.313875-1-dungvn2345@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wwan/wwan_hwsim.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/wwan/wwan_hwsim.c
+++ b/drivers/net/wwan/wwan_hwsim.c
@@ -500,6 +500,7 @@ static ssize_t wwan_hwsim_debugfs_portde
}
static const struct file_operations wwan_hwsim_debugfs_portdestroy_fops = {
+ .owner = THIS_MODULE,
.write = wwan_hwsim_debugfs_portdestroy_write,
.open = simple_open,
.llseek = noop_llseek,
@@ -524,6 +525,7 @@ static ssize_t wwan_hwsim_debugfs_portcr
}
static const struct file_operations wwan_hwsim_debugfs_portcreate_fops = {
+ .owner = THIS_MODULE,
.write = wwan_hwsim_debugfs_portcreate_write,
.open = simple_open,
.llseek = noop_llseek,
@@ -545,6 +547,7 @@ static ssize_t wwan_hwsim_debugfs_devdes
}
static const struct file_operations wwan_hwsim_debugfs_devdestroy_fops = {
+ .owner = THIS_MODULE,
.write = wwan_hwsim_debugfs_devdestroy_write,
.open = simple_open,
.llseek = noop_llseek,
@@ -568,6 +571,7 @@ static ssize_t wwan_hwsim_debugfs_devcre
}
static const struct file_operations wwan_hwsim_debugfs_devcreate_fops = {
+ .owner = THIS_MODULE,
.write = wwan_hwsim_debugfs_devcreate_write,
.open = simple_open,
.llseek = noop_llseek,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 094/547] xfs: fix integer overflow problem when setting large free areas
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 093/547] wwan: wwan_hwsim: Pin module for debugfs file operations Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 095/547] dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints Greg Kroah-Hartman
` (461 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 7e55f84434f3a63d59feb8f89076d280ea9aa8e5 upstream.
LOLLM points out that the min_t comparison in xrep_rtbitmap_mark_free
operates on a 64-bit bitmap word offset quantity and a 32-bit
words-per-block ratio. Unfortunately, I should have done the comparison
with the (64-bit) xrep_wordoff_t type, but used the 32-bit word count
type. Oops.
Cc: stable@vger.kernel.org # v6.14
Fixes: 8defee8dff2b20 ("xfs: online repair of realtime bitmaps for a realtime group")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/rtbitmap_repair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/rtbitmap_repair.c
+++ b/fs/xfs/scrub/rtbitmap_repair.c
@@ -276,7 +276,7 @@ xrep_rtbitmap_mark_free(
xrep_wordoff_t rem;
xrep_wordcnt_t wordcnt;
- wordcnt = min_t(xrep_wordcnt_t, nextwordoff - wordoff,
+ wordcnt = min_t(xrep_wordoff_t, nextwordoff - wordoff,
bufwsize);
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 095/547] dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 094/547] xfs: fix integer overflow problem when setting large free areas Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 096/547] irqchip/gic-v5: Fix standalone IRSes OF probe Greg Kroah-Hartman
` (460 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Pieralisi, Thomas Gleixner,
Sascha Bischoff, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
[ Upstream commit 1d77e79d62cfe46ad3619d42ee0d1ebd3f0f79f4 ]
An IRS is architecturally allowed to be stand-alone (ie with no direct
CPU connection).
Relax "cpus" and "arm,iaffids" properties constraints allowing a standalone
IRS configuration.
Fixes: 7d7299bd07c6 ("dt-bindings: interrupt-controller: Add Arm GICv5")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20261015-gicv5-irs-no-cpus-v1-1-d4b337b7f000@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bindings/interrupt-controller/arm,gic-v5.yaml | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml
index 86ca7f3ac2810..b901e4288816a 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml
@@ -120,13 +120,14 @@ patternProperties:
cpus:
description:
- CPUs managed by the IRS.
+ CPUs managed by the IRS. Omit it if the IRS has no associated CPUs.
arm,iaffids:
$ref: /schemas/types.yaml#/definitions/uint16-array
description:
Interrupt AFFinity ID (IAFFID) associated with the CPU whose
CPU node phandle is at the same index in the cpus array.
+ Omit it if the IRS has no associated CPUs.
patternProperties:
"^its@[0-9a-f]+$":
@@ -210,12 +211,14 @@ patternProperties:
- reg
- reg-names
+ dependencies:
+ cpus: [ "arm,iaffids" ]
+ arm,iaffids: [ cpus ]
+
required:
- compatible
- reg
- reg-names
- - cpus
- - arm,iaffids
additionalProperties: false
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 096/547] irqchip/gic-v5: Fix standalone IRSes OF probe
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 095/547] dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 097/547] serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports Greg Kroah-Hartman
` (459 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Pieralisi, Thomas Gleixner,
Sascha Bischoff, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
[ Upstream commit 64212d63193cfd81849f5948365c7b0ecd011745 ]
An IRS is architecturally allowed to be standalone, namely, with no
direct CPUs connections. Make sure such configuration is allowed on
OF firmware by skipping "cpus" and "arm,iaffids" IRS node properties
parsing if they are not present so that the IRS configuration can
complete successfully.
Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20261015-gicv5-irs-no-cpus-v1-2-d4b337b7f000@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v5-irs.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 4486645a4b6f2..fb1cecef613b3 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -609,6 +609,10 @@ static int __init gicv5_irs_of_init_affinity(struct device_node *node,
u16 iaffid_mask = GENMASK(iaffid_bits - 1, 0);
int ret, i, ncpus, niaffids;
+ /* An IRS is architecturally allowed to have no cpus associated with it */
+ if (!of_property_present(node, "cpus") && !of_property_present(node, "arm,iaffids"))
+ return 0;
+
ncpus = of_count_phandle_with_args(node, "cpus", NULL);
if (ncpus < 0)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 097/547] serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 096/547] irqchip/gic-v5: Fix standalone IRSes OF probe Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 098/547] net/sched: cls_bpf: accept dev-bound programs on shared blocks Greg Kroah-Hartman
` (458 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Hengyu Liang, Johan Hovold,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit e1f46a09df93650288babb23de6e34bff73e80e6 ]
Commit 8ca59f7baee7 ("serial: fix ioctl hangup race") made
uart_set_info() and uart_do_autoconfig() return -EIO when TTY_IO_ERROR
is set, so that they do not run on a port that has been hung up.
However, TTY_IO_ERROR is also set on a port that could not be started,
for example because its type is unknown, and by uart_shutdown(), which
both functions call. As of now, setserial cannot configure a port that
the kernel did not detect, and an autoconfig that follows a port, irq or
type change in the same setserial call fails on any port.
The issue can be reproduced with setserial (busybox) on a port without
a detected UART, for example ttyS3 of a QEMU guest:
setserial /dev/ttyS3 uart 16550A
setserial -g /dev/ttyS3
Before commit 8ca59f7baee7 ("serial: fix ioctl hangup race"), the
result is:
/dev/ttyS3, UART: 16550A, Port: 0x02e8, IRQ: 3
After that commit, the result is:
setserial: can't set serial info: Input/output error
/dev/ttyS3, UART: unknown, Port: 0x02e8, IRQ: 3
This patch will check tty_port_active() in these two functions instead.
uart_hangup() clears it under the port mutex, and it stays set on an
open port that could not be started.
Fixes: 8ca59f7baee7 ("serial: fix ioctl hangup race")
Cc: stable@kernel.org
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Tested-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261010034616.3915864-1-hengyul@cs.unc.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/serial_core.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 6332ed545c899..81a985424694c 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -896,7 +896,11 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
upf_t old_flags, new_flags;
int retval;
- if (!uport || tty_io_error(tty))
+ /*
+ * TTY_IO_ERROR is also set on a port that could not be started, and
+ * this is how such a port is configured. Only refuse a hung up port.
+ */
+ if (!uport || !tty_port_active(port))
return -EIO;
new_port = new_info->port;
@@ -1144,7 +1148,8 @@ static int uart_do_autoconfig(struct tty_struct *tty, struct uart_state *state)
*/
scoped_cond_guard(mutex_intr, return -ERESTARTSYS, &port->mutex) {
uport = uart_port_check(state);
- if (!uport || tty_io_error(tty))
+ /* As in uart_set_info(), only refuse a hung up port. */
+ if (!uport || !tty_port_active(port))
return -EIO;
if (tty_port_users(port) != 1)
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 098/547] net/sched: cls_bpf: accept dev-bound programs on shared blocks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 097/547] serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 099/547] net/sched: cls_flower: avoid stale mask references after delete Greg Kroah-Hartman
` (457 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko (nipa), Victor Nogueira,
Jamal Hadi Salim, Simon Horman, Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
commit d305547d1632a242818c5ebb430c85121a2ed434 upstream.
The issue:
Follow-up to commit 120977e2c096 ("net/sched: cls_bpf: reject dev-bound
programs bound to a different device"), which derived the target device
from block->q:
dev = block->q ? qdisc_dev(block->q) : NULL;
tcf_block_create() leaves block->q NULL for shared blocks, so a
device-bound program attached through a shared block is rejected with
-EINVAL even when it is bound to a netdev that owns the block. The
offload path (cls_bpf_offload_cmd()) never consults block->q and drives
the per-device callbacks for shared blocks as before.
The Fix:
Accept the attach on a shared block when bpf_offload_dev_match() matches
every netdev bound to the block, and reject an empty block. Every member
must match because the offload path broadcasts the program to every
callback registered on the block, so an any-member check would re-admit
the wrong-device attach on a mixed block. Every dev-bound SCHED_CLS
attach is skip_sw, which becomes err_stop and aborts the offload on the
first failing callback, so the all-members rule is the offload path's own
semantics.
Iterate the public block->ports xarray (913b47d3424e, v6.8-rc1) rather
than block->owner_list, which is private to cls_api.c. The shared-block
rejection reports "Program is not bound to every device in the block",
distinct from the non-shared message, because a member can exist without
a registered callback (netdevsim registers its block callback
ingress-only).
Context note:
This patch is not an independent fix: it re-exposes the shared-block
replay path that commit 120977e2c096 ("net/sched: cls_bpf: reject
dev-bound programs bound to a different device") had closed, so patch 1
must be applied first, including in stable. A stable tree taking this
patch alone would re-enable shared-block attaches on a kernel whose
netdevsim callback is still unchecked.
Conditions to recreate the bug:
- CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
- load a dev-bound SCHED_CLS program for netdevsim device B
(prog_ifindex=B), pin it in bpffs
- tc qdisc add dev B ingress_block 22 clsact
- tc filter add block 22 ingress bpf da object-pinned <pin> skip_sw
Unfixed, the filter add fails with -EINVAL ("Program is bound to a
different device"); fixed, it succeeds. Adding a second, independently
backed netdevsim device to the same block makes the attach fail again.
Fixes: 120977e2c096 ("net/sched: cls_bpf: reject dev-bound programs bound to a different device")
Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
Cc: stable@vger.kernel.org
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-3@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/cls_bpf.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -392,11 +392,31 @@ static int cls_bpf_prog_from_efd(struct
if (bpf_prog_is_dev_bound(fp->aux)) {
struct tcf_block *block = tp->chain->block;
struct net_device *dev;
+ unsigned long ifindex;
+ bool match = false;
- dev = block->q ? qdisc_dev(block->q) : NULL;
- if (!dev || !bpf_offload_dev_match(fp, dev)) {
- NL_SET_ERR_MSG(extack,
- "Program is bound to a different device");
+ /* A shared block has no qdisc of its own, but it may bind
+ * several netdevs and the program is offloaded to all of them;
+ * require a match with every member.
+ */
+ if (!tcf_block_shared(block)) {
+ dev = qdisc_dev(tcf_block_q(block));
+ match = bpf_offload_dev_match(fp, dev);
+ if (!match)
+ NL_SET_ERR_MSG(extack,
+ "Program is bound to a different device");
+ } else {
+ xa_for_each(&block->ports, ifindex, dev) {
+ match = bpf_offload_dev_match(fp, dev);
+ if (!match)
+ break;
+ }
+ if (!match)
+ NL_SET_ERR_MSG(extack,
+ "Program is not bound to every device in the block");
+ }
+
+ if (!match) {
bpf_prog_put(fp);
return -EINVAL;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 099/547] net/sched: cls_flower: avoid stale mask references after delete
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 098/547] net/sched: cls_bpf: accept dev-bound programs on shared blocks Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 100/547] net/sched: sch_teql: fix slaves_lock IRQ deadlock Greg Kroah-Hartman
` (456 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Liu, Yucheng Lu, Yuhang Zheng,
Ren Wei, Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhang Zheng <z1652074432@gmail.com>
commit 58f7989da6e715ce834ac861b7ba6ae9f9bdb098 upstream.
Flower releases a mask reference when a filter is removed from the
classifier. The filter object can remain alive while dump, walk, or
hardware reoffload paths hold a reference to it. Those paths can then
dereference f->mask after the mask has already been released.
Keep the mask reference until the filter reference count reaches zero.
Release the mask synchronously from the final __fl_put() while the caller
still holds the tcf_proto reference, and leave the existing RCU work to
free the mask. This keeps the mask available to every reader that still
holds the filter.
The filter is still removed from the classifier indexes immediately.
Therefore, a deleted filter can temporarily retain an otherwise empty
mask; fl_delete() uses the handle IDR, rather than the mask list, to
determine whether the classifier has become empty.
Failed mask assignment can leave fnew->mask as an error or borrowed
pointer without an owned mask reference. Clear it before the common
failure path so the final put cannot release an unowned reference.
This fix does not add fields, snapshots, or per-filter memory.
Fixes: 92149190067d ("net: sched: flower: set unlocked flag for flower proto ops")
Cc: stable@vger.kernel.org
Reported-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Yuhang Zheng <z1652074432@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/20261012010720.2248662-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/cls_flower.c | 50 +++++++++++++++++++++++++++----------------------
1 file changed, 28 insertions(+), 22 deletions(-)
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -518,15 +518,22 @@ static void fl_hw_update_stats(struct tc
tcf_exts_hw_stats_update(&f->exts, &cls_flower.stats, cls_flower.use_act_stats);
}
-static void __fl_put(struct cls_fl_filter *f)
+static bool __fl_put(struct tcf_proto *tp, struct cls_fl_filter *f)
{
+ bool last = false;
+
if (!refcount_dec_and_test(&f->refcnt))
- return;
+ return false;
+
+ if (f->mask)
+ last = fl_mask_put(fl_head_dereference(tp), f->mask);
if (tcf_exts_get_net(&f->exts))
tcf_queue_work(&f->rwork, fl_destroy_filter_work);
else
__fl_destroy_filter(f);
+
+ return last;
}
static struct cls_fl_filter *__fl_get(struct cls_fl_head *head, u32 handle)
@@ -572,11 +579,10 @@ static int __fl_delete(struct tcf_proto
list_del_rcu(&f->list);
spin_unlock(&tp->lock);
- *last = fl_mask_put(head, f->mask);
if (!tc_skip_hw(f->flags))
fl_hw_destroy_filter(tp, f, rtnl_held, extack);
tcf_unbind_filter(tp, &f->res);
- __fl_put(f);
+ *last = __fl_put(tp, f);
return 0;
}
@@ -617,7 +623,7 @@ static void fl_put(struct tcf_proto *tp,
{
struct cls_fl_filter *f = arg;
- __fl_put(f);
+ __fl_put(tp, f);
}
static void *fl_get(struct tcf_proto *tp, u32 handle)
@@ -2488,12 +2494,14 @@ static int fl_change(struct net *net, st
}
err = fl_check_assign_mask(head, fnew, fold, mask);
- if (err)
+ if (err) {
+ fnew->mask = NULL;
goto unbind_filter;
+ }
err = fl_ht_insert_unique(fnew, fold, &in_ht);
if (err)
- goto errout_mask;
+ goto unbind_filter;
if (!tc_skip_hw(fnew->flags)) {
err = fl_hw_replace_filter(tp, fnew, rtnl_held, extack);
@@ -2547,7 +2555,6 @@ static int fl_change(struct net *net, st
spin_unlock(&tp->lock);
- fl_mask_put(head, fold->mask);
if (!tc_skip_hw(fold->flags))
fl_hw_destroy_filter(tp, fold, rtnl_held, NULL);
tcf_unbind_filter(tp, &fold->res);
@@ -2555,7 +2562,7 @@ static int fl_change(struct net *net, st
* after this.
*/
refcount_dec(&fold->refcnt);
- __fl_put(fold);
+ __fl_put(tp, fold);
} else {
idr_replace(&head->handle_idr, fnew, fnew->handle);
@@ -2580,9 +2587,6 @@ errout_hw:
if (in_ht)
rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
fnew->mask->filter_ht_params);
-errout_mask:
- fl_mask_put(head, fnew->mask);
-
unbind_filter:
if (bound_to_filter) {
if (flags & TCA_ACT_FLAGS_NO_RTNL)
@@ -2598,14 +2602,14 @@ errout_idr:
idr_remove(&head->handle_idr, fnew->handle);
spin_unlock(&tp->lock);
}
- __fl_put(fnew);
+ __fl_put(tp, fnew);
errout_tb:
kfree(tb);
errout_mask_alloc:
tcf_queue_work(&mask->rwork, fl_uninit_mask_free_work);
errout_fold:
if (fold)
- __fl_put(fold);
+ __fl_put(tp, fold);
return err;
}
@@ -2618,8 +2622,10 @@ static int fl_delete(struct tcf_proto *t
int err = 0;
err = __fl_delete(tp, f, &last_on_mask, rtnl_held, extack);
- *last = list_empty(&head->masks);
- __fl_put(f);
+ spin_lock(&tp->lock);
+ *last = idr_is_empty(&head->handle_idr);
+ spin_unlock(&tp->lock);
+ __fl_put(tp, f);
return err;
}
@@ -2641,12 +2647,12 @@ static void fl_walk(struct tcf_proto *tp
rcu_read_unlock();
if (arg->fn(tp, f, arg) < 0) {
- __fl_put(f);
+ __fl_put(tp, f);
arg->stop = 1;
rcu_read_lock();
break;
}
- __fl_put(f);
+ __fl_put(tp, f);
arg->count++;
rcu_read_lock();
}
@@ -2697,7 +2703,7 @@ static int fl_reoffload(struct tcf_proto
cls_flower.rule =
flow_rule_alloc(tcf_exts_num_actions(&f->exts));
if (!cls_flower.rule) {
- __fl_put(f);
+ __fl_put(tp, f);
return -ENOMEM;
}
@@ -2715,7 +2721,7 @@ static int fl_reoffload(struct tcf_proto
if (err) {
kfree(cls_flower.rule);
if (tc_skip_sw(f->flags)) {
- __fl_put(f);
+ __fl_put(tp, f);
return err;
}
goto next_flow;
@@ -2731,11 +2737,11 @@ static int fl_reoffload(struct tcf_proto
kfree(cls_flower.rule);
if (err) {
- __fl_put(f);
+ __fl_put(tp, f);
return err;
}
next_flow:
- __fl_put(f);
+ __fl_put(tp, f);
}
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 100/547] net/sched: sch_teql: fix slaves_lock IRQ deadlock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 099/547] net/sched: cls_flower: avoid stale mask references after delete Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 101/547] net/sched: sch_teql: fix use-after-free on lower qdisc drop Greg Kroah-Hartman
` (455 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko (gemini), Jamal Hadi Salim,
Simon Horman, Paolo Abeni
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
commit 8b2043279dae25483fe1f2d926e76d41ab95c398 upstream.
This is a followup of commit e5b811fe7931 ("net/sched: sch_teql:
Introduce slaves_lock to avoid race condition and UAF") as reported by
Sashiko.
The issue: master->slaves_lock serializes the master's ring of slave
qdiscs. The control paths -- teql_dequeue(), teql_destroy() and
teql_qdisc_init() -- take it with spin_lock_bh(), while
teql_master_xmit() (the master's ndo_start_xmit) takes it with plain
spin_lock().
netpoll_send_skb() wraps the transmit in local_irq_save(), and
__netpoll_send_skb() asserts lockdep_assert_irqs_disabled(), so
teql_master_xmit() reached from netconsole always acquires slaves_lock
with hard IRQs disabled. On PREEMPT_RT spinlock_t is an rtmutex, and
Documentation/locking/locktypes.rst names
local_irq_disable();
spin_lock(&lock);
as a sequence that breaks there because the rtmutex requires a fully
preemptible context. This is reachable without any panic: the nbcon
printer thread calls netconsole's write_thread() callback on every
message. The usual remedy -- folding the IRQ disable into the lock with
spin_lock_irqsave() -- is unavailable because the local_irq_save() is
netpoll's, not ours.
On non-RT the same asymmetry leaves slaves_lock acquirable with hard IRQs
disabled on one path and held with hard IRQs enabled on another. That is
only exploitable during the panic console flush (netconsole is
CON_NBCON_ATOMIC_UNSAFE, so console_is_usable() admits its write_atomic()
only from nbcon_atomic_flush_unsafe(), which panic() alone calls), and
even then an IRQ-saving lock does not help if the holder oopsed inside the
section or was stopped by panic_other_cpus_shutdown(). So the non-RT half
is hardening; the PREEMPT_RT half is the bug.
The Fix: take slaves_lock as a raw spinlock with IRQs saved at every
site. Since skb_queue_purge() takes the queue's spinlock_t and may not
nest inside a raw lock on PREEMPT_RT, move its call in teql_destroy()
outside the raw section; dat->q is the dying qdisc's own queue and was
never serialized by slaves_lock, so the move is behaviour-neutral.
The new critical sections contain only RCU pointer assignments and
netdev_get_tx_queue(); skb_queue_purge(), netif_wake_queue() and
dev_reset_queue() are all outside them. teql_destroy()'s ring walk is
O(slaves), two pointer loads and a compare per iteration, so even a large
ring is microseconds with IRQs off. Keeping the purge conditional rather
than dropping it outright is the conservative call for a backport.
Some context: commit 6301f6a34ed8 ("net/sched: sch_teql: move
rcu_read_lock()/spin_lock() from _bh variants") hardened the parent
fix; together they addressed the master->slaves resurrection
use-after-free and the xmit-side BH warning but left the reverse
direction -- a hard IRQ re-entering xmit while a control path holds the
lock -- unaddressed.
Conditions to recreate the bug:
- CONFIG_PREEMPT_RT, CONFIG_NET_SCH_TEQL, CONFIG_DUMMY and
CONFIG_NETCONSOLE.
- Run `ip link add dev teqlslave0 type dummy`, bring teqlslave0 up, attach
it with `tc qdisc add dev teqlslave0 root teql0`, and bring teql0 up.
- Configure a netconsole target on teql0 with explicit local and remote
IP addresses and a remote MAC address, then emit a console message.
The nbcon printer thread reaches teql_master_xmit() with hard IRQs
disabled by netpoll; taking slaves_lock as a spinlock_t is invalid on
PREEMPT_RT. No panic or concurrent qdisc change is required.
- Reachable by an admin with CAP_NET_ADMIN; teql devices exist only in the
initial netns (no per-netns ops), so a user namespace does not suffice.
Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
Reported-by: Sashiko (gemini) <sashiko-bot@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260630150922.238714-1-jhs%40mojatatu.com
Link: https://lore.kernel.org/netdev/20260630150922.238714-1-jhs@mojatatu.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625-1@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_teql.c | 45 ++++++++++++++++++++++++++++-----------------
1 file changed, 28 insertions(+), 17 deletions(-)
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -53,7 +53,7 @@ struct teql_master {
struct Qdisc_ops qops;
struct net_device *dev;
struct Qdisc __rcu *slaves;
- spinlock_t slaves_lock; /* serializes writes to ->slaves */
+ raw_spinlock_t slaves_lock; /* serializes writes to ->slaves */
struct list_head master_list;
unsigned long tx_bytes;
unsigned long tx_packets;
@@ -92,6 +92,7 @@ teql_dequeue(struct Qdisc *sch)
{
struct teql_sched_data *dat = qdisc_priv(sch);
struct netdev_queue *dat_queue;
+ unsigned long flags;
struct sk_buff *skb;
struct Qdisc *q;
@@ -102,9 +103,9 @@ teql_dequeue(struct Qdisc *sch)
if (skb == NULL) {
struct net_device *m = qdisc_dev(q);
if (m) {
- spin_lock_bh(&dat->m->slaves_lock);
+ raw_spin_lock_irqsave(&dat->m->slaves_lock, flags);
rcu_assign_pointer(dat->m->slaves, sch);
- spin_unlock_bh(&dat->m->slaves_lock);
+ raw_spin_unlock_irqrestore(&dat->m->slaves_lock, flags);
netif_wake_queue(m);
}
} else {
@@ -137,11 +138,13 @@ teql_destroy(struct Qdisc *sch)
struct teql_master *master = dat->m;
struct netdev_queue *txq = NULL;
bool reset_master_queue = false;
+ unsigned long flags;
+ bool purge = false;
if (!master)
return;
- spin_lock_bh(&master->slaves_lock);
+ raw_spin_lock_irqsave(&master->slaves_lock, flags);
prev = rcu_dereference_protected(master->slaves,
lockdep_is_held(&master->slaves_lock));
if (prev) {
@@ -169,12 +172,18 @@ teql_destroy(struct Qdisc *sch)
reset_master_queue = true;
}
}
- skb_queue_purge(&dat->q);
+ purge = true;
break;
} while (prev != rcu_dereference_protected(master->slaves,
lockdep_is_held(&master->slaves_lock)));
}
- spin_unlock_bh(&master->slaves_lock);
+ raw_spin_unlock_irqrestore(&master->slaves_lock, flags);
+
+ /* skb_queue_purge() takes the queue's spinlock_t, which cannot nest
+ * inside a raw lock on PREEMPT_RT; purge after the raw section.
+ */
+ if (purge)
+ skb_queue_purge(&dat->q);
if (reset_master_queue)
dev_reset_queue(master->dev, txq, NULL);
@@ -187,6 +196,7 @@ static int teql_qdisc_init(struct Qdisc
struct teql_master *m = (struct teql_master *)sch->ops;
struct teql_sched_data *q = qdisc_priv(sch);
struct Qdisc *first;
+ unsigned long flags;
if (dev->hard_header_len > m->dev->hard_header_len)
return -EINVAL;
@@ -203,7 +213,7 @@ static int teql_qdisc_init(struct Qdisc
skb_queue_head_init(&q->q);
- spin_lock_bh(&m->slaves_lock);
+ raw_spin_lock_irqsave(&m->slaves_lock, flags);
first = rcu_dereference_protected(m->slaves, lockdep_is_held(&m->slaves_lock));
if (first) {
if (m->dev->flags & IFF_UP) {
@@ -214,7 +224,7 @@ static int teql_qdisc_init(struct Qdisc
(m->dev->flags & IFF_MULTICAST &&
!(dev->flags & IFF_MULTICAST)) ||
dev->mtu < m->dev->mtu) {
- spin_unlock_bh(&m->slaves_lock);
+ raw_spin_unlock_irqrestore(&m->slaves_lock, flags);
return -EINVAL;
}
} else {
@@ -237,7 +247,7 @@ static int teql_qdisc_init(struct Qdisc
m->dev->mtu = dev->mtu;
m->dev->flags = (m->dev->flags&~FMASK)|(dev->flags&FMASK);
}
- spin_unlock_bh(&m->slaves_lock);
+ raw_spin_unlock_irqrestore(&m->slaves_lock, flags);
return 0;
}
@@ -302,11 +312,12 @@ static inline int teql_resolve(struct sk
static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct teql_master *master = netdev_priv(dev);
- struct Qdisc *start, *q;
- int busy;
- int nores;
int subq = skb_get_queue_mapping(skb);
struct sk_buff *skb_res = NULL;
+ struct Qdisc *start, *q;
+ unsigned long flags;
+ int nores;
+ int busy;
restart:
nores = 0;
@@ -342,13 +353,13 @@ restart:
netdev_start_xmit(skb, slave, slave_txq, false) ==
NETDEV_TX_OK) {
__netif_tx_unlock(slave_txq);
- spin_lock(&master->slaves_lock);
+ raw_spin_lock_irqsave(&master->slaves_lock, flags);
if (rcu_dereference_protected(master->slaves,
lockdep_is_held(&master->slaves_lock)) == q)
rcu_assign_pointer(master->slaves,
rcu_dereference_protected(NEXT_SLAVE(q),
lockdep_is_held(&master->slaves_lock)));
- spin_unlock(&master->slaves_lock);
+ raw_spin_unlock_irqrestore(&master->slaves_lock, flags);
netif_wake_queue(dev);
master->tx_packets++;
master->tx_bytes += length;
@@ -361,13 +372,13 @@ restart:
busy = 1;
break;
case 1:
- spin_lock(&master->slaves_lock);
+ raw_spin_lock_irqsave(&master->slaves_lock, flags);
if (rcu_dereference_protected(master->slaves,
lockdep_is_held(&master->slaves_lock)) == q)
rcu_assign_pointer(master->slaves,
rcu_dereference_protected(NEXT_SLAVE(q),
lockdep_is_held(&master->slaves_lock)));
- spin_unlock(&master->slaves_lock);
+ raw_spin_unlock_irqrestore(&master->slaves_lock, flags);
rcu_read_unlock();
return NETDEV_TX_OK;
default:
@@ -489,7 +500,7 @@ static __init void teql_master_setup(str
struct teql_master *master = netdev_priv(dev);
struct Qdisc_ops *ops = &master->qops;
- spin_lock_init(&master->slaves_lock);
+ raw_spin_lock_init(&master->slaves_lock);
master->dev = dev;
ops->priv_size = sizeof(struct teql_sched_data);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 101/547] net/sched: sch_teql: fix use-after-free on lower qdisc drop
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 100/547] net/sched: sch_teql: fix slaves_lock IRQ deadlock Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 102/547] net/sched: fix packet reordering on requeue Greg Kroah-Hartman
` (454 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, owen kwan, Jamal Hadi Salim,
Simon Horman, Paolo Abeni
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: owen kwan <owen@verialabs.com>
commit 782d6bb8f9b8e9d8591181662222bf74cd3ecf79 upstream.
The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return
value against NETDEV_TX_OK alone. A slave that consumes the skb but
returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated
as if the skb were still owned, so the loop restores skb->dev and calls
__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()
from its ndo_start_xmit() (propagated since cbbef5e18307), and when the
lower qdisc drops the packet that value is NET_XMIT_DROP after the skb
has been freed, giving a use-after-free in teql_master_xmit().
The Fix: test for consumption with dev_xmit_complete(), which accepts
NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that
need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps
the packet counted in tx_packets/tx_bytes and advances the slave; a
consumed result that is neither a success nor NET_XMIT_CN ends the
attempt and is charged to tx_dropped, so lower-qdisc drops are no longer
reported as good transmits. NET_XMIT_CN is counted like success because
it can accompany acceptance of the current packet: pfifo_head_drop drops
the old head, enqueues the current skb and returns NET_XMIT_CN.
Conditions to recreate the bug:
With CONFIG_NET_SCH_TEQL,
CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and
lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0
and a teql0 root on lkrvlan0; bring teql0 up with an address and send one
UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower
qdisc while holding a freed skb.
Fixes: 572a9d7b6fc7 ("net: allow to propagate errors through ->ndo_hard_start_xmit()")
Link: https://lore.kernel.org/netdev/179248763469.3135.1739559328868319628@kernel.org/
Link: https://lore.kernel.org/netdev/20261023162821.GN708417@horms.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: owen kwan <owen@verialabs.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625-2@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_teql.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -347,12 +347,18 @@ restart:
case 0:
if (__netif_tx_trylock(slave_txq)) {
unsigned int length = qdisc_pkt_len(skb);
+ int rc = NETDEV_TX_BUSY;
skb->dev = slave;
- if (!netif_xmit_frozen_or_stopped(slave_txq) &&
- netdev_start_xmit(skb, slave, slave_txq, false) ==
- NETDEV_TX_OK) {
- __netif_tx_unlock(slave_txq);
+ if (!netif_xmit_frozen_or_stopped(slave_txq))
+ rc = netdev_start_xmit(skb, slave, slave_txq, false);
+ __netif_tx_unlock(slave_txq);
+ if (dev_xmit_complete(rc)) {
+ if (rc != NETDEV_TX_OK && rc != NET_XMIT_CN) {
+ master->tx_dropped++;
+ rcu_read_unlock();
+ return NETDEV_TX_OK;
+ }
raw_spin_lock_irqsave(&master->slaves_lock, flags);
if (rcu_dereference_protected(master->slaves,
lockdep_is_held(&master->slaves_lock)) == q)
@@ -366,7 +372,6 @@ restart:
rcu_read_unlock();
return NETDEV_TX_OK;
}
- __netif_tx_unlock(slave_txq);
}
if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)))
busy = 1;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 102/547] net/sched: fix packet reordering on requeue
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 101/547] net/sched: sch_teql: fix use-after-free on lower qdisc drop Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 103/547] net/sched: act_ife: do not consume the inner header on egress Greg Kroah-Hartman
` (453 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antonio Quartulli, Eric Dumazet,
Jesper Dangaard Brouer, Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Quartulli <antonio@mandelbit.com>
commit 14368b9aa1017fee35d2589be7b17e0485c0f93e upstream.
dev_requeue_skb() appends requeued skbs to the tail of q->gso_skb, while
dequeue_skb() takes them back one at a time from the head. If the driver
returns NETDEV_TX_BUSY again for the first of them, it moves behind the
skbs still parked there and is sent after them.
This showed up as heavy TCP reordering while benchmarking over veth,
which returns NETDEV_TX_BUSY whenever its ring is full since
commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops").
Requeue the skbs at the head of gso_skb, keeping their order. With 4 TCP
streams over a veth pair with a pfifo qdisc, this removes about 1.3M
out-of-order segments and 15-37k retransmits per 15 seconds, and raises
throughput from about 40 to 76 Gbit/s.
Fixes: a53851e2c321 ("net: sched: explicit locking in gso_cpu fallback")
Fixes: 9540d977618c ("net: sched: fix skb leak in dev_requeue_skb()")
Cc: stable@vger.kernel.org
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/20261026153113.3275494-1-antonio@mandelbit.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_generic.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -168,8 +168,11 @@ static inline void qdisc_enqueue_skb_bad
static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
{
+ struct sk_buff_head requeue;
spinlock_t *lock = NULL;
+ __skb_queue_head_init(&requeue);
+
if (q->flags & TCQ_F_NOLOCK) {
lock = qdisc_lock(q);
spin_lock(lock);
@@ -178,7 +181,7 @@ static inline void dev_requeue_skb(struc
while (skb) {
struct sk_buff *next = skb->next;
- __skb_queue_tail(&q->gso_skb, skb);
+ __skb_queue_tail(&requeue, skb);
/* it's still part of the queue */
if (qdisc_is_percpu_stats(q)) {
@@ -194,6 +197,11 @@ static inline void dev_requeue_skb(struc
skb = next;
}
+ /* the skbs may come from the head of gso_skb, so put them back there:
+ * appending them would let the ones still parked overtake them
+ */
+ skb_queue_splice(&requeue, &q->gso_skb);
+
if (lock) {
spin_unlock(lock);
set_bit(__QDISC_STATE_MISSED, &q->state);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 103/547] net/sched: act_ife: do not consume the inner header on egress
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 102/547] net/sched: fix packet reordering on requeue Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 104/547] driver core: take parent lock on deferred probe Greg Kroah-Hartman
` (452 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Eric Dumazet,
Alexei Starovoitov, Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
commit 498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7 upstream.
The issue:
tcf_ife_decode() unconditionally calls eth_type_trans(), which pulls
ETH_HLEN. On egress this consumes the inner Ethernet header, and the
device receives an skb whose data points to the L3 header:
- loopback_xmit() parses L3 data as Ethernet: the "ethertype" comes
from the inner IPv4 source address, and the decapsulated packet is
dropped or misparsed.
- a real NIC transmits the frame without its Ethernet header.
(The __skb_pull() BUG this used to trigger in loopback_xmit() when the
remaining linear area was short is handled by "loopback: use
eth_type_trans_careful()".)
The Fix:
Parse the inner Ethernet header with eth_type_trans() in both directions,
then restore the egress data position and MAC length. On ingress the
existing behavior is unchanged. On egress, push the inner Ethernet header
back after parsing so the xmit path sees the original frame and later
actions see a consistent network header.
Conditions to recreate the bug:
- egress tc filter on lo: action ife decode pipe;
- AF_PACKET SOCK_RAW frame: outer Ethernet with ETH_P_IFE, IFE metadata,
inner Ethernet + a valid IPv4 ICMP echo request to a local address;
- before this patch, no echo is received; after it, the echo is
delivered and answered.
Fixes: ef6980b6becb ("introduce IFE action")
Cc: stable@vger.kernel.org
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
[edumazet: reworded changelog, the crash is now handled in loopback]
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261028122703.2093730-6-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/act_ife.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -769,6 +769,10 @@ static int tcf_ife_decode(struct sk_buff
skb->protocol = eth_type_trans(skb, skb->dev);
skb_reset_network_header(skb);
+ if (!skb_at_tc_ingress(skb)) {
+ skb_push(skb, ETH_HLEN);
+ skb_reset_mac_len(skb);
+ }
return action;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 104/547] driver core: take parent lock on deferred probe
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 103/547] net/sched: act_ife: do not consume the inner header on egress Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 105/547] driver core: Limit the messages on a refused uevent Greg Kroah-Hartman
` (451 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Peter, Johan Hovold,
Danilo Krummrich
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 4059f8986c8f50102a04335cc1da4921dfd262d8 upstream.
USB interfaces should be probed with the parent USB device lock held,
but this is not honoured when probe is deferred.
Add a new bus_probe_device_deferred() helper to handle deferred probe
where the parent device lock is not held.
Fixes: d1c3414c2a9d ("drivercore: Add driver probe deferral mechanism")
Reported-by: Mario Peter <mario.peter@leica-geosystems.com>
Link: https://lore.kernel.org/20261007131514.1260696-1-mario.peter@leica-geosystems.com
Cc: stable@vger.kernel.org # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261014133109.1392265-3-johan@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/base.h | 1 +
drivers/base/bus.c | 28 +++++++++++++++++++++-------
drivers/base/dd.c | 7 ++++---
3 files changed, 26 insertions(+), 10 deletions(-)
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -154,6 +154,7 @@ struct kobject *virtual_device_parent(vo
int bus_add_device(struct device *dev);
void bus_probe_device(struct device *dev);
+void bus_probe_device_deferred(struct device *dev);
void bus_remove_device(struct device *dev);
void bus_notify(struct device *dev, enum bus_notifier_event value);
bool bus_is_registered(const struct bus_type *bus);
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -603,13 +603,7 @@ out_put:
return error;
}
-/**
- * bus_probe_device - probe drivers for a new device
- * @dev: device to probe
- *
- * - Automatically probe for a driver if the bus allows it.
- */
-void bus_probe_device(struct device *dev)
+static void __bus_probe_device(struct device *dev)
{
struct subsys_private *sp = bus_to_subsys(dev->bus);
struct subsys_interface *sif;
@@ -628,6 +622,26 @@ void bus_probe_device(struct device *dev
}
/**
+ * bus_probe_device - probe drivers for a new device
+ * @dev: device to probe
+ *
+ * - Automatically probe for a driver if the bus allows it.
+ */
+void bus_probe_device(struct device *dev)
+{
+ __bus_probe_device(dev);
+}
+
+void bus_probe_device_deferred(struct device *dev)
+{
+ if (dev->type && dev->type->need_parent_lock)
+ device_lock(dev->parent);
+ __bus_probe_device(dev);
+ if (dev->type && dev->type->need_parent_lock)
+ device_unlock(dev->parent);
+}
+
+/**
* bus_remove_device - remove device from bus
* @dev: device to be removed
*
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -86,8 +86,9 @@ static void deferred_probe_work_func(str
/*
* This block processes every device in the deferred 'active' list.
* Each device is removed from the active list and passed to
- * bus_probe_device() to re-attempt the probe. The loop continues
- * until every device in the active list is removed and retried.
+ * bus_probe_device_deferred() to re-attempt the probe. The loop
+ * continues until every device in the active list is removed and
+ * retried.
*
* Note: Once the device is removed from the list and the mutex is
* released, it is possible for the device get freed by another thread
@@ -121,7 +122,7 @@ static void deferred_probe_work_func(str
device_pm_move_to_tail(dev);
dev_dbg(dev, "Retrying from deferred list\n");
- bus_probe_device(dev);
+ bus_probe_device_deferred(dev);
mutex_lock(&deferred_probe_mutex);
put_device(dev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 105/547] driver core: Limit the messages on a refused uevent
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 104/547] driver core: take parent lock on deferred probe Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 106/547] driver core: fix parent lock use-after-free on USB disconnect Greg Kroah-Hartman
` (450 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Josef Bacik
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
commit a01c8e5b1dff1ce489e6b339139e744db36b8bb3 upstream.
A write to a "uevent" file which is no valid action makes
kobject_synth_uevent() print a warning and uevent_store() an error every
time. This is generally considered a bad thing so rate limit these
messages.
Fixes: b0e37c0d8a6a ("net-sysfs: make sure objects belong to container's owner")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/2026102718-conduit-glorious-a8dc@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/core.c | 4 +++-
lib/kobject_uevent.c | 6 +++---
2 files changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2847,7 +2847,9 @@ static ssize_t uevent_store(struct devic
rc = kobject_synth_uevent(&dev->kobj, buf, count);
if (rc) {
- dev_err(dev, "uevent: failed to send synthetic uevent: %d\n", rc);
+ dev_err_ratelimited(dev,
+ "uevent: failed to send synthetic uevent: %d\n",
+ rc);
return rc;
}
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -223,9 +223,9 @@ int kobject_synth_uevent(struct kobject
out:
if (r) {
devpath = kobject_get_path(kobj, GFP_KERNEL);
- pr_warn("synth uevent: %s: %s\n",
- devpath ?: "unknown device",
- msg ?: "failed to send uevent");
+ pr_warn_ratelimited("synth uevent: %s: %s\n",
+ devpath ?: "unknown device",
+ msg ?: "failed to send uevent");
kfree(devpath);
}
return r;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 106/547] driver core: fix parent lock use-after-free on USB disconnect
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 105/547] driver core: Limit the messages on a refused uevent Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 107/547] driver core: take parent lock in async device attach Greg Kroah-Hartman
` (449 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Johan Hovold,
Danilo Krummrich
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 0f554506a3fc6a21e714adf38cc3eb0ffe1bb452 upstream.
USB interfaces should be probed with their parent USB device lock held
and the USB bus therefore sets the need_parent_lock bus flag so that
driver core takes the parent lock when needed.
Driver core is only guaranteed to hold a reference to the parent device
during initial probe however and nothing prevents the device and its
parent from being deregistered and the parent potentially freed, for
example, while iterating over devices in driver_attach() or
bus_rescan_devices_helper().
Since commit 524134d42231 ("USB: don't cancel queued resets when
unbinding drivers") USB interfaces hold a reference to their parent USB
device, but a parent hub may still go away while probing a USB device
(e.g. via the drivers_probe sysfs interface). This can lead to a
use-after-free when taking the parent device lock before checking the
device->p->dead flag of the device being probed.
As only USB interfaces actually need the parent lock, make the
need_parent_lock feature even more fine grained by making it a device
type rather than bus feature. By requiring that any users also make sure
that their devices hold a reference to their parents (like USB does),
driver core can lock a device and its parent without first checking if
the device has been deregistered.
Note that this will also increase parallelism when using asynchronous
probe as USB devices connected to the same hub can now be probed in
parallel.
Fixes: bf74ad5bc417 ("[PATCH] Hold the device's parent's lock during probe and remove")
Cc: stable@vger.kernel.org # 2.6.16: 524134d42231: USB: don't cancel queued resets when unbinding drivers
Cc: stable@vger.kernel.org # 2.6.16
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261014133109.1392265-2-johan@kernel.org
[ Fix mention of bus vs. device type in __device_driver_{un}lock().
- Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/bus.c | 4 ++--
drivers/base/dd.c | 8 ++++----
drivers/usb/core/driver.c | 1 -
drivers/usb/core/message.c | 1 +
include/linux/device.h | 5 +++++
include/linux/device/bus.h | 3 ---
6 files changed, 12 insertions(+), 10 deletions(-)
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -863,10 +863,10 @@ static int __must_check bus_rescan_devic
int ret = 0;
if (!dev->driver) {
- if (dev->parent && dev->bus->need_parent_lock)
+ if (dev->type && dev->type->need_parent_lock)
device_lock(dev->parent);
ret = device_attach(dev);
- if (dev->parent && dev->bus->need_parent_lock)
+ if (dev->type && dev->type->need_parent_lock)
device_unlock(dev->parent);
}
return ret < 0 ? ret : 0;
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1159,7 +1159,7 @@ void device_initial_probe(struct device
/*
* __device_driver_lock - acquire locks needed to manipulate dev->drv
* @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the bus requires parent lock
+ * @parent: Parent device. Needed if the device type requires parent lock
*
* This function will take the required locks for manipulating dev->drv.
* Normally this will just be the @dev lock, but when called for a USB
@@ -1167,7 +1167,7 @@ void device_initial_probe(struct device
*/
static void __device_driver_lock(struct device *dev, struct device *parent)
{
- if (parent && dev->bus->need_parent_lock)
+ if (dev->type && dev->type->need_parent_lock && parent)
device_lock(parent);
device_lock(dev);
}
@@ -1175,7 +1175,7 @@ static void __device_driver_lock(struct
/*
* __device_driver_unlock - release locks needed to manipulate dev->drv
* @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the bus requires parent lock
+ * @parent: Parent device. Needed if the device type requires parent lock
*
* This function will release the required locks for manipulating dev->drv.
* Normally this will just be the @dev lock, but when called for a
@@ -1184,7 +1184,7 @@ static void __device_driver_lock(struct
static void __device_driver_unlock(struct device *dev, struct device *parent)
{
device_unlock(dev);
- if (parent && dev->bus->need_parent_lock)
+ if (dev->type && dev->type->need_parent_lock && parent)
device_unlock(parent);
}
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -2081,5 +2081,4 @@ const struct bus_type usb_bus_type = {
.name = "usb",
.match = usb_device_match,
.uevent = usb_uevent,
- .need_parent_lock = true,
};
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1922,6 +1922,7 @@ const struct device_type usb_if_device_t
.name = "usb_interface",
.release = usb_release_interface,
.uevent = usb_if_uevent,
+ .need_parent_lock = true,
};
static struct usb_interface_assoc_descriptor *find_iad(struct usb_device *dev,
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -83,6 +83,10 @@ int subsys_virtual_register(const struct
* information, equivalent to the kobj_type of a kobject.
* If "name" is specified, the uevent will contain it in
* the DEVTYPE variable.
+ *
+ * @need_parent_lock: When probing or removing a device of this type,
+ * driver core should lock the device's parent. Note that
+ * the device must hold a reference to its parent.
*/
struct device_type {
const char *name;
@@ -93,6 +97,7 @@ struct device_type {
void (*release)(struct device *dev);
const struct dev_pm_ops *pm;
+ bool need_parent_lock;
};
/**
--- a/include/linux/device/bus.h
+++ b/include/linux/device/bus.h
@@ -68,8 +68,6 @@ struct fwnode_handle;
* @driver_override: Set to true if this bus supports the driver_override
* mechanism, which allows userspace to force a specific
* driver to bind to a device via a sysfs attribute.
- * @need_parent_lock: When probing or removing a device on this bus, the
- * device core should lock the device's parent.
*
* A bus is a channel between the processor and one or more devices. For the
* purposes of the device model, all devices are connected via a bus, even if
@@ -110,7 +108,6 @@ struct bus_type {
const struct dev_pm_ops *pm;
bool driver_override;
- bool need_parent_lock;
};
int __must_check bus_register(const struct bus_type *bus);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 107/547] driver core: take parent lock in async device attach
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 106/547] driver core: fix parent lock use-after-free on USB disconnect Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 108/547] Drivers: hv: vmbus: Bounds check the shared ring buffer indices Greg Kroah-Hartman
` (448 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Peter, Dmitry Torokhov,
Johan Hovold, Danilo Krummrich
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Peter <mario.peter@leica-geosystems.com>
commit 187a62f99da29b1a55602b0d401a783d8dc86161 upstream.
For device types with need_parent_lock set (only USB interfaces),
probe() must run with the parent device locked. A synchronous attach
after device_add() gets this from the caller, e.g.
usb_set_configuration() holds the udev lock while adding interfaces.
__device_attach_async_helper() runs the probe from an async worker
instead, where that lock isn't held, and only takes device_lock(dev).
With async probing enabled for the hub driver (e.g. driver_async_probe=*
or driver_async_probe=hub), this races when a multi-TT hub is
configured. For multi-TT hubs, hub_probe() calls
usb_set_interface(hdev, 0, 1) to select the TT-per-port altsetting, and
usb_set_interface() creates the endpoint devices of the interface a
second time:
usb_set_configuration() async worker
[udev locked]
device_add(intf)
queues the probe ----------> __device_attach_async_helper()
[intf locked, udev not locked]
hub_probe()
usb_set_interface(hdev, 0, 1)
create_intf_ep_devs(intf) create_intf_ep_devs(intf)
create_intf_ep_devs() checks and sets intf->ep_devs_created without a
lock of its own. If usb_set_configuration() has created ep_81 but not
yet set the flag, usb_set_interface() skips removing the endpoint
devices of the old altsetting and creates ep_81 again. With a
synchronous probe, hub_probe() runs inside device_add() with the udev
lock held, and usb_set_configuration() then finds ep_devs_created
already set.
Single-TT hubs don't call usb_set_interface() from hub_probe() and
don't show this warning, but their probe runs without the udev lock as
well.
On an i.MX8MM board with an onboard USB2514 hub this hit 11 of 100
boots:
sysfs: cannot create duplicate filename '.../1-1/1-1:1.0/ep_81'
Call trace:
sysfs_warn_dup
usb_create_ep_devs
create_intf_ep_devs
usb_set_interface
hub_probe
usb_probe_interface
really_probe
__device_attach_async_helper
async_run_entry_fn
It also shows on v7.3-rc6 in QEMU, with dummy_hcd and a raw-gadget
program emulating a multi-TT hub: re-authorizing the hub in a loop,
while a SCHED_FIFO task preempts the writing task at random points for
3 ms, hit the warning in 29 of 6000 iterations.
Take the parent lock in __device_attach_async_helper() as well, like
__driver_attach_async_helper() does, and move
__device_driver_lock/unlock() up for that. With this the warning was
gone in 300 boots on the board and in 6000 iterations in QEMU.
Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers")
Signed-off-by: Mario Peter <mario.peter@leica-geosystems.com>
Cc: stable@vger.kernel.org # 4.2
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ johan: switch to async_schedule_dev_nocall() to avoid deadlock if
async_schedule_dev() runs synchronously when parent lock is
held ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261014133109.1392265-4-johan@kernel.org
[ Fold the nested conditions into a single if statement; correct commit
message to mention "device types" rather than "buses" for
"need_parent_lock". - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/dd.c | 83 +++++++++++++++++++++++++++++-------------------------
1 file changed, 45 insertions(+), 38 deletions(-)
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1030,6 +1030,38 @@ static int __device_attach_driver(struct
return ret == 0;
}
+/*
+ * __device_driver_lock - acquire locks needed to manipulate dev->drv
+ * @dev: Device we will update driver info for
+ * @parent: Parent device. Needed if the device type requires parent lock
+ *
+ * This function will take the required locks for manipulating dev->drv.
+ * Normally this will just be the @dev lock, but when called for a USB
+ * interface, @parent lock will be held as well.
+ */
+static void __device_driver_lock(struct device *dev, struct device *parent)
+{
+ if (dev->type && dev->type->need_parent_lock && parent)
+ device_lock(parent);
+ device_lock(dev);
+}
+
+/*
+ * __device_driver_unlock - release locks needed to manipulate dev->drv
+ * @dev: Device we will update driver info for
+ * @parent: Parent device. Needed if the device type requires parent lock
+ *
+ * This function will release the required locks for manipulating dev->drv.
+ * Normally this will just be the @dev lock, but when called for a
+ * USB interface, @parent lock will be released as well.
+ */
+static void __device_driver_unlock(struct device *dev, struct device *parent)
+{
+ device_unlock(dev);
+ if (dev->type && dev->type->need_parent_lock && parent)
+ device_unlock(parent);
+}
+
static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
{
struct device *dev = _dev;
@@ -1039,7 +1071,7 @@ static void __device_attach_async_helper
.want_async = true,
};
- device_lock(dev);
+ __device_driver_lock(dev, dev->parent);
/*
* Check if device has already been removed or claimed. This may
@@ -1061,7 +1093,7 @@ static void __device_attach_async_helper
if (dev->parent)
pm_runtime_put(dev->parent);
out_unlock:
- device_unlock(dev);
+ __device_driver_unlock(dev, dev->parent);
put_device(dev);
}
@@ -1118,8 +1150,11 @@ static int __device_attach(struct device
}
out_unlock:
device_unlock(dev);
- if (async)
- async_schedule_dev(__device_attach_async_helper, dev);
+ if (async && !async_schedule_dev_nocall(__device_attach_async_helper, dev)) {
+ put_device(dev);
+ ret = 2; /* retry synchronously */
+ }
+
return ret;
}
@@ -1146,48 +1181,20 @@ EXPORT_SYMBOL_GPL(device_attach);
void device_initial_probe(struct device *dev)
{
struct subsys_private *sp = bus_to_subsys(dev->bus);
+ int ret;
if (!sp)
return;
- if (sp->drivers_autoprobe)
- __device_attach(dev, true);
+ if (sp->drivers_autoprobe) {
+ ret = __device_attach(dev, true);
+ if (ret == 2)
+ __device_attach(dev, false);
+ }
subsys_put(sp);
}
-/*
- * __device_driver_lock - acquire locks needed to manipulate dev->drv
- * @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the device type requires parent lock
- *
- * This function will take the required locks for manipulating dev->drv.
- * Normally this will just be the @dev lock, but when called for a USB
- * interface, @parent lock will be held as well.
- */
-static void __device_driver_lock(struct device *dev, struct device *parent)
-{
- if (dev->type && dev->type->need_parent_lock && parent)
- device_lock(parent);
- device_lock(dev);
-}
-
-/*
- * __device_driver_unlock - release locks needed to manipulate dev->drv
- * @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the device type requires parent lock
- *
- * This function will release the required locks for manipulating dev->drv.
- * Normally this will just be the @dev lock, but when called for a
- * USB interface, @parent lock will be released as well.
- */
-static void __device_driver_unlock(struct device *dev, struct device *parent)
-{
- device_unlock(dev);
- if (dev->type && dev->type->need_parent_lock && parent)
- device_unlock(parent);
-}
-
/**
* device_driver_attach - attach a specific driver to a specific device
* @drv: Driver to attach
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 108/547] Drivers: hv: vmbus: Bounds check the shared ring buffer indices
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 107/547] driver core: take parent lock in async device attach Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 109/547] backlight: lm3630a: Cancel delayed work before destroying workqueue Greg Kroah-Hartman
` (447 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Kelley, Kameron Carr,
Wei Liu
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kameron Carr <kameroncarr@linux.microsoft.com>
commit 1d287c17cc5bfd6386fe0770999be410b248d021 upstream.
In a CoCo VM the host is untrusted. Since the VMBus ring buffer read and
write indices live in shared memory, the guest has to treat both as
potentially malicious.
hv_ringbuffer_write() copies into the ring at write_index with no bounds
checking, so the host can make the guest write packet data at any offset
up to 4 GiB past the start of the ring buffer. read_index matters too:
the available space derived from both indices is the only bound on how
much is copied, and an out-of-range index can make it far larger than
the ring.
The fix is to validate both indices before use and to use the validated
snapshot instead of re-accessing. For invalid indices,
hv_ringbuffer_write() logs and returns -EIO.
One re-read of write_index is left unchecked in this patch:
hv_get_ring_bufferindices() fetches it again for the prev_indices
trailer. The value is only returned to the host and is not used as an
offset or length for indexing. Since this is not a security issue, it is
addressed later in the series.
Open-coding the bytes available arithmetic keeps the fix free of
prerequisites; a later patch refactors it into a helper function.
Fixes: 3e7ee4902fe6 ("Staging: hv: add the Hyper-V virtual bus")
Cc: stable@vger.kernel.org # 5.15.x
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Kameron Carr <kameroncarr@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hv/ring_buffer.c | 29 ++++++++++++++++-------------
1 file changed, 16 insertions(+), 13 deletions(-)
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -70,15 +70,6 @@ static void hv_signal_on_write(u32 old_w
}
}
-/* Get the next write location for the specified ring buffer. */
-static inline u32
-hv_get_next_write_location(struct hv_ring_buffer_info *ring_info)
-{
- u32 next = ring_info->ring_buffer->write_index;
-
- return next;
-}
-
/* Set the next write location for the specified ring buffer. */
static inline void
hv_set_next_write_location(struct hv_ring_buffer_info *ring_info,
@@ -281,6 +272,7 @@ int hv_ringbuffer_write(struct vmbus_cha
u32 totalbytes_towrite = sizeof(u64);
u32 next_write_location;
u32 old_write;
+ u32 read_index;
u64 prev_indices;
unsigned long flags;
struct hv_ring_buffer_info *outring_info = &channel->outbound;
@@ -295,7 +287,20 @@ int hv_ringbuffer_write(struct vmbus_cha
spin_lock_irqsave(&outring_info->ring_lock, flags);
- bytes_avail_towrite = hv_get_bytes_to_write(outring_info);
+ read_index = READ_ONCE(outring_info->ring_buffer->read_index);
+ old_write = READ_ONCE(outring_info->ring_buffer->write_index);
+ if (unlikely(read_index >= outring_info->ring_datasize ||
+ old_write >= outring_info->ring_datasize)) {
+ spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+ pr_err_ratelimited("outbound ring indices out of range: relid %u read %u write %u size %u\n",
+ channel->offermsg.child_relid, read_index,
+ old_write, outring_info->ring_datasize);
+ return -EIO;
+ }
+
+ bytes_avail_towrite = old_write >= read_index ?
+ outring_info->ring_datasize - (old_write - read_index) :
+ read_index - old_write;
/*
* If there is only room for the packet, assume it is full.
@@ -317,9 +322,7 @@ int hv_ringbuffer_write(struct vmbus_cha
channel->out_full_flag = false;
/* Write to the ring buffer */
- next_write_location = hv_get_next_write_location(outring_info);
-
- old_write = next_write_location;
+ next_write_location = old_write;
for (i = 0; i < kv_count; i++) {
next_write_location = hv_copyto_ringbuffer(outring_info,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 109/547] backlight: lm3630a: Cancel delayed work before destroying workqueue
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 108/547] Drivers: hv: vmbus: Bounds check the shared ring buffer indices Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 110/547] backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() Greg Kroah-Hartman
` (446 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Daniel Thompson (RISCstar), Lee Jones
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 2cf184caab8b406fdd9db126ee40d62418237456 upstream.
The interrupt handler queues delayed work to read the interrupt status.
After free_irq() stops the producer, this work can still be waiting on its
timer. destroy_workqueue() cannot drain delayed work that has not yet been
queued by its timer, so the timer can outlive both the workqueue and the
devm-allocated chip containing the work.
Cancel the delayed work synchronously after freeing the IRQ and before
destroying the workqueue. This also waits for any running status read to
finish before the chip's resources are released.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20261003030439.599330-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/lm3630a_bl.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/backlight/lm3630a_bl.c
+++ b/drivers/video/backlight/lm3630a_bl.c
@@ -591,6 +591,7 @@ static void lm3630a_remove(struct i2c_cl
if (pchip->irq) {
free_irq(pchip->irq, pchip);
+ cancel_delayed_work_sync(&pchip->work);
destroy_workqueue(pchip->irqthread);
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 110/547] backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 109/547] backlight: lm3630a: Cancel delayed work before destroying workqueue Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 111/547] backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe Greg Kroah-Hartman
` (445 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg,
Daniel Thompson (RISCstar), Konrad Dybcio, Lee Jones
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
commit 1dbd46d4b2fb416a8202b1a8e4ef9d0cadbe075f upstream.
wled_probe() doesn't set the driver data for the platform device.
As a result, platform_get_drvdata() in wled_remove() will return NULL,
and the first dereference of it crashes on unbind.
Set the platform device driver data in wled_probe().
Cc: stable@vger.kernel.org
Fixes: feeab87b3072 ("backlight: qcom-wled: Add support for short circuit handling")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-1-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/qcom-wled.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1680,6 +1680,7 @@ static int wled_probe(struct platform_de
wled->regmap = regmap;
wled->dev = &pdev->dev;
+ platform_set_drvdata(pdev, wled);
wled->version = (uintptr_t)of_device_get_match_data(&pdev->dev);
if (!wled->version) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 111/547] backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 110/547] backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 112/547] backlight: qcom-wled: Fix WLED3 brightness register stride Greg Kroah-Hartman
` (444 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg,
Daniel Thompson (RISCstar), Lee Jones
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
commit 5eda6b51461932f9fd835ef9e4574650c69c4fe8 upstream.
wled_configure_ovp_irq() derives the initial state of the OVP interrupt
from the hardware:
/* Keep OVP irq disabled until module is enabled */
if (!(val & WLED3_CTRL_REG_MOD_EN_MASK))
disable_irq(wled->ovp_irq);
but wled->brightness, which is what the rest of the driver uses to tell
whether the module is on, is left at zero.
On boards where the bootloader hands the kernel a lit backlight the two
disagree. MOD_EN is already set, so the interrupt is left enabled, while
wled_update_status() still believes the backlight is off and takes
if (!!brightness != !!wled->brightness)
rc = wled_module_enable(wled, !!brightness);
on the first backlight update. wled_module_enable() then schedules
wled_ovp_work(), which calls enable_irq() on the already enabled
interrupt:
Unbalanced enable for IRQ 176
WARNING: CPU: 0 PID: 160 at kernel/irq/manage.c:774 __enable_irq+0x50/0x80
Hardware name: Xiaomi Pocophone F1 (DT)
Workqueue: events wled_ovp_work
Call trace:
__enable_irq+0x50/0x80
enable_irq+0x48/0xa0
wled_ovp_work+0x18/0x24
process_one_work+0x1d0/0x350
worker_thread+0x13c/0x460
kthread+0x110/0x114
ret_from_fork+0x10/0x20
The bootloader is not the only way to get there. The readback runs after
wledN_setup(), and wled4_setup() sets MOD_EN itself on the path where the
sink configuration does not already match, as does the tail of
wled_auto_string_detection(), which all three setup paths can reach
through wled_auto_detection_at_init(). A cold-booted board with a dark
panel can therefore reach the same disagreement.
Move the MOD_EN readback into wled_probe() and use it to seed
wled->brightness, so the driver starts out agreeing with the hardware,
and key the OVP interrupt off wled->brightness instead. The first
backlight update then only reprograms the brightness registers and
leaves both the module and the interrupt alone. The OVP interrupt also
stays armed from probe whenever the module is already enabled, rather
than being disabled at probe and only enabled once something writes
brightness.
Note that a backlight update requesting brightness 0 before any non-zero
one now really does turn the module off wherever MOD_EN was already set,
where before it was silently ignored.
wled->brightness is seeded with default-brightness rather than the level
the bootloader actually programmed, so the first update can still step
the brightness. Reading that level back is version specific and is done
in a follow-up, to keep this fix small enough to backport.
Assisted-by: LLM
Fixes: 8663c188beea ("backlight: qcom-wled: Add auto string detection logic")
Cc: stable@vger.kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-3-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/qcom-wled.c | 32 +++++++++++++++++++++-----------
1 file changed, 21 insertions(+), 11 deletions(-)
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1627,7 +1627,6 @@ static int wled_configure_ovp_irq(struct
struct platform_device *pdev)
{
int rc;
- u32 val;
wled->ovp_irq = platform_get_irq_byname(pdev, "ovp");
if (wled->ovp_irq < 0) {
@@ -1643,13 +1642,8 @@ static int wled_configure_ovp_irq(struct
return 0;
}
- rc = regmap_read(wled->regmap, wled->ctrl_addr +
- WLED3_CTRL_REG_MOD_EN, &val);
- if (rc < 0)
- return rc;
-
- /* Keep OVP irq disabled until module is enabled */
- if (!(val & WLED3_CTRL_REG_MOD_EN_MASK))
+ /* Keep the OVP irq disabled until the module is enabled */
+ if (!wled->brightness)
disable_irq(wled->ovp_irq);
return 0;
@@ -1665,6 +1659,7 @@ static int wled_probe(struct platform_de
struct backlight_device *bl;
struct wled *wled;
struct regmap *regmap;
+ u32 mod_en;
u32 val;
int rc;
@@ -1735,6 +1730,24 @@ static int wled_probe(struct platform_de
INIT_DELAYED_WORK(&wled->ovp_work, wled_ovp_work);
+ val = WLED_DEFAULT_BRIGHTNESS;
+ of_property_read_u32(pdev->dev.of_node, "default-brightness", &val);
+
+ /*
+ * The module may already be enabled, either by a bootloader that left
+ * the backlight lit or by the setup above. Record that, so that the
+ * first brightness update does not enable an already enabled module,
+ * and so that the OVP irq is armed from probe rather than from that
+ * first update.
+ */
+ rc = regmap_read(wled->regmap, wled->ctrl_addr + WLED3_CTRL_REG_MOD_EN,
+ &mod_en);
+ if (rc < 0)
+ return rc;
+
+ if (mod_en & WLED3_CTRL_REG_MOD_EN_MASK)
+ wled->brightness = val;
+
rc = wled_configure_short_irq(wled, pdev);
if (rc < 0)
return rc;
@@ -1743,9 +1756,6 @@ static int wled_probe(struct platform_de
if (rc < 0)
return rc;
- val = WLED_DEFAULT_BRIGHTNESS;
- of_property_read_u32(pdev->dev.of_node, "default-brightness", &val);
-
memset(&props, 0, sizeof(struct backlight_properties));
props.type = BACKLIGHT_RAW;
props.brightness = val;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 112/547] backlight: qcom-wled: Fix WLED3 brightness register stride
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 111/547] backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 113/547] ksmbd: accept share config responses from ksmbd-tools before 3.5.3 Greg Kroah-Hartman
` (443 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg,
Daniel Thompson (RISCstar), Konrad Dybcio, Lee Jones
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
commit e60dc9c05e0f415ef8bc63b3179abdd49830a619 upstream.
WLED3 has a 16-bit brightness register pair per string, at 0x40 + 2*n,
which is what the pm8941-wled driver wrote to:
rc = regmap_bulk_write(wled->regmap,
wled->addr + WLED3_CTRL_REG_VAL_BASE + 2 * i,
v, 2);
The restructuring for WLED3 turned that into WLED3_SINK_REG_BRIGHT(n),
defined as 0x40 + n, so the two byte writes for consecutive strings
overlap: string 1 overwrites the MSB of string 0 with its own LSB, and
with the default three strings only string 1 ends up with the requested
value.
Use the 2 byte stride.
Fixes: 775d2ffb4af6 ("backlight: qcom-wled: Restructure the driver for WLED3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-2-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/qcom-wled.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -59,7 +59,7 @@
#define WLED3_SINK_REG_CURR_SINK_SHFT 5
/* WLED3 specific per-'string' registers below */
-#define WLED3_SINK_REG_BRIGHT(n) (0x40 + n)
+#define WLED3_SINK_REG_BRIGHT(n) (0x40 + (n * 0x2))
#define WLED3_SINK_REG_STR_MOD_EN(n) (0x60 + (n * 0x10))
#define WLED3_SINK_REG_STR_MOD_MASK BIT(7)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 113/547] ksmbd: accept share config responses from ksmbd-tools before 3.5.3
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 112/547] backlight: qcom-wled: Fix WLED3 brightness register stride Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 114/547] ksmbd: avoid restoring only in-memory EOF after allocation change Greg Kroah-Hartman
` (442 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michail Andreas Michalopoulos,
Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
commit 4f1ce9ffb996a524acf864316479a7806ae500c6 upstream.
ksmbd-tools releases before 3.5.2 do not have the payload_sz field in
struct ksmbd_share_config_response; the field occupies the last word of
their reserved[] area, so the kernel always sees payload_sz == 0 from
them. ipc_validate_msg() and share_config_request() used to treat
payload_sz == 0 as "legacy userspace" and skip the payload size checks.
That case was removed by
commit f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config
responses").
With payload_sz == 0:
- the IPC$ (pipe) response fails the final message size comparison:
these tools always send a one-byte payload, so msg_sz is
sizeof(*resp) + 1, but the expected size is now computed as
sizeof(*resp) + 0;
- every other share fails "payload_sz <= veto_list_sz".
In addition, ksmbd-tools before 3.5.3 copy a global "veto files" setting
into the IPC$ response, so with such a configuration IPC$ also fails the
now unconditional "veto_list_sz > payload_sz" check, even though pipe
shares never use a veto list.
ksmbd_ipc_share_config_request() then returns NULL and every tree
connect fails with STATUS_BAD_NETWORK_NAME, so ksmbd cannot serve any
share when used with these ksmbd-tools releases, for example the 3.5.1
package shipped by Ubuntu 24.04. Login still works, which makes the
failure look like a configuration problem:
CIFS: VFS: BAD_NETWORK_NAME: \\127.0.0.1\IPC$
CIFS: VFS: \\127.0.0.1 failed to connect to IPC (rc=-2)
When payload_sz is zero, derive it from the size of the message actually
received and store it back in the response, so that the checks in
ipc_validate_msg() and the path and veto list parsing in
share_config_request() all use the same bound. The response is the
kernel's own copy made by handle_response(), and msg_sz has already been
checked to be at least sizeof(*resp), so this cannot underflow. All
checks added by that commit then apply unchanged, bounded by the bytes
that really arrived, and newer ksmbd-tools that fill in payload_sz are
unaffected. Also skip the veto list size check for pipe shares:
share_config_request() reads neither the path nor the veto list for
them.
Tested in QEMU with ksmbd-tools 3.5.1 and 3.5.7 and the in-kernel SMB
client over loopback, with and without a global "veto files" setting.
Fixes: f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config responses")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/transport_ipc.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -532,11 +532,25 @@ static int ipc_validate_msg(struct ipc_m
if (entry->msg_sz < sizeof(struct ksmbd_share_config_response))
return -EINVAL;
+ /*
+ * ksmbd-tools releases before 3.5.2 leave payload_sz zero.
+ * Derive it from the size of the message actually received so
+ * the checks below bound the payload for those releases too.
+ */
+ if (!resp->payload_sz)
+ resp->payload_sz = entry->msg_sz -
+ sizeof(struct ksmbd_share_config_response);
+
if (strnlen(resp->share_name, sizeof(resp->share_name)) ==
sizeof(resp->share_name))
return -EINVAL;
- if (resp->veto_list_sz > resp->payload_sz)
+ /*
+ * Pipe shares carry no veto list, but ksmbd-tools before 3.5.3
+ * copy a global "veto files" setting into the IPC$ response.
+ */
+ if (!(resp->flags & KSMBD_SHARE_FLAG_PIPE) &&
+ resp->veto_list_sz > resp->payload_sz)
return -EINVAL;
if (resp->flags != KSMBD_SHARE_FLAG_INVALID &&
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 114/547] ksmbd: avoid restoring only in-memory EOF after allocation change
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 113/547] ksmbd: accept share config responses from ksmbd-tools before 3.5.3 Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 115/547] ksmbd: defer connection scavenging while session locks are busy Greg Kroah-Hartman
` (441 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
commit 9455e920aebe41217cabff3f81e90da4c407fdb6 upstream.
When SetAllocation requests a size below the allocated block count but
above EOF, ksmbd truncates the file to that size and restores only the
in-memory i_size. The larger EOF remains on disk and reappears after a
reboot. A 3-byte file preallocated to 64 KiB can acquire a 4 KiB EOF
after reducing its allocation to 4 KiB. Extending EOF this way is not
a reliable way to reclaim the preallocation beyond the old EOF either.
Only use this truncate path when the requested allocation is at or below
the observed EOF. A truncate to the existing EOF still lets filesystems
release preallocated blocks beyond EOF. Remove the in-memory-only i_size
restoration. The size check still precedes vfs_truncate() taking the
inode lock, so a concurrent shrink can make the truncate extend EOF;
that race also existed in the original path.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8241,24 +8241,17 @@ static int set_file_allocation_info(stru
pr_err("vfs_fallocate is failed : %d\n", rc);
return rc;
}
- } else if (alloc_blks < stat.blocks) {
- loff_t size;
-
+ } else if (alloc_blks < stat.blocks &&
+ alloc_blks * 512 <= i_size_read(inode)) {
/*
- * Allocation size could be smaller than original one
- * which means allocated blocks in file should be
- * deallocated. use truncate to cut out it, but inode
- * size is also updated with truncate offset.
- * inode size is retained by backup inode size.
+ * Truncate at or below EOF to discard excess allocation.
+ * Truncating above EOF would extend the file on disk.
*/
- size = i_size_read(inode);
rc = ksmbd_vfs_truncate(work, fp, alloc_blks * 512);
if (rc) {
pr_err("truncate failed!, err %d\n", rc);
return rc;
}
- if (size < alloc_blks * 512)
- i_size_write(inode, size);
}
fp->allocation_size = le64_to_cpu(file_alloc_info->AllocationSize);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 115/547] ksmbd: defer connection scavenging while session locks are busy
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 114/547] ksmbd: avoid restoring only in-memory EOF after allocation change Greg Kroah-Hartman
@ 2026-11-04 21:04 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 116/547] ksmbd: deny access for an empty DACL instead of granting the request Greg Kroah-Hartman
` (440 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit b4bae7af1154089be87c7475218264fcbfd16d10 upstream.
The expiration worker holds conn_list_lock for reading while checking
for authenticated sessions. Without this change, the check can wait for
conn->session_lock or sessions_table_lock.
In destroy_previous_session(), the status updates after
ksmbd_conn_wait_idle_sess() run with both session locks held for
writing. Both the KSMBD_SESS_GOOD error path and the
KSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(),
which takes conn_list_lock for reading.
A writer queued on conn_list_lock can block these new read acquisitions.
The worker then waits for a session lock held by
destroy_previous_session(), which waits behind the writer. The writer
cannot proceed until the worker releases conn_list_lock.
Try both session locks instead of waiting in the scavenging check. Keep
the connection when either lock is busy and let the periodic worker
retry later.
Fixes: d7fd1f98607f ("ksmbd: follow SMB2 session expiration semantics")
Cc: stable@vger.kernel.org
Reported-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -532,7 +532,12 @@ bool ksmbd_conn_has_valid_or_expired_ses
int state, bkt;
bool found = false;
- down_read(&conn->session_lock);
+ /*
+ * The expiration worker holds conn_list_lock, which session teardown
+ * takes after the session locks. Defer scavenging if either is busy.
+ */
+ if (!down_read_trylock(&conn->session_lock))
+ return true;
xa_for_each(&conn->sessions, id, sess) {
state = READ_ONCE(sess->state);
if (state == SMB2_SESSION_VALID ||
@@ -546,7 +551,8 @@ bool ksmbd_conn_has_valid_or_expired_ses
return true;
/* A session bound through SMB3 multichannel is not in conn->sessions. */
- down_read(&sessions_table_lock);
+ if (!down_read_trylock(&sessions_table_lock))
+ return true;
hash_for_each(sessions_table, bkt, sess, hlist) {
state = READ_ONCE(sess->state);
if (state != SMB2_SESSION_VALID &&
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 116/547] ksmbd: deny access for an empty DACL instead of granting the request
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-11-04 21:04 ` [PATCH 7.3 115/547] ksmbd: defer connection scavenging while session locks are busy Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 117/547] ksmbd: drain session procfs readers before dropping table references Greg Kroah-Hartman
` (439 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
commit de0cffef897c1c232ed973f89928cd6c93d0b1e3 upstream.
smb_check_perm_dacl() returns the access mask it computes to the SMB2
CREATE handler, which uses it as the granted access for the open. For a
security descriptor whose DACL is present but contains no ACEs, the
function is supposed to deny access: an empty (non-NULL) DACL grants no
access to anyone except the object owner's implicit READ_CONTROL and
WRITE_DAC (MS-DTYP 2.4.5).
The empty-DACL branch only denies when both
- the DACL has no trailing bytes (pdacl_size == sizeof(struct smb_acl)),
and
- the request contains bits beyond READ_CONTROL / WRITE_DAC.
In every other case it takes the shared "goto err_out" with rc still 0,
which returns success without modifying *pdaccess, so the caller grants
the full requested access. Three problems follow:
- The READ_CONTROL / WRITE_DAC carve-out models the owner's implicit
rights, but the check runs before is_owner is computed, so those
rights are handed to *every* caller, not just the owner. For
READ_CONTROL the SMB2 CREATE path does not fall back to
inode_permission(), so any user can read the security descriptor of
an object whose empty DACL is meant to deny them.
- A request of exactly READ_CONTROL and/or WRITE_DAC is granted to any
caller. WRITE_DAC lets the handle rewrite the DACL.
- A DACL that declares zero ACEs but carries trailing bytes
(pdacl_size > sizeof(struct smb_acl)) skips the deny entirely and is
granted whatever was requested.
On shares where the NT ACL is the authoritative access control -- e.g.
"force user" shares, where every client maps to one POSIX identity so
POSIX cannot distinguish users -- this is an access-control bypass.
Compute is_owner before the empty-DACL branch and deny access from an
empty DACL unless the caller is the owner requesting no more than
READ_CONTROL / WRITE_DAC.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smbacl.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1490,21 +1490,27 @@ int smb_check_perm_dacl(struct ksmbd_con
if (pdacl_size > acl_size || pdacl_size < sizeof(struct smb_acl))
goto err_out;
- if (!pdacl->num_aces) {
- if (!(pdacl_size - sizeof(struct smb_acl)) &&
- *pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)) {
- rc = -EACCES;
- goto err_out;
- }
- goto err_out;
- }
-
if (!uid)
sid_type = SIDUNIX_USER;
id_to_sid(uid, sid_type, &sid);
vfsuid = i_uid_into_vfsuid(idmap, d_inode(path->dentry));
is_owner = uid == from_kuid(&init_user_ns, vfsuid_into_kuid(vfsuid));
+ if (!pdacl->num_aces) {
+ /*
+ * An empty (present, zero-ACE) DACL grants no access to
+ * anyone except the object owner's implicit READ_CONTROL
+ * and WRITE_DAC (MS-DTYP 2.4.5). Deny every other caller,
+ * deny the owner any access beyond those two bits, and do
+ * not let trailing bytes after a zero-ACE DACL become an
+ * implicit grant.
+ */
+ if (!is_owner ||
+ (*pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)))
+ rc = -EACCES;
+ goto err_out;
+ }
+
if (*pdaccess & FILE_MAXIMAL_ACCESS_LE) {
ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
aces_size = pdacl_size - sizeof(struct smb_acl);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 117/547] ksmbd: drain session procfs readers before dropping table references
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 116/547] ksmbd: deny access for an empty DACL instead of granting the request Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 118/547] ksmbd: fix extended session security negotiation for raw NTLMSSP Greg Kroah-Hartman
` (438 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 1c087cf7d5386c708d8984b263280b42b3daada0 upstream.
Session registration failure and connection cleanup can drop the table
reference while the per-session procfs entry is still accessible. If a
reader holds the last remaining reference, its final put calls
proc_remove() from its own callback and waits for that callback to
finish.
Remove the procfs entry before dropping the table reference in the
registration failure path. Queue sessions removed during connection
cleanup and drain their procfs readers after releasing both session
locks, then return their table references. Keep the global hash node
unhashed while a session is queued so a concurrent unregister cannot
drop the reference again.
Previous-session replacement also destroys the file table before the
session is finally freed. Detach the idr under the lock used by procfs
file counters, and report zero files after it has been detached. This
prevents a reader from accessing the idr during or after its
destruction.
Fixes: d7fd1f98607f ("ksmbd: follow SMB2 session expiration semantics")
Cc: stable@vger.kernel.org
Reported-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 15 +++++++++------
fs/smb/server/vfs_cache.c | 9 +++++++--
2 files changed, 16 insertions(+), 8 deletions(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -95,8 +95,10 @@ static unsigned int session_open_file_co
unsigned int id;
read_lock(&session->file_table.lock);
- idr_for_each_entry(session->file_table.idr, fp, id)
- count++;
+ if (session->file_table.idr) {
+ idr_for_each_entry(session->file_table.idr, fp, id)
+ count++;
+ }
read_unlock(&session->file_table.lock);
return count;
}
@@ -477,6 +479,7 @@ int ksmbd_session_register(struct ksmbd_
down_write(&sessions_table_lock);
ksmbd_session_remove_from_table(sess);
up_write(&sessions_table_lock);
+ delete_proc_session(sess);
ksmbd_user_session_put(sess);
}
@@ -604,6 +607,7 @@ static int ksmbd_chann_del(struct ksmbd_
void ksmbd_conn_sessions_cleanup(struct ksmbd_conn *conn)
{
+ LIST_HEAD(dispose);
struct ksmbd_session *sess;
unsigned long id;
struct hlist_node *tmp;
@@ -617,8 +621,7 @@ void ksmbd_conn_sessions_cleanup(struct
down_write(&conn->session_lock);
xa_erase(&conn->sessions, sess->id);
up_write(&conn->session_lock);
- if (atomic_dec_and_test(&sess->refcnt))
- ksmbd_session_destroy(sess);
+ list_add_tail(&sess->dispose_entry, &dispose);
}
}
@@ -628,12 +631,12 @@ void ksmbd_conn_sessions_cleanup(struct
if (xa_empty(&sess->ksmbd_chann_list)) {
xa_erase(&conn->sessions, sess->id);
ksmbd_session_remove_from_table(sess);
- if (atomic_dec_and_test(&sess->refcnt))
- ksmbd_session_destroy(sess);
+ list_add_tail(&sess->dispose_entry, &dispose);
}
}
up_write(&conn->session_lock);
up_write(&sessions_table_lock);
+ ksmbd_dispose_sessions(&dispose);
}
bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1975,14 +1975,19 @@ int ksmbd_init_file_table(struct ksmbd_f
void ksmbd_destroy_file_table(struct ksmbd_session *sess)
{
struct ksmbd_file_table *ft = &sess->file_table;
+ struct idr *idr;
if (!ft->idr)
return;
__close_file_table_ids(sess, NULL, session_fd_check, true);
- idr_destroy(ft->idr);
- kfree(ft->idr);
+ /* Stop procfs readers before freeing the detached file table. */
+ write_lock(&ft->lock);
+ idr = ft->idr;
ft->idr = NULL;
+ write_unlock(&ft->lock);
+ idr_destroy(idr);
+ kfree(idr);
}
int ksmbd_init_file_cache(void)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 118/547] ksmbd: fix extended session security negotiation for raw NTLMSSP
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 117/547] ksmbd: drain session procfs readers before dropping table references Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 119/547] ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect() Greg Kroah-Hartman
` (437 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tea La Forgia, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 6868f857514bbfd2ed10b9b566664dc4a8ca039d upstream.
ksmbd_build_ntlmssp_challenge_blob() only advertises extended session
security when conn->use_spnego is true. As a result, raw NTLMSSP
negotiation drops NTLMSSP_NEGOTIATE_EXTENDED_SEC from the challenge even
when the client requested it.
A Windows capture shows an initial SPNEGO authentication succeeding,
followed by a raw NTLMSSP negotiation on the same TCP connection. The raw
challenge omits extended session security, and the client does not send
an AUTHENTICATE message. The unfinished session then occupies the pending
session slot, causing subsequent SESSION_SETUP requests to fail with
STATUS_INSUFFICIENT_RESOURCES.
Set NTLMSSP_NEGOTIATE_EXTENDED_SEC whenever the client requests it,
independently of the SPNEGO wrapper, as required by [MS-NLMP].
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: Tea La Forgia <tealaforgia+alias@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/auth.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -336,8 +336,7 @@ ksmbd_build_ntlmssp_challenge_blob(struc
if (cflags & NTLMSSP_REQUEST_TARGET)
flags |= NTLMSSP_REQUEST_TARGET;
- if (conn->use_spnego &&
- (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
+ if (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)
flags |= NTLMSSP_NEGOTIATE_EXTENDED_SEC;
if (cflags & NTLMSSP_NEGOTIATE_KEY_XCH)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 119/547] ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 118/547] ksmbd: fix extended session security negotiation for raw NTLMSSP Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 120/547] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc() Greg Kroah-Hartman
` (436 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dairui Zhang, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dairui Zhang <zhangdairui@gmail.com>
commit 783a7fc454991544bf92268d8f2413af1a7c7eb8 upstream.
ksmbd_validate_name_reconnect() indexes
ab_pathname[share->path_sz + 1] without checking that the path is
longer than share->path_sz + 1 (d_path() fills the buffer from the
end). A durable fp is not bound to its original share, so a client
can preserve a file from a short-path share and reconnect it on a
long-path share, making strcmp() read past the PATH_MAX buffer -
with a long enough share path this oopses the kernel, and on a
mapped page it also gives a byte-equality oracle on adjacent heap
(the reconnect succeeds exactly when the out-of-bounds string
equals the requested name). A same-share variant with the durable
fp at the share root reads 1 byte past the buffer
(strlen(ab_pathname) == share->path_sz).
Check before comparing: the path must be longer than share->path_sz,
it must start with share->path, and the next character must be '/'.
The share root itself is accepted only for an empty name.
Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Reported-by: Dairui Zhang <zhangdairui@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Dairui Zhang <zhangdairui@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/vfs_cache.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1877,9 +1877,21 @@ int ksmbd_validate_name_reconnect(struct
return -EACCES;
}
- if (name && strcmp(&ab_pathname[share->path_sz + 1], name)) {
- ksmbd_debug(SMB, "invalid name reconnect %s\n", name);
- ret = -EINVAL;
+ if (name) {
+ size_t len = strlen(ab_pathname);
+
+ if (len == share->path_sz && !strncmp(ab_pathname, share->path, len)) {
+ /* the durable fp is the share root itself */
+ if (name[0])
+ ret = -EINVAL;
+ } else if (len <= share->path_sz ||
+ strncmp(ab_pathname, share->path, share->path_sz) ||
+ ab_pathname[share->path_sz] != '/' ||
+ strcmp(&ab_pathname[share->path_sz + 1], name)) {
+ ret = -EINVAL;
+ }
+ if (ret)
+ ksmbd_debug(SMB, "invalid name reconnect %s\n", name);
}
kfree(pathname);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 120/547] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 119/547] ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 121/547] ksmbd: fix parent dentry lifetime in directory enumeration Greg Kroah-Hartman
` (435 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Mei, Giorgi Kobakhia,
Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giorgi Kobakhia <gkobakhi@asu.edu>
commit eb96e2a0e817807c48dc8387ca6a5249fdeae3a0 upstream.
When the large dacl_offset is provided, dacl_offset + sizeof(struct
smb_acl) overflows on 32-bit builds and the check is passed,
Which makes le16_to_cpu(ppdacl_ptr->size) read out-of-bounds. This
only happens for dacl_offset in range [0xFFFFFFF8, 0xFFFFFFFF]. So
the oob read is max 8 bytes preceding the allocated ppntsd.
unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;
if (!dacl_offset ||
(dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
goto out;
Commit beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check")
fixes similar checks in other functions. But leaves this one out,
because it is only valid for 32-bit builds.
Reproduced on 32-bit ARM with KASAN, by a client sending SMB2
SET_INFO(SEC) with dacloffset=0xfffffff8, then QUERY_INFO(SEC) on the
same file:
BUG: KASAN: slab-out-of-bounds in build_sec_desc (fs/smb/server/smbacl.c:1105)
Read of size 2 at addr c2a273fa by task kworker/1:1/35
CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 7.3.0-rc2+ #5
Workqueue: ksmbd-io handle_ksmbd_work
Call trace:
kasan_check_range from build_sec_desc (fs/smb/server/smbacl.c:1105)
build_sec_desc from smb2_query_info (fs/smb/server/smb2pdu.c:7676)
smb2_query_info from handle_ksmbd_work (fs/smb/server/server.c:160)
handle_ksmbd_work from process_one_work (kernel/workqueue.c:3401)
process_one_work from worker_thread (kernel/workqueue.c:3473)
worker_thread from kthread (kernel/kthread.c:436)
Add overflow check.
Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()")
Cc: stable@vger.kernel.org
Assisted-by: LLM claude
Tested-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smbacl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1096,9 +1096,12 @@ int build_sec_desc(struct mnt_idmap *idm
struct smb_acl *ppdacl_ptr;
unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;
+ size_t dacl_struct_end;
if (!dacl_offset ||
- (dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
+ check_add_overflow(dacl_offset, sizeof(struct smb_acl),
+ &dacl_struct_end) ||
+ dacl_struct_end > (size_t)ppntsd_size)
goto out;
ppdacl_ptr = (struct smb_acl *)((char *)ppntsd + dacl_offset);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 121/547] ksmbd: fix parent dentry lifetime in directory enumeration
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 120/547] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 122/547] ksmbd: fix session reference leak on compounded SESSION_SETUP Greg Kroah-Hartman
` (434 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AutonomousCodeSecurity,
Cen Zhang (Microsoft), Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
commit 171df27077fb49b4af2c53ad2cedcd0e39664fe8 upstream.
ksmbd_populate_dot_dotdot_entries() builds the ".." entry from
the open directory's d_parent and passes that pointer to
ksmbd_vfs_fill_dentry_attrs() without taking a reference. That pointer
is only valid while the directory stays under this parent. If a
concurrent rename moves the directory elsewhere, the old parent loses
its last reference; a following rmdir then turns it into a negative
dentry with d_inode cleared, and after the RCU grace period the dentry
itself is freed. The worker still holds the raw pointer and
dereferences d_inode through vfs_getattr() and vfs_getxattr().
A remote SMB client, authenticated or guest, triggers this by listing
a directory while that directory is moved under a new parent and the
old parent is deleted. It can be done by the client itself with write
access or by other concurrent writers, triggering null-ptr-deref and
slab-use-after-free on a KASAN build.
KASAN: null-ptr-deref in range
[0x0000000000000000-0x0000000000000007]
Workqueue: ksmbd-io handle_ksmbd_work
RIP: 0010:xattr_permission+0x9d/0x160
Call Trace:
vfs_getxattr+0x9c/0x1b0
ksmbd_vfs_getxattr+0x82/0x100
ksmbd_vfs_get_dos_attrib_xattr+0x7f/0x130
ksmbd_vfs_fill_dentry_attrs+0x435/0x650
ksmbd_populate_dot_dotdot_entries+0x25e/0x630
smb2_query_dir+0xcf9/0x1a20
handle_ksmbd_work+0x5f1/0x1c80
process_one_work+0x90b/0x19d0
Fix by using the dentry reference counting APIs: take the parent with
dget_parent(), take a matching dget() on ".", and dput() the dentry
once ksmbd_vfs_fill_dentry_attrs() has returned or the pattern does
not match.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Cc: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb_common.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/smb/server/smb_common.c
+++ b/fs/smb/server/smb_common.c
@@ -478,16 +478,17 @@ int ksmbd_populate_dot_dotdot_entries(st
if (i == 0) {
d_info->name = ".";
d_info->name_len = 1;
- dentry = dir->filp->f_path.dentry;
+ dentry = dget(dir->filp->f_path.dentry);
} else {
d_info->name = "..";
d_info->name_len = 2;
- dentry = dir->filp->f_path.dentry->d_parent;
+ dentry = dget_parent(dir->filp->f_path.dentry);
}
if (!match_pattern(d_info->name, d_info->name_len,
search_pattern)) {
dir->dot_dotdot[i] = 1;
+ dput(dentry);
continue;
}
@@ -496,6 +497,7 @@ int ksmbd_populate_dot_dotdot_entries(st
idmap,
dentry,
&ksmbd_kstat);
+ dput(dentry);
if (rc)
break;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 122/547] ksmbd: fix session reference leak on compounded SESSION_SETUP
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 121/547] ksmbd: fix parent dentry lifetime in directory enumeration Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 123/547] ksmbd: hold a connection reference for each session channel Greg Kroah-Hartman
` (433 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Bridges, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <icb@fastmail.org>
commit 03bd8f5279e490e15e0c0f0fa388ffbd2fbacd65 upstream.
A compound request can place SESSION_SETUP after another command. That
earlier command leaves a reference to its session in work->sess.
smb2_sess_setup() then overwrites work->sess with the session it looks up
or creates, and the dispatcher later puts work->sess only once. The
inherited reference is never dropped. That leaks the session, together
with its setup connection and socket, and every repeat of the compound
leaks another.
unreferenced object (size 512):
__kmalloc_cache_noprof+0x32c/0x3a0
ksmbd_smb2_session_create+0xf6/0x9c0 [ksmbd]
smb2_sess_setup+0xda4/0x6280 [ksmbd]
handle_ksmbd_work+0x88c/0x1cb0 [ksmbd]
Save the inherited session on entry. After the request has been
processed, release it once, but only when smb2_sess_setup() has replaced
work->sess with its own session or cleared it. Do this after
ksmbd_conn_unlock() so the put does not run under srv_mutex. An error path
may instead leave the inherited session in work->sess. Keep it there, so
the dispatcher still puts it and the error response is still signed or
encrypted with it as before.
Fixes: 7aa8804c0b67 ("ksmbd: fix user-after-free from session log off")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2438,6 +2438,8 @@ int smb2_sess_setup(struct ksmbd_work *w
struct smb2_sess_setup_req *req;
struct smb2_sess_setup_rsp *rsp;
struct ksmbd_session *sess = NULL;
+ struct ksmbd_session *prev_sess = work->sess;
+ bool installed = false;
struct negotiate_message *negblob;
unsigned int negblob_len, negblob_off;
int rc = 0;
@@ -2547,6 +2549,7 @@ int smb2_sess_setup(struct ksmbd_work *w
int sign_ret;
work->sess = sess;
+ installed = true;
if (sess->dialect >= SMB30_PROT_ID)
sign_ret = smb3_check_sign_req(work);
else
@@ -2599,6 +2602,7 @@ int smb2_sess_setup(struct ksmbd_work *w
conn->binding = false;
}
work->sess = sess;
+ installed = true;
negblob_off = le16_to_cpu(req->SecurityBufferOffset);
negblob_len = le16_to_cpu(req->SecurityBufferLength);
@@ -2786,6 +2790,14 @@ out_err:
}
ksmbd_conn_unlock(conn);
+
+ /*
+ * Later in a compound, work->sess holds the reference that an
+ * earlier command took. Drop it once this request has installed
+ * its own session there or cleared it.
+ */
+ if (prev_sess && (installed || !work->sess))
+ ksmbd_user_session_put(prev_sess);
return rc;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 123/547] ksmbd: hold a connection reference for each session channel
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 122/547] ksmbd: fix session reference leak on compounded SESSION_SETUP Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 124/547] ksmbd: ignore network devices of other namespaces Greg Kroah-Hartman
` (432 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit add8d7fb04efe564193df73581889c62fc0016f1 upstream.
ksmbd_session_unregister() removes a session from the global and per-
connection tables before dropping the table reference. A concurrent
reference holder can keep the session and its channel list alive after
those removals.
Connection cleanup can no longer find the unpublished session to remove its
channels. Since a channel only stores a raw conn pointer, the connection
can be freed while another session reference holder is still accessing it,
for example during SMB3.1.1 binding or a procfs read.
Take a connection reference when registering a channel and release it on
insertion failure, channel removal, or final session destruction. Keep the
channels and signing keys until the session is destroyed so a response can
still be signed after the session has been unregistered.
Fixes: d7fd1f98607f ("ksmbd: follow SMB2 session expiration semantics")
Cc: stable@vger.kernel.org
Reported-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 2 ++
fs/smb/server/smb2pdu.c | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -273,6 +273,7 @@ static void free_channel_list(struct ksm
down_write(&sess->chann_lock);
xa_for_each(&sess->ksmbd_chann_list, index, chann) {
xa_erase(&sess->ksmbd_chann_list, index);
+ ksmbd_conn_put(chann->conn);
kfree_sensitive(chann);
}
@@ -601,6 +602,7 @@ static int ksmbd_chann_del(struct ksmbd_
if (!chann)
return -ENOENT;
+ ksmbd_conn_put(chann->conn);
kfree_sensitive(chann);
return 0;
}
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -116,11 +116,12 @@ static int register_session_channel(stru
goto out;
}
- chann->conn = conn;
+ chann->conn = ksmbd_conn_get(conn);
memcpy(chann->sess_key, sess_key, sizeof(chann->sess_key));
old = xa_store(&sess->ksmbd_chann_list, (long)conn, chann,
KSMBD_DEFAULT_GFP);
if (xa_is_err(old)) {
+ ksmbd_conn_put(chann->conn);
kfree_sensitive(chann);
rc = xa_err(old);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 124/547] ksmbd: ignore network devices of other namespaces
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 123/547] ksmbd: hold a connection reference for each session channel Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 125/547] ksmbd: limit sessions on each connection Greg Kroah-Hartman
` (431 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Koester, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Koester <j.koester@act-marketing.de>
commit 1f5ce2b8b9164b3fcb93a18fe1e7b451c2fc6eea upstream.
With no interface list configured, ksmbd binds every interface that
comes up. ksmbd_netdev_event() does not look at the device's namespace,
and create_socket() opens the listener in the namespace of the task
raising NETDEV_UP. A container with its own address on a bridge brings
up its interface and finds port 445 in its namespace already taken by
ksmbd, so an SMB server running inside the container fails with
"Address already in use".
Interfaces are also matched by name only, so a container's eth0 going
down would stop the listener on the host's eth0.
Only handle netdev events for devices in init_net.
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Signed-off-by: Jan Koester <j.koester@act-marketing.de>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/transport_tcp.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -577,6 +577,15 @@ static int ksmbd_netdev_event(struct not
struct interface *iface;
int ret;
+ /*
+ * ksmbd serves the initial namespace only. create_socket() listens in
+ * the namespace of the task raising the event, so a container bringing
+ * up its own interface would get a listener on its port 445, and the
+ * name-only interface lookup would let its interfaces stop ours.
+ */
+ if (!net_eq(dev_net(netdev), &init_net))
+ return NOTIFY_DONE;
+
switch (event) {
case NETDEV_UP:
if (netif_is_bridge_port(netdev))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 125/547] ksmbd: limit sessions on each connection
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 124/547] ksmbd: ignore network devices of other namespaces Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 126/547] ksmbd: preserve unreadable named streams on open Greg Kroah-Hartman
` (430 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68 upstream.
The pending setup limit only counts InProgress sessions. A client can
complete authentication repeatedly and retain an unbounded number of Valid
sessions on one connection.
Reserve a connection slot before allocating a session and retain a
connection reference while authentication is in progress. The first SMB3
channel takes over that reservation; binding to another connection reserves
one slot there. Reauthentication and authentication continuation reuse the
existing reservation. Return slots on allocation or insertion failure,
channel removal, and final session destruction.
Accept max_sessions_per_connection in reserved startup-request space and
default to 64 when older tools leave it zero. Keep the request size and
existing field offsets unchanged. Expose the configured limit in procfs.
The existing connection limits bound the aggregate number of sessions
without a separate global session allocation limit.
Fixes: d7fd1f98607f ("ksmbd: follow SMB2 session expiration semantics")
Cc: stable@vger.kernel.org
Reported-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/connection.c | 1
fs/smb/server/connection.h | 2 +
fs/smb/server/ksmbd_netlink.h | 3 +-
fs/smb/server/mgmt/user_session.c | 50 +++++++++++++++++++++++++++++++-------
fs/smb/server/mgmt/user_session.h | 6 +++-
fs/smb/server/proc.c | 2 +
fs/smb/server/server.c | 2 +
fs/smb/server/server.h | 3 ++
fs/smb/server/smb2pdu.c | 16 +++++++++++-
fs/smb/server/transport_ipc.c | 7 +++++
10 files changed, 80 insertions(+), 12 deletions(-)
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -306,6 +306,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void
atomic_set(&conn->req_running, 0);
atomic_set(&conn->r_count, 0);
atomic_set(&conn->refcnt, 1);
+ atomic64_set(&conn->session_count, 0);
conn->total_credits = 1;
conn->outstanding_credits = 0;
--- a/fs/smb/server/connection.h
+++ b/fs/smb/server/connection.h
@@ -77,6 +77,8 @@ struct ksmbd_conn {
struct rw_semaphore session_lock;
/* smb session 1 per user */
struct xarray sessions;
+ /* New sessions and SMB3 channels each reserve one connection slot. */
+ atomic64_t session_count;
unsigned long creation_time;
unsigned long last_active;
/* How many request are running currently */
--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
@@ -114,7 +114,8 @@ struct ksmbd_startup_request {
__s8 bind_interfaces_only;
__u32 max_ip_connections; /* Number of maximum connection per ip address */
__s8 aapl_model[32]; /* AAPL model string for Finder icon, e.g. "Xserve" */
- __s8 reserved[467]; /* Reserved room */
+ __u32 max_sessions_per_connection; /* Maximum sessions per connection */
+ __s8 reserved[463]; /* Reserved room */
__u32 ifc_list_sz; /* interfaces list size */
__s8 ____payload[];
} __packed;
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -3,6 +3,7 @@
* Copyright (C) 2018 Samsung Electronics Co., Ltd.
*/
+#include <linux/atomic.h>
#include <linux/list.h>
#include <linux/slab.h>
#include <linux/rwsem.h>
@@ -18,6 +19,7 @@
#include "../vfs_cache.h"
#include "../misc.h"
#include "../stats.h"
+#include "../server.h"
static DEFINE_IDA(session_ida);
@@ -26,6 +28,21 @@ static DEFINE_IDA(session_ida);
static DEFINE_HASHTABLE(sessions_table, SESSION_HASH_BITS);
static DECLARE_RWSEM(sessions_table_lock);
+int ksmbd_session_reserve_slot(struct ksmbd_conn *conn)
+{
+ if (atomic64_inc_return(&conn->session_count) >
+ READ_ONCE(server_conf.max_sessions_per_connection)) {
+ atomic64_dec(&conn->session_count);
+ return -ENOSPC;
+ }
+ return 0;
+}
+
+void ksmbd_session_release_slot(struct ksmbd_conn *conn)
+{
+ atomic64_dec(&conn->session_count);
+}
+
struct ksmbd_session_rpc {
int id;
unsigned int method;
@@ -273,6 +290,7 @@ static void free_channel_list(struct ksm
down_write(&sess->chann_lock);
xa_for_each(&sess->ksmbd_chann_list, index, chann) {
xa_erase(&sess->ksmbd_chann_list, index);
+ ksmbd_session_release_slot(chann->conn);
ksmbd_conn_put(chann->conn);
kfree_sensitive(chann);
}
@@ -400,9 +418,12 @@ int ksmbd_session_rpc_method(struct ksmb
void ksmbd_session_destroy(struct ksmbd_session *sess)
{
+ struct ksmbd_conn *setup_conn;
+
if (!sess)
return;
+ setup_conn = sess->setup_conn;
delete_proc_session(sess);
ksmbd_tree_conn_session_logoff(sess);
ksmbd_destroy_file_table(sess);
@@ -412,9 +433,14 @@ void ksmbd_session_destroy(struct ksmbd_
ksmbd_session_rpc_clear_list(sess);
free_channel_list(sess);
kfree_sensitive(sess->Preauth_HashValue);
- ksmbd_release_id(&session_ida, sess->id);
+ if (sess->id)
+ ksmbd_release_id(&session_ida, sess->id);
ida_destroy(&sess->tree_conn_ida);
kfree_sensitive(sess);
+ if (setup_conn) {
+ ksmbd_session_release_slot(setup_conn);
+ ksmbd_conn_put(setup_conn);
+ }
}
static void ksmbd_session_remove_from_table(struct ksmbd_session *sess)
@@ -602,6 +628,7 @@ static int ksmbd_chann_del(struct ksmbd_
if (!chann)
return -ENOENT;
+ ksmbd_session_release_slot(chann->conn);
ksmbd_conn_put(chann->conn);
kfree_sensitive(chann);
return 0;
@@ -841,7 +868,7 @@ static int __init_smb2_session(struct ks
return 0;
}
-static struct ksmbd_session *__session_create(int protocol)
+static struct ksmbd_session *__session_create(struct ksmbd_conn *conn, int protocol)
{
struct ksmbd_session *sess;
int ret;
@@ -849,15 +876,17 @@ static struct ksmbd_session *__session_c
if (protocol != CIFDS_SESSION_FLAG_SMB2)
return NULL;
+ if (ksmbd_session_reserve_slot(conn))
+ return NULL;
+
sess = kzalloc_obj(struct ksmbd_session, KSMBD_DEFAULT_GFP);
- if (!sess)
+ if (!sess) {
+ ksmbd_session_release_slot(conn);
return NULL;
+ }
+ sess->setup_conn = ksmbd_conn_get(conn);
ida_init(&sess->tree_conn_ida);
-
- if (ksmbd_init_file_table(&sess->file_table))
- goto error;
-
sess->last_active = jiffies;
sess->state = SMB2_SESSION_IN_PROGRESS;
set_session_flag(sess, protocol);
@@ -870,6 +899,9 @@ static struct ksmbd_session *__session_c
init_rwsem(&sess->rpc_lock);
init_rwsem(&sess->chann_lock);
+ if (ksmbd_init_file_table(&sess->file_table))
+ goto error;
+
ret = __init_smb2_session(sess);
if (ret)
goto error;
@@ -888,9 +920,9 @@ error:
return NULL;
}
-struct ksmbd_session *ksmbd_smb2_session_create(void)
+struct ksmbd_session *ksmbd_smb2_session_create(struct ksmbd_conn *conn)
{
- return __session_create(CIFDS_SESSION_FLAG_SMB2);
+ return __session_create(conn, CIFDS_SESSION_FLAG_SMB2);
}
int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess)
--- a/fs/smb/server/mgmt/user_session.h
+++ b/fs/smb/server/mgmt/user_session.h
@@ -37,6 +37,8 @@ struct ksmbd_session {
char ClientGUID[SMB2_CLIENT_GUID_SIZE];
struct ksmbd_user *user;
+ /* Holds the connection slot until an SMB3 channel takes it over. */
+ struct ksmbd_conn *setup_conn;
unsigned int sequence_number;
unsigned int flags;
@@ -89,7 +91,9 @@ static inline void clear_session_flag(st
sess->flags &= ~bit;
}
-struct ksmbd_session *ksmbd_smb2_session_create(void);
+struct ksmbd_session *ksmbd_smb2_session_create(struct ksmbd_conn *conn);
+int ksmbd_session_reserve_slot(struct ksmbd_conn *conn);
+void ksmbd_session_release_slot(struct ksmbd_conn *conn);
void ksmbd_session_destroy(struct ksmbd_session *sess);
--- a/fs/smb/server/proc.c
+++ b/fs/smb/server/proc.c
@@ -161,6 +161,8 @@ static int proc_show_ksmbd_stats(struct
seq_printf(m, "max_connections:\t%u\n", server_conf.max_connections);
seq_printf(m, "max_connections_per_ip:\t%u\n",
server_conf.max_ip_connections);
+ seq_printf(m, "max_sessions_per_connection:\t%u\n",
+ server_conf.max_sessions_per_connection);
seq_printf(m, "max_inflight_requests:\t%u\n",
server_conf.max_inflight_req);
seq_printf(m, "deadtime_seconds:\t%lu\n", server_conf.deadtime / HZ);
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -456,6 +456,8 @@ static int server_conf_init(void)
KSMBD_AUTH_MSKRB5;
#endif
server_conf.max_inflight_req = SMB2_MAX_CREDITS;
+ server_conf.max_sessions_per_connection =
+ KSMBD_DEFAULT_MAX_SESSIONS_PER_CONNECTION;
return 0;
}
--- a/fs/smb/server/server.h
+++ b/fs/smb/server/server.h
@@ -8,6 +8,8 @@
#include "smbacl.h"
+#define KSMBD_DEFAULT_MAX_SESSIONS_PER_CONNECTION 64
+
/*
* Server state type
*/
@@ -44,6 +46,7 @@ struct ksmbd_server_config {
unsigned int max_connections;
unsigned int max_inflight_req;
unsigned int max_ip_connections;
+ unsigned int max_sessions_per_connection;
char *conf[SERVER_CONF_WORK_GROUP + 1];
struct task_struct *dh_task;
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -116,14 +116,28 @@ static int register_session_channel(stru
goto out;
}
+ if (sess->setup_conn != conn) {
+ rc = ksmbd_session_reserve_slot(conn);
+ if (rc) {
+ kfree_sensitive(chann);
+ goto out;
+ }
+ }
+
chann->conn = ksmbd_conn_get(conn);
memcpy(chann->sess_key, sess_key, sizeof(chann->sess_key));
old = xa_store(&sess->ksmbd_chann_list, (long)conn, chann,
KSMBD_DEFAULT_GFP);
if (xa_is_err(old)) {
+ if (sess->setup_conn != conn)
+ ksmbd_session_release_slot(conn);
ksmbd_conn_put(chann->conn);
kfree_sensitive(chann);
rc = xa_err(old);
+ } else if (sess->setup_conn == conn) {
+ /* Transfer the initial reservation and reference to this channel. */
+ sess->setup_conn = NULL;
+ ksmbd_conn_put(conn);
}
out:
up_write(&sess->chann_lock);
@@ -2461,7 +2475,7 @@ int smb2_sess_setup(struct ksmbd_work *w
ksmbd_conn_lock(conn);
if (!req->hdr.SessionId) {
- sess = ksmbd_smb2_session_create();
+ sess = ksmbd_smb2_session_create(conn);
if (!sess) {
rc = -ENOMEM;
goto out_err;
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -353,6 +353,13 @@ static int ipc_server_config_on_startup(
if (req->max_ip_connections)
server_conf.max_ip_connections = req->max_ip_connections;
+ if (req->max_sessions_per_connection)
+ server_conf.max_sessions_per_connection =
+ req->max_sessions_per_connection;
+ else
+ server_conf.max_sessions_per_connection =
+ KSMBD_DEFAULT_MAX_SESSIONS_PER_CONNECTION;
+
ret = ksmbd_set_netbios_name(req->netbios_name);
ret |= ksmbd_set_server_string(req->server_string);
ret |= ksmbd_set_work_group(req->work_group);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 126/547] ksmbd: preserve unreadable named streams on open
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 125/547] ksmbd: limit sessions on each connection Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 127/547] ksmbd: prevent session binding in compound requests Greg Kroah-Hartman
` (429 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
commit 80c816c047f7cae3c99cc75740c1f5d2c4d97b45 upstream.
A write-only client can open an existing named stream with FILE_OPEN_IF
without permission to read the underlying file. The case-insensitive
lookup finds the xattr name, but querying its value length then fails
with -EACCES. smb2_set_stream_name_xattr() treats every negative result
as a missing stream and replaces the existing xattr with an empty value.
A failed xattr list is not proof that the stream is absent either:
for example, -ENOMEM can lead to the same empty replacement. Preserve
listing errors and create a stream only for -ENOENT or -ENODATA. The
latter can occur if the xattr is removed between listing its name and
querying its value. Return other lookup errors without changing the
stream.
A write-only FILE_OPEN now reports access denied instead of name not
found. FILE_OVERWRITE_IF and FILE_SUPERSEDE on an unreadable stream
also fail instead of appearing to replace it. Stream writes and EOF
changes already need to read the old value, so such handles cannot
update the stream after opening either.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 2 ++
fs/smb/server/vfs.c | 6 +++++-
2 files changed, 7 insertions(+), 1 deletion(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3428,6 +3428,8 @@ static noinline int smb2_set_stream_name
xattr_stream_size);
if (rc >= 0)
return 0;
+ if (rc != -ENOENT && rc != -ENODATA)
+ return rc;
if (fp->cdoption == FILE_OPEN_LE) {
if (!strcmp(stream_name, "AFP_AfpInfo") &&
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1912,7 +1912,11 @@ ssize_t ksmbd_vfs_casexattr_len(struct m
ssize_t value_len = -ENOENT, xattr_list_len;
xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
- if (xattr_list_len <= 0)
+ if (xattr_list_len < 0) {
+ value_len = xattr_list_len;
+ goto out;
+ }
+ if (!xattr_list_len)
goto out;
for (name = xattr_list; name - xattr_list < xattr_list_len;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 127/547] ksmbd: prevent session binding in compound requests
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 126/547] ksmbd: preserve unreadable named streams on open Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 128/547] ksmbd: prevent share root removal through empty paths Greg Kroah-Hartman
` (428 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zeng Adolph, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 19f8fd6b5ced33b02a083759e6901f9d6e8076df upstream.
A failed multichannel binding can retain its target session on the work
item so that the error response can be signed. Subsequent compound
commands can then use that session together with a tree connection left
over from an earlier command.
Limit binding SESSION_SETUP requests to standalone messages during
message validation, before smb2_sess_setup() can replace work->sess.
Check both NextCommand and the current request offset to cover binding
in the first, middle and last positions of a compound. The existing
validation error path returns STATUS_INVALID_PARAMETER and stops
processing the remaining commands.
This intentionally limits support for compounded binding. It is not a
protocol requirement that binding be standalone. Standalone binding and
non-binding compounds retain their existing behavior, without changing
session, tree or response encryption handling.
Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
Cc: stable@vger.kernel.org
Reported-by: Zeng Adolph <coderzeng@hotmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2misc.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/smb/server/smb2misc.c
+++ b/fs/smb/server/smb2misc.c
@@ -501,6 +501,14 @@ int ksmbd_smb2_check_message(struct ksmb
if (req_struct_size > len + 1)
return 1;
+ if (command == SMB2_SESSION_SETUP_HE &&
+ (work->next_smb2_rcv_hdr_off || next_cmd)) {
+ struct smb2_sess_setup_req *req = (void *)hdr;
+
+ if (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)
+ return 1;
+ }
+
if (smb2_calc_size(hdr, &clc_len))
return 1;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 128/547] ksmbd: prevent share root removal through empty paths
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 127/547] ksmbd: prevent session binding in compound requests Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 129/547] ksmbd: prevent stale data from being written by SMB2 WRITE requests Greg Kroah-Hartman
` (427 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zachariah Mithani (AploSec),
Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 9fd1fcbbf84986a7bcf601a2b90540899069d263 upstream.
A FileLinkInformation request can supply "/" as the new link name.
smb2_get_name() strips the trailing slash and passes an empty string to
ksmbd_vfs_kern_path_start_removing().
ksmbd_vfs_path_lookup() resolves an empty pathname as the configured share
path, without LOOKUP_BENEATH. With ReplaceIfExists set, smb2_create_link()
can therefore remove the share root from its parent before link creation
fails. An authenticated client with a writable share and DELETE access to
a file can trigger this if the share root is empty and the mapped user
has write and search permission on its parent directory.
Return -EINVAL for empty pathnames when for_remove is set, before
resolving the share path or acquiring removal resources. Ordinary lookups
continue to accept empty pathnames for opening the share root.
Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name")
Cc: stable@vger.kernel.org
Reported-by: Zachariah Mithani (AploSec) <zachariah@aplosai.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/vfs.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -61,6 +61,10 @@ static int ksmbd_vfs_path_lookup(struct
struct dentry *d;
if (pathname[0] == '\0') {
+ /* The share root must never be removed. */
+ if (for_remove)
+ return -EINVAL;
+
pathname = share_conf->path;
root_share_path = NULL;
} else {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 129/547] ksmbd: prevent stale data from being written by SMB2 WRITE requests
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 128/547] ksmbd: prevent share root removal through empty paths Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 130/547] ksmbd: reclaim ended sessions on logoff and expiration Greg Kroah-Hartman
` (426 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, zdi-disclosures
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit bc0e0f5ac1d7b044d403f859406b4b66d4b1ce9b upstream.
Initialize the compatibility byte in request buffers without zeroing
the entire allocation. Keep the one-byte compatibility exception for
SMB2 messages so valid zero-length WRITE requests remain compatible,
and validate the data range in the WRITE handlers against the current
compound request before accessing it.
This prevents stale request-buffer data from being written to files or
sent to IPC pipes.
Fixes: 443d61d1fa9f ("ksmbd: allocate one more byte for implied bcc[0]")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-32436
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/compress.c | 1 +
fs/smb/server/connection.c | 1 +
fs/smb/server/smb2pdu.c | 27 ++++++++++++++++++---------
3 files changed, 20 insertions(+), 9 deletions(-)
--- a/fs/smb/server/compress.c
+++ b/fs/smb/server/compress.c
@@ -65,6 +65,7 @@ static int __ksmbd_decompress_request(st
return -ENOMEM;
*(__be32 *)out = cpu_to_be32(out_size);
+ out[out_size + 4] = 0;
rc = smb_compression_decompress(conn->compress_algorithm,
conn->compress_chained,
conn->compress_pattern,
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -753,6 +753,7 @@ recheck:
if (!conn->request_buf)
break;
+ conn->request_buf[pdu_size + 4] = 0;
memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
/*
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -9303,23 +9303,25 @@ static noinline int smb2_write_pipe(stru
int err = 0, ret = 0;
char *data_buf;
size_t length;
+ unsigned int data_offset, req_len;
WORK_BUFFERS(work, req, rsp);
length = le32_to_cpu(req->Length);
id = req->VolatileFileId;
+ data_offset = le16_to_cpu(req->DataOffset);
+ req_len = smb2_current_req_len(work, &req->hdr);
- if ((u64)le16_to_cpu(req->DataOffset) + length >
- get_rfc1002_len(work->request_buf)) {
- pr_err("invalid write data offset %u, smb_len %u\n",
- le16_to_cpu(req->DataOffset),
- get_rfc1002_len(work->request_buf));
+ if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+ data_offset > req_len || length > req_len - data_offset) {
+ pr_err("invalid write data offset %u, length %zu, req_len %u\n",
+ data_offset, length, req_len);
err = -EINVAL;
goto out;
}
data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
- le16_to_cpu(req->DataOffset));
+ data_offset);
rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length);
if (rpc_resp) {
@@ -9606,14 +9608,21 @@ int smb2_write(struct ksmbd_work *work)
writethrough = true;
if (is_rdma_channel == false) {
- if (le16_to_cpu(req->DataOffset) <
- offsetof(struct smb2_write_req, Buffer)) {
+ unsigned int data_offset = le16_to_cpu(req->DataOffset);
+ unsigned int req_len = smb2_current_req_len(work, &req->hdr);
+
+ if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+ data_offset > req_len ||
+ length > req_len - data_offset) {
+ ksmbd_debug(SMB,
+ "invalid write data offset %u, length %zu, req_len %u\n",
+ data_offset, length, req_len);
err = -EINVAL;
goto out;
}
data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
- le16_to_cpu(req->DataOffset));
+ data_offset);
ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n",
fp->filp, offset, length);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 130/547] ksmbd: reclaim ended sessions on logoff and expiration
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 129/547] ksmbd: prevent stale data from being written by SMB2 WRITE requests Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 131/547] ksmbd: reserve space for the UTF-16 terminator in stream info Greg Kroah-Hartman
` (425 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 26534ef335e92b028eb58e44d98d46a0e26af0ec upstream.
LOGOFF and previous-session replacement leave sessions Expired with a
zero credential expiry. Ended sessions can retain their memory and
connection slots when no further setup arrives on the owning connection.
Unpublish a logged-off session while the request reference keeps its
response signing and encryption keys alive. Remove its procfs entry
before dropping the table reference so a reader cannot remove its own
entry on the last put. Clear proc_entry after removal to avoid removing
it twice.
Reclaim ended sessions from the global table in the existing expiration
worker before it acquires conn_list_lock. Only select Expired sessions
with zero credential expiry and no references beyond the table
reference. Keep sessions whose Kerberos credentials expired available
for reauthentication.
Unlink the session from its setup connection and all channel
connections, so SMB2 sessions and sessions with only secondary SMB3
channels are covered. The session already holds connection references,
and sessions_table_lock prevents concurrent channel removal. Queue
sessions on a separate disposal list, leaving their hash nodes unhashed,
and remove procfs entries and drop table references outside the locks.
Keep the pending setup check before allocating a new session so
abandoned InProgress sessions can release their slots even at the
connection limit. Retain the timeout and reference checks and dispose of
those sessions outside the locks. Leave ended Expired sessions to the
expiration worker.
Fixes: d7fd1f98607f ("ksmbd: follow SMB2 session expiration semantics")
Cc: stable@vger.kernel.org
Reported-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/connection.c | 1
fs/smb/server/mgmt/user_session.c | 94 ++++++++++++++++++++++++++++++--------
fs/smb/server/mgmt/user_session.h | 3 +
fs/smb/server/smb2pdu.c | 7 ++
4 files changed, 86 insertions(+), 19 deletions(-)
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -642,6 +642,7 @@ static void ksmbd_session_expiration_wor
goto reschedule;
ksmbd_expire_sessions();
+ ksmbd_reclaim_ended_sessions();
/*
* An old connection without a Valid or Expired session must be
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -231,8 +231,10 @@ static int create_proc_session(struct ks
static void delete_proc_session(struct ksmbd_session *sess)
{
- if (sess->proc_entry)
+ if (sess->proc_entry) {
proc_remove(sess->proc_entry);
+ sess->proc_entry = NULL;
+ }
}
static int show_proc_sessions(struct seq_file *m, void *v)
@@ -449,6 +451,17 @@ static void ksmbd_session_remove_from_ta
ksmbd_counter_dec(KSMBD_COUNTER_SESSIONS);
}
+static void ksmbd_dispose_sessions(struct list_head *dispose)
+{
+ struct ksmbd_session *sess, *tmp;
+
+ list_for_each_entry_safe(sess, tmp, dispose, dispose_entry) {
+ list_del_init(&sess->dispose_entry);
+ delete_proc_session(sess);
+ ksmbd_user_session_put(sess);
+ }
+}
+
struct ksmbd_session *__session_lookup(unsigned long long id)
{
struct ksmbd_session *sess;
@@ -462,8 +475,9 @@ struct ksmbd_session *__session_lookup(u
return NULL;
}
-static bool ksmbd_too_many_session_setups(struct ksmbd_conn *conn)
+bool ksmbd_too_many_session_setups(struct ksmbd_conn *conn)
{
+ LIST_HEAD(dispose);
unsigned long id;
struct ksmbd_session *sess;
unsigned int pending = 0;
@@ -474,18 +488,20 @@ static bool ksmbd_too_many_session_setup
if (READ_ONCE(sess->state) != SMB2_SESSION_IN_PROGRESS)
continue;
- if (atomic_read(&sess->refcnt) <= 1 &&
+ /* Keep response signing keys until every request has dropped its reference. */
+ if (atomic_read(&sess->refcnt) == 1 &&
time_after(jiffies, sess->last_active +
KSMBD_UNAUTHENTICATED_CONN_TIMEOUT)) {
xa_erase(&conn->sessions, sess->id);
ksmbd_session_remove_from_table(sess);
- ksmbd_session_destroy(sess);
+ list_add_tail(&sess->dispose_entry, &dispose);
continue;
}
pending++;
}
up_write(&conn->session_lock);
up_write(&sessions_table_lock);
+ ksmbd_dispose_sessions(&dispose);
return pending >= KSMBD_MAX_PENDING_SESSIONS;
}
@@ -496,12 +512,8 @@ int ksmbd_session_register(struct ksmbd_
sess->dialect = conn->dialect;
memcpy(sess->ClientGUID, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE);
- /* Bound abandoned SessionId-zero authentication exchanges. */
- if (ksmbd_too_many_session_setups(conn))
- ret = -ENOSPC;
- else
- ret = xa_err(xa_store(&conn->sessions, sess->id, sess,
- KSMBD_DEFAULT_GFP));
+ ret = xa_err(xa_store(&conn->sessions, sess->id, sess,
+ KSMBD_DEFAULT_GFP));
if (ret) {
down_write(&sessions_table_lock);
ksmbd_session_remove_from_table(sess);
@@ -513,8 +525,9 @@ int ksmbd_session_register(struct ksmbd_
return ret;
}
-void ksmbd_session_unregister(struct ksmbd_conn *conn,
- struct ksmbd_session *sess)
+/* The caller holds sessions_table_lock for writing. */
+static bool __ksmbd_session_unregister(struct ksmbd_conn *conn,
+ struct ksmbd_session *sess)
{
struct ksmbd_conn *session_conns[KSMBD_MAX_CHANNELS];
struct channel *chann;
@@ -522,10 +535,13 @@ void ksmbd_session_unregister(struct ksm
unsigned int nr_conns = 0, i;
bool removed = false;
- down_write(&sessions_table_lock);
+ lockdep_assert_held_write(&sessions_table_lock);
if (!hlist_unhashed(&sess->hlist)) {
- /* Keep each channel connection stable under sessions_table_lock. */
+ /* Existing references stay valid under sessions_table_lock. */
down_read(&sess->chann_lock);
+ /* SMB2.0/2.1 sessions have no channel holding their connection. */
+ if (sess->setup_conn)
+ session_conns[nr_conns++] = sess->setup_conn;
xa_for_each(&sess->ksmbd_chann_list, index, chann) {
if (nr_conns == ARRAY_SIZE(session_conns))
break;
@@ -537,10 +553,12 @@ void ksmbd_session_unregister(struct ksm
removed = true;
}
- down_write(&conn->session_lock);
- if (xa_load(&conn->sessions, sess->id) == sess)
- xa_erase(&conn->sessions, sess->id);
- up_write(&conn->session_lock);
+ if (conn) {
+ down_write(&conn->session_lock);
+ if (xa_load(&conn->sessions, sess->id) == sess)
+ xa_erase(&conn->sessions, sess->id);
+ up_write(&conn->session_lock);
+ }
for (i = 0; i < nr_conns; i++) {
if (session_conns[i] == conn)
continue;
@@ -549,10 +567,47 @@ void ksmbd_session_unregister(struct ksm
xa_erase(&session_conns[i]->sessions, sess->id);
up_write(&session_conns[i]->session_lock);
}
+ return removed;
+}
+
+void ksmbd_session_unregister(struct ksmbd_conn *conn,
+ struct ksmbd_session *sess)
+{
+ bool removed;
+
+ down_write(&sessions_table_lock);
+ removed = __ksmbd_session_unregister(conn, sess);
up_write(&sessions_table_lock);
- if (removed)
+ if (removed) {
+ /*
+ * Keep the table reference until procfs readers have finished,
+ * so none can remove its own proc entry on the last put.
+ */
+ delete_proc_session(sess);
ksmbd_user_session_put(sess);
+ }
+}
+
+void ksmbd_reclaim_ended_sessions(void)
+{
+ LIST_HEAD(dispose);
+ struct ksmbd_session *sess;
+ struct hlist_node *tmp;
+ int bkt;
+
+ down_write(&sessions_table_lock);
+ hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) {
+ if (READ_ONCE(sess->state) != SMB2_SESSION_EXPIRED ||
+ READ_ONCE(sess->kerberos_expiry) ||
+ atomic_read(&sess->refcnt) != 1)
+ continue;
+
+ __ksmbd_session_unregister(NULL, sess);
+ list_add_tail(&sess->dispose_entry, &dispose);
+ }
+ up_write(&sessions_table_lock);
+ ksmbd_dispose_sessions(&dispose);
}
bool ksmbd_conn_has_valid_or_expired_session(struct ksmbd_conn *conn)
@@ -893,6 +948,7 @@ static struct ksmbd_session *__session_c
xa_init(&sess->tree_conns);
xa_init(&sess->ksmbd_chann_list);
xa_init(&sess->rpc_handle_list);
+ INIT_LIST_HEAD(&sess->dispose_entry);
sess->sequence_number = 1;
atomic_set(&sess->refcnt, 2);
init_rwsem(&sess->tree_conns_lock);
--- a/fs/smb/server/mgmt/user_session.h
+++ b/fs/smb/server/mgmt/user_session.h
@@ -53,6 +53,7 @@ struct ksmbd_session {
u64 kerberos_expiry;
struct hlist_node hlist;
+ struct list_head dispose_entry;
struct rw_semaphore chann_lock;
struct xarray ksmbd_chann_list;
struct xarray tree_conns;
@@ -102,6 +103,7 @@ struct ksmbd_session *ksmbd_session_look
unsigned long long id);
bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
unsigned long long id);
+bool ksmbd_too_many_session_setups(struct ksmbd_conn *conn);
int ksmbd_session_register(struct ksmbd_conn *conn,
struct ksmbd_session *sess);
void ksmbd_session_unregister(struct ksmbd_conn *conn,
@@ -109,6 +111,7 @@ void ksmbd_session_unregister(struct ksm
void ksmbd_conn_sessions_cleanup(struct ksmbd_conn *conn);
bool ksmbd_conn_has_valid_or_expired_session(struct ksmbd_conn *conn);
void ksmbd_expire_sessions(void);
+void ksmbd_reclaim_ended_sessions(void);
struct ksmbd_session *__session_lookup(unsigned long long id);
struct ksmbd_session *ksmbd_session_lookup_all(struct ksmbd_conn *conn,
unsigned long long id);
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2475,6 +2475,11 @@ int smb2_sess_setup(struct ksmbd_work *w
ksmbd_conn_lock(conn);
if (!req->hdr.SessionId) {
+ /* Bound abandoned SessionId-zero authentication exchanges. */
+ if (ksmbd_too_many_session_setups(conn)) {
+ rc = -ENOSPC;
+ goto out_err;
+ }
sess = ksmbd_smb2_session_create(conn);
if (!sess) {
rc = -ENOMEM;
@@ -3173,6 +3178,8 @@ int smb2_session_logoff(struct ksmbd_wor
up_write(&conn->session_lock);
ksmbd_all_conn_set_status(sess, KSMBD_SESS_NEED_SETUP);
+ /* Drop the table reference while work->sess pins the response keys. */
+ ksmbd_session_unregister(conn, sess);
if (err)
return err;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 131/547] ksmbd: reserve space for the UTF-16 terminator in stream info
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 130/547] ksmbd: reclaim ended sessions on logoff and expiration Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 132/547] ksmbd: restore Kerberos logins with released ksmbd-tools Greg Kroah-Hartman
` (424 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
commit a025c4991a7d83edc4dd339e3ea86d8ff6226eca upstream.
smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the
converted characters, but get_file_stream_info() budgets only
sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry
and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing
"::$DATA" entry. When an entry exactly fills the 448-byte small response
buffer, the terminator is written two bytes past the allocation.
Reserve one extra UTF-16 unit in both budget checks. The terminator is
not part of the wire format, so the reported lengths are unchanged.
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6936,7 +6936,8 @@ static int get_file_stream_info(struct k
":%s", &stream_name[XATTR_NAME_STREAM_LEN]);
next = sizeof(struct smb2_file_stream_info) + streamlen * 2;
- if (next > buf_free_len) {
+ /* smbConvertToUTF16() also writes a terminating UTF-16 unit. */
+ if (next + sizeof(__le16) > buf_free_len) {
kfree(stream_buf);
break;
}
@@ -6970,7 +6971,7 @@ static int get_file_stream_info(struct k
out:
if (!S_ISDIR(stat.mode) &&
- buf_free_len >= sizeof(struct smb2_file_stream_info) + 7 * 2) {
+ buf_free_len >= sizeof(struct smb2_file_stream_info) + (7 + 1) * 2) {
file_info = (struct smb2_file_stream_info *)
&rsp->Buffer[nbytes];
streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 132/547] ksmbd: restore Kerberos logins with released ksmbd-tools
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 131/547] ksmbd: reserve space for the UTF-16 terminator in stream info Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 133/547] ksmbd: return end of file for reads past a named streams data Greg Kroah-Hartman
` (423 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michail Andreas Michalopoulos,
Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
commit 0fec4c24e1979032d7b7c159d9e5c45c7444e0f2 upstream.
Commit a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets
expire") added a __u64 session_expiry field to struct
ksmbd_spnego_authen_response, growing it from 156 to 168 bytes.
ipc_validate_msg() requires the response to have exactly that size, so
the 156-byte response of every released ksmbd-tools, up to 3.5.7, is
dropped and Kerberos session setup fails with STATUS_LOGON_FAILURE.
The other way round, kernels without that commit, including the stable
trees, drop the 168-byte response of current ksmbd-tools master, and
ksmbd-tools has no way to tell which layout a kernel expects.
Pass the expiry in the reserved area of the embedded struct
ksmbd_login_response instead. ksmbd-tools releases with that area
(3.4.4 and later) allocate the response zeroed and never write to it,
so they send an expiry of 0, which ksmbd already treats as no expiry.
The response is 156 bytes again, so it works with those releases, and
every kernel also accepts a response that sets the expiry. Use two
__u32 halves, as the reserved area is only 4-byte aligned.
Fixes: a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets expire")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/CAO+rqLhpPvY0NLrAnZjFXz0gOXnA6zsXxK8xCgtA42XUkSsAeg@mail.gmail.com/
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/auth.c | 3 ++-
fs/smb/server/ksmbd_netlink.h | 5 +++--
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 88953315b160..0c51ca0cb14d 100644
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -463,7 +463,8 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
memcpy(out_blob, resp->payload + resp->session_key_len,
resp->spnego_blob_len);
*out_len = resp->spnego_blob_len;
- sess->kerberos_expiry = resp->session_expiry;
+ sess->kerberos_expiry = (u64)resp->login_response.session_expiry_hi << 32 |
+ resp->login_response.session_expiry_lo;
retval = 0;
out:
kvfree_sensitive(resp, sizeof(*resp) + resp->session_key_len +
diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h
index 93ebf3f6fbef..ad050988659e 100644
--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
@@ -149,7 +149,9 @@ struct ksmbd_login_response {
__u16 status;
__u16 hash_sz; /* hash size */
__s8 hash[KSMBD_REQ_MAX_HASH_SZ]; /* password hash */
- __u32 reserved[16]; /* Reserved room */
+ __u32 session_expiry_lo; /* Kerberos ticket expiry, SPNEGO only */
+ __u32 session_expiry_hi;
+ __u32 reserved[14]; /* Reserved room */
};
/*
@@ -287,7 +289,6 @@ struct ksmbd_spnego_authen_response {
* stored in SecurityBuffer of SMB2 SESSION
* SETUP response
*/
- __u64 session_expiry; /* Kerberos ticket expiry time */
__u8 payload[]; /* session key + AP_REP */
};
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 133/547] ksmbd: return end of file for reads past a named streams data
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 132/547] ksmbd: restore Kerberos logins with released ksmbd-tools Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 134/547] ksmbd: use u8 for SMB2 oplock level values Greg Kroah-Hartman
` (422 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
commit 626611dc22a3b63b3264a7a797d9dbc530234fcd upstream.
A READ on a non-empty named stream at or beyond its end fails with
STATUS_INVALID_PARAMETER. ksmbd_vfs_stream_read() returns -EINVAL when
the offset is not below the stream length, and smb2_read() maps -EINVAL
to that status.
smb2_read() already turns a zero-byte read into STATUS_END_OF_FILE, the
status a regular file returns at its end, and an empty stream already
takes that path. Return 0 instead of -EINVAL so that non-empty streams
do the same. Clients that read a stream until end of file otherwise get
an error once they have read all of its data.
The buffered copychunk path converts a zero-byte source read to -EIO,
as it does for a regular file that shrinks during copying.
Fixes: 2ae1a6cc4302 ("cifsd: fix potential read overflow in ksmbd_vfs_stream_read()")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/vfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -272,7 +272,7 @@ static int ksmbd_vfs_stream_read(struct
return (int)v_len;
if (v_len <= *pos) {
- count = -EINVAL;
+ count = 0;
goto free_buf;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 134/547] ksmbd: use u8 for SMB2 oplock level values
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 133/547] ksmbd: return end of file for reads past a named streams data Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 135/547] ksmbd: validate AppInstanceId takeover target Greg Kroah-Hartman
` (421 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit f622fedabbb58c8006ee21373968ae07bf8a9467 upstream.
The SMB2 oplock level is an unsigned 8-bit wire value, but
smb20_oplock_break_ack() stores it in a plain char. On architectures where
plain char is signed, the value 0xff becomes -1 and cannot compare equal to
SMB2_OPLOCK_LEVEL_LEASE (0xff). The acknowledgment is consequently rejected
with STATUS_INVALID_OPLOCK_PROTOCOL instead of the intended
STATUS_INVALID_PARAMETER.
Use u8 for the request and response oplock-level variables. This preserves
all wire values in their original representation.
Fixes: 80a56d4a826c ("ksmbd: align SMB2 oplock break ack handling")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -11488,7 +11488,7 @@ static void smb20_oplock_break_ack(struc
__le32 status = STATUS_SUCCESS;
int ret;
u64 volatile_id, persistent_id;
- char req_oplevel = 0, rsp_oplevel = 0;
+ u8 req_oplevel = 0, rsp_oplevel = 0;
WORK_BUFFERS(work, req, rsp);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 135/547] ksmbd: validate AppInstanceId takeover target
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 134/547] ksmbd: use u8 for SMB2 oplock level values Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 136/547] ksmbd: validate security descriptor offsets before pointer arithmetic Greg Kroah-Hartman
` (420 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sung Byeongchan, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Byeongchan <tjdqudcks0424@naver.com>
commit e0386cd6498b9c63f8c6d10b3e08670b92c0f3f1 upstream.
AppInstanceId lookup currently selects the first open with the matching
identifier. CREATE for an unrelated share or path can therefore
force-close another session's open before authorization of the new
target. Matching only the base path also conflates alternate data streams
with the unnamed stream.
MS-SMB2 requires the old open to match the share and path, belong to a
different ClientGuid, and be closed only when the requester has
GENERIC_READ access. Search all opens with the ID and match share,
resolved path, stream, and the current connection's client GUID. Retain a
share configuration reference in ksmbd_file and reuse its name instead of
allocating a name for every open. This keeps matching safe during tree
connection teardown and preserves name-based matching across configuration
updates.
Refresh the share reference on durable reconnect and restore the old
reference if reopening fails. Serialize connection and share comparisons
with durable disconnect/reconnect, and recheck the target before closing
it. Keep the original ClientGuid for durable replay and lease checks.
Check AppInstanceVersion before querying access, even when GENERIC_READ
is absent, and before disconnected delete-on-close cleanup. Rejected
CREATE must leave other durable opens untouched. Calculate maximal access
on the matched open's referenced path so a rename cannot substitute another
file's authorization. Require read access with the effective VFS
credentials as well as the NT DACL before takeover. Access denial only
skips takeover and leaves CREATE to its normal access checks. Restore
filesystem credentials before returning a takeover error.
Handle takeover before checking FILE_CREATE collisions, and re-resolve
the path after closing the old open. This lets delete-on-close remove the
old file before a new one is created. Include SYNCHRONIZE in the baseline
maximal-access mask so read-only files report GENERIC_READ correctly.
Fixes: 16c30649709d ("ksmbd: handle durable v2 app instance id")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 123 ++++++++++++++++++++++++++++++++++++++++------
fs/smb/server/vfs.c | 5 +
fs/smb/server/vfs_cache.c | 77 ++++++++++++++++++++--------
fs/smb/server/vfs_cache.h | 10 ++-
4 files changed, 175 insertions(+), 40 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4116,18 +4116,76 @@ static int parse_app_instance_version(st
return 0;
}
-static int smb2_handle_app_instance_id(struct smb2_create_rsp *rsp,
- struct durable_info *dh_info)
+static int smb2_app_instance_stream_matches(struct ksmbd_file *fp,
+ char *stream_name, int s_type,
+ bool *matches)
{
+ char *xattr_stream_name;
+ size_t xattr_stream_size;
+ int rc;
+
+ if (!stream_name) {
+ *matches = !ksmbd_stream_fd(fp);
+ return 0;
+ }
+
+ rc = ksmbd_vfs_xattr_stream_name(stream_name, &xattr_stream_name,
+ &xattr_stream_size, s_type);
+ if (rc)
+ return rc;
+
+ *matches = fp->stream.name && fp->stream.size >= 0 &&
+ (size_t)fp->stream.size == xattr_stream_size &&
+ !strncasecmp(fp->stream.name, xattr_stream_name,
+ xattr_stream_size);
+ kfree(xattr_stream_name);
+ return 0;
+}
+
+static int smb2_handle_app_instance_id(struct ksmbd_work *work,
+ struct smb2_create_rsp *rsp,
+ struct durable_info *dh_info,
+ const struct path *path,
+ char *stream_name, int s_type,
+ bool *closed)
+{
+ struct ksmbd_conn *conn = work->conn;
struct ksmbd_file *old_fp;
- bool reject = false;
+ const struct path *old_path;
+ char *app_instance_id;
+ __le32 maximal_access = FILE_MAXIMAL_ACCESS_LE;
+ bool reject = false, stream_matches;
+ int cursor = 0, rc;
+ *closed = false;
if (!dh_info->app_instance_id)
return 0;
+ app_instance_id = dh_info->AppInstanceId;
- old_fp = ksmbd_lookup_fd_app_instance_id(dh_info->AppInstanceId);
- if (!old_fp)
- return 0;
+ while (true) {
+ old_fp = ksmbd_lookup_fd_app_instance_id_next(app_instance_id,
+ &cursor);
+ if (!old_fp)
+ return 0;
+
+ if (!ksmbd_app_instance_id_matches(work, old_fp) ||
+ !path_equal(&old_fp->filp->f_path, path)) {
+ ksmbd_put_durable_fd(old_fp);
+ continue;
+ }
+
+ rc = smb2_app_instance_stream_matches(old_fp, stream_name,
+ s_type, &stream_matches);
+ if (rc) {
+ ksmbd_put_durable_fd(old_fp);
+ return rc;
+ }
+ if (!stream_matches) {
+ ksmbd_put_durable_fd(old_fp);
+ continue;
+ }
+ break;
+ }
if (dh_info->app_instance_version_valid) {
if (old_fp->app_instance_version_valid &&
@@ -4142,13 +4200,34 @@ static int smb2_handle_app_instance_id(s
reject = true;
}
- ksmbd_put_durable_fd(old_fp);
if (reject) {
+ ksmbd_put_durable_fd(old_fp);
rsp->hdr.Status = STATUS_FILE_FORCED_CLOSED;
return -EIO;
}
- return ksmbd_close_fd_app_instance_id(dh_info->AppInstanceId);
+ /* Authorize the referenced open even if its name changes meanwhile. */
+ old_path = &old_fp->filp->f_path;
+ rc = smb_check_perm_dacl(conn, old_path, &maximal_access, 0,
+ work->sess->user->uid, false);
+ if (rc) {
+ /* Access denial prevents takeover, not the CREATE itself. */
+ ksmbd_put_durable_fd(old_fp);
+ return rc == -EACCES ? 0 : rc;
+ }
+ if (maximal_access == FILE_MAXIMAL_ACCESS_LE)
+ ksmbd_vfs_query_maximal_access(mnt_idmap(old_path->mnt),
+ old_path->dentry, &maximal_access);
+ /* Also require read access with the effective VFS credentials. */
+ if ((le32_to_cpu(maximal_access) & GENERIC_READ_FLAGS) !=
+ GENERIC_READ_FLAGS ||
+ inode_permission(mnt_idmap(old_path->mnt),
+ d_inode(old_path->dentry), MAY_OPEN | MAY_READ)) {
+ ksmbd_put_durable_fd(old_fp);
+ return 0;
+ }
+
+ return ksmbd_close_fd_app_instance_id(work, old_fp, closed);
}
/**
@@ -4188,6 +4267,7 @@ int smb2_open(struct ksmbd_work *work)
char *name = NULL;
char *stream_name = NULL;
bool file_present = false, created = false, already_permitted = false;
+ bool app_instance_id_checked = false, app_instance_closed;
int share_ret, need_truncate = 0;
u64 time, alloc_size = 0;
umode_t posix_mode = 0;
@@ -4362,13 +4442,6 @@ int smb2_open(struct ksmbd_work *work)
}
}
- if (dh_info.app_instance_id && !dh_info.reconnected &&
- !dh_info.replay) {
- rc = smb2_handle_app_instance_id(rsp, &dh_info);
- if (rc)
- goto err_out2;
- }
-
if (le32_to_cpu(req->ImpersonationLevel) > le32_to_cpu(IL_DELEGATE)) {
pr_err("Invalid impersonationlevel : 0x%x\n",
le32_to_cpu(req->ImpersonationLevel));
@@ -4481,9 +4554,29 @@ int smb2_open(struct ksmbd_work *work)
goto err_out2;
}
+resolve_path:
+ file_present = false;
+ maximal_access = 0;
rc = ksmbd_vfs_kern_path(work, name, LOOKUP_NO_SYMLINKS,
&path, 1);
+ /* Validate takeover before disconnected delete-on-close cleanup. */
+ if (!rc && dh_info.app_instance_id && !dh_info.reconnected &&
+ !dh_info.replay && !app_instance_id_checked) {
+ app_instance_id_checked = true;
+ rc = smb2_handle_app_instance_id(work, rsp, &dh_info, &path,
+ stream_name, s_type,
+ &app_instance_closed);
+ if (rc) {
+ path_put(&path);
+ goto err_out1;
+ }
+ if (app_instance_closed) {
+ path_put(&path);
+ goto resolve_path;
+ }
+ }
+
/*
* A durable handle opened with delete-on-close is preserved across a
* disconnect so it can be reclaimed by a durable reconnect. When a new
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -122,10 +122,11 @@ static int ksmbd_vfs_path_lookup(struct
void ksmbd_vfs_query_maximal_access(struct mnt_idmap *idmap,
struct dentry *dentry, __le32 *daccess)
{
- *daccess = cpu_to_le32(FILE_READ_ATTRIBUTES | READ_CONTROL);
+ *daccess = cpu_to_le32(FILE_READ_ATTRIBUTES | READ_CONTROL |
+ SYNCHRONIZE);
if (!inode_permission(idmap, d_inode(dentry), MAY_OPEN | MAY_WRITE))
- *daccess |= cpu_to_le32(WRITE_DAC | WRITE_OWNER | SYNCHRONIZE |
+ *daccess |= cpu_to_le32(WRITE_DAC | WRITE_OWNER |
FILE_WRITE_DATA | FILE_APPEND_DATA |
FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES |
FILE_DELETE_CHILD);
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -711,6 +711,7 @@ static void __ksmbd_close_fd(struct ksmb
if (ksmbd_stream_fd(fp))
kfree(fp->stream.name);
+ ksmbd_share_config_put(fp->share_conf);
kfree(fp->owner.name);
kmem_cache_free(filp_cache, fp);
@@ -1009,37 +1010,54 @@ bool ksmbd_has_other_active_fd(struct ks
return ret;
}
-struct ksmbd_file *ksmbd_lookup_fd_app_instance_id(char *app_instance_id)
+bool ksmbd_app_instance_id_matches(struct ksmbd_work *work,
+ struct ksmbd_file *fp)
{
- struct ksmbd_file *fp = NULL;
- unsigned int id;
+ bool matches;
+
+ /* Keep the current connection and share alive across the comparison. */
+ spin_lock(&fp->f_lock);
+ matches = READ_ONCE(fp->f_state) == FP_INITED &&
+ fp->conn && fp->share_conf &&
+ !strcmp(fp->share_conf->name, work->tcon->share_conf->name) &&
+ memcmp(fp->conn->ClientGUID, work->conn->ClientGUID,
+ SMB2_CLIENT_GUID_SIZE);
+ spin_unlock(&fp->f_lock);
+
+ return matches;
+}
+
+struct ksmbd_file *
+ksmbd_lookup_fd_app_instance_id_next(char *app_instance_id, int *cursor)
+{
+ struct ksmbd_file *fp, *found = NULL;
+ int id = *cursor;
read_lock(&global_ft.lock);
- idr_for_each_entry(global_ft.idr, fp, id) {
- if (!fp->has_app_instance_id)
- continue;
- if (!memcmp(fp->app_instance_id, app_instance_id,
+ while ((fp = idr_get_next(global_ft.idr, &id))) {
+ *cursor = id + 1;
+ if (fp->has_app_instance_id &&
+ !memcmp(fp->app_instance_id, app_instance_id,
SMB2_CREATE_GUID_SIZE)) {
- fp = ksmbd_fp_get(fp);
- break;
+ found = ksmbd_fp_get(fp);
+ if (found)
+ break;
}
+ id++;
}
read_unlock(&global_ft.lock);
- return fp;
+ return found;
}
-int ksmbd_close_fd_app_instance_id(char *app_instance_id)
+int ksmbd_close_fd_app_instance_id(struct ksmbd_work *work,
+ struct ksmbd_file *fp, bool *closed)
{
struct ksmbd_file_table *ft;
- struct ksmbd_file *fp;
struct oplock_info *opinfo;
int n_to_drop = 0;
- fp = ksmbd_lookup_fd_app_instance_id(app_instance_id);
- if (!fp)
- return 0;
-
+ *closed = false;
opinfo = opinfo_get(fp);
if (!opinfo)
goto out;
@@ -1052,7 +1070,8 @@ int ksmbd_close_fd_app_instance_id(char
ft = &opinfo->sess->file_table;
write_lock(&ft->lock);
- if (fp->f_state == FP_INITED && has_file_id(fp->volatile_id)) {
+ if (fp->f_state == FP_INITED && has_file_id(fp->volatile_id) &&
+ ksmbd_app_instance_id_matches(work, fp)) {
idr_remove(ft->idr, fp->volatile_id);
fp->volatile_id = KSMBD_NO_FID;
n_to_drop = ksmbd_mark_fp_closed(fp);
@@ -1069,6 +1088,7 @@ int ksmbd_close_fd_app_instance_id(char
list_del_init(&fp->node);
up_write(&fp->f_ci->m_lock);
+ *closed = true;
if (atomic_sub_and_test(n_to_drop, &fp->refcount)) {
if (fp->conn)
atomic_dec(&fp->conn->stats.open_files_count);
@@ -1281,6 +1301,8 @@ struct ksmbd_file *ksmbd_open_fd(struct
*/
fp->conn = ksmbd_conn_get(work->conn);
fp->tcon = work->tcon;
+ fp->share_conf = work->tcon->share_conf;
+ atomic_inc(&fp->share_conf->refcount);
fp->volatile_id = KSMBD_NO_FID;
fp->persistent_id = KSMBD_NO_FID;
fp->f_state = FP_NEW;
@@ -1303,6 +1325,7 @@ struct ksmbd_file *ksmbd_open_fd(struct
err_out:
/* fp->conn was set and refcounted before every branch here. */
ksmbd_conn_put(fp->conn);
+ ksmbd_share_config_put(fp->share_conf);
kmem_cache_free(filp_cache, fp);
return ERR_PTR(ret);
}
@@ -1807,9 +1830,11 @@ static bool session_fd_check(struct ksmb
ksmbd_conn_put(lock_conn);
}
+ spin_lock(&fp->f_lock);
fp->conn = NULL;
fp->tcon = NULL;
fp->volatile_id = KSMBD_NO_FID;
+ spin_unlock(&fp->f_lock);
if (fp->durable_timeout)
fp->durable_scavenger_timeout =
@@ -1904,6 +1929,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd
struct ksmbd_inode *ci;
struct oplock_info *op;
struct ksmbd_conn *conn = work->conn;
+ struct ksmbd_share_config *old_share;
struct ksmbd_lock *smb_lock;
unsigned int old_f_state;
@@ -1928,21 +1954,29 @@ int ksmbd_reopen_durable_fd(struct ksmbd
* partially-initialized fp. fp owns a strong reference on the new
* conn (see ksmbd_open_fd()); undo it on __open_id() failure.
*/
+ spin_lock(&fp->f_lock);
+ old_f_state = fp->f_state;
+ fp->f_state = FP_NEW;
+ old_share = fp->share_conf;
+ fp->share_conf = work->tcon->share_conf;
+ atomic_inc(&fp->share_conf->refcount);
fp->conn = ksmbd_conn_get(conn);
fp->tcon = work->tcon;
+ spin_unlock(&fp->f_lock);
write_unlock(&global_ft.lock);
- old_f_state = fp->f_state;
- fp->f_state = FP_NEW;
-
__open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
if (!has_file_id(fp->volatile_id)) {
write_lock(&global_ft.lock);
+ spin_lock(&fp->f_lock);
fp->conn = NULL;
fp->tcon = NULL;
+ fp->share_conf = old_share;
+ fp->f_state = old_f_state;
+ spin_unlock(&fp->f_lock);
write_unlock(&global_ft.lock);
ksmbd_conn_put(conn);
- fp->f_state = old_f_state;
+ ksmbd_share_config_put(work->tcon->share_conf);
return -EBADF;
}
@@ -1969,6 +2003,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd
kfree(fp->owner.name);
fp->owner.name = NULL;
spin_unlock(&fp->f_lock);
+ ksmbd_share_config_put(old_share);
return 0;
}
--- a/fs/smb/server/vfs_cache.h
+++ b/fs/smb/server/vfs_cache.h
@@ -102,6 +102,8 @@ struct ksmbd_file {
struct oplock_info __rcu *f_opinfo;
struct ksmbd_conn *conn;
struct ksmbd_tree_connect *tcon;
+ /* Own a share reference independently of tcon; rebind under f_lock. */
+ struct ksmbd_share_config *share_conf;
atomic_t refcount;
__le32 daccess;
@@ -213,8 +215,12 @@ void ksmbd_put_durable_fd(struct ksmbd_f
int ksmbd_invalidate_durable_fd(unsigned long long id);
bool ksmbd_has_other_active_fd(struct ksmbd_file *fp);
bool ksmbd_has_stream_without_delete_share(struct ksmbd_file *fp);
-struct ksmbd_file *ksmbd_lookup_fd_app_instance_id(char *app_instance_id);
-int ksmbd_close_fd_app_instance_id(char *app_instance_id);
+bool ksmbd_app_instance_id_matches(struct ksmbd_work *work,
+ struct ksmbd_file *fp);
+struct ksmbd_file *
+ksmbd_lookup_fd_app_instance_id_next(char *app_instance_id, int *cursor);
+int ksmbd_close_fd_app_instance_id(struct ksmbd_work *work,
+ struct ksmbd_file *fp, bool *closed);
struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid);
struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry);
bool ksmbd_has_other_nonposix_open(struct dentry *dentry);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 136/547] ksmbd: validate security descriptor offsets before pointer arithmetic
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 135/547] ksmbd: validate AppInstanceId takeover target Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 137/547] ksmbd: verify transform SessionId matches the decrypted header Greg Kroah-Hartman
` (419 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 3474e1a304fbf9f7c996b24adcd519e031227a90 upstream.
parse_sec_desc() constructs SID and DACL pointers by adding untrusted
32-bit offsets to the security descriptor before checking their bounds.
The existing checks reject offsets into the descriptor header, but do
not reject offsets beyond the descriptor's length.
On a 32-bit kernel, a large offset can wrap the pointer before the
descriptor. The end-only checks in parse_sid() and parse_dacl() can then
accept it, allowing an authenticated SMB2 SET_INFO request to access
memory outside the security descriptor and fault the kernel.
Check each nonzero offset against acl_len before constructing its
pointer. Initialize the optional owner and group SID pointers to NULL
so an omitted SID remains absent when parsing the DACL.
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smbacl.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -899,7 +899,7 @@ int parse_sec_desc(struct mnt_idmap *idm
int acl_len, struct smb_fattr *fattr)
{
int rc = 0;
- struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+ struct smb_sid *owner_sid_ptr = NULL, *group_sid_ptr = NULL;
struct smb_acl *dacl_ptr; /* no need for SACL ptr */
char *end_of_acl = ((char *)pntsd) + acl_len;
__u32 dacloffset;
@@ -911,12 +911,7 @@ int parse_sec_desc(struct mnt_idmap *idm
if (acl_len < sizeof(struct smb_ntsd))
return -EINVAL;
- owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
- le32_to_cpu(pntsd->osidoffset));
- group_sid_ptr = (struct smb_sid *)((char *)pntsd +
- le32_to_cpu(pntsd->gsidoffset));
dacloffset = le32_to_cpu(pntsd->dacloffset);
- dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
ksmbd_debug(SMB,
"revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
@@ -932,9 +927,12 @@ int parse_sec_desc(struct mnt_idmap *idm
pntsd->type = cpu_to_le16(DACL_PRESENT);
if (pntsd->osidoffset) {
- if (le32_to_cpu(pntsd->osidoffset) < sizeof(struct smb_ntsd))
+ if (le32_to_cpu(pntsd->osidoffset) < sizeof(struct smb_ntsd) ||
+ le32_to_cpu(pntsd->osidoffset) >= acl_len)
return -EINVAL;
+ owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
+ le32_to_cpu(pntsd->osidoffset));
rc = parse_sid(owner_sid_ptr, end_of_acl);
if (rc) {
pr_err("%s: Error %d parsing Owner SID\n", __func__, rc);
@@ -950,9 +948,12 @@ int parse_sec_desc(struct mnt_idmap *idm
}
if (pntsd->gsidoffset) {
- if (le32_to_cpu(pntsd->gsidoffset) < sizeof(struct smb_ntsd))
+ if (le32_to_cpu(pntsd->gsidoffset) < sizeof(struct smb_ntsd) ||
+ le32_to_cpu(pntsd->gsidoffset) >= acl_len)
return -EINVAL;
+ group_sid_ptr = (struct smb_sid *)((char *)pntsd +
+ le32_to_cpu(pntsd->gsidoffset));
rc = parse_sid(group_sid_ptr, end_of_acl);
if (rc) {
pr_err("%s: Error %d mapping Owner SID to gid\n",
@@ -974,9 +975,10 @@ int parse_sec_desc(struct mnt_idmap *idm
pntsd->type |= cpu_to_le16(DACL_PROTECTED);
if (dacloffset) {
- if (dacloffset < sizeof(struct smb_ntsd))
+ if (dacloffset < sizeof(struct smb_ntsd) || dacloffset >= acl_len)
return -EINVAL;
+ dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
rc = parse_dacl(idmap, dacl_ptr, end_of_acl,
owner_sid_ptr, group_sid_ptr, fattr);
if (rc)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 137/547] ksmbd: verify transform SessionId matches the decrypted header
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 136/547] ksmbd: validate security descriptor offsets before pointer arithmetic Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 138/547] vlan: restore HW VLAN tag insertion with reorder_hdr off Greg Kroah-Hartman
` (418 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dairui Zhang, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dairui Zhang <zhangdairui@gmail.com>
commit 798214e6fafcdcc29f5ba2661a473232b5e70cfb upstream.
When an encrypted request comes in, the decryption key is picked by
the SessionId in the transform header, but the request is then
authorized under whatever session the decrypted inner header names.
Nothing ever compares the two, so on a connection with more than
one session a client can get a request decrypted with one session's
key and run it as another session. Encrypted requests are exempt
from signing too, so a valid AEAD tag is the only proof of session
identity, and it is checked against the wrong session.
MS-SMB2 says the server must check that the transform SessionId
matches the one in the decrypted SMB2 header and treat a mismatch
as a protocol error. Add that check in __handle_ksmbd_work() after
decryption, before dispatching: the message has to be at least one
fixed SMB2 header, the first operation must not set
SMB2_FLAGS_RELATED_OPERATIONS and its SessionId must match the
transform SessionId, and every following non-related operation in
a compound chain must carry the same SessionId. NextCommand
offsets must be 8-byte aligned and stay inside the message; the
bounds check is done by subtraction so it cannot wrap.
When the decrypted payload is a compression transform, the
existing decompression step runs first and the decompressed SMB2
message is checked instead, since a compression transform header
carries no SessionId.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: Dairui Zhang <zhangdairui@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Dairui Zhang <zhangdairui@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/server.c | 16 ++++++++++++++
fs/smb/server/smb2pdu.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++
fs/smb/server/smb2pdu.h | 1
3 files changed, 71 insertions(+)
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -187,6 +187,16 @@ static void __handle_ksmbd_work(struct k
if (conn->ops->is_transform_hdr &&
conn->ops->is_transform_hdr(work->request_buf)) {
+ u64 tr_sess_id;
+
+ if (get_rfc1002_len(work->request_buf) <
+ sizeof(struct smb2_transform_hdr)) {
+ ksmbd_conn_abort(conn);
+ return;
+ }
+ tr_sess_id = le64_to_cpu(((struct smb2_transform_hdr *)
+ smb_get_msg(work->request_buf))->SessionId);
+
rc = conn->ops->decrypt_req(work);
if (rc < 0) {
ksmbd_conn_abort(conn);
@@ -215,6 +225,12 @@ static void __handle_ksmbd_work(struct k
ksmbd_conn_abort(conn);
return;
}
+
+ rc = ksmbd_check_transform_session(work, tr_sess_id);
+ if (rc < 0) {
+ ksmbd_conn_abort(conn);
+ return;
+ }
}
if (conn->ops->allocate_rsp_buf(work))
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -12483,6 +12483,60 @@ bool smb3_is_transform_hdr(void *buf)
return trhdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM;
}
+/*
+ * The decryption key is selected by the transform SessionId, but
+ * the request is authorized under the session named in the
+ * decrypted SMB2 header. Per MS-SMB2 the two must match, so check
+ * the decrypted message and its compound chain before dispatch.
+ */
+int ksmbd_check_transform_session(struct ksmbd_work *work, u64 tr_sess_id)
+{
+ struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
+ size_t msg_len = get_rfc1002_len(work->request_buf);
+ size_t off = 0;
+ bool first = true;
+
+ if (msg_len < sizeof(*hdr)) {
+ pr_err_ratelimited("Decrypted message is smaller than SMB2 header\n");
+ return -ECONNABORTED;
+ }
+
+ for (;;) {
+ u64 sid = le64_to_cpu(hdr->SessionId);
+ u32 next;
+
+ if (first) {
+ if (hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS) {
+ pr_err_ratelimited("RELATED_OPERATIONS set on first operation\n");
+ return -ECONNABORTED;
+ }
+ if (sid != tr_sess_id) {
+ pr_err_ratelimited("SessionId mismatch between transform and inner header\n");
+ return -ECONNABORTED;
+ }
+ first = false;
+ } else if (!(hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS) &&
+ sid != tr_sess_id) {
+ pr_err_ratelimited("SessionId mismatch in compound chain\n");
+ return -ECONNABORTED;
+ }
+
+ next = le32_to_cpu(hdr->NextCommand);
+ if (!next)
+ return 0;
+ if (next % 8) {
+ pr_err_ratelimited("NextCommand %u is not 8-byte aligned\n", next);
+ return -ECONNABORTED;
+ }
+ if (next > msg_len - off - sizeof(*hdr)) {
+ pr_err_ratelimited("NextCommand %u is out of the message\n", next);
+ return -ECONNABORTED;
+ }
+ off += next;
+ hdr = (struct smb2_hdr *)((u8 *)smb_get_msg(work->request_buf) + off);
+ }
+}
+
int smb3_decrypt_req(struct ksmbd_work *work)
{
char *buf = work->request_buf;
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -420,6 +420,7 @@ struct channel *lookup_chann_list(struct
void smb3_preauth_hash_rsp(struct ksmbd_work *work);
bool smb3_is_transform_hdr(void *buf);
int smb3_decrypt_req(struct ksmbd_work *work);
+int ksmbd_check_transform_session(struct ksmbd_work *work, u64 tr_sess_id);
int smb3_encrypt_resp(struct ksmbd_work *work);
bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work);
int smb2_set_rsp_credits(struct ksmbd_work *work);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 138/547] vlan: restore HW VLAN tag insertion with reorder_hdr off
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 137/547] ksmbd: verify transform SessionId matches the decrypted header Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 139/547] cgroup: serialize migrations of newly forked processes Greg Kroah-Hartman
` (417 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Čermák, Stefan Agner,
hitchin999, Eric Dumazet, Heiner Kallweit, Jakub Kicinski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@kernel.org>
[ Upstream commit c2124f80be4ceb6ec566ca3b5fc87f84ea9c36e0 ]
Commit 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling
HW VLAN offload") replaced vlan_passthru_header_ops with vlan_header_ops
unconditionally to avoid lockless data races when modifying
hard_header_len dynamically under RTNL.
Prior to that commit, vlan devices on top of a real device capable of
HW VLAN TX offload used vlan_passthru_header_ops, which never inserted
the 802.1Q header in the frame.
Now, with reorder_hdr=off (as done by Home Assistant OS / NetworkManager
when flags are omitted over D-Bus), vlan_dev_hard_header() always pushes
an in-band 802.1Q header, and vlan_dev_hard_start_xmit() hands the frame
to the real device as is, even if the real device supports HW VLAN TX
offload.
This is a regression for r8169 users (Realtek RTL8168h), who report
transmit queue timeouts (NETDEV WATCHDOG): this NIC stalls when asked
to offload checksum and/or TSO for frames carrying an in-band tag.
Users of r8152 based USB adapters were affected as well.
Reverting the blamed commit, disabling TX checksum offload (which
also disables TSO), or setting reorder_hdr=on were all reported to
work around the issue.
Keep vlan_dev_hard_header() as is: the in-band header keeps the frame
layout seen at the vlan device egress (taps, tc, netfilter) unchanged,
and is relied upon by stacked vlans (Q-in-Q) and by AF_PACKET SOCK_DGRAM
users sending ETH_P_8021Q frames.
Instead, when vlan_dev_hard_start_xmit() gets a frame carrying an
in-band tag with our protocol and the real device can insert tags,
move that tag to skb->vlan_tci with __skb_vlan_pop(), so that the real
device inserts it. Frames sent on the wire are unchanged, except that
frames shorter than 64 bytes with their tag now get up to 4 bytes of
extra padding, as with reorder_hdr=on and before 447cbe95ebb9.
skb_reset_mac_header() is needed first, because not all ndo_start_xmit()
callers set the mac header (e.g. AF_XDP copy mode, which uses
__dev_direct_xmit()).
vlan_set_encap_proto() may read the two bytes after the vlan header,
so frames whose linear part is shorter than VLAN_ETH_HLEN + 2 are sent
unchanged, as before. This also makes sure h_vlan_proto, read earlier
in the function, was in the linear part. Shared skbs (e.g. from
pktgen) are also sent unchanged, since popping the tag modifies the
skb, as are skbs already carrying a hwaccel tag (e.g. from generic XDP
redirect), whose tag must not be overwritten, skbs carrying XDP
metadata, which the pop would have to move, and CHECKSUM_PARTIAL skbs
whose csum_start lies within the first VLAN_ETH_HLEN bytes (only
possible with bogus offsets, e.g. from AF_XDP tx metadata), which the
pop would leave before skb->data.
If popping the header fails (memory allocation failure), the frame is
dropped and counted in tx_dropped, rather than handing the real device
a frame with an in-band tag.
tx_bytes is now sampled before the pop, so the vlan device statistics
do not change.
This also applies to frames provided by the sender with our tag
(AF_PACKET SOCK_RAW, or frames redirected from another reorder_hdr=off
vlan): the real device now inserts their tag too.
Fixes: 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling HW VLAN offload")
Reported-by: Jan Čermák <sairon@sairon.cz>
Closes: https://lore.kernel.org/netdev/CAPa5EdCj3v17tB-SF2JNecq5Q8s1Pranr-XzAFWNpNTBPgPG7w@mail.gmail.com/
Reported-by: Stefan Agner <stefan@agner.ch>
Reported-by: hitchin999 <hitchin999@users.noreply.github.com>
Closes: https://github.com/home-assistant/operating-system/issues/5019
Tested-by: Jan Čermák <sairon@sairon.cz>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://patch.msgid.link/20261013115022.1043024-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/8021q/vlan_dev.c | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index c949c6a829456..2d775b4c84ce6 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -110,6 +110,8 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
unsigned int len;
int ret;
+ len = skb->len;
+
/* Handle non-VLAN frames if they are sent to us, for example by DHCP.
*
* NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING
@@ -121,10 +123,39 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
vlan_tci = vlan->vlan_id;
vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb->priority);
__vlan_hwaccel_put_tag(skb, vlan->vlan_proto, vlan_tci);
+ } else if (skb_headlen(skb) >= VLAN_ETH_HLEN + sizeof(__be16) &&
+ !skb_shared(skb) && !skb_vlan_tag_present(skb) &&
+ !skb_metadata_len(skb) &&
+ (skb->ip_summed != CHECKSUM_PARTIAL ||
+ skb_checksum_start_offset(skb) >= VLAN_ETH_HLEN) &&
+ vlan_hw_offload_capable(READ_ONCE(vlan->real_dev->features),
+ vlan->vlan_proto)) {
+ u16 vlan_tci;
+
+ /* The frame carries its outer tag in-band, either inserted
+ * by vlan_dev_hard_header() or provided by the sender.
+ * Let the real device insert it: some NICs can not offload
+ * checksum or TSO for frames carrying an in-band tag.
+ * Not all ndo_start_xmit() callers set the mac header.
+ * vlan_set_encap_proto() may read two bytes after the vlan
+ * header, so frames with a shorter linear part are sent
+ * unchanged, as are shared skbs (e.g. from pktgen), skbs
+ * already carrying a hwaccel tag (e.g. from generic XDP
+ * redirect), skbs carrying XDP metadata, and CHECKSUM_PARTIAL
+ * skbs whose checksum starts within the header to be popped.
+ * On allocation failure, drop the frame rather than handing
+ * it to the real device with an in-band tag.
+ */
+ skb_reset_mac_header(skb);
+ if (unlikely(__skb_vlan_pop(skb, &vlan_tci))) {
+ dev_kfree_skb_any(skb);
+ this_cpu_inc(vlan->vlan_pcpu_stats->tx_dropped);
+ return NETDEV_TX_OK;
+ }
+ __vlan_hwaccel_put_tag(skb, vlan->vlan_proto, vlan_tci);
}
skb->dev = vlan->real_dev;
- len = skb->len;
if (unlikely(netpoll_tx_running(dev)))
return vlan_netpoll_send_skb(vlan, skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 139/547] cgroup: serialize migrations of newly forked processes
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 138/547] vlan: restore HW VLAN tag insertion with reorder_hdr off Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 140/547] wifi: b43: fix use-after-free in b43_bcma_remove() Greg Kroah-Hartman
` (416 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daehyeon Ko, Tejun Heo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit bf6fbf46b5ff68c4eebad5aa52309eb124f4509c ]
With favordynmods enabled, a cgroup.procs migration takes the target
threadgroup's cgroup_threadgroup_rwsem for writing. A process fork holds
the forking threadgroup's semaphore for reading. These are different
semaphores when fork creates a new process.
copy_process() publishes the child's PID before cgroup_post_fork() links
the child to its css_set. A writer can find the child in that interval,
take its uncontended semaphore, and migrate it while child->cgroups still
points to init_css_set and child->cg_list is empty. Migration links the
node into init_css_set.mg_tasks. cgroup_post_fork() then adds the same
node to the intended css_set as though it were unlinked, corrupting both
task lists and their css_set ownership.
This regresses the fork/migration race fixed by commit b12b533fa523
("cgroups: add lock for child->cgroups in cgroup_post_fork()") and
restored again in 2012 after the lock had been removed. The old task_lock
protection was later superseded by global css_set and cgroup threadgroup
locking. The change identified by the Fixes tag narrowed only the migration
side back to a per-threadgroup lock, recreating the different-process
exclusion failure.
Take the new threadgroup's semaphore for reading before the child becomes
visible and hold it through cgroup_post_fork(). Use a nested lock subclass
because fork already holds the parent's semaphore. CLONE_THREAD children
share the parent's signal_struct and remain covered by the existing lock.
Migrations of unrelated, fully initialized threadgroups remain concurrent.
An AI coding assistant was used to identify and reproduce the regression
and to develop and test this fix.
Fixes: 0568f89d4fb8 ("cgroup: replace global percpu_rwsem with per threadgroup resem when writing to cgroup.procs")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cgroup.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 227d09704ca59..42cc77dfa1c8a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -6844,6 +6844,31 @@ static struct cgroup *cgroup_get_from_file(struct file *f)
return cgrp;
}
+/*
+ * A new threadgroup gets its own cgroup_threadgroup_rwsem. Once its PID is
+ * visible, a cgroup.procs writer can find the child and lock that rwsem even
+ * though cgroup_post_fork() has not linked the child to its css_set yet.
+ *
+ * cgroup_can_fork() already holds the global read lock, which keeps
+ * cgroup_enable_per_threadgroup_rwsem stable. Lock the child's rwsem as a
+ * nested instance until cgroup_post_fork() finishes. Threads share their
+ * parent's signal_struct and are covered by the existing read lock.
+ */
+static void cgroup_fork_child_lock(struct task_struct *child)
+{
+ if (cgroup_enable_per_threadgroup_rwsem &&
+ child->signal != current->signal)
+ down_read_nested(&child->signal->cgroup_threadgroup_rwsem,
+ SINGLE_DEPTH_NESTING);
+}
+
+static void cgroup_fork_child_unlock(struct task_struct *child)
+{
+ if (cgroup_enable_per_threadgroup_rwsem &&
+ child->signal != current->signal)
+ up_read(&child->signal->cgroup_threadgroup_rwsem);
+}
+
/**
* cgroup_css_set_fork - find or create a css_set for a child process
* @kargs: the arguments passed to create the child process
@@ -7009,6 +7034,7 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
goto out_revert;
} while_each_subsys_mask();
+ cgroup_fork_child_lock(child);
return 0;
out_revert:
@@ -7043,6 +7069,7 @@ void cgroup_cancel_fork(struct task_struct *child,
if (ss->cancel_fork)
ss->cancel_fork(child, kargs->cset);
+ cgroup_fork_child_unlock(child);
cgroup_css_set_put_fork(kargs);
}
@@ -7140,6 +7167,7 @@ void cgroup_post_fork(struct task_struct *child,
if (unlikely(kill))
do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
+ cgroup_fork_child_unlock(child);
cgroup_css_set_put_fork(kargs);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 140/547] wifi: b43: fix use-after-free in b43_bcma_remove()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 139/547] cgroup: serialize migrations of newly forked processes Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 141/547] SUNRPC: fix netns use-after-free in write_gssp() Greg Kroah-Hartman
` (415 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andreas Wendleder, Johannes Berg
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Wendleder <gonsolo@gmail.com>
commit c6c8bc355657115664131b38c53c5ddf7d93b072 upstream.
b43_one_core_detach() frees the struct b43_wldev it is given the bus
device of. b43_bcma_remove() then reads wldev->dev again to free the bus
device, which is a read of freed memory.
b43_ssb_remove() does not have the problem: it takes a copy of wldev->dev
at the start. Do the same here.
Fixes: 96838d61102a ("b43: Fix memory leaks in b43_bus_dev_ssb_init and b43_bus_dev_bcma_init")
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Wendleder <gonsolo@gmail.com>
Link: https://patch.msgid.link/20261013000124.48605-1-gonsolo@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/b43/main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -5677,6 +5677,7 @@ static void b43_bcma_remove(struct bcma_
{
struct b43_wldev *wldev = bcma_get_drvdata(core);
struct b43_wl *wl = wldev->wl;
+ struct b43_bus_dev *dev = wldev->dev;
/* We must cancel any work here before unregistering from ieee80211,
* as the ieee80211 unreg will destroy the workqueue. */
@@ -5691,14 +5692,14 @@ static void b43_bcma_remove(struct bcma_
ieee80211_unregister_hw(wl->hw);
}
- b43_one_core_detach(wldev->dev);
+ b43_one_core_detach(dev);
/* Unregister HW RNG driver */
b43_rng_exit(wl);
b43_leds_unregister(wl);
ieee80211_free_hw(wl->hw);
- kfree(wldev->dev);
+ kfree(dev);
}
static struct bcma_driver b43_bcma_driver = {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 141/547] SUNRPC: fix netns use-after-free in write_gssp()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 140/547] wifi: b43: fix use-after-free in b43_bcma_remove() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 142/547] spmi: Fix potential use-after-free by grabbing of_node reference Greg Kroah-Hartman
` (414 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zijing Yin, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijing Yin <yzjaurora@gmail.com>
commit e7a8721b7edb54a157623f9e31d71345333b5fb9 upstream.
While fuzzing with a customized syzkaller, I hit a refcount warning in
xprt_alloc(), reached from a write to /proc/net/rpc/use-gss-proxy:
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0xf8/0x120
CPU: 0 PID: 10404 Comm: syz.0.17 Not tainted 7.3.0-rc1-00096-gcfebfd3db73d
Call Trace:
<TASK>
xprt_alloc+0x83f/0x9d0
xs_setup_xprt+0xaf/0x3c0
xs_setup_local+0x47/0x7f0
xprt_create_transport+0x16c/0x730
rpc_create+0x38e/0x7f0
gssp_rpc_create+0xe2/0x180
set_gssp_clnt+0xba/0x1b0
write_gssp+0x200/0x310
proc_reg_write+0x240/0x330
vfs_write+0x2aa/0x1050
ksys_write+0x12a/0x250
do_syscall_64+0x117/0x750
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
create_use_gss_proxy_proc_entry() stores the struct net pointer as the
proc entry's private data without taking a reference on it, and an open
file descriptor does not pin the namespace either, as procfs only pins
the proc_dir_entry. write_gssp() reads that pointer back with
pde_data() and hands it to set_gssp_clnt(), which reaches xprt_init():
xprt->xprt_net = get_net_track(net, &xprt->ns_tracker, GFP_KERNEL);
get_net_track() -> get_net() -> refcount_inc() is unconditional, so
rpc_create() assumes its caller holds a reference on args.net.
write_gssp() does not.
Dropping the last ns.count reference does not make the file go away.
__put_net() only queues cleanup_net() on a workqueue, and the
remove_proc_entry() that fences off further writes runs from the
rpcsec_gss pernet .exit method, that is, from inside cleanup_net(). A
write landing between those two points increments a refcount that is
already zero. cleanup_net() does not re-read ns.count, so the namespace
is freed anyway and the rpc_xprt -- along with the AF_LOCAL socket
opened for it -- is left pointing at freed memory. The resurrected
count is visible to the rest of that teardown too: with
CONFIG_IPV6_MROUTE the same cleanup_net() worker then trips
!mr_can_free_table() in ip6mr_free_table(), which tests check_net() on
the namespace it is freeing.
It reduces to opening /proc/net/rpc/use-gss-proxy inside a new network
namespace, calling setns() back to the original one to drop the last
reference, and then writing "1" to the still-open descriptor.
Take the reference in write_gssp() itself and refuse the write when the
namespace is already gone. This is what procfs does for every other
/proc/net file: get_proc_net() is maybe_get_net(PDE_NET(PDE(inode)))
and seq_open_net() returns -ENXIO when it fails. PDE_NET() cannot be
reused here because the parent directory /proc/net/rpc carries no
namespace pointer. Adding a .pre_exit to rpcsec_gss_net_ops so the
entry is removed earlier would only narrow the window, since pre_exit
also runs from cleanup_net().
Live namespaces are unaffected: a write still returns the error from
set_gssp_clnt(), a write of "2" still returns -EINVAL, and reads are
untouched.
Fixes: 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.")
Cc: stable@vger.kernel.org
Signed-off-by: Zijing Yin <yzjaurora@gmail.com>
Link: https://patch.msgid.link/20260907085435.644076-1-yzjaurora@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1420,10 +1420,18 @@ static ssize_t write_gssp(struct file *f
return res;
if (i != 1)
return -EINVAL;
+
+ /*
+ * Neither the proc entry nor an open descriptor pins @net, so it
+ * might already be dying when rpc_create() takes its reference.
+ */
+ if (!maybe_get_net(net))
+ return -ENXIO;
+
res = set_gssp_clnt(net);
- if (res)
- return res;
- res = set_gss_proxy(net, 1);
+ if (!res)
+ res = set_gss_proxy(net, 1);
+ put_net(net);
if (res)
return res;
return count;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 142/547] spmi: Fix potential use-after-free by grabbing of_node reference
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 141/547] SUNRPC: fix netns use-after-free in write_gssp() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 143/547] smb: client: fix use-after-free infoleak via the readdir resume name Greg Kroah-Hartman
` (413 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko Bot,
AngeloGioacchino Del Regno, Stephen Boyd
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
commit f7aa9de4f2b197cdd704cdc476901b68ee128433 upstream.
As noticed by Sashiko during a review run of an unrelated patch,
in of_spmi_register_devices(), for_each_available_child_of_node()
is used to loop through children, and to also assign a node to a
newly created SPMI child device.
Problem is that the refcount is dropped at every iteration so, in
the specific case of DT overlays, a use-after-free may occur when
an overlay is dynamically unloaded!
To resolve this, increase the of_node refcount when assigning (in
function of_spmi_register_devices) and release the reference in
spmi_device_remove().
Fixes: bc32bbd04011 ("spmi: Set fwnode for spmi devices")
Cc: stable@vger.kernel.org
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260608100949.36309-1-angelogioacchino.delregno@collabora.com?part=2
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spmi/spmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/spmi/spmi.c
+++ b/drivers/spmi/spmi.c
@@ -24,6 +24,7 @@ static void spmi_dev_release(struct devi
{
struct spmi_device *sdev = to_spmi_device(dev);
+ of_node_put(dev->of_node);
kfree(sdev);
}
@@ -517,7 +518,7 @@ static void of_spmi_register_devices(str
if (!sdev)
continue;
- device_set_node(&sdev->dev, of_fwnode_handle(node));
+ device_set_node(&sdev->dev, of_fwnode_handle(of_node_get(node)));
sdev->usid = (u8)reg[0];
err = spmi_device_add(sdev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 143/547] smb: client: fix use-after-free infoleak via the readdir resume name
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 142/547] spmi: Fix potential use-after-free by grabbing of_node reference Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 144/547] smb: client: fix use-after-free in cifs_ses_add_channel() Greg Kroah-Hartman
` (412 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
commit 59131dd72f62b198fc9ea1489ad9d3573154f684 upstream.
CIFSFindNext() copies the resume name that cifs_save_resume_key()
recorded from the last entry of the previous response into its request;
psrch_inf->presume_name points into the response buffer that entry came
from, and nothing ever clears it. find_cifs_entry() records a new
name only from a response with a usable last entry, and cifs_readdir()
only from an entry it walks to, so a response that carries no entries
and leaves last_entry NULL, because CIFSFindFirst() or CIFSFindNext()
rejected LastNameOffset, refreshes neither and presume_name keeps
pointing into the previous response. That buffer has already been
released: by CIFSFindNext() before it installs the new response, or by
find_cifs_entry() when it rewinds the search, which does not drop the
name either and can then fail in initiate_cifs_search() before a new
response replaces it. The next CIFSFindNext() then copies up to
PATH_MAX - 1 bytes of the resume name out of the released buffer into
its request and sends them to the server: a use-after-free read
that leaks kernel memory to a malicious or compromised server, which
can provoke it with a single FindNext response that carries no entries
and a LastNameOffset above CIFSMaxBufSize, which is all the existing
check rejects.
With KASAN enabled, a server that answers a listing that way gives:
CIFS: VFS: ignoring corrupt resume name
==================================================================
BUG: KASAN: slab-use-after-free in CIFSFindNext+0x8ca/0x14c0
Read of size 4080 at addr ffff88807c823f98 by task ls/83
CPU: 0 UID: 0 PID: 83 Comm: ls Tainted: G B 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
Tainted: [B]=BAD_PAGE
Call Trace:
<TASK>
kasan_report+0xdf/0x1a0
kasan_check_range+0x10f/0x1e0
__asan_memcpy+0x23/0x60
CIFSFindNext+0x8ca/0x14c0
cifs_readdir+0xf51/0x29c0
iterate_dir+0x1c0/0x570
__x64_sys_getdents64+0x133/0x270
do_syscall_64+0x109/0x5d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 83 on cpu 1 at 13.497119s:
cifs_buf_get+0x36/0x90
smb_init+0x4f/0x110
CIFSFindNext+0xf7/0x14c0
cifs_readdir+0xf51/0x29c0
Freed by task 83 on cpu 0 at 13.584018s:
cifs_buf_release+0x41/0x80
CIFSFindNext+0xfce/0x14c0
cifs_readdir+0xf51/0x29c0
The buggy address is located 16280 bytes inside of
freed 16588-byte region [ffff88807c820000, ffff88807c8240cc)
==================================================================
The same memcpy() first reads past the end of that object while it is
still live, a slab-out-of-bounds read that the following patches
bound; that is the taint the report above carries.
SMB1 is not negotiated by default; reaching this code requires an
explicit vers=1.0 mount.
Clear presume_name and resume_name_len whenever a new response is
installed and when the rewind path releases the search buffer, so that
the name never outlives the buffer it points into, and reset
resume_key with them, since it was taken from the same entry and would
otherwise be sent with an empty name. A response without a usable
last entry then continues the search with an empty resume name rather
than a stale one; CIFSFindNext() skips the copy of a zero-length name
so that it never runs on the NULL pointer.
The next patch in the series leaves last_entry NULL for a response
that carries no entries, and bounds LastNameOffset against the
received response rather than against CIFSMaxBufSize. Responses that
are given a last entry today then take the path fixed here, so that
patch must not be applied without this one.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: b77d753c413e ("[CIFS] Check that last search entry resume key is valid")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 11 ++++++++++-
fs/smb/client/readdir.c | 3 +++
2 files changed, 13 insertions(+), 1 deletion(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -4543,6 +4543,9 @@ findFirstRetry:
psrch_inf->entries_in_buffer = le16_to_cpu(parms->SearchCount);
psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
psrch_inf->entries_in_buffer;
+ psrch_inf->presume_name = NULL;
+ psrch_inf->resume_name_len = 0;
+ psrch_inf->resume_key = 0;
lnoff = le16_to_cpu(parms->LastNameOffset);
if (CIFSMaxBufSize < lnoff) {
cifs_dbg(VFS, "ignoring corrupt resume name\n");
@@ -4607,7 +4610,10 @@ int CIFSFindNext(const unsigned int xid,
name_len = psrch_inf->resume_name_len;
params += name_len;
if (name_len < PATH_MAX) {
- memcpy(pSMB->ResumeFileName, psrch_inf->presume_name, name_len);
+ if (name_len) {
+ memcpy(pSMB->ResumeFileName,
+ psrch_inf->presume_name, name_len);
+ }
byte_count += name_len;
/* 14 byte parm len above enough for 2 byte null terminator */
pSMB->ResumeFileName[name_len] = 0;
@@ -4662,6 +4668,9 @@ int CIFSFindNext(const unsigned int xid,
psrch_inf->endOfSearch = !!parms->EndofSearch;
psrch_inf->entries_in_buffer = le16_to_cpu(parms->SearchCount);
psrch_inf->index_of_last_entry += psrch_inf->entries_in_buffer;
+ psrch_inf->presume_name = NULL;
+ psrch_inf->resume_name_len = 0;
+ psrch_inf->resume_key = 0;
lnoff = le16_to_cpu(parms->LastNameOffset);
if (CIFSMaxBufSize < lnoff) {
cifs_dbg(VFS, "ignoring corrupt resume name\n");
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -752,6 +752,9 @@ find_cifs_entry(const unsigned int xid,
cfile->srch_inf.ntwrk_buf_start = NULL;
cfile->srch_inf.srch_entries_start = NULL;
cfile->srch_inf.last_entry = NULL;
+ cfile->srch_inf.presume_name = NULL;
+ cfile->srch_inf.resume_name_len = 0;
+ cfile->srch_inf.resume_key = 0;
}
rc = initiate_cifs_search(xid, file, full_path);
if (rc) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 144/547] smb: client: fix use-after-free in cifs_ses_add_channel()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 143/547] smb: client: fix use-after-free infoleak via the readdir resume name Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 145/547] sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu Greg Kroah-Hartman
` (411 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henry Martin, Namjae Jeon,
David Howells, Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <bsdhenrymartin@gmail.com>
commit 031278577380e7875d95aed81a2b2bcac39be923 upstream.
The error path of cifs_ses_add_channel() calls cifs_put_tcp_session()
before cifs_chan_clear_need_reconnect(). The latter reaches
cifs_ses_get_chan_index(), which dereferences server->terminate; if
the put was the final reference, TCP_Server_Info is already freed and
this is a use-after-free. Same put-then-use pattern as the recently
fixed sibling in commit 717e0a25036b ("cifs: Fix server use-after-free
in cifs_chan_skip_or_disable()").
Move the put last, but do not read chan->server after dropping
chan_lock: chan points into ses->chans[], and once chan_count is
decremented a concurrent add_channel can reuse the slot and overwrite
the pointer, so the put would act on the new channel's server. Cache
the pointer under chan_lock, clear the reconnect bit and decrement
chan_count while still holding the reference, and release it after
the unlock.
This issue was discovered by Tencent CodeBuddy Security.
Fixes: ee1d21794e55a ("cifs: handle when server stops supporting multichannel")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/sess.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -626,12 +626,13 @@ cifs_ses_add_channel(struct cifs_ses *se
out:
if (rc && chan->server) {
- cifs_put_tcp_session(chan->server, 0);
+ struct TCP_Server_Info *pserver;
spin_lock(&ses->chan_lock);
+ pserver = chan->server;
/* we rely on all bits beyond chan_count to be clear */
- cifs_chan_clear_need_reconnect(ses, chan->server);
+ cifs_chan_clear_need_reconnect(ses, pserver);
ses->chan_count--;
/*
* chan_count should never reach 0 as at least the primary
@@ -639,6 +640,7 @@ out:
*/
WARN_ON(ses->chan_count < 1);
spin_unlock(&ses->chan_lock);
+ cifs_put_tcp_session(pserver, 0);
}
kfree(ctx->UNC);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 145/547] sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 144/547] smb: client: fix use-after-free in cifs_ses_add_channel() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 146/547] RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup Greg Kroah-Hartman
` (410 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo, Andrea Righi
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 43e1ef14a47257ebf7e3bb3ab9a6df9c6f817c5f upstream.
A local DSQ reenq is queued on the rq through a per-sched node and run from
deferred work. When the reenq is requested from dispatch, the work is a
balance callback queued once dispatch is done. A cpu going down installs
balance push early in its teardown, and queue_balance_callback() refuses new
callbacks from then on. ops.dispatch() keeps running on that cpu until the
rq goes offline after an RCU grace period, so a reenq it requests in that
window may never run. The IMMED handling in dispatch_one() requests one the
same way.
A reenq requested from elsewhere for a cpu that is already offline goes
through irq_work_queue_on(), which warns, and its work doesn't run until the
cpu comes back.
Either way the node stays on the rq's list. When the scheduler is freed,
scx_sched_free_rcu_work() warns and frees the pcpu with the node still
linked, and the list is walked again once the cpu comes back.
An inactive cpu's local DSQ holds only tasks that are bound to it or are
being moved off, so the reenq is pointless. Ignore reenqs of an inactive
cpu's local DSQ.
The test is lockless. The hotplug thread of a cpu going down runs on that
cpu, and it marks the cpu inactive before it installs balance push. A
dispatch on the cpu runs to completion before that thread can run there, so
a dispatch that saw the cpu active has queued its callback by then. Requests
from outside dispatch run from the wakeup path or through irq_work, which
balance push doesn't affect. The grace period after the cpu goes inactive
waits for any requester that saw it active, so that irq_work is queued while
the cpu is online.
Fixes: 238eba8c210d ("sched_ext: Use schedule_deferred_locked() in schedule_dsq_reenq()")
Fixes: 76edc2761ab8 ("sched_ext: Use irq_work_queue_on() in schedule_deferred()")
Cc: stable@vger.kernel.org # v7.1+
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Tested-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -1103,6 +1103,18 @@ void schedule_dsq_reenq(struct scx_sched
rq = container_of(dsq, struct rq, scx.local_dsq);
/*
+ * An inactive cpu's local DSQ holds only tasks that are bound
+ * to it or are being moved off, so a reenq of it is pointless.
+ * Once balance push is installed, queue_balance_callback() also
+ * drops the callback that would run a reenq requested from
+ * dispatch, and irq_work_queue_on() can't reach an offline cpu.
+ * The reenq's node would then stay on this rq's list after
+ * @sch's pcpu is freed.
+ */
+ if (unlikely(!cpu_active(cpu_of(rq))))
+ return;
+
+ /*
* A sub-sched lacking baseline access on the target cid has no
* business triggering IPIs. The lockless test is fine: slipping
* through right after a revoke is harmless and a wrong denial
@@ -10020,7 +10032,8 @@ __bpf_kfunc struct task_struct *scx_bpf_
* - Local DSQs (%SCX_DSQ_LOCAL or %SCX_DSQ_LOCAL_ON | $cpu)
* - User DSQs
*
- * Re-enqueues are performed asynchronously. Can be called from anywhere.
+ * Re-enqueues are performed asynchronously. Can be called from anywhere. A
+ * re-enqueue of an inactive cpu's local DSQ is ignored.
*
* %SCX_DSQ_LOCAL resolves to the local DSQ of the rq the current scheduler
* operation is locked to - e.g. the rq being dispatched for in ops.dispatch() -
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 146/547] RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 145/547] sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 147/547] RDMA/irdma: avoid use-after-free in icrdma_remove Greg Kroah-Hartman
` (409 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Deep Shah, Leon Romanovsky
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deep Shah <deepshah146@gmail.com>
commit 2854f9025d4ef6c4566f71e52d7f496d9a0f5737 upstream.
The DMABUF release can race with ufile cleanup. When the cleanup holds
hw_destroy_rwsem for write, uverbs_uobject_release() fails its trylock
and leaves the uobject on the ufile list, but the dma_buf is freed as
soon as the release returns. The cleanup then destroys the uobject and
uses the freed dma_buf:
BUG: KASAN: slab-use-after-free in uverbs_dmabuf_fd_destroy_uobj+0x46/0x200
Read of size 8 at addr ff11000109cf14b0 by task repro/435
Call Trace:
uverbs_dmabuf_fd_destroy_uobj+0x46/0x200
destroy_hw_fd_uobject+0x3f/0x50
uverbs_destroy_uobject+0xc5/0x380
__uverbs_cleanup_ufile+0x1a8/0x260
uverbs_destroy_ufile_hw+0x54/0x160
ib_uverbs_close+0x34/0x110
Allocated by task 435:
dma_buf_export+0x1b5/0x530
ib_uverbs_handler_UVERBS_METHOD_DMABUF_ALLOC+0x223/0x3f0
Freed by task 436:
kfree+0x301/0x530
dentry_kill+0x14c/0x560
__fput+0x23a/0x4a0
rdma_user_mmap_entry_remove() dereferences the same pointer.
Protect the stored dma_buf pointer with a mutex and clear it before
release returns. Use a shared revoke helper so uobject destruction and
mmap entry removal both skip a cleared pointer. Hold a temporary uobject
reference across uverbs_uobject_release() and the pointer update.
Use a separate mutex because uobject destruction can free the mmap entry
before release finishes. Map and unmap use attachment->dmabuf directly,
so they do not need to take the new mutex while holding the reservation
lock.
Fixes: 0ac6f4056c4a ("RDMA/uverbs: Add DMABUF object type and operations")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Deep Shah <deepshah146@gmail.com>
Link: https://patch.msgid.link/20261015083637.200958-3-deepshah146@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ib_core_uverbs.c | 10 -----
drivers/infiniband/core/uverbs.h | 37 ++++++++++++++++++++
drivers/infiniband/core/uverbs_std_types_dmabuf.c | 39 ++++++++++++----------
3 files changed, 61 insertions(+), 25 deletions(-)
--- a/drivers/infiniband/core/ib_core_uverbs.c
+++ b/drivers/infiniband/core/ib_core_uverbs.c
@@ -244,16 +244,8 @@ void rdma_user_mmap_entry_remove(struct
entry->driver_removed = true;
xa_unlock(&entry->ucontext->mmap_xa);
list_for_each_entry_safe(uverbs_dmabuf, tmp, &entry->dmabufs, dmabufs_elm) {
- dma_resv_lock(uverbs_dmabuf->dmabuf->resv, NULL);
list_del(&uverbs_dmabuf->dmabufs_elm);
- uverbs_dmabuf->revoked = true;
- dma_buf_invalidate_mappings(uverbs_dmabuf->dmabuf);
- dma_resv_wait_timeout(uverbs_dmabuf->dmabuf->resv,
- DMA_RESV_USAGE_BOOKKEEP, false,
- MAX_SCHEDULE_TIMEOUT);
- dma_resv_unlock(uverbs_dmabuf->dmabuf->resv);
- kref_put(&uverbs_dmabuf->kref, ib_uverbs_dmabuf_done);
- wait_for_completion(&uverbs_dmabuf->comp);
+ ib_uverbs_dmabuf_revoke(uverbs_dmabuf);
}
mutex_unlock(&entry->dmabufs_lock);
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -42,6 +42,8 @@
#include <linux/mutex.h>
#include <linux/completion.h>
#include <linux/cdev.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-resv.h>
#include <rdma/ib_verbs.h>
#include <rdma/ib_umem.h>
@@ -135,6 +137,13 @@ struct ib_uverbs_completion_event_file {
struct ib_uverbs_dmabuf_file {
struct ib_uobject uobj;
+ /*
+ * Serializes users of dmabuf with the dma_buf's release, which sets it
+ * to NULL. The uobject can outlive the dma_buf while it waits to be
+ * destroyed. The map and unmap callbacks use attachment->dmabuf
+ * instead of taking this lock.
+ */
+ struct mutex dmabuf_release_lock;
struct dma_buf *dmabuf;
struct list_head dmabufs_elm;
struct rdma_user_mmap_entry *mmap_entry;
@@ -359,6 +368,34 @@ static inline void ib_uverbs_dmabuf_done
complete(&priv->comp);
}
+/*
+ * Revoke the dmabuf and wait for all of its DMA mappings to be gone. Must be
+ * called with the mmap entry's dmabufs_lock held, after the dmabuf has been
+ * removed from the entry's dmabufs list, so it runs once per dmabuf. Lock
+ * order is dmabufs_lock, dmabuf_release_lock, then the dma_resv lock.
+ */
+static inline void ib_uverbs_dmabuf_revoke(struct ib_uverbs_dmabuf_file *priv)
+{
+ mutex_lock(&priv->dmabuf_release_lock);
+ if (priv->dmabuf) {
+ dma_resv_lock(priv->dmabuf->resv, NULL);
+ priv->revoked = true;
+ dma_buf_invalidate_mappings(priv->dmabuf);
+ dma_resv_wait_timeout(priv->dmabuf->resv,
+ DMA_RESV_USAGE_BOOKKEEP, false,
+ MAX_SCHEDULE_TIMEOUT);
+ dma_resv_unlock(priv->dmabuf->resv);
+ } else {
+ /* A released dma_buf has no attachments left to invalidate */
+ priv->revoked = true;
+ }
+ mutex_unlock(&priv->dmabuf_release_lock);
+
+ kref_put(&priv->kref, ib_uverbs_dmabuf_done);
+ /* Wait till all DMA unmaps are completed */
+ wait_for_completion(&priv->comp);
+}
+
int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
enum rdma_remove_reason reason);
--- a/drivers/infiniband/core/uverbs_std_types_dmabuf.c
+++ b/drivers/infiniband/core/uverbs_std_types_dmabuf.c
@@ -28,7 +28,7 @@ uverbs_dmabuf_map(struct dma_buf_attachm
struct ib_uverbs_dmabuf_file *priv = attachment->dmabuf->priv;
struct sg_table *ret;
- dma_resv_assert_held(priv->dmabuf->resv);
+ dma_resv_assert_held(attachment->dmabuf->resv);
if (priv->revoked)
return ERR_PTR(-ENODEV);
@@ -49,7 +49,7 @@ static void uverbs_dmabuf_unmap(struct d
{
struct ib_uverbs_dmabuf_file *priv = attachment->dmabuf->priv;
- dma_resv_assert_held(priv->dmabuf->resv);
+ dma_resv_assert_held(attachment->dmabuf->resv);
dma_buf_free_sgt(attachment, sgt, dir);
kref_put(&priv->kref, ib_uverbs_dmabuf_done);
}
@@ -73,7 +73,25 @@ static void uverbs_dmabuf_release(struct
if (!priv->uobj.context)
return;
+ /*
+ * uverbs_uobject_release() may drop the last reference to the uobject,
+ * keep it around until the dmabuf pointer below has been cleared.
+ */
+ uverbs_uobject_get(&priv->uobj);
uverbs_uobject_release(&priv->uobj);
+
+ /*
+ * The dma_buf is freed once this function returns. If the uobject was
+ * not destroyed above, because the ufile is concurrently being cleaned
+ * up, it is still reachable through the ufile's uobjects list and the
+ * mmap entry's dmabufs list. Make sure those paths are not in the
+ * middle of using the dma_buf and cannot use it afterwards.
+ */
+ mutex_lock(&priv->dmabuf_release_lock);
+ priv->dmabuf = NULL;
+ mutex_unlock(&priv->dmabuf_release_lock);
+
+ uverbs_uobject_put(&priv->uobj);
}
static const struct dma_buf_ops uverbs_dmabuf_ops = {
@@ -99,6 +117,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_
off_t pg_off;
int ret;
+ mutex_init(&uverbs_dmabuf->dmabuf_release_lock);
+
ret = uverbs_get_const(&pg_off, attrs, UVERBS_ATTR_ALLOC_DMABUF_PGOFF);
if (ret)
return ret;
@@ -162,24 +182,11 @@ static void uverbs_dmabuf_fd_destroy_uob
{
struct ib_uverbs_dmabuf_file *uverbs_dmabuf =
container_of(uobj, struct ib_uverbs_dmabuf_file, uobj);
- bool wait_for_comp = false;
mutex_lock(&uverbs_dmabuf->mmap_entry->dmabufs_lock);
- dma_resv_lock(uverbs_dmabuf->dmabuf->resv, NULL);
if (!uverbs_dmabuf->revoked) {
- uverbs_dmabuf->revoked = true;
list_del(&uverbs_dmabuf->dmabufs_elm);
- dma_buf_invalidate_mappings(uverbs_dmabuf->dmabuf);
- dma_resv_wait_timeout(uverbs_dmabuf->dmabuf->resv,
- DMA_RESV_USAGE_BOOKKEEP, false,
- MAX_SCHEDULE_TIMEOUT);
- wait_for_comp = true;
- }
- dma_resv_unlock(uverbs_dmabuf->dmabuf->resv);
- if (wait_for_comp) {
- kref_put(&uverbs_dmabuf->kref, ib_uverbs_dmabuf_done);
- /* Let's wait till all DMA unmap are completed. */
- wait_for_completion(&uverbs_dmabuf->comp);
+ ib_uverbs_dmabuf_revoke(uverbs_dmabuf);
}
mutex_unlock(&uverbs_dmabuf->mmap_entry->dmabufs_lock);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 147/547] RDMA/irdma: avoid use-after-free in icrdma_remove
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 146/547] RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 148/547] rapidio: mport_cdev: fix use-after-free in mport_mm_close() Greg Kroah-Hartman
` (408 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Leon Romanovsky
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 8a8088b899e4cdfe558428cd6113d45df81625be upstream.
icrdma_remove() dereferences iwdev after calling
irdma_ib_unregister_device():
irdma_ib_unregister_device(iwdev)
-> ib_unregister_device(&iwdev->ibdev)
-> __ib_unregister_device()
-> ib_dealloc_device()
irdma registers irdma_ib_dealloc_device() as the dealloc_driver
callback in its ib_device_ops. The RDMA core explicitly documents
ib_unregister_device() that when ops.dealloc_driver is used, ib_dev
will be freed upon return from the function.
The ib_device is embedded in struct irdma_device and iwdev itself was
allocated by ib_alloc_device(irdma_device, ibdev). Consequently, once
irdma_ib_unregister_device() returns, iwdev must no longer be
dereferenced.
However, icrdma_remove() currently accesses iwdev->rf afterwards when
deinitializing interrupts, destroying ah_tbl_lock, and freeing rf.
Although the final ib_device storage is released with kfree_rcu(), the
object lifetime has already ended and callers must not rely on the RCU
grace period to continue dereferencing iwdev.
Save iwdev->rf before unregistering the RDMA device and use the saved
pointer for the remaining cleanup.
This issue was found by manual code inspection.
Fixes: 8498a30e1b94 ("RDMA/irdma: Register auxiliary driver and implement private channel OPs")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260914122840.1709743-1-lgs201920130244@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/irdma/icrdma_if.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/infiniband/hw/irdma/icrdma_if.c
+++ b/drivers/infiniband/hw/irdma/icrdma_if.c
@@ -318,14 +318,15 @@ static void icrdma_remove(struct auxilia
container_of(aux_dev, struct iidc_rdma_core_auxiliary_dev, adev);
struct iidc_rdma_core_dev_info *cdev_info = idc_adev->cdev_info;
struct irdma_device *iwdev = auxiliary_get_drvdata(aux_dev);
- u8 rdma_ver = iwdev->rf->rdma_ver;
+ struct irdma_pci_f *rf = iwdev->rf;
+ u8 rdma_ver = rf->rdma_ver;
ice_rdma_update_vsi_filter(cdev_info, iwdev->vsi_num, false);
irdma_ib_unregister_device(iwdev);
- icrdma_deinit_interrupts(iwdev->rf, cdev_info);
- mutex_destroy(&iwdev->rf->ah_tbl_lock);
+ icrdma_deinit_interrupts(rf, cdev_info);
+ mutex_destroy(&rf->ah_tbl_lock);
- kfree(iwdev->rf);
+ kfree(rf);
pr_debug("INIT: Gen[%d] func[%d] device remove success\n",
rdma_ver, PCI_FUNC(cdev_info->pdev->devfn));
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 148/547] rapidio: mport_cdev: fix use-after-free in mport_mm_close()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 147/547] RDMA/irdma: avoid use-after-free in icrdma_remove Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 149/547] pps: generators: fix use-after-free when closing a removed device Greg Kroah-Hartman
` (407 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Kim, Andrew Morton,
Alexandre Bounine, Dan Carpenter, Matt Porter
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kim <james010kim@gmail.com>
commit 0f2cd84858e67cf8e02438bf28243bcdc67aa49a upstream.
A use-after-free vulnerability was identified in mport_mm_close() in
drivers/rapidio/devices/rio_mport_cdev.c, identical to the pattern
previously addressed in dma_req_free().
This is observable from userspace when an application creates an mmap
mapping via the RapidIO character device and subsequently unmaps it (or
terminates, triggering exit_mmap()). During munmap, mport_mm_close() is
invoked and drops the mapping reference via kref_put().
If kref_put() drops the last reference, mport_release_mapping() is called,
which frees the underlying rio_mport_mapping structure. The subsequent
mutex_unlock() then dereferences map->md to unlock buf_mutex, leading to a
use-after-free:
mport_mm_close()
-> mutex_lock(&map->md->buf_mutex);
...
-> kref_put(&map->ref, mport_release_mapping); /* map is freed */
-> mutex_unlock(&map->md->buf_mutex); /* UAF: map used */
Fix this by caching map->md before kref_put() and using the cached pointer
for mutex unlocking, ensuring that freed memory is not accessed.
Link: https://lore.kernel.org/20260914042327.49798-1-james010kim@gmail.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: James Kim <james010kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rapidio/devices/rio_mport_cdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -2167,11 +2167,12 @@ static void mport_mm_open(struct vm_area
static void mport_mm_close(struct vm_area_struct *vma)
{
struct rio_mport_mapping *map = vma->vm_private_data;
+ struct mport_dev *md = map->md;
rmcd_debug(MMAP, "%pad", &map->phys_addr);
- mutex_lock(&map->md->buf_mutex);
+ mutex_lock(&md->buf_mutex);
kref_put(&map->ref, mport_release_mapping);
- mutex_unlock(&map->md->buf_mutex);
+ mutex_unlock(&md->buf_mutex);
}
static const struct vm_operations_struct vm_ops = {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 149/547] pps: generators: fix use-after-free when closing a removed device
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 148/547] rapidio: mport_cdev: fix use-after-free in mport_mm_close() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 150/547] PM: EM: Fix use-after-free of perf domain in netlink doit handlers Greg Kroah-Hartman
` (406 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Danish Khateeb, Rodolfo Giometti
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danish Khateeb <danishkhateeb03@gmail.com>
commit d19552611cb2eb6329826871565e5309bec2f288 upstream.
The cdev of a PPS generator is embedded in struct pps_gen_device, but
nothing ties the lifetime of that structure to the cdev: pps_gen is
freed by the release function of its device, and an open file holds a
device reference only until pps_gen_cdev_release() drops it.
When the generator is unregistered while /dev/pps-genN is open, that
put_device() drops the last reference and frees pps_gen, and __fput()
then calls cdev_put() on the freed cdev:
BUG: KASAN: slab-use-after-free in cdev_put+0x53/0x60
Read of size 8 at addr ffff88801383e138 by task ppsgen64/149
Call Trace:
cdev_put+0x53/0x60
__fput+0x745/0xad0
fput_close_sync+0xd9/0x1b0
__x64_sys_close+0x86/0xf0
...
Freed by task 149:
kfree+0x25a/0x6d0
device_release+0xca/0x3c0
kobject_put+0x169/0x320
pps_gen_cdev_release+0x51/0x80
__fput+0x36a/0xad0
pps.c had the same bug, fixed in commit c79a39dc8d06 ("pps: Fix a
use-after-free").
Fix it the usual way: embed the struct device in pps_gen_device and
register both with cdev_device_add(). This makes the device the parent
of the cdev, so the cdev holds a device reference until the last file
is closed.
Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-2-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pps/generators/pps_gen.c | 63 +++++++++++++++++++--------------------
include/linux/pps_gen_kernel.h | 2 -
2 files changed, 32 insertions(+), 33 deletions(-)
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -63,7 +63,7 @@ static long pps_gen_cdev_ioctl(struct fi
switch (cmd) {
case PPS_GEN_SETENABLE:
- dev_dbg(pps_gen->dev, "PPS_GEN_SETENABLE\n");
+ dev_dbg(&pps_gen->dev, "PPS_GEN_SETENABLE\n");
ret = get_user(status, uiuarg);
if (ret)
@@ -77,7 +77,7 @@ static long pps_gen_cdev_ioctl(struct fi
break;
case PPS_GEN_USESYSTEMCLOCK:
- dev_dbg(pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
+ dev_dbg(&pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
ret = put_user(pps_gen->info->use_system_clock, uiuarg);
if (ret)
@@ -89,12 +89,12 @@ static long pps_gen_cdev_ioctl(struct fi
struct pps_gen_event info;
unsigned int ev = pps_gen->last_ev;
- dev_dbg(pps_gen->dev, "PPS_GEN_FETCHEVENT\n");
+ dev_dbg(&pps_gen->dev, "PPS_GEN_FETCHEVENT\n");
ret = wait_event_interruptible(pps_gen->queue,
ev != pps_gen->last_ev);
if (ret == -ERESTARTSYS) {
- dev_dbg(pps_gen->dev, "pending signal caught\n");
+ dev_dbg(&pps_gen->dev, "pending signal caught\n");
return -EINTR;
}
@@ -121,7 +121,7 @@ static int pps_gen_cdev_open(struct inod
struct pps_gen_device *pps_gen = container_of(inode->i_cdev,
struct pps_gen_device, cdev);
- get_device(pps_gen->dev);
+ get_device(&pps_gen->dev);
file->private_data = pps_gen;
return 0;
}
@@ -130,7 +130,7 @@ static int pps_gen_cdev_release(struct i
{
struct pps_gen_device *pps_gen = file->private_data;
- put_device(pps_gen->dev);
+ put_device(&pps_gen->dev);
return 0;
}
@@ -151,19 +151,15 @@ static void pps_gen_device_destruct(stru
{
struct pps_gen_device *pps_gen = dev_get_drvdata(dev);
- cdev_del(&pps_gen->cdev);
-
pr_debug("deallocating pps-gen%d\n", pps_gen->id);
ida_free(&pps_gen_ida, pps_gen->id);
- kfree(dev);
kfree(pps_gen);
}
static int pps_gen_register_cdev(struct pps_gen_device *pps_gen)
{
int err;
- dev_t devt;
err = ida_alloc_max(&pps_gen_ida, PPS_GEN_MAX_SOURCES - 1, GFP_KERNEL);
if (err < 0) {
@@ -171,46 +167,52 @@ static int pps_gen_register_cdev(struct
pr_err("too many PPS sources in the system\n");
err = -EBUSY;
}
+ kfree(pps_gen);
return err;
}
pps_gen->id = err;
- devt = MKDEV(MAJOR(pps_gen_devt), pps_gen->id);
+ /*
+ * From here on pps_gen belongs to its device and is freed by
+ * pps_gen_device_destruct(). The cdev holds a reference to the
+ * device, so pps_gen stays around until the last file is closed.
+ */
+ device_initialize(&pps_gen->dev);
+ pps_gen->dev.class = &pps_gen_class;
+ pps_gen->dev.parent = pps_gen->info->parent;
+ pps_gen->dev.devt = MKDEV(MAJOR(pps_gen_devt), pps_gen->id);
+ pps_gen->dev.release = pps_gen_device_destruct;
+ dev_set_drvdata(&pps_gen->dev, pps_gen);
cdev_init(&pps_gen->cdev, &pps_gen_cdev_fops);
pps_gen->cdev.owner = pps_gen->info->owner;
- err = cdev_add(&pps_gen->cdev, devt, 1);
+ err = dev_set_name(&pps_gen->dev, "pps-gen%d", pps_gen->id);
+ if (err)
+ goto put_dev;
+
+ err = cdev_device_add(&pps_gen->cdev, &pps_gen->dev);
if (err) {
pr_err("failed to add char device %d:%d\n",
MAJOR(pps_gen_devt), pps_gen->id);
- goto free_ida;
+ goto put_dev;
}
- pps_gen->dev = device_create(&pps_gen_class, pps_gen->info->parent, devt,
- pps_gen, "pps-gen%d", pps_gen->id);
- if (IS_ERR(pps_gen->dev)) {
- err = PTR_ERR(pps_gen->dev);
- goto del_cdev;
- }
- pps_gen->dev->release = pps_gen_device_destruct;
- dev_set_drvdata(pps_gen->dev, pps_gen);
pr_debug("generator got cdev (%d:%d)\n",
MAJOR(pps_gen_devt), pps_gen->id);
return 0;
-del_cdev:
- cdev_del(&pps_gen->cdev);
-free_ida:
- ida_free(&pps_gen_ida, pps_gen->id);
+put_dev:
+ put_device(&pps_gen->dev);
return err;
}
static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
{
pr_debug("unregistering pps-gen%d\n", pps_gen->id);
- device_destroy(&pps_gen_class, pps_gen->dev->devt);
+ cdev_device_del(&pps_gen->cdev, &pps_gen->dev);
+ put_device(&pps_gen->dev);
}
/*
@@ -244,18 +246,15 @@ struct pps_gen_device *pps_gen_register_
init_waitqueue_head(&pps_gen->queue);
spin_lock_init(&pps_gen->lock);
- /* Create the char device */
+ /* Create the char device, this frees pps_gen on failure */
err = pps_gen_register_cdev(pps_gen);
if (err < 0) {
pr_err(" unable to create char device\n");
- goto kfree_pps_gen;
+ goto pps_gen_register_source_exit;
}
return pps_gen;
-kfree_pps_gen:
- kfree(pps_gen);
-
pps_gen_register_source_exit:
pr_err("unable to register generator\n");
@@ -289,7 +288,7 @@ void pps_gen_event(struct pps_gen_device
{
unsigned long flags;
- dev_dbg(pps_gen->dev, "PPS generator event %u\n", event);
+ dev_dbg(&pps_gen->dev, "PPS generator event %u\n", event);
spin_lock_irqsave(&pps_gen->lock, flags);
--- a/include/linux/pps_gen_kernel.h
+++ b/include/linux/pps_gen_kernel.h
@@ -54,7 +54,7 @@ struct pps_gen_device {
unsigned int id; /* PPS generator unique ID */
struct cdev cdev;
- struct device *dev;
+ struct device dev;
struct fasync_struct *async_queue; /* fasync method */
spinlock_t lock;
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 150/547] PM: EM: Fix use-after-free of perf domain in netlink doit handlers
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 149/547] pps: generators: fix use-after-free when closing a removed device Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 151/547] platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led Greg Kroah-Hartman
` (405 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Rafael J. Wysocki
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit f58dacfbadb7be7c7dbb2b95e9341ad56710849e upstream.
The doit handlers dropped em_pd_list_mutex before dereferencing the
perf domain, so a concurrent device unregister could free it while the
reply was being built.
Encode the reply from em_perf_domain_for_id() callbacks, which run
under the mutex, and allocate the skb outside of it, like the dumpit
path already does.
This issue was found by an in-house static analysis tool.
Fixes: 380ff27af25e ("PM: EM: Add dump to get-perf-domains in the EM YNL spec")
Fixes: f2d2946eaa5c ("PM: EM: Implement em_nl_get_pd_table_doit()")
Cc: All applicable <stable@vger.kernel.org>
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260922081052.321581-1-fanwu01@zju.edu.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/power/em_netlink.c | 122 +++++++++++++++++++++++++++-----------------
kernel/power/em_netlink.h | 8 +-
kernel/power/energy_model.c | 8 +-
3 files changed, 87 insertions(+), 51 deletions(-)
--- a/kernel/power/em_netlink.c
+++ b/kernel/power/em_netlink.c
@@ -95,41 +95,62 @@ static int __em_nl_get_pd_for_dump(struc
return ret;
}
+struct em_nl_doit_ctx {
+ struct genl_info *info;
+ int cmd;
+ struct sk_buff *msg;
+};
+
+static int __em_nl_get_pd_doit_fill(struct em_perf_domain *pd, void *data)
+{
+ struct em_nl_doit_ctx *ctx = data;
+ void *hdr;
+
+ hdr = genlmsg_put_reply(ctx->msg, ctx->info, &dev_energymodel_nl_family, 0,
+ ctx->cmd);
+ if (!hdr)
+ return -EMSGSIZE;
+
+ if (__em_nl_get_pd(pd, ctx->msg)) {
+ genlmsg_cancel(ctx->msg, hdr);
+ return -EMSGSIZE;
+ }
+
+ genlmsg_end(ctx->msg, hdr);
+ return 0;
+}
+
int dev_energymodel_nl_get_perf_domains_doit(struct sk_buff *skb,
- struct genl_info *info)
+ struct genl_info *info)
{
- int id, ret = -EMSGSIZE, msg_sz = 0;
- int cmd = info->genlhdr->cmd;
- struct em_perf_domain *pd;
+ struct em_nl_doit_ctx ctx = {
+ .info = info,
+ .cmd = info->genlhdr->cmd,
+ };
struct sk_buff *msg;
- void *hdr;
+ int id, ret, msg_sz = 0;
if (!info->attrs[DEV_ENERGYMODEL_A_PERF_DOMAIN_PERF_DOMAIN_ID])
return -EINVAL;
id = nla_get_u32(info->attrs[DEV_ENERGYMODEL_A_PERF_DOMAIN_PERF_DOMAIN_ID]);
- pd = em_perf_domain_get_by_id(id);
- if (!pd)
- return -EINVAL;
- __em_nl_get_pd_size(pd, &msg_sz);
+ /* Encode under em_pd_list_mutex, like the dumpit path. */
+ ret = em_perf_domain_for_id(id, __em_nl_get_pd_size, &msg_sz);
+ if (ret)
+ return ret;
+
msg = genlmsg_new(msg_sz, GFP_KERNEL);
if (!msg)
return -ENOMEM;
- hdr = genlmsg_put_reply(msg, info, &dev_energymodel_nl_family, 0, cmd);
- if (!hdr)
- goto out_free_msg;
-
- ret = __em_nl_get_pd(pd, msg);
+ ctx.msg = msg;
+ ret = em_perf_domain_for_id(id, __em_nl_get_pd_doit_fill, &ctx);
if (ret)
- goto out_cancel_msg;
- genlmsg_end(msg, hdr);
+ goto out_free_msg;
return genlmsg_reply(msg, info);
-out_cancel_msg:
- genlmsg_cancel(msg, hdr);
out_free_msg:
nlmsg_free(msg);
return ret;
@@ -148,19 +169,6 @@ int dev_energymodel_nl_get_perf_domains_
return for_each_em_perf_domain(__em_nl_get_pd_for_dump, &ctx);
}
-static struct em_perf_domain *__em_nl_get_pd_table_id(struct nlattr **attrs)
-{
- struct em_perf_domain *pd;
- int id;
-
- if (!attrs[DEV_ENERGYMODEL_A_PERF_TABLE_PERF_DOMAIN_ID])
- return NULL;
-
- id = nla_get_u32(attrs[DEV_ENERGYMODEL_A_PERF_TABLE_PERF_DOMAIN_ID]);
- pd = em_perf_domain_get_by_id(id);
- return pd;
-}
-
static int __em_nl_get_pd_table_size(const struct em_perf_domain *pd)
{
int id_sz, ps_sz;
@@ -245,34 +253,58 @@ out_err:
return -EMSGSIZE;
}
+static int __em_nl_get_pd_table_size_cb(struct em_perf_domain *pd, void *data)
+{
+ *(int *)data = __em_nl_get_pd_table_size(pd);
+ return 0;
+}
+
+static int __em_nl_get_pd_table_doit_fill(struct em_perf_domain *pd,
+ void *data)
+{
+ struct em_nl_doit_ctx *ctx = data;
+ void *hdr;
+
+ hdr = genlmsg_put_reply(ctx->msg, ctx->info, &dev_energymodel_nl_family, 0,
+ ctx->cmd);
+ if (!hdr)
+ return -EMSGSIZE;
+
+ if (__em_nl_get_pd_table(ctx->msg, pd))
+ return -EMSGSIZE;
+
+ genlmsg_end(ctx->msg, hdr);
+ return 0;
+}
+
int dev_energymodel_nl_get_perf_table_doit(struct sk_buff *skb,
- struct genl_info *info)
+ struct genl_info *info)
{
- int cmd = info->genlhdr->cmd;
- int msg_sz, ret = -EMSGSIZE;
- struct em_perf_domain *pd;
+ struct em_nl_doit_ctx ctx = {
+ .info = info,
+ .cmd = info->genlhdr->cmd,
+ };
struct sk_buff *msg;
- void *hdr;
+ int id, ret, msg_sz;
- pd = __em_nl_get_pd_table_id(info->attrs);
- if (!pd)
+ if (!info->attrs[DEV_ENERGYMODEL_A_PERF_TABLE_PERF_DOMAIN_ID])
return -EINVAL;
- msg_sz = __em_nl_get_pd_table_size(pd);
+ id = nla_get_u32(info->attrs[DEV_ENERGYMODEL_A_PERF_TABLE_PERF_DOMAIN_ID]);
+
+ ret = em_perf_domain_for_id(id, __em_nl_get_pd_table_size_cb, &msg_sz);
+ if (ret)
+ return ret;
msg = genlmsg_new(msg_sz, GFP_KERNEL);
if (!msg)
return -ENOMEM;
- hdr = genlmsg_put_reply(msg, info, &dev_energymodel_nl_family, 0, cmd);
- if (!hdr)
- goto out_free_msg;
-
- ret = __em_nl_get_pd_table(msg, pd);
+ ctx.msg = msg;
+ ret = em_perf_domain_for_id(id, __em_nl_get_pd_table_doit_fill, &ctx);
if (ret)
goto out_free_msg;
- genlmsg_end(msg, hdr);
return genlmsg_reply(msg, info);
out_free_msg:
--- a/kernel/power/em_netlink.h
+++ b/kernel/power/em_netlink.h
@@ -12,7 +12,8 @@
#if defined(CONFIG_ENERGY_MODEL) && defined(CONFIG_NET)
int for_each_em_perf_domain(int (*cb)(struct em_perf_domain*, void *),
void *data);
-struct em_perf_domain *em_perf_domain_get_by_id(int id);
+int em_perf_domain_for_id(int id, int (*cb)(struct em_perf_domain *, void *),
+ void *data);
void em_notify_pd_created(const struct em_perf_domain *pd);
void em_notify_pd_deleted(const struct em_perf_domain *pd);
void em_notify_pd_updated(const struct em_perf_domain *pd);
@@ -24,9 +25,10 @@ int for_each_em_perf_domain(int (*cb)(st
return -EINVAL;
}
static inline
-struct em_perf_domain *em_perf_domain_get_by_id(int id)
+int em_perf_domain_for_id(int id, int (*cb)(struct em_perf_domain *, void *),
+ void *data)
{
- return NULL;
+ return -EINVAL;
}
static inline void em_notify_pd_created(const struct em_perf_domain *pd) {}
--- a/kernel/power/energy_model.c
+++ b/kernel/power/energy_model.c
@@ -1031,7 +1031,9 @@ int for_each_em_perf_domain(int (*cb)(st
return 0;
}
-struct em_perf_domain *em_perf_domain_get_by_id(int id)
+/* Run @cb on the matching domain with em_pd_list_mutex held. */
+int em_perf_domain_for_id(int id, int (*cb)(struct em_perf_domain *, void *),
+ void *data)
{
struct em_perf_domain *pd;
@@ -1040,9 +1042,9 @@ struct em_perf_domain *em_perf_domain_ge
list_for_each_entry(pd, &em_pd_list, node) {
if (pd->id == id)
- return pd;
+ return cb(pd, data);
}
- return NULL;
+ return -EINVAL;
}
#endif
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 151/547] platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 150/547] PM: EM: Fix use-after-free of perf domain in netlink doit handlers Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 152/547] platform/x86/amd: hfi: Fix a use-after-free when unloading the driver Greg Kroah-Hartman
` (404 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Baigue, Denis Benato,
Ilpo Järvinen
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <denis.benato@linux.dev>
commit 639bc2254816b7c4e7a9801a7b3aa71bfa3f915c upstream.
kbd_led_update_all() registers asus->kbd_led with
devm_led_classdev_register() on the platform device, but kbd_led is
embedded in struct asus_wmi, which asus_wmi_remove() frees at its end.
The driver core calls .remove() before devres_release_all(), so the
deferred devres release runs led_classdev_unregister() on memory that
has already been freed. Whether that faults depends on whether the
slab has been reused in between, which makes the crash on module
unload intermittent and silently corrupts the led classdev state in
the remaining runs.
Unregister the led classdev explicitly in asus_wmi_led_exit(), after
the led workqueue has been destroyed: kbd_led_work can then neither
run nor be queued anymore, since asus_ref.asus is NULL too, so
kbd_led_registered is stable and the classdev can be released while
the memory embedding it is still alive. devm_led_classdev_unregister()
also drops the devres entry, leaving nothing to run at unbind cleanup
time; it warns when no devres entry exists, hence the
kbd_led_registered check.
Fixes: fac55d29581f ("platform/x86: asus-wmi: Add support for multiple kbd led handlers")
Closes: https://lore.kernel.org/all/CAO84+x+P2_xyHP89+nGVSMV6bL+dy0P9=vyEEfZGnFhv0hBNWw@mail.gmail.com
Reported-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260915172608.14234-1-denis.benato@linux.dev
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/asus-wmi.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index c2af1f049b67..0eb43ca44119 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -2088,6 +2088,18 @@ static void asus_wmi_led_exit(struct asus_wmi *asus)
if (asus->led_workqueue)
destroy_workqueue(asus->led_workqueue);
+
+ /*
+ * kbd_led is registered lazily by kbd_led_work: now that the
+ * workqueue is destroyed and asus_ref.asus is NULL, the work can
+ * neither run nor be queued anymore, furthermore leaving it to
+ * devres would run the unregister from devres_release_all(),
+ * after .remove() returned and the struct asus_wmi embedding
+ * kbd_led has been freed.
+ */
+ if (asus->kbd_led_registered)
+ devm_led_classdev_unregister(&asus->platform_device->dev,
+ &asus->kbd_led);
}
static int asus_wmi_led_init(struct asus_wmi *asus)
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 152/547] platform/x86/amd: hfi: Fix a use-after-free when unloading the driver
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 151/547] platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 153/547] nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt() Greg Kroah-Hartman
` (403 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Mario Limonciello,
Ilpo Järvinen
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 55d8406dfa2fa8ad8ac2f053c2a53a97d8b0ce48 upstream.
amd_hfi_probe() registers CPU hotplug callbacks with
cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, ...) and schedules the static
sched_amd_hfi_itmt_work work item, but amd_hfi_remove() tears down
neither. The dynamically assigned hotplug state returned by
cpuhp_setup_state() is discarded, so cpuhp_remove_state() can never be
called, and the pending work is never cancelled.
After the module is unloaded and its memory is freed, any subsequent CPU
hotplug event or execution of the scheduled work dereferences the stale
callback and work function pointers, resulting in a use-after-free and
kernel panic.
Store the hotplug state returned by cpuhp_setup_state() and, on removal,
call cpuhp_remove_state() to unregister the callbacks and
cancel_work_sync() to flush the scheduled work before the module memory
goes away.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: bb20421c05fc ("platform/x86: hfi: Add online and offline callback support")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260921170411.1149960-2-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/amd/hfi/hfi.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/platform/x86/amd/hfi/hfi.c
+++ b/drivers/platform/x86/amd/hfi/hfi.c
@@ -76,6 +76,8 @@ struct amd_hfi_data {
struct amd_shmem_info *shmem;
struct dentry *dbgfs_dir;
+
+ int cpuhp_state;
};
/**
@@ -244,6 +246,8 @@ static void amd_hfi_remove(struct platfo
{
struct amd_hfi_data *dev = platform_get_drvdata(pdev);
+ cpuhp_remove_state(dev->cpuhp_state);
+ cancel_work_sync(&sched_amd_hfi_itmt_work);
debugfs_remove_recursive(dev->dbgfs_dir);
}
@@ -494,6 +498,7 @@ static int amd_hfi_probe(struct platform
amd_hfi_online, amd_hfi_offline);
if (ret < 0)
return ret;
+ amd_hfi_data->cpuhp_state = ret;
schedule_work(&sched_amd_hfi_itmt_work);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 153/547] nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 152/547] platform/x86/amd: hfi: Fix a use-after-free when unloading the driver Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 154/547] nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection() Greg Kroah-Hartman
` (402 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Daejun Park,
Keith Busch
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
commit f316aa7f018840523939183425394931b373e4d7 upstream.
nvmet_pr_preempt() handles a preempt sent by the reservation holder by
changing the reservation type with nvmet_pr_update_reg_attr(), unless
the reservation is of an All Registrants type. For the holder that
helper does not modify the registrant in place: it puts a copy on the
registrant list, points pr->holder to the copy and passes the old
registrant to kfree_rcu().
If the reservation type changed, nvmet_pr_preempt() then hands
®->hostid of that old registrant to nvmet_pr_resv_released(). Unless
the reservation released notification is masked, that function takes
subsys->lock and compares the host id against every controller of the
subsystem. The caller only holds pr->pr_sem and is not in an RCU
read-side critical section, so nothing keeps the old registrant alive
while it is read.
The result is a read of 16 freed bytes that decides which controllers
get the notification. Found by code inspection. kfree_rcu() defers
the free, so it usually happens after the read; when the pending free
is forced to run before the read, KASAN reports the host id as freed
memory.
Pass the host id of the controller that sent the command instead. The
registrant was looked up by that host id, and the controller outlives
the request.
Fixes: 5a47c2080a73 ("nvmet: support reservation feature")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/pr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/target/pr.c
+++ b/drivers/nvme/target/pr.c
@@ -593,7 +593,7 @@ static u16 nvmet_pr_preempt(struct nvmet
status = nvmet_pr_update_reg_attr(pr, holder,
nvmet_pr_update_holder_rtype, &rtype);
if (!status && original_rtype != rtype)
- nvmet_pr_resv_released(pr, ®->hostid);
+ nvmet_pr_resv_released(pr, &ctrl->hostid);
return status;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 154/547] nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 153/547] nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 155/547] iommufd: Fix event queue release use-after-free Greg Kroah-Hartman
` (401 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Yehyeong Lee,
Keith Busch
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit 2c29f8c9b9e598c09fa50aa02200136a107f6b3f upstream.
nvmet_fc_ls_create_connection() looks up the association with
nvmet_fc_find_target_assoc(), which returns it with a reference held,
and drops that reference as soon as the target queue has been allocated.
iod->assoc is then dereferenced again by nvmet_fc_makeconnid() while
building the connection id.
The queue only borrows the pointer and takes no reference of its own.
Once the lookup reference is dropped the association is kept alive
solely by the reference taken when it was created, so a disconnect LS or
a remote port unregister running concurrently can free it before
nvmet_fc_makeconnid() reads it:
BUG: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
Read of size 8 at addr ffff888179f1b000 by task kworker/u9:2/1167
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvmet-wq nvmet_fc_handle_ls_rqst_work
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
worker_thread (kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (archkernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
</TASK>
Freed by task 1167 on cpu 0 at 405.998150s:
kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:1808 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
worker_thread (kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (archkernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
The buggy address belongs to the object at ffff888179f1b000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes inside of
freed 2048-byte region [ffff888179f1b000, ffff888179f1b800)
Hold the lookup reference until the response has been built, and drop it
on the error path as well.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-nvme/20260731204504.2396434-1-shuangpeng.kernel@gmail.com
Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/fc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1796,9 +1796,6 @@ nvmet_fc_ls_create_connection(struct nvm
be16_to_cpu(rqst->connect_cmd.sqsize));
if (!queue)
ret = VERR_QUEUE_ALLOC_FAIL;
-
- /* release get taken in nvmet_fc_find_target_assoc */
- nvmet_fc_tgt_a_put(iod->assoc);
}
}
@@ -1812,6 +1809,8 @@ nvmet_fc_ls_create_connection(struct nvm
FCNVME_RJT_RC_INV_ASSOC :
FCNVME_RJT_RC_LOGIC,
FCNVME_RJT_EXP_NONE, 0);
+ if (iod->assoc)
+ nvmet_fc_tgt_a_put(iod->assoc);
return;
}
@@ -1833,6 +1832,9 @@ nvmet_fc_ls_create_connection(struct nvm
acc->connectid.connection_id =
cpu_to_be64(nvmet_fc_makeconnid(iod->assoc,
be16_to_cpu(rqst->connect_cmd.qid)));
+
+ /* release get taken in nvmet_fc_find_target_assoc */
+ nvmet_fc_tgt_a_put(iod->assoc);
}
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 155/547] iommufd: Fix event queue release use-after-free
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 154/547] nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 156/547] landlock: Fix superblock use-after-free in release_inode() Greg Kroah-Hartman
` (400 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Jason Gunthorpe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <nirmoyd@nvidia.com>
commit 440ca8a4b69f40088065b9e05ef11373292a254e upstream.
iommufd_eventq_fops_release() drops the file's users reference before
reading eventq->ictx. Once that reference is dropped, IOMMU_DESTROY in
another thread can remove and free the event queue, so the later load
accesses freed memory.
Read ictx while the users reference still pins the event queue, then
drop the reference and put the saved context. The context reference
taken by iommufd_eventq_init() keeps ictx valid until the put. Fault and
vEVENTQ file descriptors share this release path.
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Cc: stable@vger.kernel.org
Assisted-by: LLM, Specula
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Link: https://patch.msgid.link/20261014133632.3440297-1-nirmoyd@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/eventq.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/iommu/iommufd/eventq.c
+++ b/drivers/iommu/iommufd/eventq.c
@@ -396,9 +396,11 @@ static __poll_t iommufd_eventq_fops_poll
static int iommufd_eventq_fops_release(struct inode *inode, struct file *filep)
{
struct iommufd_eventq *eventq = filep->private_data;
+ /* eventq may be freed once the users reference is dropped. */
+ struct iommufd_ctx *ictx = eventq->ictx;
refcount_dec(&eventq->obj.users);
- iommufd_ctx_put(eventq->ictx);
+ iommufd_ctx_put(ictx);
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 156/547] landlock: Fix superblock use-after-free in release_inode()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 155/547] iommufd: Fix event queue release use-after-free Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 157/547] lockd: Fix use-after-free in nlmsvc_retry_blocked Greg Kroah-Hartman
` (399 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Günther Noack,
Mickaël Salaün
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <gnoack@google.com>
commit 3e271a27c46fd591d1011c7de5a644a41e2010f1 upstream.
Without this fix, release_inode() (task 1) can race with a umount
operation in hook_sb_delete() (task 2). The order of operations in
which the race occurs is:
* task 2: hook_sb_delete() arrives at the end of the function, waiting
for landlock_superblock(sb)->inode_refs to become zero.
* task 1: release_inode(): does atomic_long_dec_and_test(), decrementing
inode_refs to zero.
* task 2: gets woken up through some other means, sees that inode_refs
is zero and returns. The caller is the unmount operation and proceeds
to release the superblock.
* task 1: Runs wake_up_var(&landlock_superblock(sb)->inode_refs),
*dereferencing the sb_security on the freed-up superblock*.
Notably, wake_up_var() does not dereference the pointer passed to it,
and only uses it to determine an overapproximated set of tasks to wake
up. So while it's potentially possible for an attacker to provide a
different value for that pointer, this only results in the wrong set of
tasks getting woken up, and in this scenario, no further tasks are
actually waiting.
Nevertheless, KASAN detects it as a slab-use-after-free read on
sb->s_security:
BUG: KASAN: slab-use-after-free in release_inode+0x196/0x290
Read of size 8 at addr ffff888103b6c0a8 by task repro/217
release_inode+0x196/0x290
landlock_put_object+0x71/0x90
landlock_free_rules+0x38/0xc0
landlock_put_ruleset+0x47/0x130
fop_ruleset_release+0x33/0x40
__fput+0x305/0x780
Freed by task 54:
kfree+0x11c/0x390
process_scheduled_works+0x766/0xe50
worker_thread+0x7bc/0xb20
The fix is to determine &landlock_superblock(inode->i_sb)->inode_refs only once
earlier in release_inode(), and later use that precalculated address for the
wake_up_var() call, without having to dereference through the superblock.
Cc: stable@vger.kernel.org
Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
Assisted-by: LLM
Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20261006105847.2541190-1-gnoack@google.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/landlock/fs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -61,7 +61,7 @@ static void release_inode(struct landloc
__releases(object->lock)
{
struct inode *const inode = object->underobj;
- struct super_block *sb;
+ atomic_long_t *inode_refs;
if (!inode) {
spin_unlock(&object->lock);
@@ -77,8 +77,8 @@ static void release_inode(struct landloc
* Makes sure that if the filesystem is concurrently unmounted,
* hook_sb_delete() will wait for us to finish iput().
*/
- sb = inode->i_sb;
- atomic_long_inc(&landlock_superblock(sb)->inode_refs);
+ inode_refs = &landlock_superblock(inode->i_sb)->inode_refs;
+ atomic_long_inc(inode_refs);
spin_unlock(&object->lock);
/*
* Because object->underobj was not NULL, hook_sb_delete() and
@@ -92,8 +92,8 @@ static void release_inode(struct landloc
*/
iput(inode);
- if (atomic_long_dec_and_test(&landlock_superblock(sb)->inode_refs))
- wake_up_var(&landlock_superblock(sb)->inode_refs);
+ if (atomic_long_dec_and_test(inode_refs))
+ wake_up_var(inode_refs);
}
static const struct landlock_object_underops landlock_fs_underops = {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 157/547] lockd: Fix use-after-free in nlmsvc_retry_blocked
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 156/547] landlock: Fix superblock use-after-free in release_inode() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 158/547] media: au0828: fix use-after-free in bulk_timeout timer on disconnect Greg Kroah-Hartman
` (398 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit f5b7634f0f213299a07b461fb10385c8639a4ab8 upstream.
nlmsvc_retry_blocked() examines the block at the head of nlm_blocked
under nlm_blocked_lock, then releases the lock before calling
nlmsvc_grant_blocked() or retry_deferred_block(). The nlm_blocked list
reference is all that keeps the block alive across that window.
nlmsvc_grant_blocked() does take one of its own, but not until after
the lock has been dropped. Unmounting the nfsd filesystem while a lock
request is still blocked reaches nlmsvc_traverse_blocks(), which drops
the list reference and frees the block along with the nlm_rqst hanging
off it.
BUG: KASAN: slab-use-after-free in nlm_async_call+0xd6/0x230
Read of size 8 at addr ffff88811b04c808 by task lockd/8377
nlm_async_call+0xd6/0x230
nlmsvc_retry_blocked+0x61c/0x800
lockd+0x144/0x1c0
Freed by task 8392:
nlmsvc_release_block+0x231/0x290
nlmsvc_traverse_blocks+0x139/0x1b0
nlm_traverse_files+0x1aa/0xa00
nlmsvc_free_host_resources+0x12/0x60
nlm_shutdown_hosts_net+0x127/0x280
lockd_down+0xd5/0x1c0
Take a reference before releasing nlm_blocked_lock and drop it once
the retry has run.
Fixes: 0e4ac9d93515 ("lockd: handle fl_grant callbacks")
Cc: stable@vger.kernel.org
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-nfs/20260818235808.3458075-1-shuangpeng.kernel@gmail.com/
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260822-lockd-retry-blocked-uaf-v3-1-761661eae60c@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svclock.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -1023,6 +1023,7 @@ nlmsvc_retry_blocked(struct svc_rqst *rq
timeout = block->b_when - jiffies;
break;
}
+ kref_get(&block->b_count);
spin_unlock(&nlm_blocked_lock);
dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
@@ -1033,6 +1034,7 @@ nlmsvc_retry_blocked(struct svc_rqst *rq
retry_deferred_block(block);
} else
nlmsvc_grant_blocked(block);
+ nlmsvc_release_block(block);
spin_lock(&nlm_blocked_lock);
}
spin_unlock(&nlm_blocked_lock);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 158/547] media: au0828: fix use-after-free in bulk_timeout timer on disconnect
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 157/547] lockd: Fix use-after-free in nlmsvc_retry_blocked Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 159/547] media: cx23885: Fix use-after-free in cx23885_finidev due to race condition Greg Kroah-Hartman
` (397 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 521030837bee352515d5ea57cc6a29581db3506e upstream.
start_urb_transfer() arms dev->bulk_timeout, whose callback
au0828_bulk_timeout() queues dev->restart_streaming; that work in turn
calls start_urb_transfer() and re-arms the timer.
au0828_dvb_unregister() cancels restart_streaming on disconnect but does
not sync bulk_timeout. au0828_usb_release() then frees dev with kfree(),
so a timer still armed or pending at that point can fire after the free
and dereference dev through timer_container_of().
Sync the timer with timer_shutdown_sync() before cancel_work_sync(). The
timer callback queues the work, so the timer must be stopped first; the
shutdown variant is needed because the work re-arms the timer through
start_urb_transfer(). The dvb->frontend == NULL early return guards the
register-failure path where the timer was never set up.
This bug was found by static analysis.
Fixes: 53460c53b761 ("[media] au0828: Add timer to restart TS stream if no data arrives on bulk endpoint")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/au0828/au0828-dvb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/usb/au0828/au0828-dvb.c
+++ b/drivers/media/usb/au0828/au0828-dvb.c
@@ -537,6 +537,7 @@ void au0828_dvb_unregister(struct au0828
if (dvb->frontend == NULL)
return;
+ timer_shutdown_sync(&dev->bulk_timeout);
cancel_work_sync(&dev->restart_streaming);
dvb_net_release(&dvb->net);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 159/547] media: cx23885: Fix use-after-free in cx23885_finidev due to race condition
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 158/547] media: au0828: fix use-after-free in bulk_timeout timer on disconnect Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 160/547] media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path Greg Kroah-Hartman
` (396 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
commit 75016a992d9b03f5cc6df1414d1da35840d4feeb upstream.
In cx23885_v4l2_dev_notify_init, &dev->cx25840_work is bound with
cx23885_av_work_handler, and &dev->ir_rx_work and &dev->ir_tx_work
are bound with cx23885_ir_rx_work_handler and
cx23885_ir_tx_work_handler. cx23885_irq can schedule these works on
system_wq when an AV_CORE interrupt is received, and the IR subdevice
can also schedule the IR works from its interrupt service routine via
the v4l2_device notify callback.
If we remove the device, cx23885_finidev makes cleanup and the memory
allocated for dev is released by kfree(dev), while the works mentioned
above may still be pending or running. The sequence of operations that
may lead to a UAF bug is as follows:
CPU0 CPU1
| cx23885_irq
| schedule_work(&dev->cx25840_work)
cx23885_finidev |
cx23885_input_fini(dev) |
cx23885_ir_fini(dev) |
cx23885_shutdown(dev) |
free_irq(pci_dev->irq, dev) |
pci_disable_device(pci_dev) |
cx23885_dev_unregister(dev) |
v4l2_device_unregister(v4l2_dev) |
kfree(dev) |
// dev is freed |
| cx23885_av_work_handler
| // use dev (use-after-free)
Fix it by canceling the works after the IRQ handler that can schedule
them has been stopped, and before proceeding with the remaining
cleanup in cx23885_finidev.
Note that the flush_work() calls in cx23885_input_ir_stop() do not
close this race: they only wait for works that are already queued or
running at that moment, they do not prevent the IRQ handler, which is
still registered at that point, from scheduling the works again
afterwards, and they are skipped entirely when dev->sd_ir is NULL.
The cancel_work_sync() calls are therefore placed after free_irq(),
the only point at which no new work can be scheduled.
Fixes: e5514f104d87 ("V4L/DVB: cx23885: Move AV Core irq handling to a work handler")
Cc: stable@vger.kernel.org
Assisted-by: Codex:deepseek-v4-flash
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cx23885/cx23885-core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -2246,6 +2246,10 @@ static void cx23885_finidev(struct pci_d
/* unregister stuff */
free_irq(pci_dev->irq, dev);
+ cancel_work_sync(&dev->cx25840_work);
+ cancel_work_sync(&dev->ir_rx_work);
+ cancel_work_sync(&dev->ir_tx_work);
+
pci_disable_device(pci_dev);
cx23885_dev_unregister(dev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 160/547] media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 159/547] media: cx23885: Fix use-after-free in cx23885_finidev due to race condition Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 161/547] media: imon: fix use-after-free in display_close via dev_dbg Greg Kroah-Hartman
` (395 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+832ce9fa3face1b7d44d,
Anuj Bolewar, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anuj Bolewar <bolewara@gmail.com>
commit 6802ad4b6b267dda02209b5811edac7825c8a5f6 upstream.
hackrf_alloc_urbs() frees the URBs it allocated so far when one
allocation fails, but leaves the entries in dev->urb_list[] and
dev->urbs_initialized untouched. The caller, hackrf_start_streaming(),
then calls hackrf_free_urbs() on the error path, which walks
dev->urbs_initialized entries and calls usb_free_urb() a second time on
the already-freed URBs, causing a use-after-free (slab-use-after-free
Write in usb_free_urb()).
Drop the redundant cleanup loop inside hackrf_alloc_urbs() and let
hackrf_free_urbs(), which the caller already invokes on error, own the
cleanup of the successfully allocated URBs.
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Fixes: 969ec1f6bd92 ("[media] hackrf: HackRF SDR driver")
Cc: stable@vger.kernel.org
Signed-off-by: Anuj Bolewar <bolewara@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/hackrf/hackrf.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -665,7 +665,7 @@ static int hackrf_free_urbs(struct hackr
static int hackrf_alloc_urbs(struct hackrf_dev *dev, bool rcv)
{
- int i, j;
+ int i;
unsigned int pipe;
usb_complete_t complete;
@@ -681,11 +681,8 @@ static int hackrf_alloc_urbs(struct hack
for (i = 0; i < MAX_BULK_BUFS; i++) {
dev_dbg(dev->dev, "alloc urb=%d\n", i);
dev->urb_list[i] = usb_alloc_urb(0, GFP_KERNEL);
- if (!dev->urb_list[i]) {
- for (j = 0; j < i; j++)
- usb_free_urb(dev->urb_list[j]);
+ if (!dev->urb_list[i])
return -ENOMEM;
- }
usb_fill_bulk_urb(dev->urb_list[i],
dev->udev,
pipe,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 161/547] media: imon: fix use-after-free in display_close via dev_dbg
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 160/547] media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 162/547] media: ipu-bridge: Fix use-after-free in IVSC error path Greg Kroah-Hartman
` (394 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9bfac891bdd42eb708fc,
Deepanshu Kartikey, Sean Young
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 118a3590a4080c71c565265b05b3f92e814d7647 upstream.
ictx->dev is a raw pointer to the usb_interface's embedded device.
On disconnect, usb_disconnect() can drop the last reference on the
interface and free it while a userspace fd for /dev/lcd0 is still
open. When that fd is later closed, display_close() dereferences
the now-freed ictx->dev via dev_dbg(), causing a use-after-free.
Remove the dev_dbg() calls that dereference ictx->dev in
display_close() and free_imon_context(), rather than taking a
reference on the device.
Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
Link: https://lore.kernel.org/all/20260918054851.26083-1-kartikey406@gmail.com/T/ [v1]
Link: https://lore.kernel.org/all/20260928121230.35359-1-kartikey406@gmail.com/T/ [v2]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/imon.c | 5 -----
1 file changed, 5 deletions(-)
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -492,16 +492,12 @@ MODULE_PARM_DESC(pad_thresh, "Threshold
static void free_imon_context(struct imon_context *ictx)
{
- struct device *dev = ictx->dev;
-
usb_free_urb(ictx->tx_urb);
WARN_ON(ictx->dev_present_intf0);
usb_free_urb(ictx->rx_urb_intf0);
WARN_ON(ictx->dev_present_intf1);
usb_free_urb(ictx->rx_urb_intf1);
kfree_rcu(ictx, rcu);
-
- dev_dbg(dev, "%s: iMON context freed\n", __func__);
}
/*
@@ -577,7 +573,6 @@ static int display_close(struct inode *i
retval = -EIO;
} else {
ictx->display_isopen = false;
- dev_dbg(ictx->dev, "display port closed\n");
}
mutex_unlock(&ictx->lock);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 162/547] media: ipu-bridge: Fix use-after-free in IVSC error path
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 161/547] media: imon: fix use-after-free in display_close via dev_dbg Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 163/547] mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte() Greg Kroah-Hartman
` (393 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yibo Tan, Sakari Ailus
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yibo Tan <lhfff@tju.edu.cn>
commit 3d42d1c82717f0853379b516a7fab54b636e09cc upstream.
ipu_bridge_get_ivsc_acpi_dev() returns an ACPI device with a reference
held. If no matching CSI device is found, ipu_bridge_check_ivsc_dev()
drops that reference before passing the device to dev_err(). Concurrent
CSI device and ACPI namespace removal can drop the other references,
making this the final put. dev_err() then reads the freed struct
acpi_device and its kobject name.
This was reproduced without kprobes by racing normal CSI platform-device
unregistration and ACPI configfs table removal against the production
ipu_bridge_init() entry. KASAN reported the final free through
device_release(), followed by invalid reads through _dev_err().
Emit the error message while the lookup reference is still held, then
drop the reference as before.
Source reproducers and vulnerable/fixed serial logs, with only the build
hostname redacted, are available at:
https://github.com/kimaiden1984-boop/linux-ipu-bridge-acpi-uaf-reproducer
The fixed target builds with W=1 on x86-64. This was not tested on
physical IPU hardware. The tests establish runtime reachability but do
not measure occurrence frequency on shipping systems or establish
exploitability.
Fixes: c66821f381ae ("media: pci: intel: Add IVSC support for IPU bridge driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/intel/ipu-bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/pci/intel/ipu-bridge.c
+++ b/drivers/media/pci/intel/ipu-bridge.c
@@ -326,8 +326,8 @@ static int ipu_bridge_check_ivsc_dev(str
if (adev) {
csi_dev = ipu_bridge_get_ivsc_csi_dev(adev);
if (!csi_dev) {
- acpi_dev_put(adev);
dev_err(ADEV_DEV(adev), "Failed to find MEI or CVS CSI dev\n");
+ acpi_dev_put(adev);
return -ENODEV;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 163/547] mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 162/547] media: ipu-bridge: Fix use-after-free in IVSC error path Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 164/547] mm/hugetlb: fix use-after-free of a new anon folio Greg Kroah-Hartman
` (392 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Andrew Morton, Lorenzo Stoakes (ARM), Muchun Song, Lance Yang,
Liam R. Howlett, Vlastimil Babka, Jann Horn, Pedro Falcato,
Oscar Salvador, Miaohe Lin, Naoya Horiguchi, Adam Litke,
Mel Gorman, Rik van Riel, Peter Xu, Kiryl Shutsemau,
Mike Rapoport, Josef Bacik
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Arm) <david@kernel.org>
commit d8a9cd7fd2fb01211430c933932da58839b8ca65 upstream.
Let's fix another instance where we use a folio after dropping the PTL,
where someone else could e.g., MADV_DONTNEED it once we drop the PTL,
making us trigger a use-after-free on the folio.
Link: https://lore.kernel.org/20261015-urgent_fixes-v1-3-42796911043b@kernel.org
Fixes: cb6acd01e2e4 ("hugetlbfs: fix races and page leaks during migration")
Fixes: 1c9e8def43a3 ("userfaultfd: hugetlbfs: add UFFDIO_COPY support for shared mappings")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6474,11 +6474,16 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_
/* No need to invalidate - it was non-present before */
update_mmu_cache(dst_vma, dst_addr, dst_pte);
- spin_unlock(ptl);
if (!is_continue)
folio_set_hugetlb_migratable(folio);
if (vm_shared || is_continue)
folio_unlock(folio);
+
+ /*
+ * Hold the PTL until we're done with the folio: the page table owns the
+ * folio reference now.
+ */
+ spin_unlock(ptl);
ret = 0;
out:
return ret;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 164/547] mm/hugetlb: fix use-after-free of a new anon folio
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 163/547] mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 165/547] apparmor: fix a use-after-free in aa_lookupn_ns() Greg Kroah-Hartman
` (391 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, David Hildenbrand (Arm),
Andrew Morton, Lorenzo Stoakes (ARM), Muchun Song, Lance Yang,
Liam R. Howlett, Vlastimil Babka, Jann Horn, Pedro Falcato,
Oscar Salvador, Miaohe Lin, Naoya Horiguchi, Adam Litke,
Mel Gorman, Rik van Riel, Peter Xu, Kiryl Shutsemau,
Mike Rapoport
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
commit 824cc56bf43c714319992bad3558803cac6e77c0 upstream.
For a fault in a private mapping with nothing in the page cache,
hugetlb_no_page() allocates a folio, locks it and maps it. The folio has
one reference, which belongs to the page table entry from then on. After
dropping the page table lock the function still sets the migratable flag
of the folio and unlocks it.
Whoever zaps the entry in between frees the folio. The fault holds the
fault mutex and the lock of the vma. MADV_DONTNEED and the first unmap of
a hole punch, hugetlb_vmdelete_list(), do not take the fault mutex, and a
private vma only has a lock if it owns a reservation map: not with
MAP_NORESERVE, and not in the child after fork().
Then the flag is set in, and folio_unlock() is called on, a folio that is
free or has a new owner. A surplus page goes back to the page allocator
while it is locked:
BUG: Bad page state in process init pfn:108e00
flags: 0x200000000000059(locked|uptodate|dirty|head|node=0|zone=2)
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
A page of the pool can be given to the next user, of any file, who locks
it and loses the lock to the late folio_unlock():
kernel BUG at mm/filemap.c:1532!
hugetlb_no_page+0x111b/0x23e0
hugetlb_fault+0x3a9/0x14a0
An unprivileged process is enough: threads that write to a MAP_PRIVATE |
MAP_NORESERVE hugetlb mapping, threads that call MADV_DONTNEED on it, and
one that takes the freed pages for another file.
Until commit 3a47c54f09c4 ("hugetlbfs: revert use i_mmap_rwsem for more
pmd sharing synchronization") the fault held i_mmap_rwsem for reading,
which everybody who zaps takes for writing. The lock that commit
bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs") gave
to private vmas closed the window again, but only for those with a
reservation map.
Be done with the folio before the page table lock is dropped, as
hugetlb_wp() is with its copy. The function already unlocks page cache
folios under that lock.
Original fix generated by an LLM and sent in private by Josef.
[david@kernel.org: simplify+move comment]
Link: https://lore.kernel.org/20261015-urgent_fixes-v1-2-42796911043b@kernel.org
Fixes: 3a47c54f09c4 ("hugetlbfs: revert use i_mmap_rwsem for more pmd sharing synchronization")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5949,8 +5949,6 @@ static vm_fault_t hugetlb_no_page(struct
ret = hugetlb_wp(vmf);
}
- spin_unlock(vmf->ptl);
-
/*
* Only set hugetlb_migratable in newly allocated pages. Existing pages
* found in the pagecache may not have hugetlb_migratable if they have
@@ -5961,6 +5959,12 @@ static vm_fault_t hugetlb_no_page(struct
if (folio_locked)
folio_unlock(folio);
+
+ /*
+ * Hold the PTL until we're done with the folio: the page table owns the
+ * folio reference now.
+ */
+ spin_unlock(vmf->ptl);
out:
hugetlb_vma_unlock_read(vma);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 165/547] apparmor: fix a use-after-free in aa_lookupn_ns()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 164/547] mm/hugetlb: fix use-after-free of a new anon folio Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 166/547] ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c() Greg Kroah-Hartman
` (390 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Binbin Deng, John Johansen
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Deng <18983559317@163.com>
commit f292873ceb4bd3a1a0f75f884361cd556e457692 upstream.
aa_lookupn_ns() takes a reference on the namespace it finds with
aa_get_ns(), which is kref_get() on the reference count that the
namespace is released through, without checking whether the namespace
is still in use. A concurrent removal of a ":"-prefixed namespace
looks the same namespace up and only then takes the parent lock to
remove it, so the last reference can be dropped between the lookup and
the aa_get_ns() call: the reference count then reports the increment on
a zero count and the kernel classifies the following use of the object
as a use-after-free. A user with CAP_MAC_ADMIN can trigger this by
writing a ":<name>" removal and a ":<name>/<profile>" removal to
/sys/kernel/security/apparmor/.remove concurrently.
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0xc0/0xe0, CPU#6
Call Trace:
<TASK>
aa_lookupn_ns+0xa9/0xc0
aa_remove_profiles+0x4fb/0x730
? __kvmalloc_node_noprof+0x219/0x5c0
? __pfx_aa_remove_profiles+0x10/0x10
? aa_loaddata_alloc+0x65/0x1f0
? _copy_from_user+0x2d/0x80
? aa_loaddata_alloc+0x111/0x1f0
profile_remove+0x2ee/0x4a0
vfs_write+0x21e/0xcf0
? rcu_core+0x29c/0x1740
? timerqueue_linked_add+0x1f4/0x3d0
? __pfx_vfs_write+0x10/0x10
? mutex_lock+0x81/0xe0
? __pfx_mutex_lock+0x10/0x10
? __pfx_rcu_core+0x10/0x10
? __pfx_hrtimer_update_next_event+0x10/0x10
? mutex_unlock+0x7b/0xd0
? fdget_pos+0x24d/0x4b0
ksys_write+0xf7/0x1c0
? __pfx_ksys_write+0x10/0x10
? restore_fpregs_from_fpstate+0x37/0xc0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Fix by rejecting a namespace whose reference count is zero.
Fixes: 3664268f19ea0 ("apparmor: add namespace lookup fns()")
Cc: stable@vger.kernel.org
Signed-off-by: Binbin Deng <18983559317@163.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/include/policy_ns.h | 16 ++++++++++++++++
security/apparmor/policy_ns.c | 2 +-
2 files changed, 17 insertions(+), 1 deletion(-)
--- a/security/apparmor/include/policy_ns.h
+++ b/security/apparmor/include/policy_ns.h
@@ -118,6 +118,22 @@ static inline struct aa_ns *aa_get_ns(st
}
/**
+ * aa_get_ns_not0 - increment references count on @ns found via lookup
+ * @ns: namespace to increment reference count of (MAYBE NULL)
+ *
+ * Returns: pointer to @ns, if @ns is NULL returns NULL,
+ * NULL if @ns is being freed
+ * Requires: @ns must be held with valid refcount when called
+ */
+static inline struct aa_ns *aa_get_ns_not0(struct aa_ns *ns)
+{
+ if (ns && aa_get_profile_not0(ns->unconfined))
+ return ns;
+
+ return NULL;
+}
+
+/**
* aa_put_ns - decrement refcount on @ns
* @ns: namespace to put reference of
*
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -207,7 +207,7 @@ struct aa_ns *aa_lookupn_ns(struct aa_ns
struct aa_ns *ns = NULL;
rcu_read_lock();
- ns = aa_get_ns(__aa_lookupn_ns(view, name, n));
+ ns = aa_get_ns_not0(__aa_lookupn_ns(view, name, n));
rcu_read_unlock();
return ns;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 166/547] ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 165/547] apparmor: fix a use-after-free in aa_lookupn_ns() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 167/547] ata: sata_fsl: Fix use-after-free of host_priv on probe() failure Greg Kroah-Hartman
` (389 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Kuninori Morimoto,
Mark Brown
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 5ea495bccfd746b063bc6702064f167467717b41 upstream.
of_graph_get_next_port() consumes the reference of its prev argument.
port0 is only borrowed from the caller's iterator, so the call drops a
reference the function does not own, and port0 is dereferenced again
afterwards. Pass an extra reference, as graph_count_c2c() does, so the
reference the callee consumes is the one taken here.
Fixes: 5f281c3e82b1 ("ASoC: audio-graph-card2: use __free(device_node) for device node")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/20260917165851.2163548-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/generic/audio-graph-card2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/soc/generic/audio-graph-card2.c
+++ b/sound/soc/generic/audio-graph-card2.c
@@ -969,7 +969,8 @@ int audio_graph2_link_c2c(struct simple_
struct snd_soc_dai_link *dai_link = simple_priv_to_link(priv, li->link);
struct device_node *port0 = lnk;
struct device_node *ports __free(device_node) = port_to_ports(port0);
- struct device_node *port1 __free(device_node) = of_graph_get_next_port(ports, port0);
+ struct device_node *port1 __free(device_node) =
+ of_graph_get_next_port(ports, of_node_get(port0));
u32 val = 0;
int ret = -EINVAL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 167/547] ata: sata_fsl: Fix use-after-free of host_priv on probe() failure
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 166/547] ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 168/547] drm/msm: Fix vm_bo use-after-free in with_vm_locks() Greg Kroah-Hartman
` (388 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 70b1196740d61aabda13b2ad0e9c1dfa2ef9cfa3 upstream.
sata_fsl_host_stop() releases hcr_base and host_priv:
static void sata_fsl_host_stop(struct ata_host *host)
{
struct sata_fsl_host_priv *host_priv = host->private_data;
iounmap(host_priv->hcr_base);
kfree(host_priv);
}
->host_stop() is called by the driver core through the ata_host_stop()
devres action which ata_host_start() registers, so it is called both when
the device is unbound and when probe() fails after the host has been
started.
The error_exit_with_cleanup label of sata_fsl_probe() releases hcr_base
and host_priv as well, and it is reachable from the two
device_create_file() calls which are done after the host has been
activated. In that case sata_fsl_host_stop() runs on an already freed
host_priv, resulting in a use-after-free and a double iounmap()/kfree().
Add a separate error label for the failures happening after the host has
been activated, which only detaches the host and leaves hcr_base and
host_priv to sata_fsl_host_stop().
Note that ata_host_detach() is dropped from error_exit_with_cleanup, as
that label is now only reachable while host is still NULL.
Fixes: 6c8ad7e8cf29 ("sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-11-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/sata_fsl.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1500,7 +1500,7 @@ static int sata_fsl_probe(struct platfor
host_priv->intr_coalescing.attr.mode = S_IRUGO | S_IWUSR;
retval = device_create_file(host->dev, &host_priv->intr_coalescing);
if (retval)
- goto error_exit_with_cleanup;
+ goto error_exit_detach;
host_priv->rx_watermark.show = fsl_sata_rx_watermark_show;
host_priv->rx_watermark.store = fsl_sata_rx_watermark_store;
@@ -1510,16 +1510,24 @@ static int sata_fsl_probe(struct platfor
retval = device_create_file(host->dev, &host_priv->rx_watermark);
if (retval) {
device_remove_file(&ofdev->dev, &host_priv->intr_coalescing);
- goto error_exit_with_cleanup;
+ goto error_exit_detach;
}
return 0;
-error_exit_with_cleanup:
+error_exit_detach:
+ /*
+ * Once the host has been activated, hcr_base and host_priv are
+ * released by sata_fsl_host_stop(), which is called by the driver core
+ * through the ata_host_stop() devres action registered by
+ * ata_host_start(). Releasing them here as well would result in a
+ * double iounmap() and a use-after-free.
+ */
+ ata_host_detach(host);
- if (host)
- ata_host_detach(host);
+ return retval;
+error_exit_with_cleanup:
if (hcr_base)
iounmap(hcr_base);
kfree(host_priv);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 168/547] drm/msm: Fix vm_bo use-after-free in with_vm_locks()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 167/547] ata: sata_fsl: Fix use-after-free of host_priv on probe() failure Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 169/547] s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup Greg Kroah-Hartman
` (387 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Rob Clark
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 81878aa1a2f551f51a3d3aef2a9509503ec34d8b upstream.
The unwind loop drops the vm_bo reference taken while locking before
advancing to the next entry. drm_gpuvm_bo_put() may drop the last
reference, removing and freeing the vm_bo, after which the plain list
iterator dereferences freed memory to advance.
Use the safe iterator, which saves the next entry before the body runs.
Fixes: fe4952b5f27cca5d ("drm/msm: Convert vm locking")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Patchwork: https://patchwork.freedesktop.org/patch/754331/
Message-ID: <20260916175548.2089821-1-vulab@iscas.ac.cn>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/msm_gem_shrinker.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/msm/msm_gem_shrinker.c
+++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c
@@ -51,6 +51,7 @@ with_vm_locks(void (*fn)(struct drm_gem_
* success paths
*/
struct drm_gpuvm_bo *vm_bo, *last_locked = NULL;
+ struct drm_gpuvm_bo *next;
bool locked = true;
drm_gem_for_each_gpuvm_bo (vm_bo, obj) {
@@ -82,7 +83,7 @@ with_vm_locks(void (*fn)(struct drm_gem_
out_unlock:
if (last_locked) {
- drm_gem_for_each_gpuvm_bo (vm_bo, obj) {
+ drm_gem_for_each_gpuvm_bo_safe(vm_bo, next, obj) {
struct dma_resv *resv = drm_gpuvm_resv(vm_bo->vm);
if (resv == obj->resv)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 169/547] s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 168/547] drm/msm: Fix vm_bo use-after-free in with_vm_locks() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 170/547] s390/pci: Fix MSI directed-mode teardown IRQ bit count Greg Kroah-Hartman
` (386 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Schnelle, Tobias Schumacher,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schumacher <ts@linux.ibm.com>
commit 31c66bd273303590fe69fad370e72a12faa0bf76 upstream.
zpci_remove_parent_msi_domain() dereferences zbus->msi_parent_domain
unconditionally and does not clear it afterwards.
zpci_bus_create_pci_bus() removes the domain when pci_create_root_bus()
fails, then zpci_bus_release() removes it again on the last kref_put(),
reading ->fwnode from the freed irq_domain and freeing it twice.
If zpci_alloc_domain() or zpci_create_parent_msi_domain() fails, no domain
is created at all; zbus is kzalloc'd, so the same release path dereferences
NULL.
Return early when there is no domain, and clear the pointer after removing
one.
Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_irq.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -533,9 +533,13 @@ void zpci_remove_parent_msi_domain(struc
{
struct fwnode_handle *fn;
+ if (!zbus->msi_parent_domain)
+ return;
+
fn = zbus->msi_parent_domain->fwnode;
irq_domain_remove(zbus->msi_parent_domain);
irq_domain_free_fwnode(fn);
+ zbus->msi_parent_domain = NULL;
}
static void __init cpu_enable_directed_irq(void *unused)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 170/547] s390/pci: Fix MSI directed-mode teardown IRQ bit count
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 169/547] s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 171/547] s390/pci: Fix resource leak in zpci MSI setup Greg Kroah-Hartman
` (385 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Schnelle, Tobias Schumacher,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schumacher <ts@linux.ibm.com>
commit 1844913582fec337c54b54fdd3c92ce225930515 upstream.
On s390 with directed interrupts enabled, zpci_msi_teardown_directed()
frees the platform's maximum number of MSI bits (zdev->max_msi) instead
of the actual allocated count (zdev->msi_nr_irqs). This corrupts the
shared IRQ bitmap used by all PCI functions, causing lost interrupts and
heap corruption. Fix zpci_msi_teardown_directed() to only free the
actual allocated IRQ bit count.
Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_irq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -339,7 +339,7 @@ static struct airq_struct zpci_airq = {
static void zpci_msi_teardown_directed(struct zpci_dev *zdev)
{
- airq_iv_free(zpci_ibv[0], zdev->msi_first_bit, zdev->max_msi);
+ airq_iv_free(zpci_ibv[0], zdev->msi_first_bit, zdev->msi_nr_irqs);
zdev->msi_first_bit = -1U;
zdev->msi_nr_irqs = 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 171/547] s390/pci: Fix resource leak in zpci MSI setup
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 170/547] s390/pci: Fix MSI directed-mode teardown IRQ bit count Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 172/547] s390/pci: Fix use-after-free race in zpci floating interrupt cleanup Greg Kroah-Hartman
` (384 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Schnelle, Tobias Schumacher,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schumacher <ts@linux.ibm.com>
commit 4a185d99179a307d856dc43610cfe72395d0c42a upstream.
If airq_iv_create() fails in __alloc_airq(), the zpci_sbv bit allocated
by airq_iv_alloc_bit() is never freed. This permanently leaks one of the
ZPCI_NR_DEVICES summary bits, reducing system capacity with each failed
device hotplug. In systems with repeated device insertion failures or
under memory pressure, all summary bits can be exhausted, preventing new
PCI devices from being added until reboot.
Add proper error handling to free the zpci_sbv bit and reset zdev->aisb
if the AIBV creation fails.
Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_irq.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index c9520a16ca75..134f8f4a5cfa 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -313,8 +313,11 @@ static int __alloc_airq(struct zpci_dev *zdev, int msi_vecs,
zdev->aibv = airq_iv_create(msi_vecs,
AIRQ_IV_PTR | AIRQ_IV_DATA | AIRQ_IV_BITLOCK,
NULL);
- if (!zdev->aibv)
+ if (!zdev->aibv) {
+ airq_iv_free_bit(zpci_sbv, *bit);
+ zdev->aisb = -1UL;
return -ENOMEM;
+ }
/* Wire up shortcut pointer */
zpci_ibv[*bit] = zdev->aibv;
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 172/547] s390/pci: Fix use-after-free race in zpci floating interrupt cleanup
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 171/547] s390/pci: Fix resource leak in zpci MSI setup Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 173/547] s390/pci: Add error cleanup in zpci_directed_irq_init() Greg Kroah-Hartman
` (383 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tobias Schumacher, Niklas Schnelle,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schumacher <ts@linux.ibm.com>
commit 422d75ad5bc96b8eb9cb3cfd9d68fc685a0a9b75 upstream.
zpci_clear_irq() stops the adapter from raising new interrupts for the
function, but a zpci_floating_irq_handler() already running on another CPU
can still be scanning zdev->aibv when zpci_msi_teardown_floating() releases
it.
Clear the zpci_ibv[] entry so no further handler picks the vector up, then
wait for a grace period before releasing it. The handler runs inside the
rcu_read_lock() section that do_airq_interrupt() holds across
airq->handler(), so synchronize_rcu() drains any handler still in flight.
Release the vector and free the summary bit only after the grace period, so
neither can be reused while a reader still holds the old pointer.
zpci_ibv served both delivery modes, indexed by function under
FLOATING and by cpu under DIRECTED. Only the floating vectors are
published to and torn down under the interrupt handler, so split the
directed vectors out into zpci_dibv and annotate zpci_ibv __rcu, which
lets sparse check the accessors above.
Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_irq.c | 58 +++++++++++++++++++++++------------------
1 file changed, 32 insertions(+), 26 deletions(-)
diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index d5763c5feb09..c5fabad38139 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -22,12 +22,11 @@ static enum {FLOATING, DIRECTED} irq_delivery;
*/
static struct airq_iv *zpci_sbv;
-/*
- * interrupt bit vectors
- * FLOATING - interrupt bit vector per function
- * DIRECTED - interrupt bit vector per cpu
- */
-static struct airq_iv **zpci_ibv;
+/* FLOATING - interrupt bit vector per function */
+static struct airq_iv __rcu **zpci_ibv;
+
+/* DIRECTED - interrupt bit vector per cpu */
+static struct airq_iv **zpci_dibv;
/* Modify PCI: Register floating adapter interruptions */
static int zpci_set_airq(struct zpci_dev *zdev)
@@ -169,7 +168,7 @@ static struct irq_chip zpci_irq_chip = {
static void zpci_handle_cpu_local_irq(bool rescan)
{
- struct airq_iv *dibv = zpci_ibv[smp_processor_id()];
+ struct airq_iv *dibv = zpci_dibv[smp_processor_id()];
union zpci_sic_iib iib = {{0}};
struct irq_domain *msi_domain;
irq_hw_number_t hwirq;
@@ -279,7 +278,9 @@ static void zpci_floating_irq_handler(struct airq_struct *airq,
}
/* Scan the adapter interrupt vector for this device. */
- aibv = zpci_ibv[si];
+ aibv = rcu_dereference(zpci_ibv[si]);
+ if (!aibv)
+ continue;
for (ai = 0;;) {
ai = airq_iv_scan(aibv, ai, airq_iv_end(aibv));
if (ai == -1UL)
@@ -299,7 +300,7 @@ static int __alloc_airq(struct zpci_dev *zdev, int msi_vecs,
{
if (irq_delivery == DIRECTED) {
/* Allocate cpu vector bits */
- *bit = airq_iv_alloc(zpci_ibv[0], msi_vecs);
+ *bit = airq_iv_alloc(zpci_dibv[0], msi_vecs);
if (*bit == -1UL)
return -EIO;
} else {
@@ -320,7 +321,7 @@ static int __alloc_airq(struct zpci_dev *zdev, int msi_vecs,
}
/* Wire up shortcut pointer */
- zpci_ibv[*bit] = zdev->aibv;
+ rcu_assign_pointer(zpci_ibv[*bit], zdev->aibv);
/* Each function has its own interrupt vector */
*bit = 0;
}
@@ -342,13 +343,16 @@ static struct airq_struct zpci_airq = {
static void zpci_msi_teardown_directed(struct zpci_dev *zdev)
{
- airq_iv_free(zpci_ibv[0], zdev->msi_first_bit, zdev->msi_nr_irqs);
+ airq_iv_free(zpci_dibv[0], zdev->msi_first_bit, zdev->msi_nr_irqs);
zdev->msi_first_bit = -1U;
zdev->msi_nr_irqs = 0;
}
static void zpci_msi_teardown_floating(struct zpci_dev *zdev)
{
+ rcu_assign_pointer(zpci_ibv[zdev->aisb], NULL);
+ synchronize_rcu();
+
airq_iv_release(zdev->aibv);
zdev->aibv = NULL;
airq_iv_free_bit(zpci_sbv, zdev->aisb);
@@ -428,9 +432,9 @@ static int zpci_msi_domain_alloc(struct irq_domain *domain, unsigned int virq,
if (irq_delivery == DIRECTED) {
for_each_possible_cpu(cpu) {
- airq_iv_set_ptr(zpci_ibv[cpu], bit + i,
+ airq_iv_set_ptr(zpci_dibv[cpu], bit + i,
(unsigned long)zbus->msi_parent_domain);
- airq_iv_set_data(zpci_ibv[cpu], bit + i, hwirq + i);
+ airq_iv_set_data(zpci_dibv[cpu], bit + i, hwirq + i);
}
} else {
airq_iv_set_ptr(zdev->aibv, bit + i,
@@ -455,8 +459,8 @@ static void zpci_msi_clear_airq(struct irq_data *d, int i)
if (irq_delivery == DIRECTED) {
for_each_possible_cpu(cpu) {
- airq_iv_set_ptr(zpci_ibv[cpu], bit + i, 0);
- airq_iv_set_data(zpci_ibv[cpu], bit + i, 0);
+ airq_iv_set_ptr(zpci_dibv[cpu], bit + i, 0);
+ airq_iv_set_data(zpci_dibv[cpu], bit + i, 0);
}
} else {
airq_iv_set_ptr(zdev->aibv, bit + i, 0);
@@ -550,7 +554,7 @@ static void __init cpu_enable_directed_irq(void *unused)
union zpci_sic_iib iib = {{0}};
union zpci_sic_iib ziib = {{0}};
- iib.cdiib.dibv_addr = virt_to_phys(zpci_ibv[smp_processor_id()]->vector);
+ iib.cdiib.dibv_addr = virt_to_phys(zpci_dibv[smp_processor_id()]->vector);
zpci_set_irq_ctrl(SIC_IRQ_MODE_SET_CPU, 0, &iib);
zpci_set_irq_ctrl(SIC_IRQ_MODE_D_SINGLE, PCI_ISC, &ziib);
@@ -570,8 +574,8 @@ static int __init zpci_directed_irq_init(void)
iib.diib.disb_addr = virt_to_phys(zpci_sbv->vector);
zpci_set_irq_ctrl(SIC_IRQ_MODE_DIRECT, 0, &iib);
- zpci_ibv = kzalloc_objs(*zpci_ibv, num_possible_cpus());
- if (!zpci_ibv)
+ zpci_dibv = kzalloc_objs(*zpci_dibv, num_possible_cpus());
+ if (!zpci_dibv)
return -ENOMEM;
for_each_possible_cpu(cpu) {
@@ -579,12 +583,12 @@ static int __init zpci_directed_irq_init(void)
* Per CPU IRQ vectors look the same but bit-allocation
* is only done on the first vector.
*/
- zpci_ibv[cpu] = airq_iv_create(cache_line_size() * BITS_PER_BYTE,
- AIRQ_IV_PTR |
- AIRQ_IV_DATA |
- AIRQ_IV_CACHELINE |
- (!cpu ? AIRQ_IV_ALLOC : 0), NULL);
- if (!zpci_ibv[cpu])
+ zpci_dibv[cpu] = airq_iv_create(cache_line_size() * BITS_PER_BYTE,
+ AIRQ_IV_PTR |
+ AIRQ_IV_DATA |
+ AIRQ_IV_CACHELINE |
+ (!cpu ? AIRQ_IV_ALLOC : 0), NULL);
+ if (!zpci_dibv[cpu])
return -ENOMEM;
}
on_each_cpu(cpu_enable_directed_irq, NULL, 1);
@@ -660,10 +664,12 @@ void __init zpci_irq_exit(void)
if (irq_delivery == DIRECTED) {
for_each_possible_cpu(cpu) {
- airq_iv_release(zpci_ibv[cpu]);
+ airq_iv_release(zpci_dibv[cpu]);
}
+ kfree(zpci_dibv);
+ } else {
+ kfree(zpci_ibv);
}
- kfree(zpci_ibv);
if (zpci_sbv)
airq_iv_release(zpci_sbv);
unregister_adapter_interrupt(&zpci_airq);
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 173/547] s390/pci: Add error cleanup in zpci_directed_irq_init()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 172/547] s390/pci: Fix use-after-free race in zpci floating interrupt cleanup Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 174/547] s390/cpum_cf: Check session mask before cpu offline Greg Kroah-Hartman
` (382 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tobias Schumacher, Niklas Schnelle,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schumacher <ts@linux.ibm.com>
commit 769f66f595c11185c66913ea5d96420504bfebc3 upstream.
If per-CPU airq_iv allocation fails in the loop, previously allocated
vectors and arrays leak. Add proper error path to release all resources
on failure.
The error path frees zpci_sbv, but SIC_IRQ_MODE_DIRECT has already
programmed its address into the hardware. Set the directed interrupt
mode only after all allocations have succeeded, so a failed init leaves
no freed memory registered with the hardware.
Fixes: e979ce7bced2 ("s390/pci: provide support for CPU directed interrupts")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_irq.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index c5fabad38139..bcf11585df8d 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -569,14 +569,9 @@ static int __init zpci_directed_irq_init(void)
if (!zpci_sbv)
return -ENOMEM;
- iib.diib.isc = PCI_ISC;
- iib.diib.nr_cpus = num_possible_cpus();
- iib.diib.disb_addr = virt_to_phys(zpci_sbv->vector);
- zpci_set_irq_ctrl(SIC_IRQ_MODE_DIRECT, 0, &iib);
-
zpci_dibv = kzalloc_objs(*zpci_dibv, num_possible_cpus());
if (!zpci_dibv)
- return -ENOMEM;
+ goto out_free_sbv;
for_each_possible_cpu(cpu) {
/*
@@ -589,13 +584,30 @@ static int __init zpci_directed_irq_init(void)
AIRQ_IV_CACHELINE |
(!cpu ? AIRQ_IV_ALLOC : 0), NULL);
if (!zpci_dibv[cpu])
- return -ENOMEM;
+ goto out_free_dibv;
}
+
+ iib.diib.isc = PCI_ISC;
+ iib.diib.nr_cpus = num_possible_cpus();
+ iib.diib.disb_addr = virt_to_phys(zpci_sbv->vector);
+ zpci_set_irq_ctrl(SIC_IRQ_MODE_DIRECT, 0, &iib);
on_each_cpu(cpu_enable_directed_irq, NULL, 1);
zpci_irq_chip.irq_set_affinity = zpci_set_irq_affinity;
return 0;
+
+out_free_dibv:
+ for_each_possible_cpu(cpu) {
+ if (zpci_dibv[cpu])
+ airq_iv_release(zpci_dibv[cpu]);
+ }
+ kfree(zpci_dibv);
+ zpci_dibv = NULL;
+out_free_sbv:
+ airq_iv_release(zpci_sbv);
+ zpci_sbv = NULL;
+ return -ENOMEM;
}
static int __init zpci_floating_irq_init(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 174/547] s390/cpum_cf: Check session mask before cpu offline
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 173/547] s390/pci: Add error cleanup in zpci_directed_irq_init() Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 175/547] s390/extable: Fix mvcos instruction decoding Greg Kroah-Hartman
` (381 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Sumanth Korikkar, Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumanth Korikkar <sumanthk@linux.ibm.com>
commit 99a95985dfc85eecad97f0991a2401d2fcef294c upstream.
cfset_offline_cpu() stops counter sets for every active session without
checking whether the outgoing cpu belongs to the session mask.
For example, run an hwctr session on cpu0 and a cpu bound perf event on
cpu1:
lshwc -l 9999 -i 5 0:b
perf stat -C 1 -e cpum_cf/CPU_CYCLES/ sleep 120
chcpu -d 1
chcpu -e 1
Although the hwctr session does not include cpu1, cfset_offline_cpu()
decrements its counter set reference count. The subsequent perf teardown
decrements it again, causing it to underflow.
The perf event keeps the percpu state alive across hotplug. When cpu1
comes online, the hwctr session is started there and the reference count
moves from -1 to 0. Stopping the hwctr session then decrements it to -1
again, so the zero triggered counter set disable path is skipped.
Check the session mask before stopping counter sets on the outgoing cpu.
This prevents the unmatched decrement and the resulting reference count
underflow.
Fixes: a029a4eab39e ("s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/perf_cpum_cf.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -1797,6 +1797,9 @@ static int cfset_offline_cpu(unsigned in
if (!list_empty(&cfset_session.head)) {
list_for_each_entry(rp, &cfset_session.head, node) {
+ if (!cpumask_test_cpu(cpu, &rp->mask))
+ continue;
+
p.sets = rp->ctrset;
cfset_ioctl_off(&p);
cpumask_clear_cpu(cpu, &rp->mask);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 175/547] s390/extable: Fix mvcos instruction decoding
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 174/547] s390/cpum_cf: Check session mask before cpu offline Greg Kroah-Hartman
@ 2026-11-04 21:05 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 176/547] s390/kprobes: Prevent kprobes on instructions with exception table entry Greg Kroah-Hartman
` (380 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Schnelle, Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit 4044466ff004c7ad5fd47be717cd933077e6e874 upstream.
If either the b1 or b2 field of the mvcos instruction is zero, register
zero is not used for address computation; zero is used instead, according
to the architecture. ex_handler_ua_mvcos() incorrectly uses the real
contents of register zero. Fix this.
This shouldn't be a problem for any generated code, since the compiler
would only generate such code if it is possible to prove at compile time
that either the source or destination address is within the first 4kb of
the designated address space. Such code should not exist (also confirmed
by an allyesconfig build and decoding all ~7000 mvcos instructions).
Fixes: c488f5187a24 ("s390/uaccess: Shorten raw_copy_from_user() / raw_copy_to_user() inline assemblies")
Cc: stable@vger.kernel.org
Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/mm/extable.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/mm/extable.c
+++ b/arch/s390/mm/extable.c
@@ -106,9 +106,9 @@ static bool ex_handler_ua_mvcos(const st
regs->psw.addr = extable_fixup(ex);
insn = (struct insn_ssf *)regs->psw.addr;
if (from)
- uaddr = regs->gprs[insn->b2] + insn->d2;
+ uaddr = (insn->b2 ? regs->gprs[insn->b2] : 0) + insn->d2;
else
- uaddr = regs->gprs[insn->b1] + insn->d1;
+ uaddr = (insn->b1 ? regs->gprs[insn->b1] : 0) + insn->d1;
remainder = PAGE_SIZE - (uaddr & (PAGE_SIZE - 1));
if (regs->gprs[insn->r3] <= remainder)
remainder = 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 176/547] s390/kprobes: Prevent kprobes on instructions with exception table entry
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-11-04 21:05 ` [PATCH 7.3 175/547] s390/extable: Fix mvcos instruction decoding Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 177/547] s390/probes: Fix wrong opcode for cgrb fixup Greg Kroah-Hartman
` (379 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit fc9bb0ecd310b53af5116415952a1fb89d4660b9 upstream.
The mvcos exception handler ex_handler_ua_mvcos() decodes the faulting
instruction, assuming it is an mvcos instruction. In case the instruction
is kprobed the decoded instruction is a breakpoint instruction instead,
which leads to incorrect instruction decoding and potential register
corruption.
Fix this by simply preventing to set a kprobe on such instructions,
similar like arm64 is doing it.
Fixes: c488f5187a24 ("s390/uaccess: Shorten raw_copy_from_user() / raw_copy_to_user() inline assemblies")
Cc: stable@vger.kernel.org
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/kprobes.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -85,6 +85,9 @@ static bool can_probe(unsigned long padd
if (!kallsyms_lookup_size_offset(paddr, NULL, &offset))
return false;
+ if (s390_search_extables(paddr))
+ return false;
+
/* Decode instructions */
addr = paddr - offset;
while (addr < paddr) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 177/547] s390/probes: Fix wrong opcode for cgrb fixup
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 176/547] s390/kprobes: Prevent kprobes on instructions with exception table entry Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 178/547] s390/signal: Fix incorrect return address in signal frame Greg Kroah-Hartman
` (378 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit d7ccab11a13475e656b9d2277900422c1bfc12c5 upstream.
The last byte of the cgrb instruction is 0xe4, however the probes code
compares against 0xe6. Fix it.
Fixes: 6b169ac9b434 ("s390/kprobes: add support for compare and branch instructions")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/lib/probes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/lib/probes.c
+++ b/arch/s390/lib/probes.c
@@ -99,8 +99,8 @@ int probe_get_fixup_type(u16 *insn)
break;
case 0xec:
switch (insn[2] & 0xff) {
+ case 0xe4: /* cgrb */
case 0xe5: /* clgrb */
- case 0xe6: /* cgrb */
case 0xf6: /* crb */
case 0xf7: /* clrb */
case 0xfc: /* cgib */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 178/547] s390/signal: Fix incorrect return address in signal frame
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 177/547] s390/probes: Fix wrong opcode for cgrb fixup Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 179/547] s390/vmcp: Initialize full session info to zero Greg Kroah-Hartman
` (377 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit adc9e872f7350e3ac29c1818d8c68b0760b4ba23 upstream.
exit_to_user_mode_loop() can call arch_do_signal_or_restart() multiple
times when signals are pending.
If the first call set up a vDSO system call restart by saving the real
user return address and adjusting psw.addr so it points to the vDSO stub,
a second call builds the signal frame with the wrong return address.
Restore psw.addr from arch_data, and set the return code to -EINTR before
building the signal frame.
This requires restart_block.arch_data to be properly initialized for all
tasks. Move the initialization in copy_thread() in front of the kernel
thread check, so that it also covers kernel threads and their children
(PID 1, usermode helpers). Only PID 0 is left uninitialized, since it
never returns to user space.
Fixes: df29a7440c4b ("s390/signal: switch to using vdso for sigreturn and syscall restart")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/process.c | 12 ++++++------
arch/s390/kernel/signal.c | 6 +++++-
2 files changed, 11 insertions(+), 7 deletions(-)
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -131,6 +131,12 @@ int copy_thread(struct task_struct *p, c
p->thread.hardirq_timer = 0;
p->thread.softirq_timer = 0;
p->thread.last_break = 1;
+ /*
+ * s390 stores the svc return address in arch_data when calling
+ * sigreturn()/restart_syscall() via vdso. 1 means no valid address
+ * stored.
+ */
+ p->restart_block.arch_data = 1;
frame->sf.back_chain = 0;
frame->sf.gprs[11 - 6] = (unsigned long)&frame->childregs;
@@ -168,12 +174,6 @@ int copy_thread(struct task_struct *p, c
p->thread.acrs[0] = (unsigned int)(tls >> 32);
p->thread.acrs[1] = (unsigned int)tls;
}
- /*
- * s390 stores the svc return address in arch_data when calling
- * sigreturn()/restart_syscall() via vdso. 1 means no valid address
- * stored.
- */
- p->restart_block.arch_data = 1;
return 0;
}
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -475,7 +475,11 @@ void arch_do_signal_or_restart(struct pt
}
/* No longer in a system call */
clear_pt_regs_flag(regs, PIF_SYSCALL);
-
+ if (!(current->restart_block.arch_data & 1)) {
+ regs->psw.addr = current->restart_block.arch_data;
+ current->restart_block.arch_data = 1;
+ regs->gprs[2] = -EINTR;
+ }
rseq_signal_deliver(&ksig, regs);
handle_signal(&ksig, oldset, regs);
return;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 179/547] s390/vmcp: Initialize full session info to zero
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 178/547] s390/signal: Fix incorrect return address in signal frame Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 180/547] s390/zcrypt: Fix and improve zcrypt reply message verification checks Greg Kroah-Hartman
` (376 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit f63eb4ee4a30fc5d8de07a229d92310e3c8d560c upstream.
The cma_alloc bit as well as the response can contain old data.
cma_release will not free the kmalloced memory in that case and
the response code might leak kernel stack data to CAP_SYS_ADMIN
users.
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/char/vmcp.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -104,13 +104,11 @@ static int vmcp_open(struct inode *inode
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
- session = kmalloc_obj(*session);
+ session = kzalloc_obj(*session);
if (!session)
return -ENOMEM;
session->bufsize = PAGE_SIZE;
- session->response = NULL;
- session->resp_size = 0;
mutex_init(&session->mutex);
file->private_data = session;
return nonseekable_open(inode, file);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 180/547] s390/zcrypt: Fix and improve zcrypt reply message verification checks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 179/547] s390/vmcp: Initialize full session info to zero Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 181/547] s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility() Greg Kroah-Hartman
` (375 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harald Freudenberger, Holger Dengler,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <freude@linux.ibm.com>
commit 5e9b339f323216d71f3ede8a0a427abf7859c486 upstream.
Add or improve checks related to buffer sizes and reply sizes to the
handling of replies from the crypto cards for CCA, EP11 (AP message
type 6) and ICA (AP type 50) messages. The verification code related
to reply field length was not designed well and thus firmware
deficiencies could lead to unexpected behavior in the zcrypt device
driver. Thus improve the code to more closely inspect especially
length fields at message replies.
Add length validation before accessing reply message structures in
zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11(), and
zcrypt_msgtype50_receive() to prevent out-of-bounds reads and
potential kernel memory disclosure.
Also rework these three functions to validate reply lengths more
carefully before copying data back into the request buffer. Use size_t
for length calculations, reject inconsistent reply sizes, and add
defensive handling for short invalid replies. For XCRB replies,
validate both reply segments and derive the effective message length
from the covered range instead of trusting only the second segment.
Additionally improve some of the later invoked evaluation functions
which further check the payload. Add comments about length assumptions
and for the type50 processing rework the payload processing completely
with removing a misplaced BUG_ON().
Fixes: 5e55a488c87a ("s390/zcrypt: Separate msgtype implementation from card modules.")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/zcrypt_msgtype50.c | 95 +++++++++++----
drivers/s390/crypto/zcrypt_msgtype6.c | 202 ++++++++++++++++++++++++---------
2 files changed, 218 insertions(+), 79 deletions(-)
--- a/drivers/s390/crypto/zcrypt_msgtype50.c
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -152,6 +152,11 @@ struct type80_hdr {
unsigned char reserved3[8];
} __packed;
+struct type80_reply {
+ struct type80_hdr hdr;
+ char data[];
+} __packed;
+
int get_rsa_modex_fc(struct ica_rsa_modexpo *mex, int *fcode)
{
if (!mex->inputdatalength)
@@ -340,32 +345,43 @@ static int ICACRT_msg_to_type50CRT_msg(s
* @data: pointer to user output data
* @length: size of user output data
*
- * Returns 0 on success or -EFAULT.
+ * Returns 0 on success or neg. errno value on failure.
*/
static int convert_type80(struct zcrypt_queue *zq,
struct ap_message *reply,
char __user *outputdata,
unsigned int outputdatalength)
{
- struct type80_hdr *t80h = reply->msg;
- unsigned char *data;
+ struct type80_reply *msg = reply->msg;
+ size_t payload_len;
- if (t80h->len < sizeof(*t80h) + outputdatalength) {
- /* The result is too short, the CEXxA card may not do that.. */
+ /*
+ * reply->len is always >= sizeof(struct type80_reply) here and
+ * outputdatalength (the modulus size) is guaranteed to be equal to
+ * inputdatalength and 0 < outputdatalength <= CEX3A_MAX_MOD_SIZE,
+ * also payload size may be >= outputdatalength.
+ */
+
+ payload_len = reply->len - sizeof(msg->hdr);
+
+ if (outputdatalength > payload_len) {
+ /* We expect at least outputdatalength bytes, broken card ? */
zq->online = 0;
pr_err("Crypto dev=%02x.%04x code=0x%02x => online=0 rc=EAGAIN\n",
AP_QID_CARD(zq->queue->qid),
- AP_QID_QUEUE(zq->queue->qid), t80h->code);
+ AP_QID_QUEUE(zq->queue->qid), msg->hdr.code);
ZCRYPT_DBF_ERR("%s dev=%02x.%04x code=0x%02x => online=0 rc=EAGAIN\n",
__func__, AP_QID_CARD(zq->queue->qid),
- AP_QID_QUEUE(zq->queue->qid), t80h->code);
+ AP_QID_QUEUE(zq->queue->qid), msg->hdr.code);
ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
return -EAGAIN;
}
- BUG_ON(t80h->len > CEX3A_MAX_RESPONSE_SIZE);
- data = reply->msg + t80h->len - outputdatalength;
- if (copy_to_user(outputdata, data, outputdatalength))
+
+ if (copy_to_user(outputdata,
+ msg->data + payload_len - outputdatalength,
+ outputdatalength))
return -EFAULT;
+
return 0;
}
@@ -374,14 +390,19 @@ static int convert_response(struct zcryp
char __user *outputdata,
unsigned int outputdatalength)
{
- /* Response type byte is the second byte in the response. */
- unsigned char rtype = ((unsigned char *)reply->msg)[1];
+ struct type80_reply *msg = reply->msg;
- switch (rtype) {
+ /* reply->len is always >= sizeof(struct error_hdr) here */
+
+ switch (msg->hdr.type) {
case TYPE82_RSP_CODE:
case TYPE88_RSP_CODE:
return convert_error(zq, reply);
case TYPE80_RSP_CODE:
+ if (msg->hdr.code)
+ return convert_error(zq, reply);
+ if (reply->len < sizeof(struct type80_reply))
+ return -EINVAL;
return convert_type80(zq, reply,
outputdata, outputdatalength);
default: /* Unknown response type, this should NEVER EVER happen */
@@ -389,11 +410,11 @@ static int convert_response(struct zcryp
pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
AP_QID_CARD(zq->queue->qid),
AP_QID_QUEUE(zq->queue->qid),
- (int)rtype);
+ (int)msg->hdr.type);
ZCRYPT_DBF_ERR(
"%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
__func__, AP_QID_CARD(zq->queue->qid),
- AP_QID_QUEUE(zq->queue->qid), (int)rtype);
+ AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
return -EAGAIN;
}
@@ -416,26 +437,46 @@ static void zcrypt_msgtype50_receive(str
.reply_code = REP82_ERROR_MACHINE_FAILURE,
};
struct type80_hdr *t80h;
- int len;
+ size_t len;
/* Copy the reply message to the request message buffer. */
if (!reply)
goto out; /* ap_msg->rc indicates the error */
+
t80h = reply->msg;
- if (t80h->type == TYPE80_RSP_CODE) {
- len = t80h->len;
- if (len > reply->bufsize || len > msg->bufsize ||
- len != reply->len) {
- pr_debug("len mismatch => EMSGSIZE\n");
- msg->rc = -EMSGSIZE;
+
+ if (reply->len < sizeof(*t80h) ||
+ t80h->type != TYPE80_RSP_CODE) {
+ if (reply->len < sizeof(error_reply)) {
+ /* total broken reply, use static error reply instead */
+ memcpy(msg->msg, &error_reply, sizeof(error_reply));
+ msg->len = sizeof(error_reply);
goto out;
+ } else {
+ /* malformed reply, convert function will handle this */
+ len = reply->len;
+ goto copy_len_and_out;
}
- memcpy(msg->msg, reply->msg, len);
- msg->len = len;
- } else {
- memcpy(msg->msg, reply->msg, sizeof(error_reply));
- msg->len = sizeof(error_reply);
}
+
+ len = t80h->len;
+
+copy_len_and_out:
+ if (len != reply->len) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("len %zu rpl.len %zu mismatch, msg.rc=%d\n",
+ len, reply->len, msg->rc);
+ goto out;
+ }
+ if (len > reply->bufsize || len > msg->bufsize) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("len %zu exceeds buf %zu/%zu, msg.rc=%d\n",
+ len, reply->bufsize, msg->bufsize, msg->rc);
+ goto out;
+ }
+ memcpy(msg->msg, reply->msg, len);
+ msg->len = len;
+
out:
complete(&msg->response.work);
}
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -766,6 +766,15 @@ static int convert_type86_rng(struct zcr
if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
return -EINVAL;
+ /*
+ * Note that offset2 and count2 have already been checked in
+ * zcrypt_msgtype6_receive(). So only check for valid count2
+ * and for not exceeding the hard coded rng buffer size.
+ */
+ if (!msg->fmt2.count2)
+ return -EINVAL;
+ if (msg->fmt2.count2 > ZCRYPT_RNG_BUFFER_SIZE)
+ return -EMSGSIZE;
memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
return msg->fmt2.count2;
}
@@ -777,11 +786,17 @@ static int convert_response_ica(struct z
{
struct type86x_reply *msg = reply->msg;
+ /* reply->len is always >= sizeof(struct error_hdr) here */
+
switch (msg->hdr.type) {
case TYPE82_RSP_CODE:
case TYPE88_RSP_CODE:
return convert_error(zq, reply);
case TYPE86_RSP_CODE:
+ if (msg->hdr.reply_code)
+ return convert_error(zq, reply);
+ if (reply->len < sizeof(struct type86x_reply))
+ return -EINVAL;
if (msg->cprbx.ccp_rtcode &&
msg->cprbx.ccp_rscode == 0x14f &&
outputdatalength > 256) {
@@ -792,8 +807,6 @@ static int convert_response_ica(struct z
return -EINVAL;
}
}
- if (msg->hdr.reply_code)
- return convert_error(zq, reply);
if (msg->cprbx.cprb_ver_id == 0x02)
return convert_type86_ica(zq, reply,
outputdata, outputdatalength);
@@ -820,6 +833,8 @@ static int convert_response_xcrb(bool us
{
struct type86x_reply *msg = reply->msg;
+ /* reply->len is always >= sizeof(struct error_hdr) here */
+
switch (msg->hdr.type) {
case TYPE82_RSP_CODE:
case TYPE88_RSP_CODE:
@@ -827,9 +842,16 @@ static int convert_response_xcrb(bool us
return convert_error(zq, reply);
case TYPE86_RSP_CODE:
if (msg->hdr.reply_code) {
- xcrb->status = msg->fmt2.apfs;
+ if (reply->len < sizeof(struct type86_fmt2_msg))
+ xcrb->status = 0x0008044DL;
+ else
+ xcrb->status = msg->fmt2.apfs;
return convert_error(zq, reply);
}
+ if (reply->len < sizeof(struct type86_fmt2_msg) +
+ offsetof(struct CPRBX, cprb_ver_id) +
+ sizeof(msg->cprbx.cprb_ver_id))
+ return -EINVAL;
if (msg->cprbx.cprb_ver_id == 0x02)
return convert_type86_xcrb(userspace, zq, reply, xcrb);
fallthrough; /* wrong cprb version is an unknown response */
@@ -854,6 +876,8 @@ static int convert_response_ep11_xcrb(bo
{
struct type86_ep11_reply *msg = reply->msg;
+ /* reply->len is always >= sizeof(struct error_hdr) here */
+
switch (msg->hdr.type) {
case TYPE82_RSP_CODE:
case TYPE87_RSP_CODE:
@@ -861,6 +885,8 @@ static int convert_response_ep11_xcrb(bo
case TYPE86_RSP_CODE:
if (msg->hdr.reply_code)
return convert_error(zq, reply);
+ if (reply->len < sizeof(struct type86_ep11_reply))
+ return -EINVAL;
if (msg->cprbx.cprb_ver_id == 0x04)
return convert_type86_ep11_xcrb(userspace, zq, reply, xcrb);
fallthrough; /* wrong cprb version is an unknown resp */
@@ -885,6 +911,8 @@ static int convert_response_rng(struct z
{
struct type86x_reply *msg = reply->msg;
+ /* reply->len is always >= sizeof(struct error_hdr) here */
+
switch (msg->hdr.type) {
case TYPE82_RSP_CODE:
case TYPE88_RSP_CODE:
@@ -892,6 +920,8 @@ static int convert_response_rng(struct z
case TYPE86_RSP_CODE:
if (msg->hdr.reply_code)
return -EINVAL;
+ if (reply->len < sizeof(struct type86x_reply))
+ return -EINVAL;
if (msg->cprbx.cprb_ver_id == 0x02)
return convert_type86_rng(zq, reply, data);
fallthrough; /* wrong cprb version is an unknown response */
@@ -928,48 +958,85 @@ static void zcrypt_msgtype6_receive(stru
};
struct ap_response_type *resp_type = &msg->response;
struct type86x_reply *t86r;
- int len;
+ size_t minlen, len;
/* Copy the reply message to the request message buffer. */
if (!reply)
goto out; /* ap_msg->rc indicates the error */
+
t86r = reply->msg;
- if (t86r->hdr.type == TYPE86_RSP_CODE &&
- t86r->cprbx.cprb_ver_id == 0x02) {
- switch (resp_type->type) {
- case CEXXC_RESPONSE_TYPE_ICA:
- len = sizeof(struct type86x_reply) + t86r->length;
- if (len > reply->bufsize || len > msg->bufsize ||
- len != reply->len) {
- pr_debug("len mismatch => EMSGSIZE\n");
- msg->rc = -EMSGSIZE;
- goto out;
- }
- memcpy(msg->msg, reply->msg, len);
- msg->len = len;
- break;
- case CEXXC_RESPONSE_TYPE_XCRB:
- if (t86r->fmt2.count2)
- len = t86r->fmt2.offset2 + t86r->fmt2.count2;
- else
- len = t86r->fmt2.offset1 + t86r->fmt2.count1;
- if (len > reply->bufsize || len > msg->bufsize ||
- len != reply->len) {
- pr_debug("len mismatch => EMSGSIZE\n");
+ minlen = sizeof(t86r->hdr) + sizeof(t86r->fmt2) +
+ offsetof(struct CPRBX, cprb_ver_id) +
+ sizeof(t86r->cprbx.cprb_ver_id);
+
+ if (reply->len < minlen ||
+ t86r->hdr.type != TYPE86_RSP_CODE ||
+ t86r->cprbx.cprb_ver_id != 0x02) {
+ if (reply->len < sizeof(error_reply)) {
+ /* total broken reply, use static error reply instead */
+ memcpy(msg->msg, &error_reply, sizeof(error_reply));
+ msg->len = sizeof(error_reply);
+ goto out;
+ } else {
+ /* malformed reply, convert function will handle this */
+ len = reply->len;
+ goto copy_len_and_out;
+ }
+ }
+
+ switch (resp_type->type) {
+ case CEXXC_RESPONSE_TYPE_ICA:
+ if (reply->len < sizeof(struct type86x_reply)) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("rpl.len %zu < struct type86_reply, msg.rc=%d\n",
+ reply->len, msg->rc);
+ goto out;
+ }
+ len = sizeof(struct type86x_reply) + (size_t)t86r->length;
+ break;
+ case CEXXC_RESPONSE_TYPE_XCRB:
+ len = (size_t)t86r->fmt2.offset1 + (size_t)t86r->fmt2.count1;
+ if (len > reply->len) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("offset1 %u count1 %u rpl.len %zu mismatch, msg.rc=%d\n",
+ t86r->fmt2.offset1, t86r->fmt2.count1,
+ reply->len, msg->rc);
+ goto out;
+ }
+ if (t86r->fmt2.count2) {
+ len = (size_t)t86r->fmt2.offset2 +
+ (size_t)t86r->fmt2.count2;
+ if (len > reply->len) {
msg->rc = -EMSGSIZE;
+ pr_debug("offset2 %u count2 %u rpl.len %zu mismatch, msg.rc=%d\n",
+ t86r->fmt2.offset2, t86r->fmt2.count2,
+ reply->len, msg->rc);
goto out;
}
- memcpy(msg->msg, reply->msg, len);
- msg->len = len;
- break;
- default:
- memcpy(msg->msg, &error_reply, sizeof(error_reply));
- msg->len = sizeof(error_reply);
}
- } else {
- memcpy(msg->msg, reply->msg, sizeof(error_reply));
+ break;
+ default:
+ memcpy(msg->msg, &error_reply, sizeof(error_reply));
msg->len = sizeof(error_reply);
+ goto out;
}
+
+copy_len_and_out:
+ if (len != reply->len) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("len %zu rpl.len %zu mismatch, msg.rc=%d\n",
+ len, reply->len, msg->rc);
+ goto out;
+ }
+ if (len > reply->bufsize || len > msg->bufsize) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("len %zu exceeds buf %zu/%zu, msg.rc=%d\n",
+ len, reply->bufsize, msg->bufsize, msg->rc);
+ goto out;
+ }
+ memcpy(msg->msg, reply->msg, len);
+ msg->len = len;
+
out:
complete(&resp_type->work);
}
@@ -992,34 +1059,65 @@ static void zcrypt_msgtype6_receive_ep11
};
struct ap_response_type *resp_type = &msg->response;
struct type86_ep11_reply *t86r;
- int len;
+ size_t minlen, len;
/* Copy the reply message to the request message buffer. */
if (!reply)
goto out; /* ap_msg->rc indicates the error */
+
t86r = reply->msg;
- if (t86r->hdr.type == TYPE86_RSP_CODE &&
- t86r->cprbx.cprb_ver_id == 0x04) {
- switch (resp_type->type) {
- case CEXXC_RESPONSE_TYPE_EP11:
- len = t86r->fmt2.offset1 + t86r->fmt2.count1;
- if (len > reply->bufsize || len > msg->bufsize ||
- len != reply->len) {
- pr_debug("len mismatch => EMSGSIZE\n");
- msg->rc = -EMSGSIZE;
- goto out;
- }
- memcpy(msg->msg, reply->msg, len);
- msg->len = len;
- break;
- default:
+ minlen = sizeof(t86r->hdr) + sizeof(t86r->fmt2) +
+ offsetof(struct ep11_cprb, cprb_ver_id) +
+ sizeof(t86r->cprbx.cprb_ver_id);
+
+ if (reply->len < minlen ||
+ t86r->hdr.type != TYPE86_RSP_CODE ||
+ t86r->cprbx.cprb_ver_id != 0x04) {
+ if (reply->len < sizeof(error_reply)) {
+ /* total broken reply, use static error reply instead */
memcpy(msg->msg, &error_reply, sizeof(error_reply));
msg->len = sizeof(error_reply);
+ goto out;
+ } else {
+ /* malformed reply, convert function will handle this */
+ len = reply->len;
+ goto copy_len_and_out;
+ }
+ }
+
+ switch (resp_type->type) {
+ case CEXXC_RESPONSE_TYPE_EP11:
+ len = (size_t)t86r->fmt2.offset1 + (size_t)t86r->fmt2.count1;
+ if (len > reply->len) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("offset1 %u count1 %u rpl.len %zu mismatch, msg.rc=%d\n",
+ t86r->fmt2.offset1, t86r->fmt2.count1,
+ reply->len, msg->rc);
+ goto out;
}
- } else {
- memcpy(msg->msg, reply->msg, sizeof(error_reply));
+ break;
+ default:
+ memcpy(msg->msg, &error_reply, sizeof(error_reply));
msg->len = sizeof(error_reply);
+ goto out;
+ }
+
+copy_len_and_out:
+ if (len != reply->len) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("len %zu rpl.len %zu mismatch, msg.rc=%d\n",
+ len, reply->len, msg->rc);
+ goto out;
}
+ if (len > reply->bufsize || len > msg->bufsize) {
+ msg->rc = -EMSGSIZE;
+ pr_debug("len %zu exceeds buf %zu/%zu, msg.rc=%d\n",
+ len, reply->bufsize, msg->bufsize, msg->rc);
+ goto out;
+ }
+ memcpy(msg->msg, reply->msg, len);
+ msg->len = len;
+
out:
complete(&resp_type->work);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 181/547] s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 180/547] s390/zcrypt: Fix and improve zcrypt reply message verification checks Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 182/547] s390/zcrypt: Guard domain index uses against speculative bypass Greg Kroah-Hartman
` (374 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harald Freudenberger, Holger Dengler,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <freude@linux.ibm.com>
commit 9fd7fca66735307fd7afa3450882a55ef80f2add upstream.
The FQ reply parser code blindly advanced the walk pointer by a length
value read directly from the hardware reply payload without checking
that the advance stayed within the allocated reply buffer. A corrupt
or malicious device response could push ptr beyond the cprbmem region,
causing an out-of-bounds dereference or kernel memory exposure via the
subsequent memcpy().
Fix this by tracking the remaining reply buffer space in a variable
and validating each device-supplied length field against it before
advancing or dereferencing the pointer.
Fixes: 2004b57cde6b ("s390/zcrypt: code cleanup")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/zcrypt_ccamisc.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -1627,6 +1627,7 @@ int cca_query_crypto_facility(u16 cardnr
u8 subfunc_code[2];
u8 lvdata[];
} __packed * prepparm;
+ size_t datalen;
/* get already prepared memory for 2 cprbs with param block each */
rc = alloc_and_prep_cprbmem(parmbsize, &mem,
@@ -1673,27 +1674,44 @@ int cca_query_crypto_facility(u16 cardnr
prepcblk->rpl_parmb = (u8 __user *)ptr;
prepparm = (struct fqrepparm *)ptr;
ptr = prepparm->lvdata;
+ datalen = parmbsize - 2 * sizeof(u8);
/* check and possibly copy reply rule array */
len = *((u16 *)ptr);
+ if (len > datalen) {
+ ZCRYPT_DBF_ERR("%s reply rule array len %u exceeds datalen %zu\n",
+ __func__, len, datalen);
+ rc = -EIO;
+ goto out;
+ }
+ datalen -= sizeof(u16);
+ ptr += sizeof(u16);
if (len > sizeof(u16)) {
- ptr += sizeof(u16);
len -= sizeof(u16);
if (rarray && rarraylen && *rarraylen > 0) {
*rarraylen = (len > *rarraylen ? *rarraylen : len);
memcpy(rarray, ptr, *rarraylen);
}
+ datalen -= len;
ptr += len;
}
/* check and possible copy reply var array */
len = *((u16 *)ptr);
+ if (len > datalen) {
+ ZCRYPT_DBF_ERR("%s reply var array len %u exceeds datalen %zu\n",
+ __func__, len, datalen);
+ rc = -EIO;
+ goto out;
+ }
+ datalen -= sizeof(u16);
+ ptr += sizeof(u16);
if (len > sizeof(u16)) {
- ptr += sizeof(u16);
len -= sizeof(u16);
if (varray && varraylen && *varraylen > 0) {
*varraylen = (len > *varraylen ? *varraylen : len);
memcpy(varray, ptr, *varraylen);
}
+ datalen -= len;
ptr += len;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 182/547] s390/zcrypt: Guard domain index uses against speculative bypass
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 181/547] s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility() Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 183/547] HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities Greg Kroah-Hartman
` (373 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harald Freudenberger, Holger Dengler,
Heiko Carstens
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <freude@linux.ibm.com>
commit 7b88e8b6d714cd1b2b6185e2963c8ec4d98542d0 upstream.
The previous array_index_nospec() placement only covered the admin
permission check, leaving ap_test_config_usage_domain() and
ap_test_config_ctrl_domain() in the CCA path exposed to speculative
execution.
Move the sanitization to before all permission and config checks in
both the CCA and EP11 paths. Hold the sanitized domain value in
another variable so that the later use can choose to use either the
original value (subject to speculative execution) or the sanitized
value (which may in case of AUTOSEL_DOM reflect the wrong
value). Before that, check the domain value to be either AUTOSEL_DOM
or in range 0...AP_DOMAINS-1 and return with -EINVAL in case this check
does not pass.
Fixes: e935cd525af4 ("s390/zcrypt: Close speculative mem read possibility")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/zcrypt_api.c | 35 +++++++++++++++++++++++++----------
1 file changed, 25 insertions(+), 10 deletions(-)
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -854,7 +854,7 @@ static long _zcrypt_send_cprb(u32 xflags
struct ica_xcRB *xcrb)
{
bool userspace = xflags & ZCRYPT_XFLAG_USERSPACE;
- unsigned int card, domain, func_code = 0;
+ unsigned int card, domain, _dom, func_code = 0;
unsigned int wgt = 0, pref_wgt = 0;
struct zcrypt_queue *zq, *pref_zq;
struct zcrypt_card *zc, *pref_zc;
@@ -877,10 +877,17 @@ static long _zcrypt_send_cprb(u32 xflags
print_hex_dump_debug("ccareq: ", DUMP_PREFIX_ADDRESS, 16, 1,
ap_msg.msg, ap_msg.len, false);
+ /* Check domain for either AUTOSEL_DOM or in range 0...AP_DOMAINS-1 */
+ if (domain != AUTOSEL_DOM && domain >= AP_DOMAINS) {
+ rc = -EINVAL;
+ goto out;
+ }
+ /* Spectre-v1: sanitize domain unconditionally for later use */
+ _dom = array_index_nospec(domain, AP_DOMAINS);
+
if (perms != &ap_perms && domain < AP_DOMAINS) {
if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
- domain = array_index_nospec(domain, AP_DOMAINS);
- if (!test_bit_inv(domain, perms->adm)) {
+ if (!test_bit_inv(_dom, perms->adm)) {
rc = -ENODEV;
goto out;
}
@@ -893,10 +900,11 @@ static long _zcrypt_send_cprb(u32 xflags
* If a valid target domain is set and this domain is NOT a usage
* domain but a control only domain, autoselect target domain.
*/
- if (domain < AP_DOMAINS &&
- !ap_test_config_usage_domain(domain) &&
- ap_test_config_ctrl_domain(domain))
- domain = AUTOSEL_DOM;
+ if (domain < AP_DOMAINS) {
+ if (!ap_test_config_usage_domain(_dom) &&
+ ap_test_config_ctrl_domain(_dom))
+ domain = AUTOSEL_DOM;
+ }
pref_zc = NULL;
pref_zq = NULL;
@@ -1041,7 +1049,7 @@ static long _zcrypt_send_ep11_cprb(u32 x
struct ep11_target_dev *targets = NULL;
unsigned short target_num;
unsigned int wgt = 0, pref_wgt = 0;
- unsigned int func_code = 0, domain;
+ unsigned int func_code = 0, domain, _dom;
struct ap_message ap_msg;
int cpen, qpen, qid = 0, rc;
struct module *mod;
@@ -1078,10 +1086,17 @@ static long _zcrypt_send_ep11_cprb(u32 x
print_hex_dump_debug("ep11req: ", DUMP_PREFIX_ADDRESS, 16, 1,
ap_msg.msg, ap_msg.len, false);
+ /* Check domain for either AUTOSEL_DOM or in range 0...AP_DOMAINS-1 */
+ if (domain != AUTOSEL_DOM && domain >= AP_DOMAINS) {
+ rc = -EINVAL;
+ goto out;
+ }
+ /* Spectre-v1: sanitize domain unconditionally for later use */
+ _dom = array_index_nospec(domain, AP_DOMAINS);
+
if (perms != &ap_perms && domain < AP_DOMAINS) {
if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
- domain = array_index_nospec(domain, AP_DOMAINS);
- if (!test_bit_inv(domain, perms->adm)) {
+ if (!test_bit_inv(_dom, perms->adm)) {
rc = -ENODEV;
goto out;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 183/547] HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 182/547] s390/zcrypt: Guard domain index uses against speculative bypass Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 184/547] HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration Greg Kroah-Hartman
` (372 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
commit 86472508a7ef74b525e79a79d2d02d911a641d6b upstream.
Replace the lookup-dependent 'wacom_wac->shared->touch->product' references
with 'hdev->product' inside wacom_setup_touch_input_capabilities() since
'hdev' is already available (via container_of) and represents the touch
device itself.
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3966,8 +3966,8 @@ int wacom_setup_pen_input_capabilities(s
int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
struct wacom_wac *wacom_wac)
{
+ struct hid_device *hdev = container_of(wacom_wac, struct wacom, wacom_wac)->hdev;
struct wacom_features *features = &wacom_wac->features;
-
if (!(features->device_type & WACOM_DEVICETYPE_TOUCH))
return -ENODEV;
@@ -3976,9 +3976,11 @@ int wacom_setup_touch_input_capabilities
else
__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
- if (features->type == HID_GENERIC)
+ if (features->type == HID_GENERIC) {
+ hid_dbg(hdev, "generic touch setup\n");
/* setup has already been done */
return 0;
+ }
input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
__set_bit(BTN_TOUCH, input_dev->keybit);
@@ -4010,19 +4012,17 @@ int wacom_setup_touch_input_capabilities
input_dev->evbit[0] |= BIT_MASK(EV_SW);
__set_bit(SW_MUTE_DEVICE, input_dev->swbit);
- if (wacom_wac->shared->touch->product == 0x361) {
+ if (hdev->product == 0x361) {
input_set_abs_params(input_dev, ABS_MT_POSITION_X,
0, 12440, 4, 0);
input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
0, 8640, 4, 0);
- }
- else if (wacom_wac->shared->touch->product == 0x360) {
+ } else if (hdev->product == 0x360) {
input_set_abs_params(input_dev, ABS_MT_POSITION_X,
0, 8960, 4, 0);
input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
0, 5920, 4, 0);
- }
- else if (wacom_wac->shared->touch->product == 0x393) {
+ } else if (hdev->product == 0x393) {
input_set_abs_params(input_dev, ABS_MT_POSITION_X,
0, 6400, 4, 0);
input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
@@ -4052,8 +4052,8 @@ int wacom_setup_touch_input_capabilities
fallthrough;
case WACOM_27QHDT:
- if (wacom_wac->shared->touch->product == 0x32C ||
- wacom_wac->shared->touch->product == 0xF6) {
+ if (hdev->product == 0x32C ||
+ hdev->product == 0xF6) {
input_dev->evbit[0] |= BIT_MASK(EV_SW);
__set_bit(SW_MUTE_DEVICE, input_dev->swbit);
wacom_wac->has_mute_touch_switch = true;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 184/547] HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 183/547] HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 185/547] HID: wacom: Fix Use-After-Free in wacom_intuos_pad Greg Kroah-Hartman
` (371 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
commit ba16e5ffbaa10fde960918d69af5e49f2b3fdd5e upstream.
Input subsystem guidelines require that device capabilities are advertised
before the input device is registered. The Wacom driver was violating
this by advertising the SW_MUTE_DEVICE capability post-registration in
wacom_set_shared_values() (and duplicating it in device-specific setup
cases).
Resolve this by moving the SW_MUTE_DEVICE capability setup to
wacom_setup_touch_input_capabilities() for all touch devices that support
it.
For generic touch devices whose capabilities depend on mute switch
usages parsed from a sibling Pen/Pad interface, defer registration
with -EPROBE_DEFER until the sibling has parsed its descriptors and
initialized shared capabilities.
Cc: stable@vger.kernel.org
Fixes: d2ec58aee8b1 ("HID: wacom: generic: support generic touch switch")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 93 ++++++++++++++++++++++++++++++++++++++----------
drivers/hid/wacom_wac.c | 5 ++
2 files changed, 79 insertions(+), 19 deletions(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -908,19 +908,14 @@ static int wacom_add_shared_data(struct
list_add_tail(&data->list, &wacom_udev_list);
}
- mutex_unlock(&wacom_udev_list_lock);
-
wacom_wac->shared = &data->shared;
- retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom);
- if (retval)
- return retval;
+ if (wacom_wac->has_mute_touch_switch)
+ WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true);
- if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH)
- wacom_wac->shared->touch = hdev;
- else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN)
- wacom_wac->shared->pen = hdev;
+ mutex_unlock(&wacom_udev_list_lock);
+ retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom);
return retval;
}
@@ -2344,13 +2339,12 @@ static void wacom_release_resources(stru
static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
{
- if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
- wacom_wac->shared->type = wacom_wac->features.type;
- wacom_wac->shared->touch_input = wacom_wac->touch_input;
- }
+ struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac);
+
+ guard(mutex)(&wacom_udev_list_lock);
if (wacom_wac->has_mute_touch_switch) {
- wacom_wac->shared->has_mute_touch_switch = true;
+ WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true);
/* Hardware touch switch may be off. Wait until
* we know the switch state to decide is_touch_on.
* Softkey state should be initialized to "on" to
@@ -2360,12 +2354,67 @@ static void wacom_set_shared_values(stru
wacom_wac->shared->is_touch_on = true;
}
- if (wacom_wac->shared->has_mute_touch_switch &&
- wacom_wac->shared->touch_input) {
- set_bit(EV_SW, wacom_wac->shared->touch_input->evbit);
- input_set_capability(wacom_wac->shared->touch_input, EV_SW,
- SW_MUTE_DEVICE);
+ if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
+ wacom_wac->shared->type = wacom_wac->features.type;
+ wacom_wac->shared->touch_input = wacom_wac->touch_input;
+ wacom_wac->shared->touch = wacom->hdev;
+ } else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
+ /* Pairs with smp_load_acquire() in wacom_sibling_pending() */
+ smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
+ }
+}
+
+static bool wacom_sibling_pending(struct wacom *wacom)
+{
+ const struct wacom_features *features = &wacom->wacom_wac.features;
+ struct hid_device *hdev = wacom->hdev;
+ struct usb_interface *sibling_intf;
+ int ifnum;
+
+ if (features->type != HID_GENERIC ||
+ !(features->device_type & WACOM_DEVICETYPE_TOUCH))
+ return false;
+
+ if (wacom->wacom_wac.shared) {
+ /* Pairs with smp_store_release() in wacom_set_shared_values() */
+ if (smp_load_acquire(&wacom->wacom_wac.shared->pen))
+ return false;
}
+
+ if (!hid_is_usb(hdev) || !wacom->usbdev || !wacom->intf ||
+ !wacom->intf->cur_altsetting)
+ return false;
+
+ ifnum = wacom->intf->cur_altsetting->desc.bInterfaceNumber;
+
+ /*
+ * On composite Wacom devices, the Pen interface is always interface 0.
+ * If the Touch interface is interface 0, there is no sibling Pen
+ * interface on this device (standalone touch device).
+ */
+ if (ifnum == 0)
+ return false;
+
+ /* Look for the sibling Pen interface at interface 0 */
+ sibling_intf = usb_ifnum_to_if(wacom->usbdev, 0);
+ if (!sibling_intf || !sibling_intf->cur_altsetting)
+ return false;
+
+ if (sibling_intf->cur_altsetting->desc.bInterfaceClass !=
+ USB_INTERFACE_CLASS_HID)
+ return false;
+
+ if (sibling_intf->cur_altsetting->desc.bInterfaceSubClass == 1 &&
+ (sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 1 ||
+ sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 2))
+ return false;
+
+ /*
+ * Interface 0 is a candidate HID interface on this composite device
+ * whose probe has not completed yet (shared->pen is NULL). Defer until
+ * interface 0 finishes probing and registers shared values.
+ */
+ return true;
}
static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
@@ -2445,6 +2494,11 @@ static int wacom_parse_and_register(stru
if (error)
goto fail;
+ if (wacom_sibling_pending(wacom)) {
+ error = -EPROBE_DEFER;
+ goto fail;
+ }
+
error = wacom_setup_inputs(wacom);
if (error)
goto fail;
@@ -2502,6 +2556,7 @@ static int wacom_parse_and_register(stru
fail_hw_stop:
hid_hw_stop(hdev);
+ cancel_delayed_work_sync(&wacom->init_work);
fail:
wacom_release_resources(wacom);
return error;
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3978,6 +3978,11 @@ int wacom_setup_touch_input_capabilities
if (features->type == HID_GENERIC) {
hid_dbg(hdev, "generic touch setup\n");
+ if (wacom_wac->has_mute_touch_switch ||
+ (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) {
+ input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE);
+ wacom_wac->has_mute_touch_switch = true;
+ }
/* setup has already been done */
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 185/547] HID: wacom: Fix Use-After-Free in wacom_intuos_pad
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 184/547] HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 186/547] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad Greg Kroah-Hartman
` (370 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
commit ef32877368a7013c060ef6bd03a30b6da2fe0c41 upstream.
wacom_intuos_pad() accesses wacom->shared->touch_input locklessly
inside the interrupt handler context. If the Touch sibling device
is disconnected, wacom_remove_shared_data() clears 'touch_input'
outside any lock, creating a Time-of-Check to Time-of-Use (TOCTOU)
race condition where a preempted reader in interrupt context
dereferences the freed pointer, leading to a Use-After-Free.
Resolve this by introducing RCU protection for the touch_input
pointer:
- Annotate 'touch_input' in wacom_shared struct with __rcu
- Wrap all lockless readers in wacom_wac.c with guard(rcu)() and
rcu_dereference() using a unified wacom_report_touch_mute()
helper
- Update writers in wacom_sys.c using rcu_assign_pointer()
- Call synchronize_rcu() in wacom_remove_shared_data() to ensure
all active RCU readers have finished before the input device is
freed
Also wrap wacom_set_shared_values() and touch/pen assignments in
wacom_add_shared_data() inside the wacom_udev_list_lock to serialize
concurrent probe assignments, and verify that 'shared->touch == hdev'
before setting touch_input to prevent concurrent sibling probe state
desynchronization.
Cc: stable@vger.kernel.org
Fixes: 961794a00eab ("Input: wacom - add reporting of SW_MUTE_DEVICE events")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 23 ++++++++++++++++-------
drivers/hid/wacom_wac.c | 36 ++++++++++++++++++------------------
drivers/hid/wacom_wac.h | 2 +-
3 files changed, 35 insertions(+), 26 deletions(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -876,10 +876,16 @@ static void wacom_remove_shared_data(voi
data = container_of(wacom_wac->shared, struct wacom_hdev_data,
shared);
- if (wacom_wac->shared->touch == wacom->hdev)
- wacom_wac->shared->touch = NULL;
- else if (wacom_wac->shared->pen == wacom->hdev)
- wacom_wac->shared->pen = NULL;
+ scoped_guard(mutex, &wacom_udev_list_lock) {
+ if (wacom_wac->shared->touch == wacom->hdev) {
+ wacom_wac->shared->touch = NULL;
+ rcu_assign_pointer(wacom_wac->shared->touch_input, NULL);
+ } else if (wacom_wac->shared->pen == wacom->hdev) {
+ wacom_wac->shared->pen = NULL;
+ }
+ }
+
+ synchronize_rcu();
kref_put(&data->kref, wacom_release_shared_data);
wacom_wac->shared = NULL;
@@ -916,6 +922,7 @@ static int wacom_add_shared_data(struct
mutex_unlock(&wacom_udev_list_lock);
retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom);
+
return retval;
}
@@ -2355,9 +2362,11 @@ static void wacom_set_shared_values(stru
}
if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
- wacom_wac->shared->type = wacom_wac->features.type;
- wacom_wac->shared->touch_input = wacom_wac->touch_input;
- wacom_wac->shared->touch = wacom->hdev;
+ if (wacom_wac->shared->touch == wacom->hdev || !wacom_wac->shared->touch) {
+ wacom_wac->shared->type = wacom_wac->features.type;
+ wacom_wac->shared->touch = wacom->hdev;
+ rcu_assign_pointer(wacom_wac->shared->touch_input, wacom_wac->touch_input);
+ }
} else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
/* Pairs with smp_load_acquire() in wacom_sibling_pending() */
smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -510,6 +510,18 @@ static void wacom_intuos_schedule_prox_e
}
}
+static void wacom_report_touch_mute(struct wacom_wac *wacom_wac, bool mute)
+{
+ struct input_dev *touch_input;
+
+ guard(rcu)();
+ touch_input = rcu_dereference(wacom_wac->shared->touch_input);
+ if (touch_input) {
+ input_report_switch(touch_input, SW_MUTE_DEVICE, mute);
+ input_sync(touch_input);
+ }
+}
+
static int wacom_intuos_pad(struct wacom_wac *wacom)
{
struct wacom_features *features = &wacom->features;
@@ -650,12 +662,8 @@ static int wacom_intuos_pad(struct wacom
input_report_key(input, KEY_CONTROLPANEL, menu);
input_report_key(input, KEY_INFO, info);
- if (wacom->shared && wacom->shared->touch_input) {
- input_report_switch(wacom->shared->touch_input,
- SW_MUTE_DEVICE,
- !wacom->shared->is_touch_on);
- input_sync(wacom->shared->touch_input);
- }
+ if (wacom->shared)
+ wacom_report_touch_mute(wacom, !wacom->shared->is_touch_on);
input_report_abs(input, ABS_RX, strip1);
input_report_abs(input, ABS_RY, strip2);
@@ -2168,7 +2176,7 @@ static void wacom_wac_pad_event(struct h
*/
if ((equivalent_usage == WACOM_HID_WD_MUTE_DEVICE) ||
(equivalent_usage == WACOM_HID_WD_TOUCHONOFF)) {
- if (wacom_wac->shared->touch_input) {
+ if (wacom_wac->shared) {
bool *is_touch_on = &wacom_wac->shared->is_touch_on;
if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value)
@@ -2176,9 +2184,7 @@ static void wacom_wac_pad_event(struct h
else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)
*is_touch_on = value;
- input_report_switch(wacom_wac->shared->touch_input,
- SW_MUTE_DEVICE, !(*is_touch_on));
- input_sync(wacom_wac->shared->touch_input);
+ wacom_report_touch_mute(wacom_wac, !(*is_touch_on));
}
return;
}
@@ -3396,11 +3402,8 @@ static int wacom_wireless_irq(struct wac
if ((wacom->shared->type == INTUOSHT ||
wacom->shared->type == INTUOSHT2) &&
- wacom->shared->touch_input &&
wacom->shared->touch_max) {
- input_report_switch(wacom->shared->touch_input,
- SW_MUTE_DEVICE, data[5] & 0x40);
- input_sync(wacom->shared->touch_input);
+ wacom_report_touch_mute(wacom, data[5] & 0x40);
}
pid = get_unaligned_be16(&data[6]);
@@ -3435,11 +3438,8 @@ static int wacom_status_irq(struct wacom
if ((features->type == INTUOSHT ||
features->type == INTUOSHT2) &&
- wacom_wac->shared->touch_input &&
features->touch_max) {
- input_report_switch(wacom_wac->shared->touch_input,
- SW_MUTE_DEVICE, data[8] & 0x40);
- input_sync(wacom_wac->shared->touch_input);
+ wacom_report_touch_mute(wacom_wac, data[8] & 0x40);
}
if (data[9] & 0x02) { /* wireless module is attached */
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -285,7 +285,7 @@ struct wacom_shared {
/* for wireless device to access USB interfaces */
unsigned touch_max;
int type;
- struct input_dev *touch_input;
+ struct input_dev __rcu *touch_input;
struct hid_device *pen;
struct hid_device *touch;
bool has_mute_touch_switch;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 186/547] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 185/547] HID: wacom: Fix Use-After-Free in wacom_intuos_pad Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 187/547] HID: wacom: Redesign shared sibling data lifecycle Greg Kroah-Hartman
` (369 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
commit 3a523ecf9ac3fdd33f5eb31c43937ee44135395b upstream.
wacom_bamboo_pad_pen_event() accesses wacom->shared->pen locklessly
relative to wacom_remove_shared_data() which nullifies it. This
can lead to a Use-After-Free if the sibling device is removed while
events are being processed.
Resolve this by introducing RCU protection for pen and touch
pointers:
- Annotate 'pen' and 'touch' in wacom_shared struct with __rcu.
- Wrap lockless readers in wacom_bamboo_pad_pen_event() with
rcu_read_lock() and rcu_dereference().
- Update writers in wacom_sys.c using rcu_assign_pointer().
- Use rcu_dereference_protected for comparisons under
wacom_udev_list_lock.
- Also use rcu_access_pointer in wacom_sibling_pending() and
wacom_mode_change_work() to avoid warnings (while lockless access in
the latter remains a pre-existing issue).
Cc: stable@vger.kernel.org
Fixes: 8c97a765467c ("HID: wacom: add full support of the Wacom Bamboo PAD")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 40 ++++++++++++++++++++++++++--------------
drivers/hid/wacom_wac.c | 13 ++++++-------
drivers/hid/wacom_wac.h | 4 ++--
3 files changed, 34 insertions(+), 23 deletions(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -877,11 +877,18 @@ static void wacom_remove_shared_data(voi
shared);
scoped_guard(mutex, &wacom_udev_list_lock) {
- if (wacom_wac->shared->touch == wacom->hdev) {
- wacom_wac->shared->touch = NULL;
+ struct hid_device *touch =
+ rcu_dereference_protected(wacom_wac->shared->touch,
+ lockdep_is_held(&wacom_udev_list_lock));
+ struct hid_device *pen =
+ rcu_dereference_protected(wacom_wac->shared->pen,
+ lockdep_is_held(&wacom_udev_list_lock));
+
+ if (touch == wacom->hdev) {
+ rcu_assign_pointer(wacom_wac->shared->touch, NULL);
rcu_assign_pointer(wacom_wac->shared->touch_input, NULL);
- } else if (wacom_wac->shared->pen == wacom->hdev) {
- wacom_wac->shared->pen = NULL;
+ } else if (pen == wacom->hdev) {
+ rcu_assign_pointer(wacom_wac->shared->pen, NULL);
}
}
@@ -2362,14 +2369,17 @@ static void wacom_set_shared_values(stru
}
if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
- if (wacom_wac->shared->touch == wacom->hdev || !wacom_wac->shared->touch) {
+ struct hid_device *touch =
+ rcu_dereference_protected(wacom_wac->shared->touch,
+ lockdep_is_held(&wacom_udev_list_lock));
+
+ if (touch == wacom->hdev || !touch) {
wacom_wac->shared->type = wacom_wac->features.type;
- wacom_wac->shared->touch = wacom->hdev;
+ rcu_assign_pointer(wacom_wac->shared->touch, wacom->hdev);
rcu_assign_pointer(wacom_wac->shared->touch_input, wacom_wac->touch_input);
}
} else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
- /* Pairs with smp_load_acquire() in wacom_sibling_pending() */
- smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
+ rcu_assign_pointer(wacom_wac->shared->pen, wacom->hdev);
}
}
@@ -2385,8 +2395,7 @@ static bool wacom_sibling_pending(struct
return false;
if (wacom->wacom_wac.shared) {
- /* Pairs with smp_store_release() in wacom_set_shared_values() */
- if (smp_load_acquire(&wacom->wacom_wac.shared->pen))
+ if (rcu_access_pointer(wacom->wacom_wac.shared->pen))
return false;
}
@@ -2853,16 +2862,19 @@ static void wacom_mode_change_work(struc
bool is_direct = wacom->wacom_wac.is_direct_mode;
int error = 0;
- if (shared->pen) {
- wacom1 = hid_get_drvdata(shared->pen);
+ struct hid_device *pen = rcu_access_pointer(shared->pen);
+ struct hid_device *touch = rcu_access_pointer(shared->touch);
+
+ if (pen) {
+ wacom1 = hid_get_drvdata(pen);
wacom_release_resources(wacom1);
hid_hw_stop(wacom1->hdev);
wacom1->wacom_wac.has_mode_change = true;
wacom1->wacom_wac.is_direct_mode = is_direct;
}
- if (shared->touch) {
- wacom2 = hid_get_drvdata(shared->touch);
+ if (touch) {
+ wacom2 = hid_get_drvdata(touch);
wacom_release_resources(wacom2);
hid_hw_stop(wacom2->hdev);
wacom2->wacom_wac.has_mode_change = true;
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3307,6 +3307,7 @@ static int wacom_bpt_irq(struct wacom_wa
static void wacom_bamboo_pad_pen_event(struct wacom_wac *wacom,
unsigned char *data)
{
+ struct hid_device *pen;
unsigned char prefix;
/*
@@ -3319,13 +3320,11 @@ static void wacom_bamboo_pad_pen_event(s
prefix = data[0];
data[0] = WACOM_REPORT_BPAD_PEN;
- /*
- * actually reroute the event.
- * No need to check if wacom->shared->pen is valid, hid_input_report()
- * will check for us.
- */
- hid_input_report(wacom->shared->pen, HID_INPUT_REPORT, data,
- WACOM_PKGLEN_PENABLED, 1);
+ guard(rcu)();
+ pen = rcu_dereference(wacom->shared->pen);
+ if (pen)
+ hid_input_report(pen, HID_INPUT_REPORT, data,
+ WACOM_PKGLEN_PENABLED, 1);
data[0] = prefix;
}
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -286,8 +286,8 @@ struct wacom_shared {
unsigned touch_max;
int type;
struct input_dev __rcu *touch_input;
- struct hid_device *pen;
- struct hid_device *touch;
+ struct hid_device __rcu *pen;
+ struct hid_device __rcu *touch;
bool has_mute_touch_switch;
bool is_touch_on;
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 187/547] HID: wacom: Redesign shared sibling data lifecycle
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 186/547] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 188/547] HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration Greg Kroah-Hartman
` (368 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
commit 480c9cb14ae81f8e112ff83f8778b3d7b9324dc8 upstream.
The Wacom driver coordinates state between sibling interfaces of
the same physical device using a shared structure 'wacom_shared'
inside 'wacom_hdev_data'. The driver kept a volatile representative
pointer 'data->dev' pointing to a sibling 'hid_device' for physical
path comparisons during sibling matching.
This pointer management is fragile. When the representative device
is disconnected, wacom_remove_shared_data() failed to clear/update
'data->dev', leading to a Use-After-Free vulnerability when
subsequent sibling probes dereference the dangling 'data->dev'
pointer.
Resolve this issue by redesigning the sibling data lifecycle:
- Eliminate the volatile 'data->dev' representative pointer
completely
- Redesign 'wacom_hdev_data' to store stable static copies of the
required attributes upon first allocation: 'phys' path string,
'vendor', 'product' IDs and the sibling's 'device_type'
- Use these static attributes for stable sibling matching in
wacom_are_sibling() and wacom_get_hdev_data()
This ensures sibling matching remains safe and stable even if
individual siblings are dynamically added or removed.
To secure the lifecycle against concurrent probe/disconnect races:
- Switch kref_put() to kref_put_mutex() in
wacom_remove_shared_data() to serialize refcount drops with list
traversal and lookup
- Modify wacom_release_shared_data() to assume the list lock is
already held
Also, do not accumulate the 'device_type' capability flag during
subsequent sibling probes. Keeping only the first probed sibling's
device_type exactly preserves the original sibling matching behavior
without introducing side effects.
Cc: stable@vger.kernel.org
Fixes: 4492efffffeb ("Input: wacom - share pen info with touch of the same ID")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 70 +++++++++++++++++++++++++++++++-----------------
1 file changed, 46 insertions(+), 24 deletions(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -758,27 +758,47 @@ static void wacom_retrieve_hid_descripto
struct wacom_hdev_data {
struct list_head list;
struct kref kref;
- struct hid_device *dev;
+ char phys[64];
+ __u32 vendor;
+ __u32 product;
+ __u32 device_type;
struct wacom_shared shared;
};
+static bool wacom_compare_device_paths(struct hid_device *hdev_a,
+ const char *phys_b, char separator)
+{
+ const char *p1 = strrchr(hdev_a->phys, separator);
+ const char *p2 = strrchr(phys_b, separator);
+ int n1, n2;
+
+ if (!p1 || !p2)
+ return false;
+
+ n1 = p1 - hdev_a->phys;
+ n2 = p2 - phys_b;
+
+ if (n1 != n2 || n1 <= 0 || n2 <= 0)
+ return false;
+
+ return !strncmp(hdev_a->phys, phys_b, n1);
+}
+
static LIST_HEAD(wacom_udev_list);
static DEFINE_MUTEX(wacom_udev_list_lock);
static bool wacom_are_sibling(struct hid_device *hdev,
- struct hid_device *sibling)
+ struct wacom_hdev_data *data)
{
struct wacom *wacom = hid_get_drvdata(hdev);
struct wacom_features *features = &wacom->wacom_wac.features;
- struct wacom *sibling_wacom = hid_get_drvdata(sibling);
- struct wacom_features *sibling_features = &sibling_wacom->wacom_wac.features;
__u32 oVid = features->oVid ? features->oVid : hdev->vendor;
__u32 oPid = features->oPid ? features->oPid : hdev->product;
/* The defined oVid/oPid must match that of the sibling */
- if (features->oVid != HID_ANY_ID && sibling->vendor != oVid)
+ if (features->oVid != HID_ANY_ID && data->vendor != oVid)
return false;
- if (features->oPid != HID_ANY_ID && sibling->product != oPid)
+ if (features->oPid != HID_ANY_ID && data->product != oPid)
return false;
/*
@@ -786,11 +806,11 @@ static bool wacom_are_sibling(struct hid
* device path, while those with different VID/PID must share
* the same physical parent device path.
*/
- if (hdev->vendor == sibling->vendor && hdev->product == sibling->product) {
- if (!hid_compare_device_paths(hdev, sibling, '/'))
+ if (hdev->vendor == data->vendor && hdev->product == data->product) {
+ if (!wacom_compare_device_paths(hdev, data->phys, '/'))
return false;
} else {
- if (!hid_compare_device_paths(hdev, sibling, '.'))
+ if (!wacom_compare_device_paths(hdev, data->phys, '.'))
return false;
}
@@ -803,7 +823,7 @@ static bool wacom_are_sibling(struct hid
* devices.
*/
if ((features->device_type & WACOM_DEVICETYPE_DIRECT) &&
- !(sibling_features->device_type & WACOM_DEVICETYPE_DIRECT))
+ !(data->device_type & WACOM_DEVICETYPE_DIRECT))
return false;
/*
@@ -811,17 +831,17 @@ static bool wacom_are_sibling(struct hid
* devices.
*/
if (!(features->device_type & WACOM_DEVICETYPE_DIRECT) &&
- (sibling_features->device_type & WACOM_DEVICETYPE_DIRECT))
+ (data->device_type & WACOM_DEVICETYPE_DIRECT))
return false;
/* Pen devices may only be siblings of touch devices */
if ((features->device_type & WACOM_DEVICETYPE_PEN) &&
- !(sibling_features->device_type & WACOM_DEVICETYPE_TOUCH))
+ !(data->device_type & WACOM_DEVICETYPE_TOUCH))
return false;
/* Touch devices may only be siblings of pen devices */
if ((features->device_type & WACOM_DEVICETYPE_TOUCH) &&
- !(sibling_features->device_type & WACOM_DEVICETYPE_PEN))
+ !(data->device_type & WACOM_DEVICETYPE_PEN))
return false;
/*
@@ -837,7 +857,7 @@ static struct wacom_hdev_data *wacom_get
/* Try to find an already-probed interface from the same device */
list_for_each_entry(data, &wacom_udev_list, list) {
- if (hid_compare_device_paths(hdev, data->dev, '/')) {
+ if (wacom_compare_device_paths(hdev, data->phys, '/')) {
kref_get(&data->kref);
return data;
}
@@ -845,7 +865,7 @@ static struct wacom_hdev_data *wacom_get
/* Fallback to finding devices that appear to be "siblings" */
list_for_each_entry(data, &wacom_udev_list, list) {
- if (wacom_are_sibling(hdev, data->dev)) {
+ if (wacom_are_sibling(hdev, data)) {
kref_get(&data->kref);
return data;
}
@@ -859,18 +879,15 @@ static void wacom_release_shared_data(st
struct wacom_hdev_data *data =
container_of(kref, struct wacom_hdev_data, kref);
- mutex_lock(&wacom_udev_list_lock);
list_del(&data->list);
- mutex_unlock(&wacom_udev_list_lock);
-
kfree(data);
}
static void wacom_remove_shared_data(void *res)
{
- struct wacom *wacom = res;
+ struct wacom *res_wacom = res;
struct wacom_hdev_data *data;
- struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct wacom_wac *wacom_wac = &res_wacom->wacom_wac;
if (wacom_wac->shared) {
data = container_of(wacom_wac->shared, struct wacom_hdev_data,
@@ -884,17 +901,19 @@ static void wacom_remove_shared_data(voi
rcu_dereference_protected(wacom_wac->shared->pen,
lockdep_is_held(&wacom_udev_list_lock));
- if (touch == wacom->hdev) {
+ if (touch == res_wacom->hdev) {
rcu_assign_pointer(wacom_wac->shared->touch, NULL);
rcu_assign_pointer(wacom_wac->shared->touch_input, NULL);
- } else if (pen == wacom->hdev) {
+ } else if (pen == res_wacom->hdev) {
rcu_assign_pointer(wacom_wac->shared->pen, NULL);
}
}
synchronize_rcu();
- kref_put(&data->kref, wacom_release_shared_data);
+ if (kref_put_mutex(&data->kref, wacom_release_shared_data, &wacom_udev_list_lock))
+ mutex_unlock(&wacom_udev_list_lock);
+
wacom_wac->shared = NULL;
}
}
@@ -917,7 +936,10 @@ static int wacom_add_shared_data(struct
}
kref_init(&data->kref);
- data->dev = hdev;
+ strscpy(data->phys, hdev->phys, sizeof(data->phys));
+ data->vendor = hdev->vendor;
+ data->product = hdev->product;
+ data->device_type = wacom_wac->features.device_type;
list_add_tail(&data->list, &wacom_udev_list);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 188/547] HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 187/547] HID: wacom: Redesign shared sibling data lifecycle Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 189/547] HID: wacom: Write shared touch initial status only once Greg Kroah-Hartman
` (367 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <ping.cheng@wacom.com>
commit 97ce491bcef2d231b8d51cee8e579183319a5ba4 upstream.
The refactored SW_MUTE_DEVICE code assumed that stylus will be
the first regiestered input. In reality, touch can be registered
before stylus, such as the Wacom Cintiq Pro 13 and 16.
This patch covers both touch-first and stylus-first cases.
Cc: stable@vger.kernel.org
Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 33 ++++++++++++++++++++++++++++++---
1 file changed, 30 insertions(+), 3 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3977,10 +3977,18 @@ int wacom_setup_touch_input_capabilities
if (features->type == HID_GENERIC) {
hid_dbg(hdev, "generic touch setup\n");
- if (wacom_wac->has_mute_touch_switch ||
- (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) {
+
+ /*
+ * This is to setup the touch switch for those devices that report
+ * pen interface first. The setup can only be done here since this
+ * routine is only called once. When we are here, the shared
+ * has_mute_touch_switch has been set by the pad.
+
+ * There are two ways of reporting inputs from firmware: stylus first
+ * or touch first. This path covers the stylus input first case.
+ */
+ if (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch)) {
input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE);
- wacom_wac->has_mute_touch_switch = true;
}
/* setup has already been done */
return 0;
@@ -4403,7 +4411,26 @@ int wacom_setup_pad_input_capabilities(s
break;
case INTUOSHT3_BT:
+ break;
+
case HID_GENERIC:
+ if (wacom_wac->shared) {
+ /*
+ * The setup of touch switch capability can only be done
+ * here for those devices, such as Cintiq Pro 13 and 16,
+ * that have touch input registered before stylus and pad
+ * inputs.
+ *
+ * There are two ways of reporting inputs from firmware:
+ * stylus first or touch first. This path covers the touch
+ * input first case.
+ */
+ if (wacom_wac->has_mute_touch_switch &&
+ wacom_wac->shared->touch_input) {
+ input_set_capability(wacom_wac->shared->touch_input,
+ EV_SW, SW_MUTE_DEVICE);
+ }
+ }
break;
default:
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 189/547] HID: wacom: Write shared touch initial status only once
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 188/547] HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 190/547] klist: avoid accesses after waking klist_remove() Greg Kroah-Hartman
` (366 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Ping Cheng, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <ping.cheng@wacom.com>
commit cae3031c691dff0be61a26bc64e31a6939010d5c upstream.
For consistency with how the shared has_mute_touch_switch is handled
during registration, let's apply WRITE_ONCE to is_touch_on too.
Cc: stable@vger.kernel.org
Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2387,7 +2387,7 @@ static void wacom_set_shared_values(stru
* match historic default.
*/
if (wacom_wac->is_soft_touch_switch)
- wacom_wac->shared->is_touch_on = true;
+ WRITE_ONCE(wacom_wac->shared->is_touch_on, true);
}
if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 190/547] klist: avoid accesses after waking klist_remove()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 189/547] HID: wacom: Write shared touch initial status only once Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 191/547] objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0 Greg Kroah-Hartman
` (365 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Andrew Morton,
Danilo Krummrich, Matthew Wilcox (Oracle), Rafael J. Wysocki
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit 732e3e10234cbe302d0dcbaa98c91c66628209cb upstream.
klist_remove() waits until a node is unreferenced so that its caller can
free the containing object. klist_release() currently publishes
waiter->woken and wakes the waiter before its final accesses to the waiter
and node. klist_remove() can then return, allowing its stack waiter and
the containing object to be freed or reused while klist_release() is still
running. In particular, bus_remove_driver() can free drv->p while
__device_attach() walks the same bus klist with bus_for_each_drv().
On an arm64 Cortex-A72 system, an unpatched 7.2.0-rc3 kernel with
CONFIG_PREEMPT_RT=y and CONFIG_KASAN=y reproduced the bug through the
in-tree I2C/at24 path. KASAN reported a use-after-free in
klist_dec_and_del() reached from klist_next()/bus_for_each_drv() while
at24 was being unregistered.
Clear n_klist and take a task reference before publishing woken. Use
release/acquire accesses for that publication and wake the referenced
task. The task reference keeps the waiter task alive if it returns and
exits before wake_up_process().
Link: https://lore.kernel.org/20260827041708.31682-1-kmehltretter@gmail.com
Fixes: 8b0c250be489 ("[PATCH] add klist_node_attached() to determine if a node is on a list or not.")
Fixes: 210272a28465 ("driver core: Remove completion from struct klist_node")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/klist.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -36,6 +36,7 @@
#include <linux/klist.h>
#include <linux/export.h>
#include <linux/sched.h>
+#include <linux/sched/task.h>
/*
* Use the lowest bit of n_klist to mark deleted nodes and exclude
@@ -187,18 +188,24 @@ static void klist_release(struct kref *k
WARN_ON(!knode_dead(n));
list_del(&n->n_node);
+ knode_set_klist(n, NULL);
spin_lock(&klist_remove_lock);
list_for_each_entry_safe(waiter, tmp, &klist_remove_waiters, list) {
+ struct task_struct *p;
+
if (waiter->node != n)
continue;
+ p = waiter->process;
+ get_task_struct(p);
list_del(&waiter->list);
- waiter->woken = 1;
+ /* Publish only after the final waiter and n accesses */
+ smp_store_release(&waiter->woken, 1);
mb();
- wake_up_process(waiter->process);
+ wake_up_process(p);
+ put_task_struct(p);
}
spin_unlock(&klist_remove_lock);
- knode_set_klist(n, NULL);
}
static int klist_dec_and_del(struct klist_node *n)
@@ -250,7 +257,8 @@ void klist_remove(struct klist_node *n)
for (;;) {
set_current_state(TASK_UNINTERRUPTIBLE);
- if (waiter.woken)
+ /* Pairs with the release store in klist_release() */
+ if (smp_load_acquire(&waiter.woken))
break;
schedule();
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 191/547] objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 190/547] klist: avoid accesses after waking klist_remove() Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 192/547] rust: bindings: fix `VM_MAYSHARE` blocklist entry Greg Kroah-Hartman
` (364 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf, Peter Zijlstra,
Miguel Ojeda
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit 6b704ec9007a3f23ec5ded8f320825ac444f307d upstream.
Starting with Rust 1.101.0 (expected 2026-12-24), `objtool` may report:
rust/kernel.o: warning: objtool: _R..._4core6result13unwrap_failed...()
falls through to next function _R..._4core6result13unwrap_failed...()
(and others) due to calls to the `noreturn` symbol:
core::result::unwrap_failed::unwrap_failed_inner
Rust introduced this helper when making `unwrap_failed` generic [1]. The
existing entry for `unwrap_failed` does not match the new helper.
Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.
See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
for more details.
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://github.com/rust-lang/rust/pull/164059 [1]
Assisted-by: LLM
Link: https://patch.msgid.link/20261018131313.59391-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/check.c | 1 +
1 file changed, 1 insertion(+)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -201,6 +201,7 @@ static bool is_rust_noreturn(const struc
str_ends_with(func->name, "_4core6option13expect_failed") ||
str_ends_with(func->name, "_4core6option13unwrap_failed") ||
str_ends_with(func->name, "_4core6result13unwrap_failed") ||
+ str_ends_with(func->name, "_4core6result13unwrap_failed19unwrap_failed_inner") ||
str_ends_with(func->name, "_4core9panicking5panic") ||
str_ends_with(func->name, "_4core9panicking9panic_fmt") ||
str_ends_with(func->name, "_4core9panicking14panic_explicit") ||
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 192/547] rust: bindings: fix `VM_MAYSHARE` blocklist entry
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 191/547] objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0 Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 193/547] rust: bindings: fix VM_MAYSHARE value Greg Kroah-Hartman
` (363 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Lorenzo Stoakes (ARM),
Vishal Moola (Fractile), Miguel Ojeda
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit f9a6960c7b27c03becd50a2a7620273d80e4040d upstream.
Commit 2b6a3f061f11 ("mm: declare VMA flags by bit") added constant helpers
for the VMA flags and blocklist entries to suppress their direct bindings.
However, it listed `VM_MAYEXEC` twice and omitted `VM_MAYSHARE`.
Thus fix it.
Fixes: 2b6a3f061f11 ("mm: declare VMA flags by bit")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Link: https://patch.msgid.link/20260930123645.302318-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/bindgen_parameters | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -50,7 +50,7 @@
--blocklist-item VM_MAYREAD
--blocklist-item VM_MAYWRITE
--blocklist-item VM_MAYEXEC
---blocklist-item VM_MAYEXEC
+--blocklist-item VM_MAYSHARE
--blocklist-item VM_PFNMAP
--blocklist-item VM_IO
--blocklist-item VM_DONTCOPY
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 193/547] rust: bindings: fix VM_MAYSHARE value
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 192/547] rust: bindings: fix `VM_MAYSHARE` blocklist entry Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 194/547] rust: bitmap: restrict bitmap length to at most i32::MAX Greg Kroah-Hartman
` (362 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Lorenzo Stoakes,
Alice Ryhl, wang lian, Gary Guo, Miguel Ojeda
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
commit 7b5ba47d845f35b04937748a191a1772ffc1f288 upstream.
Commit 2b6a3f061f11 ("mm: declare VMA flags by bit") added a number of
overrides to the rust bindings helper as the change performed in the commit
caused rust bindgen to not be able to automatically determine values of
VMA flags.
However a typo was introduced leaving VM_MAYSHARE to be incorrectly
interpreted as VM_MAYEXEC in rust code. This patch fixes the typo.
Fixes: 2b6a3f061f11 ("mm: declare VMA flags by bit")
Reported-by: Chris Mason <clm@meta.com>
Closes: https://lore.kernel.org/all/20260113185142.254821-1-clm@meta.com/
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: wang lian <lianux.mm@gmail.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260113192949.689834-1-lorenzo.stoakes@oracle.com
[ Reworded to improve title and to fix typo. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/bindings/bindings_helper.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/rust/bindings/bindings_helper.h
+++ b/rust/bindings/bindings_helper.h
@@ -138,7 +138,7 @@ const vm_flags_t RUST_CONST_HELPER_VM_SH
const vm_flags_t RUST_CONST_HELPER_VM_MAYREAD = VM_MAYREAD;
const vm_flags_t RUST_CONST_HELPER_VM_MAYWRITE = VM_MAYWRITE;
const vm_flags_t RUST_CONST_HELPER_VM_MAYEXEC = VM_MAYEXEC;
-const vm_flags_t RUST_CONST_HELPER_VM_MAYSHARE = VM_MAYEXEC;
+const vm_flags_t RUST_CONST_HELPER_VM_MAYSHARE = VM_MAYSHARE;
const vm_flags_t RUST_CONST_HELPER_VM_PFNMAP = VM_PFNMAP;
const vm_flags_t RUST_CONST_HELPER_VM_IO = VM_IO;
const vm_flags_t RUST_CONST_HELPER_VM_DONTCOPY = VM_DONTCOPY;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 194/547] rust: bitmap: restrict bitmap length to at most i32::MAX
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 193/547] rust: bindings: fix VM_MAYSHARE value Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 195/547] rust: block: fix `Send` bound for `GenDisk` Greg Kroah-Hartman
` (361 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yury Norov, Burak Emir,
Eliot Courtney, Miguel Ojeda
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliot Courtney <ecourtney@nvidia.com>
commit 931790a91378f6513ba82730eb5607479c3184a0 upstream.
It is currently possible to construct a non-`BitmapVec` backed `Bitmap`
using `Bitmap::from_raw` that is larger than `i32::MAX`, and it is not
part of the unsafe requirements. Restricting all bitmaps (even
non-`BitmapVec` backed ones) to a maximum size of `i32::MAX` simplifies
a few things and matches `BitmapVec::MAX_LEN`. For example,
`copy_and_extend` truncates `len` to u32, which is wrong for > u32::MAX
size. `__bitmap_set` and `__bitmap_clear` need i32 for `size` and u32
for `start` - so they can't be run on a `Bitmap` with a > i32::MAX size.
Rather than adding runtime checks to account for the case of a non
`BitmapVec` backed `Bitmap`, just include that in the requirements for
`Bitmap`.
Add that requirement to the unsafe requirements on `Bitmap::from_raw`
and `Bitmap::from_raw_mut`, and to the invariants on `Bitmap`.
This also fixes u32 casts truncating in `copy_and_extend`, which could
otherwise lead to OOB writes.
Fixes: 11eca92a2cae ("rust: add bitmap API.")
Link: https://lore.kernel.org/DKG0U8RLO7LZ.2I1AIH0S38PAP@nvidia.com
Reviewed-by: Yury Norov <ynorov@nvidia.com>
Reviewed-by: Burak Emir <burak.emir@gmail.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-2-0d6cca376cff@nvidia.com
Cc: stable@vger.kernel.org
[ Added a few intra-doc links. Added backticks to C types. Capitalize
tagged comments. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/bitmap.rs | 70 +++++++++++++++++++++++++++++++++++---------------
1 file changed, 49 insertions(+), 21 deletions(-)
--- a/rust/kernel/bitmap.rs
+++ b/rust/kernel/bitmap.rs
@@ -17,24 +17,59 @@ use core::ptr::NonNull;
/// # Invariants
///
/// Must reference a `[c_ulong]` long enough to fit `data.len()` bits.
+/// Must not be longer than [`i32::MAX`] bits, so offsets and lengths used with
+/// [`Bitmap`] functions fit in the `int` and `unsigned int` arguments of the C bitmap API.
+/// This also matches [`BitmapVec::MAX_LEN`].
#[cfg_attr(CONFIG_64BIT, repr(align(8)))]
#[cfg_attr(not(CONFIG_64BIT), repr(align(4)))]
pub struct Bitmap {
data: [()],
}
+macro_rules! bitmap_assert {
+ ($cond:expr, $($arg:tt)+) => {
+ #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
+ assert!($cond, $($arg)*);
+ }
+}
+
+macro_rules! bitmap_assert_return {
+ ($cond:expr, $($arg:tt)+) => {
+ #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
+ assert!($cond, $($arg)*);
+
+ #[cfg(not(CONFIG_RUST_BITMAP_HARDENED))]
+ if !($cond) {
+ pr_err!($($arg)*);
+ return
+ }
+ }
+}
+
impl Bitmap {
/// Borrows a C bitmap.
///
+ /// # Panics
+ ///
+ /// Panics if CONFIG_RUST_BITMAP_HARDENED is enabled and `nbits` exceeds [`i32::MAX`].
+ ///
/// # Safety
///
/// * `ptr` holds a non-null address of an initialized array of `unsigned long`
/// that is large enough to hold `nbits` bits.
+ /// * `nbits` must not exceed [`i32::MAX`].
/// * the array must not be freed for the lifetime of this [`Bitmap`]
/// * concurrent access only happens through atomic operations
pub unsafe fn from_raw<'a>(ptr: *const usize, nbits: usize) -> &'a Bitmap {
+ bitmap_assert!(
+ nbits <= i32::MAX as usize,
+ "`nbits` must be <= {}, was {}",
+ i32::MAX,
+ nbits
+ );
let data: *const [()] = core::ptr::slice_from_raw_parts(ptr.cast(), nbits);
// INVARIANT: `data` references an initialized array that can hold `nbits` bits.
+ // INVARIANT: The caller guarantees that `nbits` does not exceed `i32::MAX`.
// SAFETY:
// The caller guarantees that `data` (derived from `ptr` and `nbits`)
// points to a valid, initialized, and appropriately sized memory region
@@ -51,15 +86,27 @@ impl Bitmap {
/// Borrows a C bitmap exclusively.
///
+ /// # Panics
+ ///
+ /// Panics if CONFIG_RUST_BITMAP_HARDENED is enabled and `nbits` exceeds [`i32::MAX`].
+ ///
/// # Safety
///
/// * `ptr` holds a non-null address of an initialized array of `unsigned long`
/// that is large enough to hold `nbits` bits.
+ /// * `nbits` must not exceed [`i32::MAX`].
/// * the array must not be freed for the lifetime of this [`Bitmap`]
/// * no concurrent access may happen.
pub unsafe fn from_raw_mut<'a>(ptr: *mut usize, nbits: usize) -> &'a mut Bitmap {
+ bitmap_assert!(
+ nbits <= i32::MAX as usize,
+ "`nbits` must be <= {}, was {}",
+ i32::MAX,
+ nbits
+ );
let data: *mut [()] = core::ptr::slice_from_raw_parts_mut(ptr.cast(), nbits);
// INVARIANT: `data` references an initialized array that can hold `nbits` bits.
+ // INVARIANT: The caller guarantees that `nbits` does not exceed `i32::MAX`.
// SAFETY:
// The caller guarantees that `data` (derived from `ptr` and `nbits`)
// points to a valid, initialized, and appropriately sized memory region
@@ -96,26 +143,6 @@ union BitmapRepr {
ptr: NonNull<usize>,
}
-macro_rules! bitmap_assert {
- ($cond:expr, $($arg:tt)+) => {
- #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
- assert!($cond, $($arg)*);
- }
-}
-
-macro_rules! bitmap_assert_return {
- ($cond:expr, $($arg:tt)+) => {
- #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
- assert!($cond, $($arg)*);
-
- #[cfg(not(CONFIG_RUST_BITMAP_HARDENED))]
- if !($cond) {
- pr_err!($($arg)*);
- return
- }
- }
-}
-
/// Represents an owned bitmap.
///
/// Wraps underlying C bitmap API. See [`Bitmap`] for available
@@ -415,7 +442,8 @@ impl Bitmap {
#[inline]
pub fn copy_and_extend(&mut self, src: &Bitmap) {
let len = core::cmp::min(src.len(), self.len());
- // SAFETY: access to `self` and `src` is within bounds.
+ // SAFETY: Access to `self` and `src` is within bounds. Both lengths fit in `u32`
+ // because a `Bitmap` is at most `i32::MAX` bits, so the casts are lossless.
unsafe {
bindings::bitmap_copy_and_extend(
self.as_mut_ptr(),
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 195/547] rust: block: fix `Send` bound for `GenDisk`
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 194/547] rust: bitmap: restrict bitmap length to at most i32::MAX Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 196/547] rust: block: require `Sync` for `Operations::QueueData` Greg Kroah-Hartman
` (360 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Andreas Hindborg,
Jens Axboe, Priya Bala Govindasamy
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Hindborg <a.hindborg@kernel.org>
commit e502b667ee70a7fa2a578e7722672ecd4fe0eb81 upstream.
The `Send` implementation for `GenDisk<T>` was conditioned on `T: Send`.
This constrains the wrong type. `T` is the `Operations` implementation,
which is typically a zero-sized marker type that carries no data, so `T:
Send` says nothing about whether the data a `GenDisk` actually owns can be
moved to another thread.
A `GenDisk<T>` owns the queue data `T::QueueData` (stored as the
`gendisk`'s `queuedata` and dropped when the `GenDisk` is dropped) and an
`Arc<TagSet<T>>`. These are the values transferred when a `GenDisk` is sent
across a thread boundary, so the `Send` bound must constrain exactly them.
Bound `T::QueueData: Send` and `Arc<TagSet<T>>: Send` instead.
Fixes: 3253aba3408a ("rust: block: introduce `kernel::block::mq` module")
Cc: stable@vger.kernel.org
Reported-by: Priya Bala Govindasamy <pgovind2@uci.edu>, Dylan Zueck <dzueck@uci.edu>, Yuan Tan <ytan089@ucr.edu>
Closes: https://lore.kernel.org/all/cover.1780633578.git.ytan089@ucr.edu
Signed-off-by: Yuan Tan <ytan089@ucr.edu>
Link: https://msgid.link/20260709100100.604252-1-yuantan098@gmail.com
[ Andreas: Fix tags to make checkpatch happy. Change summary line. ]
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260929-rust-block-for-v7-4-rc1-b4-v1-4-642a4c1aebd7@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/block/mq/gen_disk.rs | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/rust/kernel/block/mq/gen_disk.rs
+++ b/rust/kernel/block/mq/gen_disk.rs
@@ -212,8 +212,14 @@ pub struct GenDisk<T: Operations> {
}
// SAFETY: `GenDisk` is an owned pointer to a `struct gendisk` and an `Arc` to a
-// `TagSet` It is safe to send this to other threads as long as T is Send.
-unsafe impl<T: Operations + Send> Send for GenDisk<T> {}
+// `TagSet`. It is safe to send this to other threads as long as these two are `Send`.
+unsafe impl<T> Send for GenDisk<T>
+where
+ T: Operations,
+ T::QueueData: Send,
+ Arc<TagSet<T>>: Send,
+{
+}
impl<T: Operations> Drop for GenDisk<T> {
fn drop(&mut self) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 196/547] rust: block: require `Sync` for `Operations::QueueData`
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 195/547] rust: block: fix `Send` bound for `GenDisk` Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 197/547] rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML Greg Kroah-Hartman
` (359 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Gary Guo,
Andreas Hindborg, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Hindborg <a.hindborg@kernel.org>
commit 67b7a2728e4873e64405c5564fe50f7123012b71 upstream.
The queue data installed in a `GenDisk` is stored in the request queue and
handed back to the driver as a shared borrow through the `queue_rq` and
`commit_rqs` callbacks. Both callbacks obtain that borrow via
`ForeignOwnable::borrow` and may execute concurrently on several CPUs,
since the block layer runs one hardware queue per CPU. That means a shared
reference to the same queue data can be live on multiple threads at once,
which is only sound when the referent is `Sync`.
The initial `GenDisk` private data support omitted this bound, so a
driver could install a non-`Sync` type as queue data and then access
it concurrently from multiple CPUs without synchronization. Add a
`Sync` bound to the `QueueData` associated type to rule that out.
Fixes: 90d952fac8ac ("rust: block: add `GenDisk` private data support")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://msgid.link/20260608-queue-data-sync-v1-1-0efff051aaf3@kernel.org
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260929-rust-block-for-v7-4-rc1-b4-v1-9-642a4c1aebd7@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/block/mq/operations.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/rust/kernel/block/mq/operations.rs
+++ b/rust/kernel/block/mq/operations.rs
@@ -30,7 +30,7 @@ type ForeignBorrowed<'a, T> = <T as Fore
pub trait Operations: Sized {
/// Data associated with the `struct request_queue` that is allocated for
/// the `GenDisk` associated with this `Operations` implementation.
- type QueueData: ForeignOwnable;
+ type QueueData: ForeignOwnable + Sync;
/// Called by the kernel to queue a request with the driver. If `is_last` is
/// `false`, the driver is allowed to defer committing the request.
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 197/547] rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 196/547] rust: block: require `Sync` for `Operations::QueueData` Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 198/547] rust: bug: update the SAFETY comment for " Greg Kroah-Hartman
` (358 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, FUJITA Tomonori, Miguel Ojeda
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
commit 951d09ca450ca76a695016ea76c3fa653bd20439 upstream.
On UML, `warn_flags!` calls `warn_slowpath_fmt()` directly. Its third
argument is a taint number, but `warn_on!` passes its bug flags there.
As a result, `add_taint()` gets 2304 instead of 9 (`TAINT_WARN`). The
warning is not recorded: `/proc/sys/kernel/tainted` stays 0 after
`warn_on!` fires, where it should be 512. It also causes an
out-of-bounds write in `add_taint()`.
Pass `TAINT_WARN` directly, as C does on UML.
Cc: stable@vger.kernel.org
Fixes: dff64b072708 ("rust: Add warn_on macro")
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20261001123103.2198104-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/bug.rs | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/rust/kernel/bug.rs
+++ b/rust/kernel/bug.rs
@@ -85,6 +85,7 @@ macro_rules! warn_flags {
($file:expr, $flags:expr) => {
if false {
_ = $file;
+ _ = $flags;
}
// SAFETY: It is always safe to call `warn_slowpath_fmt()`
@@ -93,7 +94,7 @@ macro_rules! warn_flags {
$crate::bindings::warn_slowpath_fmt(
$crate::str::CStrExt::as_char_ptr($crate::c_str!(::core::file!())),
line!() as $crate::ffi::c_int,
- $flags as $crate::ffi::c_uint,
+ $crate::bindings::TAINT_WARN,
::core::ptr::null(),
);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 198/547] rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 197/547] rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 199/547] rust: configfs: fix data offset calculation for subsystem callbacks Greg Kroah-Hartman
` (357 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miguel Ojeda, FUJITA Tomonori
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
commit 5c94956f2bfb87025c1eaded6c51d5841d38d333 upstream.
The SAFETY comment says that it is always safe to call
`warn_slowpath_fmt()` with a valid null-terminated string. This is not
true. The taint argument must also be a valid taint number.
Commit 951d09ca450c ("rust: bug: pass TAINT_WARN to warn_slowpath_fmt()
on UML") fixed a bug where it was not.
List each condition that the call meets: the file name, the taint
number, and the null `fmt`.
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20261002104550.2877930-1-tomo@flapping.org
Cc: stable@vger.kernel.org
Fixes: dff64b072708 ("rust: Add warn_on macro")
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/bug.rs | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/rust/kernel/bug.rs
+++ b/rust/kernel/bug.rs
@@ -88,8 +88,10 @@ macro_rules! warn_flags {
_ = $flags;
}
- // SAFETY: It is always safe to call `warn_slowpath_fmt()`
- // with a valid null-terminated string.
+ // SAFETY:
+ // - The file name is a null-terminated string with `'static` lifetime.
+ // - `TAINT_WARN` is a valid taint number.
+ // - `fmt` can be NULL, and NULL is passed.
unsafe {
$crate::bindings::warn_slowpath_fmt(
$crate::str::CStrExt::as_char_ptr($crate::c_str!(::core::file!())),
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 199/547] rust: configfs: fix data offset calculation for subsystem callbacks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 198/547] rust: bug: update the SAFETY comment for " Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 200/547] rust: cpufreq: reject NULL from cpufreq_cpu_get() Greg Kroah-Hartman
` (356 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andreas Hindborg
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Hindborg <a.hindborg@kernel.org>
commit e84c9b64df615e658e47561b835c1364dc48f0c0 upstream.
`get_group_data()` chooses between `Group::<Parent>::container_of()` and
`Subsystem::<Parent>::container_of()` based on whether `this` represents
the root group of a configfs subsystem. It detects this by checking
`(*this).cg_subsys.is_null()`, but `link_group()` in `fs/configfs/dir.c`
unconditionally sets `cg_subsys` for every `config_group` attached anywhere
in a registered subsystem, including the subsystem's own `su_group`. The
only `config_group` with a NULL `cg_subsys` is the configfs root, on which
userspace cannot trigger callbacks. The check is therefore always false at
runtime, and the `Subsystem` branch is dead. Subsystem-level callbacks
reach the `Group` branch and may read `data` at the wrong offset.
Thus change the `is_root` check to correctly identify whether a group is a
root group by comparing `this` to `subsys.su_group`.
Cc: stable@vger.kernel.org
Fixes: 446cafc295bf ("rust: configfs: introduce rust support for configfs")
Link: https://msgid.link/20260608-configfs-fix-offset-v1-1-7f01b8fb9e5f@kernel.org
[ Andreas: Fix clippy warning on 1.85.0 by moving safety comment. ]
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/configfs.rs | 43 ++++++++++++++++++++++++++++---------------
1 file changed, 28 insertions(+), 15 deletions(-)
--- a/rust/kernel/configfs.rs
+++ b/rust/kernel/configfs.rs
@@ -297,26 +297,39 @@ unsafe impl<Data> HasGroup<Data> for Gro
///
/// `this` must be a valid pointer.
///
-/// If `this` does not represent the root group of a configfs subsystem,
-/// `this` must be a pointer to a `bindings::config_group` embedded in a
-/// `Group<Parent>`.
+/// If `this` is the `su_group` field of a `bindings::configfs_subsystem`, that
+/// `configfs_subsystem` must be embedded in a `Subsystem<Parent>`.
///
-/// Otherwise, `this` must be a pointer to a `bindings::config_group` that
-/// is embedded in a `bindings::configfs_subsystem` that is embedded in a
-/// `Subsystem<Parent>`.
+/// Otherwise, `this` must be a pointer to a `bindings::config_group` embedded
+/// in a `Group<Parent>`.
unsafe fn get_group_data<'a, Parent>(this: *mut bindings::config_group) -> &'a Parent {
// SAFETY: `this` is a valid pointer.
- let is_root = unsafe { (*this).cg_subsys.is_null() };
+ let subsys = unsafe { (*this).cg_subsys };
- if !is_root {
- // SAFETY: By C API contact,`this` was returned from a call to
- // `make_group`. The pointer is known to be embedded within a
- // `Group<Parent>`.
- unsafe { &(*Group::<Parent>::container_of(this)).data }
- } else {
- // SAFETY: By C API contract, `this` is a pointer to the
- // `bindings::config_group` field within a `Subsystem<Parent>`.
+ // `link_group()` in `fs/configfs/dir.c` assigns `cg_subsys` for every
+ // `config_group` attached anywhere in a registered subsystem, including
+ // the subsystem's own `su_group` (which gets a pointer to itself). The
+ // only `config_group` with a NULL `cg_subsys` is the configfs root, and
+ // userspace cannot trigger callbacks on it. The group is therefore the
+ // subsystem's `su_group` iff it equals `&cg_subsys->su_group`.
+ let is_root = !subsys.is_null()
+ && core::ptr::eq(
+ this.cast_const(),
+ // SAFETY: For every `config_group` the configfs core dispatches a
+ // callback on, `cg_subsys` was set by `link_group()` at registration time
+ // and points to a valid `configfs_subsystem` that outlives the callback.
+ unsafe { &raw const (*subsys).su_group },
+ );
+
+ if is_root {
+ // SAFETY: By the above, `this` is the `su_group` field of a
+ // `configfs_subsystem` that, by function safety requirements, is
+ // embedded in a `Subsystem<Parent>`.
unsafe { &(*Subsystem::container_of(this)).data }
+ } else {
+ // SAFETY: By function safety requirements, `this` is a
+ // `config_group` embedded in a `Group<Parent>`.
+ unsafe { &(*Group::<Parent>::container_of(this)).data }
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 200/547] rust: cpufreq: reject NULL from cpufreq_cpu_get()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 199/547] rust: configfs: fix data offset calculation for subsystem callbacks Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 201/547] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope Greg Kroah-Hartman
` (355 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mehmet Koseoglu, Onur Özkan,
spidermana, Viresh Kumar
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehmet Koseoglu <mehmet.mkoseoglu@gmail.com>
commit 02c5d7bfa8724789f6620f7787532666edc891a1 upstream.
cpufreq_cpu_get() returns either a referenced policy or NULL.
PolicyCpu::from_cpu() passed its return value to from_err_ptr(), which
rejects ERR_PTR values but accepts NULL.
If the lookup fails, Policy::from_raw_mut() therefore constructs a mutable
reference from NULL. Dropping the resulting PolicyCpu then passes the
invalid pointer to cpufreq_cpu_put(), causing an oops in kobject_put().
Reject NULL with NonNull before constructing the Policy reference. Return
ENODEV instead.
A KUnit negative-control run reproduced the oops with the original
conversion. The same test passed with this change. The reproducer is
available on request.
Fixes: 6ebdd7c93177 ("rust: cpufreq: Extend abstractions for policy and driver ops")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Mehmet Koseoglu <mehmet.mkoseoglu@gmail.com>
Reviewed-by: Onur Özkan <work@onurozkan.dev>
Reviewed-by: spidermana <xuyiwen14@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/cpufreq.rs | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/rust/kernel/cpufreq.rs
+++ b/rust/kernel/cpufreq.rs
@@ -14,7 +14,13 @@ use crate::{
cpumask,
device::{Bound, Device},
devres,
- error::{code::*, from_err_ptr, from_result, to_result, Result, VTABLE_DEFAULT_ERROR},
+ error::{
+ code::*,
+ from_result,
+ to_result,
+ Result,
+ VTABLE_DEFAULT_ERROR, //
+ },
ffi::{c_char, c_ulong},
prelude::*,
types::ForeignOwnable,
@@ -29,7 +35,10 @@ use core::{
marker::PhantomData,
ops::{Deref, DerefMut},
pin::Pin,
- ptr,
+ ptr::{
+ self,
+ NonNull, //
+ },
};
use macros::vtable;
@@ -687,12 +696,13 @@ struct PolicyCpu<'a>(&'a mut Policy);
impl<'a> PolicyCpu<'a> {
fn from_cpu(cpu: CpuId) -> Result<Self> {
// SAFETY: It is safe to call `cpufreq_cpu_get` for any valid CPU.
- let ptr = from_err_ptr(unsafe { bindings::cpufreq_cpu_get(u32::from(cpu)) })?;
+ let ptr =
+ NonNull::new(unsafe { bindings::cpufreq_cpu_get(u32::from(cpu)) }).ok_or(ENODEV)?;
Ok(Self(
- // SAFETY: The `ptr` is guaranteed to be valid and remains valid for the lifetime of
- // the returned reference.
- unsafe { Policy::from_raw_mut(ptr) },
+ // SAFETY: `ptr` is non-NULL and `cpufreq_cpu_get()` took a reference on it, so it is
+ // valid for writing and remains valid for the lifetime of the returned reference.
+ unsafe { Policy::from_raw_mut(ptr.as_ptr()) },
))
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 201/547] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 200/547] rust: cpufreq: reject NULL from cpufreq_cpu_get() Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 202/547] rust: module_param: Fix potentially incorrect access of `SetOnce<T>` Greg Kroah-Hartman
` (354 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Zhi Wang,
Jason Gunthorpe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <aliceryhl@google.com>
commit bc6f2a284c63313e789d8cd294531e1cc2dc8c99 upstream.
Currently, VTable::fw_rpc_callback() takes scope as a u32, whereas C
calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With kCFI enabled,
enum types are encoded distinctly from integers, causing every fw_rpc
indirect call into a Rust fwctl driver to trip a CFI failure. Thus,
generate fwctl_rpc_scope as a newtype with a cfi_encoding attribute and
use it in fw_rpc_callback().
Link: https://patch.msgid.link/r/20261020-fwctl-cfi-encoding-v1-1-ebb30d1500df@google.com
Cc: stable@vger.kernel.org
Fixes: e052daab94ee ("rust: introduce abstractions for fwctl")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Zhi Wang <zhiw@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/bindgen_parameters | 2 ++
rust/kernel/fwctl.rs | 12 ++++++------
2 files changed, 8 insertions(+), 6 deletions(-)
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -27,6 +27,8 @@
--opaque-type spinlock
# enums that appear in indirect function calls should specify a cfi type
+--newtype-enum fwctl_rpc_scope
+--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
--newtype-enum lru_status
--with-attribute-custom-enum=lru_status='#[cfi_encoding="10lru_status"]'
--- a/rust/kernel/fwctl.rs
+++ b/rust/kernel/fwctl.rs
@@ -53,13 +53,13 @@ pub enum DeviceType {
#[derive(Copy, Clone, Debug, Eq, PartialEq)]
pub enum RpcScope {
/// Read/write access to device configuration.
- Configuration = bindings::fwctl_rpc_scope_FWCTL_RPC_CONFIGURATION,
+ Configuration = bindings::fwctl_rpc_scope::FWCTL_RPC_CONFIGURATION.0,
/// Read-only access to debug information.
- DebugReadOnly = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_READ_ONLY,
+ DebugReadOnly = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_READ_ONLY.0,
/// Write access to lockdown-compatible debug information.
- DebugWrite = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE,
+ DebugWrite = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE.0,
/// Full read/write access to all debug information (requires `CAP_SYS_RAWIO`).
- DebugWriteFull = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE_FULL,
+ DebugWriteFull = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE_FULL.0,
}
impl TryFrom<u32> for RpcScope {
@@ -539,12 +539,12 @@ impl<T: Operations> VTable<T> {
/// - `out_len` must be valid for reading and writing an initialised `usize`.
unsafe extern "C" fn fw_rpc_callback(
uctx: *mut bindings::fwctl_uctx,
- scope: u32,
+ scope: bindings::fwctl_rpc_scope,
rpc_in: *mut ffi::c_void,
in_len: usize,
out_len: *mut usize,
) -> *mut ffi::c_void {
- let scope = match RpcScope::try_from(scope) {
+ let scope = match RpcScope::try_from(scope.0) {
Ok(s) => s,
Err(e) => return Error::to_ptr(e),
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 202/547] rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 201/547] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 203/547] rust: rcpufreq_dt: add module alias Greg Kroah-Hartman
` (353 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dylan Zueck, Andreas Hindborg,
Priya Bala Govindasamy, Petr Pavlu
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priya Bala Govindasamy <pgovind2@uci.edu>
commit 2e8bac09ed6d7aa2ad4e8a9a6cba67e5835865c2 upstream.
The `set_param` function casts `kernel_param.arg` to `*const SetOnce<T>`
But the Rust module macro in rust/macros/module.rs initializes `arg` with
`#param_name.as_void_ptr()`, and `#param_name` is a `ModuleParamAccess<T>`,
not a `SetOnce<T>`.
ModuleParamAccess<T> has default Rust layout but `set_param` accesses its
first field SetOnce<T> assuming it to be at offset 0. This is not
guaranteed by Rust and could cause type confusion leading to data
corruption.
Fix this by casting `kernel_param.arg` to `ModuleParamAccess<T>` and
then accessing the `value: SetOnce<T>` field.
Fixes: 0b08fc292842 ("rust: introduce module_param module")
Cc: stable@vger.kernel.org
Reported-by: Dylan Zueck <dzueck@uci.edu>
Assisted-by: LLM
Suggested-by: Andreas Hindborg <a.hindborg@kernel.org>
Signed-off-by: Priya Bala Govindasamy <pgovind2@uci.edu>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/module_param.rs | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/rust/kernel/module_param.rs
+++ b/rust/kernel/module_param.rs
@@ -74,8 +74,13 @@ where
crate::error::from_result(|| {
let new_value = T::try_from_param_arg(arg)?;
- // SAFETY: By function safety requirements, this access is safe.
- let container = unsafe { &*((*param).__bindgen_anon_1.arg.cast::<SetOnce<T>>()) };
+ // SAFETY: By function safety requirements, `param` is valid for read.
+ let arg = unsafe { (*param).__bindgen_anon_1.arg };
+ let param_access_ptr = arg.cast::<ModuleParamAccess<T>>();
+ // SAFETY: The `arg` field is initialized with a pointer to a `static ModuleAccessParam` by
+ // the rust module macro. Thus, the pointer is valid for use as a reference.
+ let param_access = unsafe { &*(param_access_ptr) };
+ let container = ¶m_access.value;
container
.populate(new_value)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 203/547] rust: rcpufreq_dt: add module alias
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 202/547] rust: module_param: Fix potentially incorrect access of `SetOnce<T>` Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 204/547] accel/amdxdna: clear the mailbox channel pointer when starting it fails Greg Kroah-Hartman
` (352 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Zhang, Viresh Kumar
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Zhang <rmxpzlb@gmail.com>
commit 53732733c7af437b0ed710a1df91a67a0d3dfc07 upstream.
Add the missing `platform:cpufreq-dt` module alias so that the driver
can be automatically loaded when the platform device is registered.
Fixes: 06149d8f2216 ("cpufreq: Add Rust-based cpufreq-dt driver")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/rcpufreq_dt.rs | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/cpufreq/rcpufreq_dt.rs
+++ b/drivers/cpufreq/rcpufreq_dt.rs
@@ -225,4 +225,5 @@ module_platform_driver! {
authors: ["Viresh Kumar <viresh.kumar@linaro.org>"],
description: "Generic CPUFreq DT driver",
license: "GPL v2",
+ alias: ["platform:cpufreq-dt"],
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 204/547] accel/amdxdna: clear the mailbox channel pointer when starting it fails
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 203/547] rust: rcpufreq_dt: add module alias Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 205/547] ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect Greg Kroah-Hartman
` (351 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eva Crystal, Lizhi Hou
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eva Crystal <0xiviel@gmail.com>
commit 2117e3d96a4fd1ee13fa28b31494ff5f5db6ccf4 upstream.
aie2_create_context() allocates a mailbox channel, starts it, and on a
failed start frees it again:
hwctx->priv->mbox_chann = xdna_mailbox_alloc_channel(ndev->mbox);
...
ret = xdna_mailbox_start_channel(hwctx->priv->mbox_chann, ...);
if (ret)
goto free_channel;
...
free_channel:
xdna_mailbox_free_channel(hwctx->priv->mbox_chann);
hwctx->priv->mbox_chann keeps pointing at the freed channel. That
pointer is the driver's own test for whether a hardware context has a
usable channel: aie2_destroy_context() returns early on NULL,
aie2_sched_job_run() refuses to run a job on NULL, and the message
helpers return -ENODEV on NULL. A stale pointer passes all of them.
It matters on the restart path. aie2_hwctx_restart() calls
aie2_create_context() again on a hardware context that is already live,
after aie2_hwctx_stop() has torn its channel down, and the context
survives a failure there: aie2_sched_job_timedout() discards the return
value entirely, and aie2_hwctx_resume() only propagates it. What is
left is a live hardware context holding a freed channel, and every
later user of it takes the non-NULL branch:
- the next job submitted reaches xdna_mailbox_send_msg() on the freed
channel, via the !mbox_chann guard in aie2_sched_job_run(),
- a second command timeout reaches aie2_hwctx_stop() ->
aie2_destroy_context(),
- closing the device reaches aie2_hwctx_fini() ->
aie2_release_resource() -> xrs_release_resource() ->
aie2_xrs_unload() -> aie2_destroy_context(),
and aie2_destroy_context() then calls xdna_mailbox_stop_channel()
followed by xdna_mailbox_free_channel() on memory that was already
freed: a use-after-free, and a second free of the same channel.
The AIE4 management channel already does this correctly -
aie4_mailbox_start() clears ndev->aie.mgmt_chann right after freeing
it. Do the same here.
The create path itself is not affected: when aie2_xrs_load() fails,
xrs_allocate_resource() removes the solver node without calling
->unload, and aie2_hwctx_init() frees hwctx->priv, so the stale pointer
never outlives the structure holding it.
Starting a channel can fail today without this patch: the ring buffer
sizes firmware reports are rejected unless both are powers of two, and
request_irq() can fail.
Fixes: d5b8b0347fa8 ("accel/amdxdna: Split mailbox channel create function")
Cc: stable@vger.kernel.org
Signed-off-by: Eva Crystal <0xiviel@gmail.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/2fcf0eca215090dbbd95cb86e1bf5076056d3818.1789334558.git.0xiviel@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/amdxdna/aie2_message.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
index b4c49259a1a2..f658760c3d48 100644
--- a/drivers/accel/amdxdna/aie2_message.c
+++ b/drivers/accel/amdxdna/aie2_message.c
@@ -277,6 +277,7 @@ int aie2_create_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwct
free_channel:
xdna_mailbox_free_channel(hwctx->priv->mbox_chann);
+ hwctx->priv->mbox_chann = NULL;
del_ctx_req:
aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
return ret;
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 205/547] ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 204/547] accel/amdxdna: clear the mailbox channel pointer when starting it fails Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 206/547] ALSA: emux: Fix UAF of soundfont zones at note-on Greg Kroah-Hartman
` (350 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Farhad Alemi, Takashi Iwai
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d4febca239be3c91498762dd0535a87d4af1eabc upstream.
A use-after-free can be triggered via SNDRV_CTL_IOCTL_ELEM_ADD when a
USB audio card is disconnected while an ELEM_ADD ioctl is in flight.
The reproducer parks the ioctl thread inside copy_from_user() using
userfaultfd, then tears down the USB device. Unlike every other
ALSA control _user handler (ELEM_INFO, ELEM_READ, ELEM_WRITE, TLV_*),
snd_ctl_elem_add_user() never calls snd_power_ref_and_wait(), so the
parked thread holds no power reference. snd_card_disconnect() therefore
cannot observe it via snd_power_sync_ref() and proceeds unimpeded:
1. card->shutdown is set to 1
2. device_del(&card->card_dev) drops the kobject reference on the
parent USB interface device (card->dev = &intf->dev)
3. The USB core drops its own reference and calls device_release(),
freeing the struct usb_interface, including the embedded struct
device that card->dev points to
When the userfaultfd is resolved and the thread resumes,
snd_ctl_elem_add() acquires controls_rwsem without checking
card->shutdown and calls __snd_ctl_add_replace(). Because the
reproducer pre-registered the same control, the CTL_ADD_EXCLUSIVE
path calls dev_err(card->dev, ...) on the freed USB interface:
KASAN: slab-use-after-free Read in __dev_printk
Add a card->shutdown guard immediately after acquiring controls_rwsem
in snd_ctl_elem_add(). At that point card->shutdown is guaranteed to
be stable: snd_card_disconnect() sets it before freeing the parent
device, and it never transitions back to 0. A thread that acquired
the lock before disconnect sees shutdown=0 and holds the write lock
through the rest of the operation, preventing concurrent disconnect
from proceeding past its own controls_rwsem-less shutdown=1 store
(which happened earlier, outside the lock) from racing with dev_err().
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260929125346.1478631-3-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1802,6 +1802,8 @@ static int snd_ctl_elem_add(struct snd_c
alloc_size = compute_user_elem_size(private_size, count);
guard(rwsem_write)(&card->controls_rwsem);
+ if (card->shutdown)
+ return -ENODEV;
if (check_user_elem_overflow(card, alloc_size))
return -ENOMEM;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 206/547] ALSA: emux: Fix UAF of soundfont zones at note-on
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 205/547] ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 207/547] ALSA: pcmtest: handle multiple wraps in random capture fill Greg Kroah-Hartman
` (349 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Takashi Iwai
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 34e3e04b8a1731a773797542f0781e99ce7cd755 upstream.
snd_emux_note_on() looks up the matching zones via
snd_soundfont_search_zone(), which takes sflist->lock only during the
lookup and returns the raw zone pointers after releasing it. The
caller then stores them in vp->zone without any protection.
Meanwhile, a concurrent SNDRV_EMUX_IOCTL_REMOVE_LAST_SAMPLES ioctl may
unlink and free those zones in snd_soundfont_remove_unlocked(); this
leads to a use-after-free in snd_emux_note_on(), and later at
accessing the cached vp->zone, e.g. in snd_emux_send_effect().
Fix it by holding sflist->lock in snd_emux_note_on() over the whole
zone lookup and voice setup, and let snd_soundfont_search_zone()
require the caller to hold the lock, instead.
snd_soundfont_lock_preset() takes sflist->lock for setting
presets_locked, so the removal path now syncs with the note-on finish.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-697212bb-a434-4ff5-8778-25a84f5dad89
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020101624.205638-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/synth/emux/emux_synth.c | 3 +++
sound/synth/emux/soundfont.c | 9 ++++++---
2 files changed, 9 insertions(+), 3 deletions(-)
--- a/sound/synth/emux/emux_synth.c
+++ b/sound/synth/emux/emux_synth.c
@@ -60,6 +60,9 @@ snd_emux_note_on(void *p, int note, int
return;
key = note; /* remember the original note */
+
+ /* hold sflist->lock for protecting against concurrent free */
+ guard(spinlock_irqsave)(&emu->sflist->lock);
nvoices = get_zone(emu, port, ¬e, vel, chan, table);
if (! nvoices)
return;
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -1225,6 +1225,9 @@ delete_preset(struct snd_sf_list *sflist
* The found zones are stored on 'table' array. max_layers defines
* the maximum number of elements in this array.
* This function returns the number of found zones. 0 if not found.
+ *
+ * The caller must hold sflist->lock, and keep holding it as long as
+ * the returned zones are accessed.
*/
int
snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
@@ -1234,11 +1237,11 @@ snd_soundfont_search_zone(struct snd_sf_
{
int nvoices;
- /* this function is supposed to be called atomically,
- * so we check the lock. if it's busy, just returns 0 to
+ lockdep_assert_held(&sflist->lock);
+
+ /* if the presets are being modified, just returns 0 to
* tell the caller the busy state
*/
- guard(spinlock_irqsave)(&sflist->lock);
if (sflist->presets_locked)
return 0;
nvoices = search_zones(sflist, notep, vel, preset, bank,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 207/547] ALSA: pcmtest: handle multiple wraps in random capture fill
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 206/547] ALSA: emux: Fix UAF of soundfont zones at note-on Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 208/547] ASoC: amd: ps: fix snd_acp63_remove() teardown ordering Greg Kroah-Hartman
` (348 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sung Byeongchan, Takashi Iwai
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Byeongchan <tjdqudcks0424@naver.com>
commit 6541871e8e63e721733cd120af4d9cd22c5ef62f upstream.
The random capture helpers assume that the data generated for one timer
tick wraps the DMA ring at most once. However, b_rw describes 200 ms of
audio because the timer runs at 5 Hz, so it can be several times larger
than a small ring.
For 48 kHz, S16_LE, four-channel capture with a 512-frame buffer, the DMA
ring is 4096 bytes while one tick generates 76800 bytes. After filling the
4096-byte tail, the existing code issues a second 72704-byte write from the
ring base, writing 68608 bytes beyond the ring. Both interleaved and
non-interleaved capture are affected.
KASAN reports the first write into the adjacent free page as a
use-after-free in the random-byte generator. The underlying defect is an
out-of-bounds write from the live DMA ring, not a stale DMA allocation.
Split each random write repeatedly at the interleaved ring or per-channel
block boundary. Keep the hardware-pointer update exactly once after the
complete logical write.
The issue reproduced on three of three clean boots. With this change, the
same vulnerable geometry completed six times without a sanitizer finding.
Boundary, pattern-fill, no-timer, open/close, and module-reload controls
also completed normally.
snd-pcmtest is a test driver, and selecting random fill requires an
administrator-controlled module parameter. The written values come from the
kernel random generator; no privilege escalation or attacker-controlled
write primitive was demonstrated.
Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI Codex
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Link: https://patch.msgid.link/20261003101854.1423146-1-tjdqudcks0424@naver.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/pcmtest.c | 42 +++++++++++++++++++-----------------------
1 file changed, 19 insertions(+), 23 deletions(-)
--- a/sound/drivers/pcmtest.c
+++ b/sound/drivers/pcmtest.c
@@ -280,39 +280,35 @@ static void fill_block_pattern(struct pc
fill_block_pattern_n(v_iter, runtime);
}
+static void fill_random_block(char *buf, size_t buf_size, size_t pos,
+ size_t count)
+{
+ while (count) {
+ size_t chunk = min(count, buf_size - pos);
+
+ get_random_bytes(buf + pos, chunk);
+ count -= chunk;
+ pos = 0;
+ }
+}
+
static void fill_block_rand_n(struct pcmtst_buf_iter *v_iter, struct snd_pcm_runtime *runtime)
{
unsigned int channels = runtime->channels;
- // Remaining space in all channel buffers
- size_t bytes_remain = runtime->dma_bytes - v_iter->buf_pos;
+ size_t pos = v_iter->buf_pos / channels;
unsigned int i;
- for (i = 0; i < channels; i++) {
- if (v_iter->b_rw <= bytes_remain) {
- //b_rw - count of bytes must be written for all channels at each timer tick
- get_random_bytes(runtime->dma_area + buf_pos_n(v_iter, channels, i),
- v_iter->b_rw / channels);
- } else {
- // Write to the end of buffer and start from the beginning of it
- get_random_bytes(runtime->dma_area + buf_pos_n(v_iter, channels, i),
- bytes_remain / channels);
- get_random_bytes(runtime->dma_area + v_iter->chan_block * i,
- (v_iter->b_rw - bytes_remain) / channels);
- }
- }
+ for (i = 0; i < channels; i++)
+ fill_random_block(runtime->dma_area + v_iter->chan_block * i,
+ v_iter->chan_block, pos,
+ v_iter->b_rw / channels);
inc_buf_pos(v_iter, v_iter->b_rw, runtime->dma_bytes);
}
static void fill_block_rand_i(struct pcmtst_buf_iter *v_iter, struct snd_pcm_runtime *runtime)
{
- size_t in_cur_block = runtime->dma_bytes - v_iter->buf_pos;
-
- if (v_iter->b_rw <= in_cur_block) {
- get_random_bytes(&runtime->dma_area[v_iter->buf_pos], v_iter->b_rw);
- } else {
- get_random_bytes(&runtime->dma_area[v_iter->buf_pos], in_cur_block);
- get_random_bytes(runtime->dma_area, v_iter->b_rw - in_cur_block);
- }
+ fill_random_block(runtime->dma_area, runtime->dma_bytes,
+ v_iter->buf_pos, v_iter->b_rw);
inc_buf_pos(v_iter, v_iter->b_rw, runtime->dma_bytes);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 208/547] ASoC: amd: ps: fix snd_acp63_remove() teardown ordering
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 207/547] ALSA: pcmtest: handle multiple wraps in random capture fill Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 209/547] Bluetooth: hci_vhci: Pin module for debugfs file operations Greg Kroah-Hartman
` (347 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Vijendar Mukunda,
Mark Brown
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit c53791d673ed4da6759d276078627ec4d0c6536b upstream.
The ACP IRQ handlers dereference the SoundWire, SoundWire DMA, and PDM
child platform devices, but snd_acp63_remove() unregisters them while
the interrupt is still held by devres, which frees it only after remove
returns. An interrupt in this window is a use-after-free.
Mask the ACP interrupt sources and call devm_free_irq() before the
first child device is unregistered. The masking goes through the new
acp_hw_ops->disable_interrupts callback, keeping the remove path
platform-agnostic. The interrupt line is shared, and acp_hw_deinit()
clears the sources only after the children are gone, which would
leave the line raised with no handler left to ack it. The window
predates the tagged refactor, which only reshaped the dereferences.
devm_free_irq() waits for in-flight handlers, but not for work the
hardirq has already queued: acp63_irq_handler() schedules
amd_sdw_irq_thread on the SoundWire manager. Draining that work in
the manager's remove path is a soundwire-side change and follows
separately.
This issue was found by an in-house static analysis tool.
Fixes: eaf825037d6d ("ASoC: amd: ps: refactor acp child platform device creation code")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260929061349.3879-1-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/amd/ps/acp63.h | 8 ++++++++
sound/soc/amd/ps/pci-ps.c | 2 ++
sound/soc/amd/ps/ps-common.c | 2 ++
3 files changed, 12 insertions(+)
--- a/sound/soc/amd/ps/acp63.h
+++ b/sound/soc/amd/ps/acp63.h
@@ -294,6 +294,7 @@ struct acp63_dev_data;
* struct acp_hw_ops - ACP PCI driver platform specific ops
* @acp_init: ACP initialization
* @acp_deinit: ACP de-initialization
+ * @disable_interrupts: disable ACP interrupt sources
* @acp_get_config: function to read the acp pin configuration
* @acp_sdw_dma_irq_thread: ACP SoundWire DMA interrupt thread
* acp_suspend: ACP system level suspend callback
@@ -304,6 +305,7 @@ struct acp63_dev_data;
struct acp_hw_ops {
int (*acp_init)(void __iomem *acp_base, struct device *dev);
int (*acp_deinit)(void __iomem *acp_base, struct device *dev);
+ void (*disable_interrupts)(void __iomem *acp_base);
void (*acp_get_config)(struct pci_dev *pci, struct acp63_dev_data *acp_data);
void (*acp_sdw_dma_irq_thread)(struct acp63_dev_data *acp_data);
int (*acp_suspend)(struct device *dev);
@@ -397,6 +399,12 @@ static inline int acp_hw_deinit(struct a
return -EOPNOTSUPP;
}
+static inline void acp_hw_disable_interrupts(struct acp63_dev_data *adata)
+{
+ if (adata && adata->hw_ops && adata->hw_ops->disable_interrupts)
+ ACP_HW_OPS(adata, disable_interrupts)(adata->acp63_base);
+}
+
static inline void acp_hw_get_config(struct pci_dev *pci, struct acp63_dev_data *adata)
{
if (adata && adata->hw_ops && adata->hw_ops->acp_get_config)
--- a/sound/soc/amd/ps/pci-ps.c
+++ b/sound/soc/amd/ps/pci-ps.c
@@ -738,6 +738,8 @@ static void snd_acp63_remove(struct pci_
int ret;
adata = pci_get_drvdata(pci);
+ acp_hw_disable_interrupts(adata);
+ devm_free_irq(&pci->dev, pci->irq, adata);
if (adata->sdw) {
amd_sdw_exit(adata);
platform_device_unregister(adata->sdw_dma_dev);
--- a/sound/soc/amd/ps/ps-common.c
+++ b/sound/soc/amd/ps/ps-common.c
@@ -248,6 +248,7 @@ void acp63_hw_init_ops(struct acp_hw_ops
{
hw_ops->acp_init = acp63_init;
hw_ops->acp_deinit = acp63_deinit;
+ hw_ops->disable_interrupts = acp63_disable_interrupts;
hw_ops->acp_get_config = acp63_get_config;
hw_ops->acp_sdw_dma_irq_thread = acp63_sdw_dma_irq_thread;
hw_ops->acp_suspend = snd_acp63_suspend;
@@ -484,6 +485,7 @@ void acp70_hw_init_ops(struct acp_hw_ops
{
hw_ops->acp_init = acp70_init;
hw_ops->acp_deinit = acp70_deinit;
+ hw_ops->disable_interrupts = acp70_disable_interrupts;
hw_ops->acp_get_config = acp70_get_config;
hw_ops->acp_sdw_dma_irq_thread = acp70_sdw_dma_irq_thread;
hw_ops->acp_suspend = snd_acp70_suspend;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 209/547] Bluetooth: hci_vhci: Pin module for debugfs file operations
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 208/547] ASoC: amd: ps: fix snd_acp63_remove() teardown ordering Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 210/547] drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase Greg Kroah-Hartman
` (346 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bui Viet Dung,
Luiz Augusto von Dentz
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
commit 645ee6b176c958579cff1c783413d5cff65c8197 upstream.
An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, force_suspend_fops, force_wakeup_fops,
aosp_capable_fops, and force_devcoredump_fops have no .owner set to
THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get()
which succeeds without taking a reference to the hci_vhci module.
When userspace opens any of these debugfs files and later closes
the /dev/vhci file descriptor (triggering vhci_release() and
debugfs file removal), the open debugfs file descriptor remains valid
in userspace. Because the module refcount was not incremented,
the hci_vhci module can be unloaded via delete_module (rmmod hci_vhci).
When the userspace process subsequently closes the debugfs file
descriptor, full_proxy_release() accesses the already unmapped
file_operations structure, resulting in a kernel page fault / oops:
BUG: unable to handle page fault for address: fffffbfff846f18b
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0x8e/0x140
Call Trace:
<TASK>
__fput+0x39f/0xa60
fput_close_sync+0xff/0x200
__x64_sys_close+0x8c/0xf0
do_syscall_64+0xc3/0x590
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Modules linked in: ... [last unloaded: hci_vhci(E)]
The issue was discovered via manual code audit of
drivers/bluetooth/hci_vhci.c and verified on a Linux 7.3-rc6 test VM
with CONFIG_BT_VHCI=m by keeping a debugfs file open across controller
teardown and module unload.
Set .owner = THIS_MODULE on all four file_operations structures so that
debugfs pins the module until all file descriptors are closed.
Fixes: 28010791193a ("Bluetooth: vhci: Prevent use-after-free by removing debugfs files early")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_vhci.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -155,6 +155,7 @@ static ssize_t force_suspend_write(struc
}
static const struct file_operations force_suspend_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_suspend_read,
.write = force_suspend_write,
@@ -194,6 +195,7 @@ static ssize_t force_wakeup_write(struct
}
static const struct file_operations force_wakeup_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_wakeup_read,
.write = force_wakeup_write,
@@ -263,6 +265,7 @@ static ssize_t aosp_capable_write(struct
}
static const struct file_operations aosp_capable_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = aosp_capable_read,
.write = aosp_capable_write,
@@ -386,6 +389,7 @@ static ssize_t force_devcd_write(struct
}
static const struct file_operations force_devcoredump_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.write = force_devcd_write,
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 210/547] drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 209/547] Bluetooth: hci_vhci: Pin module for debugfs file operations Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 211/547] fbdev: atmel_lcdfb: Prevent FIFO work after removal Greg Kroah-Hartman
` (345 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Brezillon, Liviu Dudau,
Osama Abdelkader, Steven Price
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <osama.abdelkader@gmail.com>
commit 7764289d76a38c3a2f9b093bf17e193ab54acd70 upstream.
panthor_group_destroy() checks the GROUP_REGISTERED mark and then calls
xa_erase() without holding the xarray lock across both. If the handle is
destroyed by another thread in between, and a concurrent GROUP_CREATE
reuses the freed ID, the first destroy erases and releases the new,
still-initializing group, leading to a use-after-free in
panthor_group_create().
Do the mark check and erase atomically under xa_lock().
Fixes: eec7e23d848d ("drm/panthor: Prevent potential UAF in group creation")
Assisted-by: Claude:claude-opus-5.5
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20261008100935.3059587-1-osama.abdelkader@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3794,12 +3794,18 @@ int panthor_group_destroy(struct panthor
struct panthor_group_pool *gpool = pfile->groups;
struct panthor_device *ptdev = pfile->ptdev;
struct panthor_scheduler *sched = ptdev->scheduler;
- struct panthor_group *group;
+ struct panthor_group *group = NULL;
- if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED))
- return -EINVAL;
+ /*
+ * Check the mark and erase the entry atomically, so a concurrent
+ * destroy + create can't make us erase a group that's still being
+ * initialized and happens to reuse the same handle.
+ */
+ xa_lock(&gpool->xa);
+ if (xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED))
+ group = __xa_erase(&gpool->xa, group_handle);
+ xa_unlock(&gpool->xa);
- group = xa_erase(&gpool->xa, group_handle);
if (!group)
return -EINVAL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 211/547] fbdev: atmel_lcdfb: Prevent FIFO work after removal
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 210/547] drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 212/547] fbdev: udlfb: dont rebuild the mode list while the framebuffer is in use Greg Kroah-Hartman
` (344 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yibo Tan, Helge Deller
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yibo Tan <lhfff@tju.edu.cn>
commit 20b3b97cf89cb381bf07516090d99399cc9b91fd upstream.
The LCD controller IRQ schedules sinfo->task to recover from a FIFO
underflow. Probe currently requests the IRQ before initializing the
work, so an early interrupt can schedule an uninitialized work item.
The probe error path and remove path cancel the work before freeing the
IRQ. A FIFO-underflow interrupt can schedule the work again after that
cancellation. framebuffer_release() may then free sinfo while the work
is still pending.
KASAN reported a use-after-free in atmel_lcdfb_task() when an underflow
interrupt occurred during removal. With the IRQ freed before the work
was cancelled, the same test completed without a kernel diagnostic.
Initialize the work before requesting the IRQ. In both cleanup paths,
free the IRQ before cancelling the work so that it cannot be scheduled
again after cancellation.
Fixes: d22579b83735 ("atmel_lcdfb: FIFO underflow management")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/atmel_lcdfb.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1146,6 +1146,9 @@ static int atmel_lcdfb_probe(struct plat
/* Initialize PWM for contrast or backlight ("off") */
init_contrast(sinfo);
+ /* Some LCDC recovery operations require process context. */
+ INIT_WORK(&sinfo->task, atmel_lcdfb_task);
+
/* interrupt */
ret = request_irq(sinfo->irq_base, atmel_lcdfb_interrupt, 0, pdev->name, info);
if (ret) {
@@ -1153,10 +1156,6 @@ static int atmel_lcdfb_probe(struct plat
goto unmap_mmio;
}
- /* Some operations on the LCDC might sleep and
- * require a preemptible task context */
- INIT_WORK(&sinfo->task, atmel_lcdfb_task);
-
ret = atmel_lcdfb_init_fbinfo(sinfo);
if (ret < 0) {
dev_err(dev, "init fbinfo failed: %d\n", ret);
@@ -1192,8 +1191,8 @@ reset_drvdata:
dev_set_drvdata(dev, NULL);
fb_dealloc_cmap(&info->cmap);
unregister_irqs:
- cancel_work_sync(&sinfo->task);
free_irq(sinfo->irq_base, info);
+ cancel_work_sync(&sinfo->task);
unmap_mmio:
exit_backlight(sinfo);
iounmap(sinfo->mmio);
@@ -1230,6 +1229,7 @@ static void atmel_lcdfb_remove(struct pl
return;
sinfo = info->par;
+ free_irq(sinfo->irq_base, info);
cancel_work_sync(&sinfo->task);
exit_backlight(sinfo);
atmel_lcdfb_power_control(sinfo, 0);
@@ -1238,7 +1238,6 @@ static void atmel_lcdfb_remove(struct pl
clk_put(sinfo->lcdc_clk);
clk_put(sinfo->bus_clk);
fb_dealloc_cmap(&info->cmap);
- free_irq(sinfo->irq_base, info);
iounmap(sinfo->mmio);
release_mem_region(info->fix.mmio_start, info->fix.mmio_len);
if (platform_get_resource(pdev, IORESOURCE_MEM, 1)) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 212/547] fbdev: udlfb: dont rebuild the mode list while the framebuffer is in use
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 211/547] fbdev: atmel_lcdfb: Prevent FIFO work after removal Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 213/547] filelock: keep superblock active through delegation wait Greg Kroah-Hartman
` (343 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+ed9902f2e44184d9, Xiang Mei,
Helge Deller
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit ac9cfa552102b8e80e88c2872e80dc9cb5f07dda upstream.
dlfb_setup_modes() frees info->modelist with fb_destroy_modelist() and
rebuilds it, but fbcon holds raw pointers into that list in
fb_display[i].mode and nothing un-publishes them the way
do_unregister_framebuffer() and store_modes() do with
fbcon_delete_modelist(). The function does refuse to install a new mode
while the framebuffer has users (dlfb->fb_count != 0), but only after the
list is already destroyed. Reached from the 0666 "edid" sysfs attribute,
an unprivileged write to /sys/class/graphics/fb0/edid therefore fails with
-EINVAL and still leaves every fb_display[i].mode dangling; the next
console switch reads the freed fb_videomode in fb_videomode_to_var().
Test fb_count before touching the list. fbcon takes a reference through
fbcon_open(), so that condition covers exactly the states in which
fb_display[] points into the list, and the errno returned to userspace is
unchanged.
BUG: KASAN: slab-use-after-free in fb_videomode_to_var (drivers/video/fbdev/core/modedb.c:905)
Read of size 4 at addr ffff8880107b449c by task kworker/1:1/47
Workqueue: events console_callback
Call Trace:
fb_videomode_to_var (drivers/video/fbdev/core/modedb.c:905)
display_to_var (drivers/video/fbdev/core/fbcon.c:998)
fbcon_switch (drivers/video/fbdev/core/fbcon.c:2182)
redraw_screen (drivers/tty/vt/vt.c:994)
complete_change_console (drivers/tty/vt/vt_ioctl.c:1141)
console_callback (drivers/tty/vt/vt.c:3358)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
...
The buggy address is located 28 bytes inside of
freed 96-byte region [ffff8880107b4480, ffff8880107b44e0)
Cc: stable@vger.kernel.org
Fixes: 7d9485e2c53c ("Staging: udlfb: Add functions to expose sysfs metrics and controls")
Reported-by: co+ed9902f2e44184d9@bugs.sh
Closes: https://lore.kernel.org/all/1jSCSNaDKmuUG7h40rTsSl1rMaSwdlJef4rp%40bugs.sh/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://lore.kernel.org/all/1jSCSNaDKmuUG7h40rTsSl1rMaSwdlJef4rp%40bugs.sh/
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/udlfb.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1293,6 +1293,11 @@ static int dlfb_setup_modes(struct dlfb_
goto error;
}
+ if (dlfb->fb_count) {
+ result = -EINVAL;
+ goto error;
+ }
+
fb_destroy_modelist(&info->modelist);
memset(&info->monspecs, 0, sizeof(info->monspecs));
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 213/547] filelock: keep superblock active through delegation wait
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 212/547] fbdev: udlfb: dont rebuild the mode list while the framebuffer is in use Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 214/547] fs/proc/task_mmu: pin mm_users in do_pagemap_scan() Greg Kroah-Hartman
` (342 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhao Gongyi, Jeff Layton, Jan Kara,
Christian Brauner (Amutable)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Gongyi <zhaogongyi@bytedance.com>
commit c206cdfee6c037b829178bb7e17e6e37ddc9aa35 upstream.
A caller may drop its path after try_break_deleg() returns a delegated
inode but before break_deleg_wait() finishes. The extra inode reference
held in struct delegated_inode does not keep the superblock active.
After a lazy unmount, closing the delegation holder can release the last
mount reference and shut down the superblock while another task waits for
the delegation break. The waiter's final iput() can then enter the
filesystem's eviction code after its superblock-private state was freed.
This has been observed as a KASAN use-after-free in shmem_evict_inode().
When try_break_deleg() saves a delegated inode, take an active reference
to its superblock while the caller still pins the mount. Keep that
reference through break_deleg_wait() and the final iput(), then release
it with deactivate_super(). This protects every caller of the helpers,
including the mknod, mkdir, symlink and rmdir paths that drop their path
before waiting.
Fixes: e12d203b8c88 ("vfs: allow mkdir to wait for delegation break on parent")
Fixes: 4fa76319cd0c ("vfs: allow rmdir to wait for delegation break on parent")
Fixes: c826229c6a82 ("vfs: make vfs_create break delegations on parent directory")
Fixes: e8960c1b2ee9 ("vfs: make vfs_mknod break delegations on parent directory")
Fixes: 92bf53577f01 ("vfs: make vfs_symlink break delegations on parent dir")
Link: https://lore.kernel.org/r/20261016093421.90725-1-zhaogongyi@bytedance.com
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>
Link: https://patch.msgid.link/20261023111250.17696-1-zhaogongyi@bytedance.com
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/filelock.h | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/include/linux/filelock.h
+++ b/include/linux/filelock.h
@@ -530,8 +530,8 @@ static inline bool is_delegated(struct d
*
* Break delegations in a non-blocking fashion. If there are
* outstanding delegations and @di is set, then an extra reference
- * will be taken on @inode and @di->di_inode will be populated so
- * that it may be waited upon.
+ * will be taken on @inode and its superblock, and @di->di_inode will
+ * be populated so that it may be waited upon.
*
* Returns 0 if there is no need to wait or an error. If -EWOULDBLOCK
* is returned, then @di will be populated (if non-NULL).
@@ -545,16 +545,21 @@ static inline int try_break_deleg(struct
if (ret == -EWOULDBLOCK && di) {
di->di_inode = inode;
ihold(inode);
+ /* The caller may drop its mount before break_deleg_wait(). */
+ atomic_inc(&inode->i_sb->s_active);
}
return ret;
}
static inline int break_deleg_wait(struct delegated_inode *di)
{
+ struct inode *inode = di->di_inode;
+ struct super_block *sb = inode->i_sb;
int ret;
- ret = break_deleg(di->di_inode, 0);
- iput(di->di_inode);
+ ret = break_deleg(inode, 0);
+ iput(inode);
+ deactivate_super(sb);
di->di_inode = NULL;
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 214/547] fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 213/547] filelock: keep superblock active through delegation wait Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 215/547] fsverity: Set S_VERITY only after rollback is no longer possible Greg Kroah-Hartman
` (341 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ngoc Quy, Andrew Morton,
Liam R. Howlett, Lorenzo Stoakes, Vlastimil Babka, Jann Horn,
Pedro Falcato, Muhammad Usama Anjum
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ngoc Quy <ngocquy0700@gmail.com>
commit 4fb975471717c953f912776bb60301add1ffae11 upstream.
The PAGEMAP_SCAN ioctl takes mmap_read_lock() on an mm obtained from
/proc/<pid>/pagemap without holding a reference to mm_users.
proc_mem_open() deliberately grabs only mm_count, so a consumer that
touches the address space has to call mmget_not_zero() first. Every other
consumer in this file does -- m_start(), do_procmap_query(),
show_smaps_rollup() and pagemap_read() -- but do_pagemap_scan() does not.
Without that reference the target can reach exit_mmap() concurrently, and
exit_mmap() calls unmap_vmas() while holding mmap_lock only for reading,
which does not exclude the scanner. For ordinary VMAs this is harmless,
as free_pgtables() and remove_vma() run afterwards under mmap_write_lock.
A shared hugetlb VMA is different: __hugetlb_zap_end() frees the VMA's
hugetlb_vma_lock inside the read-locked phase.
walk_hugetlb_range() can therefore load vma->vm_private_data, have the
lock freed underneath it, and then down_read() a freed rw_semaphore. The
load happens before the freeing side clears the pointer, so this is a
use-after-free and not a NULL dereference. Any unprivileged user can
reach it with no huge pages configured, as hugetlb_reserve_pages()
allocates the lock before the VM_NORESERVE early return.
Pin mm_users across the scan, the way the other consumers do. mmput()
from the exiting task can then no longer reach exit_mmap() while a walk is
in progress.
[akpm@linux-foundation.org: remove unneeded & undesirable test for !mm]
Link: https://lore.kernel.org/20261014095540.3261469-1-ngocquy0700@gmail.com
Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
Signed-off-by: Ngoc Quy <ngocquy0700@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Muhammad Usama Anjum <usama.anjum@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/task_mmu.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -3231,15 +3231,18 @@ static long do_pagemap_scan(struct mm_st
size_t n_ranges_out = 0;
int ret;
+ if (!mmget_not_zero(mm))
+ return -ESRCH;
+
ret = pagemap_scan_get_args(&p.arg, uarg);
if (ret)
- return ret;
+ goto out_mmput;
p.masks_of_interest = p.arg.category_mask | p.arg.category_anyof_mask |
p.arg.return_mask;
ret = pagemap_scan_init_bounce_buffer(&p);
if (ret)
- return ret;
+ goto out_mmput;
for (walk_start = p.arg.start; walk_start < p.arg.end;
walk_start = p.arg.walk_end) {
@@ -3294,6 +3297,8 @@ static long do_pagemap_scan(struct mm_st
ret = -EFAULT;
kfree(p.vec_buf);
+out_mmput:
+ mmput(mm);
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 215/547] fsverity: Set S_VERITY only after rollback is no longer possible
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 214/547] fs/proc/task_mmu: pin mm_users in do_pagemap_scan() Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 216/547] genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes Greg Kroah-Hartman
` (340 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Eric Biggers
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit c349b233d6ab0fc3517401a1e2d36f5f90eb8c9b upstream.
Commit f77f281b6118 ("fsverity: use a hashtable to find the
fsverity_info") changed the implementation of FS_IOC_ENABLE_VERITY to
make concurrent reads start going through fsverity verification slightly
earlier than they did before.
Instead of it happening when enable_verity() calls fsverity_set_info(),
it now happens when ->end_enable_verity() sets S_VERITY.
However, ext4 and btrfs can roll back verity after they set S_VERITY,
causing a use-after-free.
Fix that by making ext4 and btrfs set S_VERITY only after rollback is no
longer possible. On failure, don't roll back S_VERITY, but do roll back
the filesystem-specific verity flag.
Also update enable_verity() to handle any future instances of this bug
more safely by warning and *not* freeing the fsverity_info.
Finally, tweak some comments. Clarify one, and move information from
another to its proper place in the comment for ->end_enable_verity().
Fixes: f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20261025204807.122875-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/verity.c | 7 ++++---
fs/ext4/verity.c | 4 +++-
fs/verity/enable.c | 12 +++++-------
include/linux/fsverity.h | 12 +++++++-----
4 files changed, 19 insertions(+), 16 deletions(-)
--- a/fs/btrfs/verity.c
+++ b/fs/btrfs/verity.c
@@ -489,8 +489,6 @@ static int rollback_verity(struct btrfs_
inode->vfs_inode.i_ino);
goto out;
}
- inode->ro_flags &= ~BTRFS_INODE_RO_VERITY;
- btrfs_sync_inode_flags_to_i_flags(inode);
ret = btrfs_update_inode(trans, inode);
if (unlikely(ret)) {
btrfs_abort_transaction(trans, ret);
@@ -555,16 +553,19 @@ static int finish_verity(struct btrfs_in
if (IS_ERR(trans))
return PTR_ERR(trans);
inode->ro_flags |= BTRFS_INODE_RO_VERITY;
- btrfs_sync_inode_flags_to_i_flags(inode);
ret = btrfs_update_inode(trans, inode);
if (ret)
goto end_trans;
ret = del_orphan(trans, inode);
if (ret)
goto end_trans;
+ /* Now that rollback is no longer possible, set S_VERITY. */
+ btrfs_sync_inode_flags_to_i_flags(inode);
clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
btrfs_set_fs_compat_ro(root->fs_info, VERITY);
end_trans:
+ if (ret)
+ inode->ro_flags &= ~BTRFS_INODE_RO_VERITY;
btrfs_end_transaction(trans);
return ret;
--- a/fs/ext4/verity.c
+++ b/fs/ext4/verity.c
@@ -242,17 +242,19 @@ static int ext4_end_enable_verity(struct
goto stop_and_cleanup;
ext4_set_inode_flag(inode, EXT4_INODE_VERITY);
- ext4_set_inode_flags(inode, false);
err = ext4_mark_iloc_dirty(handle, inode, &iloc);
if (err)
goto stop_and_cleanup;
ext4_journal_stop(handle);
+ /* Now that rollback is no longer possible, set S_VERITY. */
+ ext4_set_inode_flags(inode, false);
ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS);
return 0;
stop_and_cleanup:
+ ext4_clear_inode_flag(inode, EXT4_INODE_VERITY);
ext4_journal_stop(handle);
cleanup:
/*
--- a/fs/verity/enable.c
+++ b/fs/verity/enable.c
@@ -274,8 +274,8 @@ static int enable_verity(struct file *fi
* initialization so that we don't have to undo the enabling when memory
* allocation for the hash table fails. This is safe because looking up
* the fsverity_info always first checks the S_VERITY flag on the inode,
- * which will only be set at the very end of the ->end_enable_verity
- * method.
+ * which will only be set at the very end of a successful call to
+ * ->end_enable_verity().
*/
err = fsverity_set_info(vi);
if (err) {
@@ -285,10 +285,7 @@ static int enable_verity(struct file *fi
/*
* Tell the filesystem to finish enabling verity on the file.
- * Serialized with ->begin_enable_verity() by the inode lock. The file
- * system needs to set the S_VERITY flag on the inode at the very end of
- * the method, at which point the fsverity information can be accessed
- * by other threads.
+ * Serialized with ->begin_enable_verity() by the inode lock.
*/
inode_lock(inode);
err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size);
@@ -296,7 +293,8 @@ static int enable_verity(struct file *fi
if (err) {
fsverity_err(inode, "%ps() failed with err %d",
vops->end_enable_verity, err);
- fsverity_remove_info(vi);
+ if (!WARN_ON_ONCE(IS_VERITY(inode)))
+ fsverity_remove_info(vi);
} else if (WARN_ON_ONCE(!IS_VERITY(inode))) {
fsverity_remove_info(vi);
err = -EINVAL;
--- a/include/linux/fsverity.h
+++ b/include/linux/fsverity.h
@@ -54,11 +54,13 @@ struct fsverity_operations {
* @merkle_tree_size: total bytes the Merkle tree took up
*
* If desc == NULL, then enabling verity failed and the filesystem only
- * must do any necessary cleanups. Else, it must also store the given
- * verity descriptor to a fs-specific location associated with the inode
- * and do any fs-specific actions needed to mark the inode as a verity
- * inode, e.g. setting a bit in the on-disk inode. The filesystem is
- * also responsible for setting the S_VERITY flag in the VFS inode.
+ * must do any necessary cleanups.
+ *
+ * Else, the filesystem must store the given verity descriptor to a
+ * fs-specific location associated with the inode and do any fs-specific
+ * actions needed to mark the inode as a verity inode, e.g. set a bit in
+ * the on-disk inode. Finally, on success (only when rollback is no
+ * longer possible!) it must set S_VERITY in the VFS inode.
*
* i_rwsem is held for write, but it may have been dropped between
* ->begin_enable_verity() and ->end_enable_verity().
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 216/547] genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 215/547] fsverity: Set S_VERITY only after rollback is no longer possible Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 217/547] genirq: Move interrupt thread exit_work object to irqaction Greg Kroah-Hartman
` (339 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Richard Patel, Thomas Gleixner
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Patel <ripatel@wii.dev>
commit d04adff6860587e843948b0c31174f8ae11b8dfe upstream.
When an interrupt thread exits abnormally via do_exit() (e.g. the interrupt
handler oopses) without returning from irq_thread(), a concurrent call to
free_irq() could free the irqaction before the irq_thread_dtor() exit task
work runs.
irq thread (oopsed) free_irq()
------------------- ----------
do_exit()
exit_mm()
complete_vfork_done() -------> kthread_stop() returns
exit_files() ... kfree(action)
exit_task_work()
irq_thread_dtor()
action->... <- use-after-free
Track the pending exit work with the IRQTF_EXIT_WORK thread flag, and have
__free_irq() wait for the bit to clear before kfree().
irq_thread_dtor() only runs on irq_thread abnormal exit. If that dtor also
faults, free_irq() will hang indefinitely, but double IRQ thread faults
require a reboot anyways.
[ tglx: Add missing include ]
Fixes: ed3e694d78cc ("move exit_task_work() past exit_files() et.al.")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009145842.1616117-2-ripatel@wii.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/internals.h | 2 ++
kernel/irq/manage.c | 26 ++++++++++++++++++++------
2 files changed, 22 insertions(+), 6 deletions(-)
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -36,6 +36,7 @@ extern struct irqaction chained_action;
* IRQTF_AFFINITY - irq thread is requested to adjust affinity
* IRQTF_FORCED_THREAD - irq action is force threaded
* IRQTF_READY - signals that irq thread is ready
+ * IRQTF_EXIT_WORK - irq thread exit task_work is pending
*/
enum {
IRQTF_RUNTHREAD,
@@ -43,6 +44,7 @@ enum {
IRQTF_AFFINITY,
IRQTF_FORCED_THREAD,
IRQTF_READY,
+ IRQTF_EXIT_WORK,
};
/*
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -21,6 +21,7 @@
#include <linux/sched/isolation.h>
#include <uapi/linux/sched/types.h>
#include <linux/task_work.h>
+#include <linux/wait_bit.h>
#include "internals.h"
@@ -1176,17 +1177,14 @@ void wake_threads_waitq(struct irq_desc
wake_up(&desc->wait_for_threads);
}
-static void irq_thread_dtor(struct callback_head *unused)
+static void __irq_thread_dtor(struct irqaction *action)
{
struct task_struct *tsk = current;
struct irq_desc *desc;
- struct irqaction *action;
if (WARN_ON_ONCE(!(current->flags & PF_EXITING)))
return;
- action = kthread_data(tsk);
-
pr_err("exiting task \"%s\" (%d) is an active IRQ thread (irq %d)\n",
tsk->comm, tsk->pid, action->irq);
@@ -1203,6 +1201,14 @@ static void irq_thread_dtor(struct callb
irq_finalize_oneshot(desc, action);
}
+static void irq_thread_dtor(struct callback_head *unused)
+{
+ struct irqaction *action = kthread_data(current);
+
+ __irq_thread_dtor(action);
+ clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
+}
+
static void irq_wake_secondary(struct irq_desc *desc, struct irqaction *action)
{
struct irqaction *secondary = action->secondary;
@@ -1263,6 +1269,7 @@ static int irq_thread(void *data)
else
handler_fn = irq_thread_fn;
+ set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
init_task_work(&on_exit_work, irq_thread_dtor);
task_work_add(current, &on_exit_work, TWA_NONE);
@@ -1283,6 +1290,7 @@ static int irq_thread(void *data)
* oneshot mask bit can be set.
*/
task_work_cancel_func(current, irq_thread_dtor);
+ clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
return 0;
}
@@ -1853,6 +1861,12 @@ out_mput:
return ret;
}
+static void irq_stop_thread(struct irqaction *action)
+{
+ kthread_stop_put(action->thread);
+ wait_on_bit(&action->thread_flags, IRQTF_EXIT_WORK, TASK_UNINTERRUPTIBLE);
+}
+
/*
* Internal function to unregister an irqaction - used to free
* regular and special interrupts that are part of the architecture.
@@ -1958,9 +1972,9 @@ static struct irqaction *__free_irq(stru
* the same bit to a newly requested action.
*/
if (action->thread) {
- kthread_stop_put(action->thread);
+ irq_stop_thread(action);
if (action->secondary && action->secondary->thread)
- kthread_stop_put(action->secondary->thread);
+ irq_stop_thread(action->secondary);
}
/* Last action releases resources */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 217/547] genirq: Move interrupt thread exit_work object to irqaction
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 216/547] genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 218/547] HID: hiddev: keep state alive through disconnect unlock Greg Kroah-Hartman
` (338 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Richard Patel, Thomas Gleixner
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Patel <ripatel@wii.dev>
commit 89a9e003a2ef73f67dff03dfd59e0a5474b56b0b upstream.
irq_thread() registers irq_thread_dtor() as exit task_work using a
stack-allocated callback_head. On normal interrupt thread exit, this work
gets cancelled and never runs.
On x86, an abnormal interrupt thread exit (e.g. handler oops) discards the
stack, including the callback_head, while that callback_head is still
pending. By the time exit_task_work() runs, the stack memory formerly
backing callback_head is already clobbered.
irq_thread() <-- on_exit_work allocated
** IRQ handler faults **
oops_end()
rewind_stack_and_make_dead() <-- on_exit_work freed
make_task_dead()
do_exit(SIGSEGV)
...
exit_shm() <-- on_exit_work clobbered
...
exit_task_work() <-- stack use-after-free
exit_shm()+0x30 <-- wild jump to return addr
Thus, a benign threaded IRQ oops (e.g. a NULL pointer deref) is
turned into a wild jump. This is caught by kernel IBT:
** first fault **
Oops: general protection fault, kernel NULL pointer dereference 0x3c0: 0000 [#1] SMP NOPTI
...
** second fault **
Missing ENDBR: exit_shm+0x30/0x1c0
kernel BUG at arch/x86/kernel/cet.c:133!
...
? task_work_run+0x5c/0x90
? do_exit+0x209/0x460
? rewind_stack_and_make_dead+0x16/0x20
...
note: irq/165-AudioDS[1427] exited with irqs disabled
Fixing recursive fault but reboot is needed!
Fix this by storing the callback_head in struct irqaction. The irqaction
is only freed once irq_thread_dtor() finishes.
Fixes: 2deb4be28077 ("x86/dumpstack: When OOPSing, rewind the stack before do_exit()")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009145842.1616117-3-ripatel@wii.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/interrupt.h | 2 ++
kernel/irq/manage.c | 9 ++++-----
2 files changed, 6 insertions(+), 5 deletions(-)
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -119,6 +119,7 @@ typedef irqreturn_t (*irq_handler_t)(int
* @thread_flags: flags related to @thread
* @thread_mask: bitmask for keeping track of @thread activity
* @dir: pointer to the proc/irq/NN/name entry
+ * @thread_dtor: task_work for @thread irregular exit cleanup
*/
struct irqaction {
irq_handler_t handler;
@@ -137,6 +138,7 @@ struct irqaction {
unsigned long thread_mask;
const char *name;
struct proc_dir_entry *dir;
+ struct callback_head thread_dtor;
} ____cacheline_internodealigned_in_smp;
extern irqreturn_t no_action(int cpl, void *dev_id);
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1201,9 +1201,9 @@ static void __irq_thread_dtor(struct irq
irq_finalize_oneshot(desc, action);
}
-static void irq_thread_dtor(struct callback_head *unused)
+static void irq_thread_dtor(struct callback_head *work)
{
- struct irqaction *action = kthread_data(current);
+ struct irqaction *action = container_of(work, struct irqaction, thread_dtor);
__irq_thread_dtor(action);
clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
@@ -1250,7 +1250,6 @@ static void wake_up_and_wait_for_irq_thr
*/
static int irq_thread(void *data)
{
- struct callback_head on_exit_work;
struct irqaction *action = data;
struct irq_desc *desc = irq_to_desc(action->irq);
irqreturn_t (*handler_fn)(struct irq_desc *desc,
@@ -1270,8 +1269,8 @@ static int irq_thread(void *data)
handler_fn = irq_thread_fn;
set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
- init_task_work(&on_exit_work, irq_thread_dtor);
- task_work_add(current, &on_exit_work, TWA_NONE);
+ init_task_work(&action->thread_dtor, irq_thread_dtor);
+ task_work_add(current, &action->thread_dtor, TWA_NONE);
while (!irq_wait_for_interrupt(desc, action)) {
irqreturn_t action_ret;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 218/547] HID: hiddev: keep state alive through disconnect unlock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 217/547] genirq: Move interrupt thread exit_work object to irqaction Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 219/547] io_uring/io-wq: save worker type before dropping its reference Greg Kroah-Hartman
` (337 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+563191a4939ddbfe73d4,
Yousef Alhouseen, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit 03f449b5de36a25fc5eba7dabf2b4494389bdb91 upstream.
mutex_unlock() clears the mutex owner before taking its wait lock. A
thread spinning in the final hiddev file release can acquire
existancelock after hiddev_disconnect() clears the owner, then free
hiddev before the disconnecting thread reaches the mutex wait lock. This
causes a use-after-free in the mutex slow unlock path.
Give the connection and each open file an explicit reference. Drop each
reference only after its existancelock critical section has completed,
so neither unlock path can free the mutex while the other is still using
it.
Fixes: 079034073faf ("HID: hiddev cleanup -- handle all error conditions properly")
Reported-by: syzbot+563191a4939ddbfe73d4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hiddev.c | 37 +++++++++++++++++++------------------
include/linux/hiddev.h | 2 ++
2 files changed, 21 insertions(+), 18 deletions(-)
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -46,6 +46,12 @@ struct hiddev_list {
struct mutex thread_lock;
};
+static void hiddev_put(struct hiddev *hiddev)
+{
+ if (refcount_dec_and_test(&hiddev->refcount))
+ kfree(hiddev);
+}
+
/*
* Find a report, given the report's type and ID. The ID can be specified
* indirectly by REPORT_ID_FIRST (which returns the first report of the given
@@ -216,26 +222,21 @@ static int hiddev_fasync(int fd, struct
static int hiddev_release(struct inode * inode, struct file * file)
{
struct hiddev_list *list = file->private_data;
+ struct hiddev *hiddev = list->hiddev;
unsigned long flags;
- spin_lock_irqsave(&list->hiddev->list_lock, flags);
+ spin_lock_irqsave(&hiddev->list_lock, flags);
list_del(&list->node);
- spin_unlock_irqrestore(&list->hiddev->list_lock, flags);
+ spin_unlock_irqrestore(&hiddev->list_lock, flags);
- mutex_lock(&list->hiddev->existancelock);
- if (!--list->hiddev->open) {
- if (list->hiddev->exist) {
- hid_hw_close(list->hiddev->hid);
- hid_hw_power(list->hiddev->hid, PM_HINT_NORMAL);
- } else {
- mutex_unlock(&list->hiddev->existancelock);
- kfree(list->hiddev);
- vfree(list);
- return 0;
- }
+ mutex_lock(&hiddev->existancelock);
+ if (!--hiddev->open && hiddev->exist) {
+ hid_hw_close(hiddev->hid);
+ hid_hw_power(hiddev->hid, PM_HINT_NORMAL);
}
- mutex_unlock(&list->hiddev->existancelock);
+ mutex_unlock(&hiddev->existancelock);
+ hiddev_put(hiddev);
vfree(list);
return 0;
@@ -270,6 +271,7 @@ static int __hiddev_open(struct hiddev *
spin_unlock_irq(&hiddev->list_lock);
file->private_data = list;
+ refcount_inc(&hiddev->refcount);
return 0;
@@ -897,6 +899,7 @@ int hiddev_connect(struct hid_device *hi
INIT_LIST_HEAD(&hiddev->list);
spin_lock_init(&hiddev->list_lock);
mutex_init(&hiddev->existancelock);
+ refcount_set(&hiddev->refcount, 1);
hid->hiddev = hiddev;
hiddev->hid = hid;
hiddev->exist = 1;
@@ -937,9 +940,7 @@ void hiddev_disconnect(struct hid_device
if (hiddev->open) {
hid_hw_close(hiddev->hid);
wake_up_interruptible(&hiddev->wait);
- mutex_unlock(&hiddev->existancelock);
- } else {
- mutex_unlock(&hiddev->existancelock);
- kfree(hiddev);
}
+ mutex_unlock(&hiddev->existancelock);
+ hiddev_put(hiddev);
}
--- a/include/linux/hiddev.h
+++ b/include/linux/hiddev.h
@@ -13,6 +13,7 @@
#ifndef _HIDDEV_H
#define _HIDDEV_H
+#include <linux/refcount.h>
#include <uapi/linux/hiddev.h>
@@ -24,6 +25,7 @@ struct hiddev {
int minor;
int exist;
int open;
+ refcount_t refcount;
struct mutex existancelock;
wait_queue_head_t wait;
struct hid_device *hid;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 219/547] io_uring/io-wq: save worker type before dropping its reference
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 218/547] HID: hiddev: keep state alive through disconnect unlock Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 220/547] iomap: dont resubmit an ioend after ->writeback_submit() failed Greg Kroah-Hartman
` (336 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kyle Zeng, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
commit 37e425460b7c41687e51e3254b1eb1d799da9614 upstream.
io_wq_cancel_tw_create() inspects cb->func after calling
io_worker_cancel_cb(). For an existing worker, that call can drop the
last worker reference and wake io_worker_exit(). If the canceling task
is preempted, the worker can be unlinked and freed by kfree_rcu() before
the callback function is inspected. KASAN reports a slab-use-after-free
read in this path.
Save whether the callback belongs to an unpublished continuation worker
while its reference is still held, then use the saved result for the
conditional free. This preserves the existing accounting and frees only
the worker allocated for the canceled continuation.
Fixes: e6db6f9398da ("io_uring/io-wq: only free worker if it was allocated for creation")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io-wq.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -1424,14 +1424,16 @@ static void io_wq_cancel_tw_create(struc
while ((cb = task_work_cancel_match(wq->task, io_task_work_match, wq)) != NULL) {
struct io_worker *worker;
+ bool free_worker;
worker = container_of(cb, struct io_worker, create_work);
- io_worker_cancel_cb(worker);
/*
* Only the worker continuation helper has worker allocated and
- * hence needs freeing.
+ * hence needs freeing. Save this before dropping its reference.
*/
- if (cb->func == create_worker_cont)
+ free_worker = cb->func == create_worker_cont;
+ io_worker_cancel_cb(worker);
+ if (free_worker)
kfree(worker);
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 220/547] iomap: dont resubmit an ioend after ->writeback_submit() failed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 219/547] io_uring/io-wq: save worker type before dropping its reference Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 221/547] iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown Greg Kroah-Hartman
` (335 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Foster, Christoph Hellwig,
Andrea Parri, Christian Brauner (Amutable)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
commit 3f517370076f1fedaa38cd8c78ceb73616b79336 upstream.
iomap_add_to_ioend() submits the pending ioend through
->writeback_submit() before allocating a new one for the current range.
When the submission fails the helper completes the ioend with an error,
but iomap_add_to_ioend() returns the error without clearing
wpc->wb_ctx. iomap_writepages() then submits whatever wpc->wb_ctx
points to, so the already completed ioend is submitted a second time.
For XFS the second bio_endio() lands in xfs_end_bio(), which
list_add_tail()s the already linked ioend into ip->i_ioend_list. This
corrupts the list and leaves a use-after-free/double-free window against
the ioend completion worker. Reproduced with a fault-injected
->writeback_submit() failure on a reflinked XFS file with several
CoW writeback ranges in flight: the unfixed kernel hits repeated
"list_add double add" warnings from __list_add_valid_or_report(),
the fixed kernel fails writeback cleanly.
Clear wpc->wb_ctx when ->writeback_submit() fails. The old
iomap_submit_ioend() cleared the context unconditionally; that clear was
lost when submission moved to iomap_ioend_writeback_submit(). The final
->writeback_submit() call in iomap_writepages() needs no equivalent fix:
it is the last thing the function does before returning, and every
caller allocates its iomap_writepage_ctx on the stack for a single call,
so wpc->wb_ctx is never read again afterwards.
Fixes: f4fa7981fa26 ("iomap: hide ioends from the generic writeback code")
Cc: stable@vger.kernel.org # v6.17
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/90fbd42df4f51306e57a95830d2d53873f630eb9.1790342457.git.parri.andrea@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/iomap/ioend.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/fs/iomap/ioend.c
+++ b/fs/iomap/ioend.c
@@ -246,8 +246,16 @@ ssize_t iomap_add_to_ioend(struct iomap_
new_ioend:
if (ioend) {
error = wpc->ops->writeback_submit(wpc, 0);
- if (error)
+ if (error) {
+ /*
+ * ->writeback_submit() completed the ioend
+ * with an error, so drop the stale context;
+ * iomap_writepages() would otherwise submit
+ * it a second time.
+ */
+ wpc->wb_ctx = NULL;
return error;
+ }
}
wpc->wb_ctx = ioend = iomap_alloc_ioend(wpc, pos, ioend_flags);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 221/547] iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 220/547] iomap: dont resubmit an ioend after ->writeback_submit() failed Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 222/547] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot Greg Kroah-Hartman
` (334 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Nicolin Chen,
Jason Gunthorpe, Will Deacon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
commit ab0dbf411aced59c04ce86fd8443faf13bdc9936 upstream.
arm_smmu_device_shutdown() only calls arm_smmu_device_disable(), and never
the impl_ops->device_disable() hook. On tegra241-cmdqv, that hook quiesces
every VINTF through tegra241_vintf_hw_deinit(), which issues a CMD_SYNC on
the shared CMDQ while it is still enabled.
arm_smmu_disable_action() already runs this hook before disabling the SMMU,
to cover an unbind or a probe failure, and no devres release ever follows a
reboot or a kexec to run it again. Have arm_smmu_device_shutdown() call it
directly, instead of reimplementing part of what it already does.
Fixes: 9ff145a25c5c ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
Cc: stable@vger.kernel.org
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Assisted-by: LLM
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -5633,7 +5633,7 @@ static void arm_smmu_device_shutdown(str
{
struct arm_smmu_device *smmu = platform_get_drvdata(pdev);
- arm_smmu_device_disable(smmu);
+ arm_smmu_disable_action(smmu);
}
static const struct of_device_id arm_smmu_of_match[] = {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 222/547] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 221/547] iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 223/547] KVM: pfncache: use a dedicated invalidation sequence for cache refresh Greg Kroah-Hartman
` (333 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Teodorescu, Dennis Tighe,
Sashiko Bot, David Hildenbrand (Arm), Ackerley Tng,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit e6ecb88711d93b9e014532f17d3d29b57e80932c upstream.
If inserting a memslot into a guest_memfd's bindings xarray fails,
propagate the error back to the caller, i.e. fail memslot creation as well.
Signalling success and continuing on with memslot creation results in
use-after-free, as the guest_memfd instance will remain reachable via the
memslot after the file is freed (kvm_gmem_release() won't nullify the file
pointer due to lack of a valid binding).
Opportunistically WARN and reject binding if KVM_MEMSLOT_GMEM_ONLY is
already set, partly to guard against goofs elsewhere, but mostly so that
KVM doesn't need to worry about clobbering flags when unwinding on failure.
Regarding the unwind, the slot must be fully prepared before inserting it
into the bindings, at which point the slot becomes reachable. I.e. waiting
to update the slot in order to avoid the ugly unwind isn't an option. And
as part of the unwind, explicitly nullify the relevant bindings, as xarray
can store a subset of entries when populating a range.
Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Reported-by: Dennis Tighe <dtighe@google.com>
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260823135031.4F6DC1F000E9%40smtp.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Link: https://patch.msgid.link/20260922001332.1121266-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/guest_memfd.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -616,6 +616,9 @@ int kvm_gmem_bind(struct kvm *kvm, struc
BUILD_BUG_ON(sizeof(gpa_t) != sizeof(offset));
BUILD_BUG_ON(sizeof(gfn_t) != sizeof(slot->gmem.pgoff));
+ if (WARN_ON_ONCE(slot->flags & KVM_MEMSLOT_GMEM_ONLY))
+ return -EINVAL;
+
file = fget(fd);
if (!file)
return -EBADF;
@@ -654,7 +657,13 @@ int kvm_gmem_bind(struct kvm *kvm, struc
if (kvm_gmem_supports_mmap(inode))
slot->flags |= KVM_MEMSLOT_GMEM_ONLY;
- xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL);
+ r = xa_err(xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL));
+ if (r) {
+ xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL);
+ slot->gmem.file = NULL;
+ slot->gmem.pgoff = 0;
+ slot->flags &= ~KVM_MEMSLOT_GMEM_ONLY;
+ }
filemap_invalidate_unlock(inode->i_mapping);
/*
@@ -662,7 +671,6 @@ int kvm_gmem_bind(struct kvm *kvm, struc
* not the other way 'round. Active bindings are invalidated if the
* file is closed before memslots are destroyed.
*/
- r = 0;
err:
fput(file);
return r;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 223/547] KVM: pfncache: use a dedicated invalidation sequence for cache refresh
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 222/547] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 224/547] KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls Greg Kroah-Hartman
` (332 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson,
syzbot+0948c82180d475ad24e2, syzbot+fb7c2dd166d3ea63df2a,
David Woodhouse, Paul Durrant, Paolo Bonzini
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit da260bcb56feeb6489a83f310308453a0a7de25e upstream.
The gfn_to_pfn_cache refresh path guards against mmu notifier
invalidations which complete while it has dropped gpc->lock for the
HVA->PFN lookup: hva_to_pfn_retry() samples kvm->mmu_invalidate_seq
and retries if it changed, or if mn_active_invalidate_count is still
elevated.
That is insufficient for HVA-based caches. mmu_invalidate_seq is only
advanced by kvm_mmu_invalidate_end() when the invalidated range
overlaps a memslot, and an HVA-based cache (e.g. the Xen shared_info
page mapped with KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA) need not be backed
by any memslot at all. An invalidation of the cached HVA which starts
and ends entirely within the lookup window is thus invisible to the
retry check: mn_active_invalidate_count is back to zero and the
sequence never moved. The refresh then publishes a mapping of a page
which has already been freed, and the next reader dereferences it:
BUG: KASAN: use-after-free in kvm_xen_shared_info_init+0x3c6/0x440
Read of size 4 at addr ffff8880599c2900 by task syz.2.383/7257
Since gfn_to_pfn_cache_invalidate_start() deliberately skips caches
which are not currently valid (including one whose refresh is in
progress, as the refresh clears the valid flag before dropping the
lock), the retry check is the only line of defence, and it must fire
for *any* invalidation, not just those hitting a memslot.
Add a dedicated kvm->gpc_invalidate_seq, incremented by every
kvm_mmu_notifier_invalidate_range_end() under mn_invalidate_lock
before mn_active_invalidate_count is decremented, and check it in
hva_to_pfn_retry() instead of mmu_invalidate_seq. Incrementing in
range_end() in the same critical section as the in-progress count
also closes the variant where the cache is activated with the
contested HVA only after invalidate_range_start() has run.
The same bug is also reachable through the per-vCPU vcpu_info cache
(KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO_HVA), where the stale mapping is
then dereferenced by kvm_setup_guest_pvclock() on the next KVM_RUN:
BUG: KASAN: use-after-free in kvm_setup_guest_pvclock+0x5bf/0x660
This intentionally makes refresh retry on *unrelated* mmu notifier
events; restoring precision (and reworking the GPC locking more
generally) is left for a subsequent series.
Reproducers: https://david.woodhou.se/xen_shinfo_race.c
https://david.woodhou.se/vcpu_info_race.c
Suggested-by: Sean Christopherson <seanjc@google.com>
Reported-by: syzbot+0948c82180d475ad24e2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a0c5f2c.a00a0220.2c7954.0000.GAE@google.com/
Tested-by: syzbot+0948c82180d475ad24e2@syzkaller.appspotmail.com
Reported-by: syzbot+fb7c2dd166d3ea63df2a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a426dd2.854d4ab9.360e1d.0008.GAE@google.com/
Fixes: b9220d32799a ("KVM: x86/xen: allow shared_info to be mapped by fixed HVA")
Cc: stable@vger.kernel.org
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Assisted-by: Claude:claude-mythos-5
Reviewed-by: Paul Durrant <paul@xen.org>
Link: https://patch.msgid.link/20260831213632.81023-13-dwmw2@infradead.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/kvm_host.h | 2 ++
virt/kvm/kvm_main.c | 10 ++++++++++
virt/kvm/pfncache.c | 18 +++++++++---------
3 files changed, 21 insertions(+), 9 deletions(-)
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -854,6 +854,8 @@ struct kvm {
gfn_t mmu_invalidate_range_start;
gfn_t mmu_invalidate_range_end;
+ unsigned long gpc_invalidate_seq;
+
struct list_head devices;
u64 manual_dirty_log_protect;
struct dentry *debugfs_dentry;
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -813,6 +813,16 @@ static void kvm_mmu_notifier_invalidate_
/* Pairs with the increment in range_start(). */
spin_lock(&kvm->mn_invalidate_lock);
+ kvm->gpc_invalidate_seq++;
+
+ /*
+ * As with the MMU sequence counter and mmu_invalidate_in_progress, the
+ * GPC sequence increase must be visible before the invalidate count
+ * goes to zero. Pairs with the smp_rmb() in
+ * mmu_notifier_retry_cache().
+ */
+ smp_wmb();
+
if (!WARN_ON_ONCE(!kvm->mn_active_invalidate_count))
--kvm->mn_active_invalidate_count;
wake = !kvm->mn_active_invalidate_count;
--- a/virt/kvm/pfncache.c
+++ b/virt/kvm/pfncache.c
@@ -124,7 +124,7 @@ static void gpc_unmap(kvm_pfn_t pfn, voi
#endif
}
-static inline bool mmu_notifier_retry_cache(struct kvm *kvm, unsigned long mmu_seq)
+static inline bool mmu_notifier_retry_cache(struct kvm *kvm, unsigned long gpc_seq)
{
/*
* mn_active_invalidate_count acts for all intents and purposes
@@ -136,20 +136,20 @@ static inline bool mmu_notifier_retry_ca
* Note, it does not matter that mn_active_invalidate_count
* is not protected by gpc->lock. It is guaranteed to
* be elevated before the mmu_notifier acquires gpc->lock, and
- * isn't dropped until after mmu_invalidate_seq is updated.
+ * isn't dropped until after gpc_invalidate_seq is updated.
*/
if (kvm->mn_active_invalidate_count)
return true;
/*
* Ensure mn_active_invalidate_count is read before
- * mmu_invalidate_seq. This pairs with the smp_wmb() in
- * mmu_notifier_invalidate_range_end() to guarantee either the
+ * gpc_invalidate_seq. This pairs with the smp_wmb() in
+ * kvm_mmu_notifier_invalidate_range_end() to guarantee either the
* old (non-zero) value of mn_active_invalidate_count or the
- * new (incremented) value of mmu_invalidate_seq is observed.
+ * new (incremented) value of gpc_invalidate_seq is observed.
*/
smp_rmb();
- return kvm->mmu_invalidate_seq != mmu_seq;
+ return kvm->gpc_invalidate_seq != gpc_seq;
}
static kvm_pfn_t hva_to_pfn_retry(struct gfn_to_pfn_cache *gpc)
@@ -158,7 +158,7 @@ static kvm_pfn_t hva_to_pfn_retry(struct
void *old_khva = (void *)PAGE_ALIGN_DOWN((uintptr_t)gpc->khva);
kvm_pfn_t new_pfn = KVM_PFN_ERR_FAULT;
void *new_khva = NULL;
- unsigned long mmu_seq;
+ unsigned long gpc_seq;
struct page *page;
struct kvm_follow_pfn kfp = {
@@ -181,7 +181,7 @@ static kvm_pfn_t hva_to_pfn_retry(struct
gpc->valid = false;
do {
- mmu_seq = gpc->kvm->mmu_invalidate_seq;
+ gpc_seq = gpc->kvm->gpc_invalidate_seq;
smp_rmb();
write_unlock_irq(&gpc->lock);
@@ -232,7 +232,7 @@ static kvm_pfn_t hva_to_pfn_retry(struct
* attempting to refresh.
*/
WARN_ON_ONCE(gpc->valid);
- } while (mmu_notifier_retry_cache(gpc->kvm, mmu_seq));
+ } while (mmu_notifier_retry_cache(gpc->kvm, gpc_seq));
gpc->valid = true;
gpc->pfn = new_pfn;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 224/547] KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 223/547] KVM: pfncache: use a dedicated invalidation sequence for cache refresh Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 225/547] media: cx23885: unregister DVB bus when SP2 CI setup fails Greg Kroah-Hartman
` (331 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM), Amit Machhiwal,
Madhavan Srinivasan
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Machhiwal <amachhiw@linux.ibm.com>
commit 61a39797bb136243c48b46e2586d8a9e2cea6a89 upstream.
The virtual-mode HPT hcall handlers (H_ENTER, H_REMOVE, H_BULK_REMOVE,
H_CLEAR_REF, H_CLEAR_MOD) call into book3s_hv_rm_mmu.c, which accesses
memslots via kvm_memslots_raw(). kvm_memslots_raw() uses
rcu_dereference_raw_check() to bypass SRCU lockdep annotation checking.
This is safe in real mode because the entire guest entry/exit is wrapped
in srcu_read_lock/unlock inside kvmppc_run_core() and
kvmhv_run_single_vcpu().
However, since commit 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual
mode handlers for HPT hcalls and page faults"), these same handlers are
also executed in virtual mode via kvmppc_pseries_do_hcall(), which runs
after SRCU has already been released on guest exit.
A concurrent KVM_SET_USER_MEMORY_REGION deletion or move can therefore
call synchronize_srcu_expedited() — which does not wait for this thread —
and then kfree(slot) and vfree(slot->arch.rmap) while the hcall handler
still holds a raw pointer to the memslot. lock_rmap() then writes to
freed vmalloc memory, leading to use-after-free and memory corruption.
Because kvm_memslots_raw() suppresses lockdep checks, this race is
entirely silent.
Fix this by factoring out the 7 HPT hcall handlers (H_REMOVE, H_ENTER,
H_READ, H_CLEAR_MOD, H_CLEAR_REF, H_PROTECT, H_BULK_REMOVE) into a
helper function, kvmppc_pseries_do_hpt_hcall(), and wrapping its call
site in srcu_read_lock(&kvm->srcu) / srcu_read_unlock(&kvm->srcu, idx).
Targeting only the HPT hcalls avoids wrapping non-HPT hcalls that sleep
(such as H_CONFER, H_REGISTER_VPA, H_PAGE_INIT) or handlers that already
acquire SRCU internally (such as H_RTAS).
Fixes: 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for HPT hcalls and page faults")
Cc: stable@vger.kernel.org # v5.14+
Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260928122837.8782-2-amachhiw@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kvm/book3s_hv.c | 70 +++++++++++++++++++++----------------------
1 file changed, 35 insertions(+), 35 deletions(-)
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1159,6 +1159,38 @@ static long kvmppc_h_rpt_invalidate(stru
return H_SUCCESS;
}
+static long kvmppc_pseries_do_hpt_hcall(struct kvm_vcpu *vcpu, unsigned long req)
+{
+ switch (req) {
+ case H_REMOVE:
+ return kvmppc_h_remove(vcpu, kvmppc_get_gpr(vcpu, 4),
+ kvmppc_get_gpr(vcpu, 5),
+ kvmppc_get_gpr(vcpu, 6));
+ case H_ENTER:
+ return kvmppc_h_enter(vcpu, kvmppc_get_gpr(vcpu, 4),
+ kvmppc_get_gpr(vcpu, 5),
+ kvmppc_get_gpr(vcpu, 6),
+ kvmppc_get_gpr(vcpu, 7));
+ case H_READ:
+ return kvmppc_h_read(vcpu, kvmppc_get_gpr(vcpu, 4),
+ kvmppc_get_gpr(vcpu, 5));
+ case H_CLEAR_MOD:
+ return kvmppc_h_clear_mod(vcpu, kvmppc_get_gpr(vcpu, 4),
+ kvmppc_get_gpr(vcpu, 5));
+ case H_CLEAR_REF:
+ return kvmppc_h_clear_ref(vcpu, kvmppc_get_gpr(vcpu, 4),
+ kvmppc_get_gpr(vcpu, 5));
+ case H_PROTECT:
+ return kvmppc_h_protect(vcpu, kvmppc_get_gpr(vcpu, 4),
+ kvmppc_get_gpr(vcpu, 5),
+ kvmppc_get_gpr(vcpu, 6));
+ case H_BULK_REMOVE:
+ return kvmppc_h_bulk_remove(vcpu);
+ }
+
+ return H_FUNCTION;
+}
+
int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
{
struct kvm *kvm = vcpu->kvm;
@@ -1174,47 +1206,15 @@ int kvmppc_pseries_do_hcall(struct kvm_v
switch (req) {
case H_REMOVE:
- ret = kvmppc_h_remove(vcpu, kvmppc_get_gpr(vcpu, 4),
- kvmppc_get_gpr(vcpu, 5),
- kvmppc_get_gpr(vcpu, 6));
- if (ret == H_TOO_HARD)
- return RESUME_HOST;
- break;
case H_ENTER:
- ret = kvmppc_h_enter(vcpu, kvmppc_get_gpr(vcpu, 4),
- kvmppc_get_gpr(vcpu, 5),
- kvmppc_get_gpr(vcpu, 6),
- kvmppc_get_gpr(vcpu, 7));
- if (ret == H_TOO_HARD)
- return RESUME_HOST;
- break;
case H_READ:
- ret = kvmppc_h_read(vcpu, kvmppc_get_gpr(vcpu, 4),
- kvmppc_get_gpr(vcpu, 5));
- if (ret == H_TOO_HARD)
- return RESUME_HOST;
- break;
case H_CLEAR_MOD:
- ret = kvmppc_h_clear_mod(vcpu, kvmppc_get_gpr(vcpu, 4),
- kvmppc_get_gpr(vcpu, 5));
- if (ret == H_TOO_HARD)
- return RESUME_HOST;
- break;
case H_CLEAR_REF:
- ret = kvmppc_h_clear_ref(vcpu, kvmppc_get_gpr(vcpu, 4),
- kvmppc_get_gpr(vcpu, 5));
- if (ret == H_TOO_HARD)
- return RESUME_HOST;
- break;
case H_PROTECT:
- ret = kvmppc_h_protect(vcpu, kvmppc_get_gpr(vcpu, 4),
- kvmppc_get_gpr(vcpu, 5),
- kvmppc_get_gpr(vcpu, 6));
- if (ret == H_TOO_HARD)
- return RESUME_HOST;
- break;
case H_BULK_REMOVE:
- ret = kvmppc_h_bulk_remove(vcpu);
+ idx = srcu_read_lock(&kvm->srcu);
+ ret = kvmppc_pseries_do_hpt_hcall(vcpu, req);
+ srcu_read_unlock(&kvm->srcu, idx);
if (ret == H_TOO_HARD)
return RESUME_HOST;
break;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 225/547] media: cx23885: unregister DVB bus when SP2 CI setup fails
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 224/547] KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 226/547] media: gspca: use vb2_video_unregister_device() on disconnect Greg Kroah-Hartman
` (330 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 22f552ff726a82a086be4ef02ce5099a0e8624b6 upstream.
The DVBSKY S950C, DVBSKY T980C and TechnoTrend CT2-4500 CI paths register
the DVB bus before attaching their SP2 CI client. If that client cannot be
created, bound, or pinned, the current error path removes the I2C frontend
components and only deallocates the frontend list, leaving the registered
DVB adapter behind. Removing an I2C demod before unregistering the DVB bus
can also expose the use-after-free ordering fixed for the normal remove
path.
Unregister the DVB bus immediately when SP2 CI setup fails, before the
existing I2C client cleanup. The bus helper empties the frontend list, so
the later frontend deallocation has nothing left to release. Keep failures
from vb2_dvb_register_bus() on the existing cleanup path. Also release an
unbound SP2 client and propagate the actual I2C creation or CI registration
error.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 2b0aac3011bc ("[media] cx23885: move CI/MAC registration to a separate function")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cx23885/cx23885-dvb.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1158,8 +1158,12 @@ static int dvb_register_ci_mac(struct cx
info.platform_data = &sp2_config;
request_module(info.type);
client_ci = i2c_new_client_device(&i2c_bus->i2c_adap, &info);
- if (!i2c_client_has_driver(client_ci))
+ if (IS_ERR(client_ci))
+ return PTR_ERR(client_ci);
+ if (!client_ci->dev.driver) {
+ i2c_unregister_device(client_ci);
return -ENODEV;
+ }
if (!try_module_get(client_ci->dev.driver->owner)) {
i2c_unregister_device(client_ci);
return -ENODEV;
@@ -1202,7 +1206,7 @@ static int dvb_register(struct cx23885_t
int (*p_set_voltage)(struct dvb_frontend *fe,
enum fe_sec_voltage voltage) = NULL;
int mfe_shared = 0; /* bus not shared by default */
- int ret;
+ int ret = -EINVAL;
/* Get the first frontend */
fe0 = vb2_dvb_get_frontend(&port->frontends, 1);
@@ -2586,8 +2590,10 @@ static int dvb_register(struct cx23885_t
goto frontend_detach;
ret = dvb_register_ci_mac(port);
- if (ret)
+ if (ret) {
+ vb2_dvb_unregister_bus(&port->frontends);
goto frontend_detach;
+ }
return 0;
@@ -2618,7 +2624,7 @@ frontend_detach:
port->gate_ctrl = NULL;
vb2_dvb_dealloc_frontends(&port->frontends);
- return -EINVAL;
+ return ret;
}
int cx23885_dvb_register(struct cx23885_tsport *port)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 226/547] media: gspca: use vb2_video_unregister_device() on disconnect
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 225/547] media: cx23885: unregister DVB bus when SP2 CI setup fails Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 227/547] media: imx-jpeg: cancel timeout worker when streaming stops Greg Kroah-Hartman
` (329 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Shuangpeng Bai,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit 3dbbbc3cafa2de377d9b97af4e35b8b6b5282047 upstream.
gspca uses vb2_fop_release(), but gspca_disconnect() only unregisters
the video device. If the queue owner closes the device after USB
disconnect, vb2_fop_release() releases the queue and invokes
gspca_stop_streaming() at that point.
gspca_stream_off() calls subdriver stop callbacks and
usb_set_interface() through gspca_dev->dev. By the time the late close
runs, the USB core can have freed the usb_device, resulting in a
use-after-free. This was observed as a KASAN use-after-free in sd_stopN().
Use vb2_video_unregister_device() so the queue is released and streaming
is stopped synchronously during disconnect, while the usb_device is still
valid. Since the helper takes the queue lock, which is usb_lock, call it
after dropping that lock.
Fixes: f729ef5796d8 ("media: videobuf2-v4l2.c: add vb2_video_unregister_device helper function")
Cc: stable@vger.kernel.org # 5.10.x
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/gspca/gspca.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1636,9 +1636,8 @@ void gspca_disconnect(struct usb_interfa
#endif
v4l2_device_disconnect(&gspca_dev->v4l2_dev);
- video_unregister_device(&gspca_dev->vdev);
-
mutex_unlock(&gspca_dev->usb_lock);
+ vb2_video_unregister_device(&gspca_dev->vdev);
/* (this will call gspca_release() immediately or on last close) */
v4l2_device_put(&gspca_dev->v4l2_dev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 227/547] media: imx-jpeg: cancel timeout worker when streaming stops
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 226/547] media: gspca: use vb2_video_unregister_device() on disconnect Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 228/547] media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers Greg Kroah-Hartman
` (328 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Wu, Ming Qian, Frank Li,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 78fdfbf117c409273eecbfa7a528ef42358a0e38 upstream.
Each per-fd context ctx owns a delayed_work (ctx->task_timer, callback
mxc_jpeg_device_run_timeout) armed via schedule_delayed_work() at the end
of mxc_jpeg_device_run() to recover a stalled encode/decode job. The only
existing cancellation is cancel_delayed_work() in the frame-done IRQ
handler, which de-queues a pending work item but does not wait for a
callback that has already started, and it only runs when a frame completes.
When the fd is closed while a job is in flight (the frame-done IRQ has not
fired yet), nothing syncs the worker before mxc_jpeg_release() frees ctx
with kfree() after v4l2_m2m_ctx_release(). A queued or executing
mxc_jpeg_device_run_timeout() can then recover ctx through
container_of(&ctx->task_timer) and dereference it (ctx->mxc_jpeg,
slot_data, dev_warn) after ctx has been freed.
Cancel the worker from mxc_jpeg_stop_streaming(). The cancel cannot live
in mxc_jpeg_release(): mxc_jpeg_device_run() arms the timer while holding
only hw_lock, not the mxc_jpeg->lock mutex that release holds, so a cancel
in release could still race a concurrent mxc_jpeg_device_run() that
re-arms the timer afterwards. mxc_jpeg_stop_streaming() instead runs inside
v4l2_m2m_ctx_release() -> vb2_queue_release(), i.e. after
v4l2_m2m_cancel_job() has set TRANS_ABORT and waited for any in-flight job
to finish (so __v4l2_m2m_try_queue() will not queue and v4l2_m2m_try_run()
will not run any further job for this context, which prevents
mxc_jpeg_device_run() from re-arming the timer) and before the m2m context
is freed. cancel_delayed_work_sync() removes a pending work item and waits
for a running callback, so the worker can no longer race with the
subsequent kfree(). The cancel is placed before the buffer-release loop so
a concurrently running timeout callback cannot race with it over the same
buffers. If the frame-done IRQ canceled a still-pending timer, this cancel
is a no-op; if the timeout callback has already started, it waits for the
callback to finish. The same mxc_jpeg_stop_streaming() call is also
reached from VIDIOC_STREAMOFF, which drains the worker early, although
STREAMOFF itself does not free ctx -- the use-after-free arises only
when the fd is later closed.
This bug was found by static analysis.
Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -1798,6 +1798,8 @@ static void mxc_jpeg_stop_streaming(stru
dev_dbg(ctx->mxc_jpeg->dev, "Stop streaming ctx=%p", ctx);
+ cancel_delayed_work_sync(&ctx->task_timer);
+
/* Release all active buffers */
for (;;) {
if (V4L2_TYPE_IS_OUTPUT(q->type))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 228/547] media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 227/547] media: imx-jpeg: cancel timeout worker when streaming stops Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 229/547] media: microchip-csi2dc: fix async notifier leak on probe error path Greg Kroah-Hartman
` (327 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 0f29f84317c1e35f6a9265277be33e60d3fc8c1c upstream.
In vmalloc mode the frame-completion IRQ queues mcam_frame_work() on
cam->s_bh_work, which memcpy()s from the dma_bufs[] that
mcam_free_dma_bufs() frees with dma_free_coherent(). mccic_shutdown()
frees those buffers without stopping the controller, so while streaming
a late frame IRQ can re-arm the work after the buffers are gone, causing a
use-after-free.
Stop the controller in mccic_shutdown() when streaming is still active
(gated on an open fd, which holds a runtime-PM reference, so the device
is powered), cancel s_bh_work in mcam_free_dma_bufs(), and move
INIT_WORK() into mccic_register() before the device can be published.
Fixes: 67a8dbbc4e04 ("[media] marvell-cam: Basic working MMP camera driver")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/marvell/mcam-core.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/drivers/media/platform/marvell/mcam-core.c
+++ b/drivers/media/platform/marvell/mcam-core.c
@@ -406,6 +406,8 @@ static void mcam_free_dma_bufs(struct mc
{
int i;
+ cancel_work_sync(&cam->s_bh_work);
+
for (i = 0; i < cam->nbufs; i++) {
dma_free_coherent(cam->dev, cam->dma_buf_size,
cam->dma_bufs[i], cam->dma_handles[i]);
@@ -1306,7 +1308,6 @@ static int mcam_setup_vb2(struct mcam_ca
break;
case B_vmalloc:
#ifdef MCAM_MODE_VMALLOC
- INIT_WORK(&cam->s_bh_work, mcam_frame_work);
vq->ops = &mcam_vb2_ops;
vq->mem_ops = &vb2_vmalloc_memops;
cam->dma_setup = mcam_ctlr_dma_vmalloc;
@@ -1864,6 +1865,12 @@ int mccic_register(struct mcam_camera *c
goto out;
}
+#ifdef MCAM_MODE_VMALLOC
+ /* Init before sensor bind: armed by IRQ, cancelled on probe-error paths. */
+ if (cam->buffer_mode == B_vmalloc)
+ INIT_WORK(&cam->s_bh_work, mcam_frame_work);
+#endif
+
mutex_init(&cam->s_mutex);
cam->state = S_NOTREADY;
mcam_set_config_needed(cam, 1);
@@ -1922,10 +1929,15 @@ void mccic_shutdown(struct mcam_camera *
* take it down again will wedge the machine, which is frowned
* upon.
*/
+ mutex_lock(&cam->s_mutex);
if (!list_empty(&cam->vdev.fh_list)) {
cam_warn(cam, "Removing a device with users!\n");
+ /* Stop so the IRQ can't re-arm s_bh_work after the buffers are freed. */
+ if (cam->state == S_STREAMING)
+ mcam_ctlr_stop_dma(cam);
sensor_call(cam, core, s_power, 0);
}
+ mutex_unlock(&cam->s_mutex);
if (cam->buffer_mode == B_vmalloc)
mcam_free_dma_bufs(cam);
v4l2_ctrl_handler_free(&cam->ctrl_handler);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 229/547] media: microchip-csi2dc: fix async notifier leak on probe error path
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 228/547] media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 230/547] media: microchip-isc: take a reference on the parsed endpoints Greg Kroah-Hartman
` (326 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Eugen Hristev,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit c7528789244ce7329ca883170fb9315d739ae985 upstream.
csi2dc_of_parse() ends up calling csi2dc_prepare_notifier(), which
registers the V4L2 async notifier with v4l2_async_nf_register(). The
probe error label csi2dc_probe_cleanup_notifier is reached after
csi2dc_of_parse() has already succeeded (e.g. when media entity init,
csi2dc_power() or v4l2_async_register_subdev() fail), but it calls only
v4l2_async_nf_cleanup() and never v4l2_async_nf_unregister().
The notifier therefore stays chained in the global notifier_list while
the enclosing struct csi2dc_device is freed, leading to list corruption
and a use-after-free when the list is next walked.
Unregister the notifier before cleaning it up on the error path,
matching the teardown already done in csi2dc_remove().
Fixes: 2de0b3c0f678 ("media: atmel: introduce microchip csi2dc driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/microchip/microchip-csi2dc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/platform/microchip/microchip-csi2dc.c
+++ b/drivers/media/platform/microchip/microchip-csi2dc.c
@@ -735,6 +735,7 @@ static int csi2dc_probe(struct platform_
return 0;
csi2dc_probe_cleanup_notifier:
+ v4l2_async_nf_unregister(&csi2dc->notifier);
v4l2_async_nf_cleanup(&csi2dc->notifier);
csi2dc_probe_cleanup_entity:
media_entity_cleanup(&csi2dc->csi2dc_sd.entity);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 230/547] media: microchip-isc: take a reference on the parsed endpoints
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 229/547] media: microchip-csi2dc: fix async notifier leak on probe error path Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 231/547] media: redrat3: fix UAF in probe error path leaving rc device registered Greg Kroah-Hartman
` (325 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
commit f2eb2fd388bf3f1959556a326e797cacca341c86 upstream.
for_each_endpoint_of_node() drops the reference on the current node as
it advances. xisc_parse_dt() and isc_parse_dt() store the node in
subdev_entity->epn and release it later with of_node_put(), but never
took their own reference, so the stored pointer refers to an
already-released node. This underflows the refcount and can
use-after-free, reachable through the camera device tree overlay.
Take a reference with of_node_get() when storing the node, and drop it
in microchip_isc_subdev_cleanup() so the entities the bind loop never
reaches on an early exit do not leak it.
Fixes: c9aa973884a1 ("media: atmel: atmel-isc: add microchip-xisc driver")
Fixes: d6701f13bd07 ("media: atmel: Use v4l2_async_notifier_add_fwnode_remote_subdev")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/microchip/microchip-isc-base.c | 6 +++++
drivers/media/platform/microchip/microchip-sama5d2-isc.c | 17 ++++++++++-----
drivers/media/platform/microchip/microchip-sama7g5-isc.c | 17 ++++++++++-----
3 files changed, 30 insertions(+), 10 deletions(-)
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1860,6 +1860,12 @@ void microchip_isc_subdev_cleanup(struct
list_for_each_entry(subdev_entity, &isc->subdev_entities, list) {
v4l2_async_nf_unregister(&subdev_entity->notifier);
v4l2_async_nf_cleanup(&subdev_entity->notifier);
+ /*
+ * Release the endpoint reference taken while parsing. It is
+ * NULL for entities the bind loop already consumed, so this
+ * only drops the ones left over on an early exit.
+ */
+ of_node_put(subdev_entity->epn);
}
INIT_LIST_HEAD(&isc->subdev_entities);
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -356,28 +356,30 @@ static int isc_parse_dt(struct device *d
struct device_node *epn;
struct isc_subdev_entity *subdev_entity;
unsigned int flags;
+ int ret;
INIT_LIST_HEAD(&isc->subdev_entities);
for_each_endpoint_of_node(np, epn) {
struct v4l2_fwnode_endpoint v4l2_epn = { .bus_type = 0 };
- int ret;
ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(epn),
&v4l2_epn);
if (ret) {
- of_node_put(epn);
dev_err(dev, "Could not parse the endpoint\n");
- return -EINVAL;
+ of_node_put(epn);
+ ret = -EINVAL;
+ goto err_cleanup;
}
subdev_entity = devm_kzalloc(dev, sizeof(*subdev_entity),
GFP_KERNEL);
if (!subdev_entity) {
of_node_put(epn);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_cleanup;
}
- subdev_entity->epn = epn;
+ subdev_entity->epn = of_node_get(epn);
flags = v4l2_epn.bus.parallel.flags;
@@ -398,6 +400,11 @@ static int isc_parse_dt(struct device *d
}
return 0;
+
+err_cleanup:
+ list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+ of_node_put(subdev_entity->epn);
+ return ret;
}
static int microchip_isc_probe(struct platform_device *pdev)
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -340,6 +340,7 @@ static int xisc_parse_dt(struct device *
struct isc_subdev_entity *subdev_entity;
unsigned int flags;
bool mipi_mode;
+ int ret;
INIT_LIST_HEAD(&isc->subdev_entities);
@@ -347,23 +348,24 @@ static int xisc_parse_dt(struct device *
for_each_endpoint_of_node(np, epn) {
struct v4l2_fwnode_endpoint v4l2_epn = { .bus_type = 0 };
- int ret;
ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(epn),
&v4l2_epn);
if (ret) {
- of_node_put(epn);
dev_err(dev, "Could not parse the endpoint\n");
- return -EINVAL;
+ of_node_put(epn);
+ ret = -EINVAL;
+ goto err_cleanup;
}
subdev_entity = devm_kzalloc(dev, sizeof(*subdev_entity),
GFP_KERNEL);
if (!subdev_entity) {
of_node_put(epn);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_cleanup;
}
- subdev_entity->epn = epn;
+ subdev_entity->epn = of_node_get(epn);
flags = v4l2_epn.bus.parallel.flags;
@@ -387,6 +389,11 @@ static int xisc_parse_dt(struct device *
}
return 0;
+
+err_cleanup:
+ list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+ of_node_put(subdev_entity->epn);
+ return ret;
}
static int microchip_xisc_probe(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 231/547] media: redrat3: fix UAF in probe error path leaving rc device registered
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 230/547] media: microchip-isc: take a reference on the parsed endpoints Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 232/547] media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog Greg Kroah-Hartman
` (324 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+302b9b575a06733ff60c,
Rik van Riel, Sean Young
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <riel@surriel.com>
commit af452b9e01331b5338a1e5141624f17607239207 upstream.
redrat3 stores its device name and phys path inside the main rr3
structure, and the rc device's device_name and input_phys point into
rr3. When the RC device is registered, it keeps those pointers.
KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648
Read of size 1 at addr ffff888051fda758 by task udevd/7464
Call Trace:
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
vscnprintf+0x41/0x90 lib/vsprintf.c:3014
sysfs_emit+0x10e/0x180 fs/sysfs/file.c:761
input_dev_show_name+0x58/0x70 drivers/input/input.c:1282
Allocated by task 10:
redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023
Freed by task 10:
redrat3_delete drivers/media/rc/redrat3.c:466 [inline]
redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124
Syzkaller triggers this via usb probing. It probes the RedRat3 USB
interface, which calls redrat3_dev_probe() in redrat3.c. That function
allocates rr3, then builds an rc device whose name points into rr3 via
redrat3_init_rc_dev() in redrat3.c, and registers it with
rc_register_device().
When the detector enable fails after the RC device is registered, the
probe jumps to the led_free path. That path unregisters the LED but does
not unregister the RC device before freeing rr3 via redrat3_delete() in
redrat3.c. The RC device still holds device_name = rr3->name which is now
freed.
Later udevd reads /sys/.../input device name via sysfs_emit() in file.c,
which calls input_dev_show_name() in input.c, which emits dev->name which
is the freed rr3->name.
When the detector enable fails after the RC device is registered, the
error path must not leave the RC device registered. Make the probe error
path clean up the same way redrat3_dev_disconnect() does.
This change should be safe because the RC device is fully registered at
this point and its teardown via rc_unregister_device() is protected by
the input device mutex, and rr3 is still alive during unregister so
device_name remains valid until after unregister. The URBs are killed
before rc_free, so no completion can run after rc is freed. No new lock
ordering is introduced.
Reported-by: syzbot+302b9b575a06733ff60c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=302b9b575a06733ff60c
Link: https://lore.kernel.org/all/6a74a76d.ec7c9571.3ac9bb.0056.GAE@google.com/
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org
Assisted-by: Hermes:muse-spark-1.2 syzkaller
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/redrat3.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -975,6 +975,7 @@ static int redrat3_dev_probe(struct usb_
struct device *dev = &intf->dev;
struct usb_host_interface *uhi;
struct redrat3_dev *rr3;
+ struct rc_dev *rc;
struct usb_endpoint_descriptor *ep;
struct usb_endpoint_descriptor *ep_narrow = NULL;
struct usb_endpoint_descriptor *ep_wide = NULL;
@@ -1119,9 +1120,12 @@ static int redrat3_dev_probe(struct usb_
return 0;
led_free:
+ rc_unregister_device(rr3->rc);
led_classdev_unregister(&rr3->led);
redrat_free:
+ rc = rr3->rc;
redrat3_delete(rr3, rr3->udev);
+ rc_free_device(rc);
no_endpoints:
return retval;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 232/547] media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 231/547] media: redrat3: fix UAF in probe error path leaving rc device registered Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 233/547] mm/rmap: dont discard lazyfree THPs at PMD level Greg Kroah-Hartman
` (323 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrzej Hajda, Fan Wu,
Marek Szyprowski, Nicolas Dufresne, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 63069b5917cba2e15b1a78b3f4ff99e45102c56f upstream.
The MFC watchdog timer (s5p_mfc_watchdog) is self-rearming: every
callback re-arms itself with add_timer() and, on a timeout, schedules
watchdog_work. s5p_mfc_remove() tears this down with timer_delete_sync()
followed by flush_work().
timer_delete_sync() dequeues the timer and waits for a callback that is
already running, but it does not prevent a subsequent re-arm. Because the
watchdog callback re-arms via add_timer(), this is the wrong shutdown
primitive: once the wait returns nothing guarantees a just-queued re-arm
will not fire later, dereferencing dev (clock on/off, deinit_hw,
load_firmware, init_hw) after video_unregister_device(), DMA teardown and
s5p_mfc_final_pm() have run, a potential use-after-free.
Use timer_shutdown_sync(), which puts the timer into a shutdown state so
that any add_timer()/mod_timer() from the callback becomes a no-op and no
later firing is possible. Switch flush_work() to cancel_work_sync() so any
watchdog_work that was already queued before the timer was stopped is
cancelled rather than allowed to run to completion against the torn-down
device.
This issue was found by an in-house static analysis tool. No runtime
reproducer is available.
Fixes: af9357467810 ("[media] MFC: Add MFC 5.1 V4L2 driver")
Cc: stable@vger.kernel.org
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c
@@ -1474,8 +1474,8 @@ static void s5p_mfc_remove(struct platfo
}
mutex_unlock(&dev->mfc_mutex);
- timer_delete_sync(&dev->watchdog_timer);
- flush_work(&dev->watchdog_work);
+ timer_shutdown_sync(&dev->watchdog_timer);
+ cancel_work_sync(&dev->watchdog_work);
video_unregister_device(dev->vfd_enc);
video_unregister_device(dev->vfd_dec);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 233/547] mm/rmap: dont discard lazyfree THPs at PMD level
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 232/547] media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 234/547] mm/slab: sample slab_state once in kmem_cache_destroy() Greg Kroah-Hartman
` (322 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zi Yan, Andrew Morton, Kyle Zeng,
Lance Yang, David Hildenbrand (Arm), Lorenzo Stoakes (ARM),
JongHyuk Kim(MalHyuk), Rik van Riel, Liam R. Howlett,
Vlastimil Babka, Harry Yoo, Jann Horn
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zi Yan <ziy@nvidia.com>
commit 984c0700854e35779a2bcce6b02783e709b6efa2 upstream.
__discard_anon_folio_pmd_locked() clears a lazyfree THP's PMD before it
determines whether the folio can be discarded, and restores it if the
folio is dirty or has extra references. It is done under only the PMD
lock and the anon_vma read lock inside try_to_unmap_one() and no mmap lock
is held. The temporarily none PMD causes UAF.
A parallel munmap() or mremap() is supposed to serialize with it on the
PMD lock, but zap_pmd_range() (called by munmap()) and move_page_tables()
(called by mremap()) do not take the lock when they see the temporarily
none PMD and skip the PMD. There is no more page table walk after the
none PMD is restored:
- munmap(): free_pgtables() waits in unlink_anon_vmas() for the anon_vma
lock, then free_pmd_range() drops the restored PMD as bad without
removing the rmap, so the folio keeps a stale mapcount.
- whole-VMA MREMAP_DONTUNMAP: dontunmap_complete() unlinks the source VMA
from its anon_vma while the restored PMD still maps the folio.
- plain mremap(): the THP is not moved but unmapped, so the THP's data is
lost.
In the first two cases, the folio stays mapped, but no VMA that maps it is
linked to its anon_vma. When the anon_vma is freed, it is still reachable
when one rmap walks the folio. Racing lazyfree reclaim against
MREMAP_DONTUNMAP as an unprivileged user reproduces a KASAN use-after-free
in folio_lock_anon_vma_read() as reported in the Closes link.
One solution is to use an invalidated PMD instead of a cleared one until
the discard is committed, but it needs arch fixes first.
1. GUP-fast still follows an invalidated PMD on riscv, LoongArch and s390.
2. sparc64 miscounts thp_pte_count when an invalidated PMD is set again or
cleared.
To keep the fix simple for backport, stop discarding lazyfree THPs at PMD
level instead. try_to_unmap_one() splits the PMD and discards the folio at
PTE level.
unmap_huge_pmd_locked() and __discard_anon_folio_pmd_locked() are left in
place, unused, to minimize this fix for backport and the invalidated PMD
approach is planned as a follow-up series to use them again.
Link: https://lore.kernel.org/20261012-lazyfree-stable-fix-v2-1-6387d6e30063@nvidia.com
Fixes: 735ecdfaf4e8 ("mm/vmscan: avoid split lazyfree THP during shrink_folio_list()")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Kyle Zeng <kylebot@openai.com>
Closes: https://lore.kernel.org/r/20261009165214.40212-2-kylebot@openai.com
Reviewed-by: Kyle Zeng <kylebot@openai.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: JongHyuk Kim(MalHyuk) <malhyuk97@gmail.com>
Link: https://lore.kernel.org/CADQRuqvXQ=YE=7T3oR66vTxE33pi=ygEeZKPTOU=cALZL0Figw@mail.gmail.com
Assisted-by: LLM
Cc: Rik van Riel <riel@surriel.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Harry Yoo <harry@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/rmap.c | 11 -----------
1 file changed, 11 deletions(-)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -2275,17 +2275,6 @@ static bool try_to_unmap_one(struct foli
}
if (!pvmw.pte) {
- if (folio_test_lazyfree(folio)) {
- if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio))
- goto walk_done;
- /*
- * unmap_huge_pmd_locked has either already marked
- * the folio as swap-backed or decided to retain it
- * due to GUP or speculative references.
- */
- goto walk_abort;
- }
-
if (flags & TTU_SPLIT_HUGE_PMD) {
/*
* We temporarily have to drop the PTL and
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 234/547] mm/slab: sample slab_state once in kmem_cache_destroy()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 233/547] mm/rmap: dont discard lazyfree THPs at PMD level Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 235/547] mm/truncate: look up the end-edge straddler by index Greg Kroah-Hartman
` (321 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Imre Kaloz,
Jose A. Perez de Azpillaga, Harry Yoo (Meta),
Vlastimil Babka (SUSE)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Kaloz <kaloz@kernel.org>
commit 088bfdc0d7947d623f4899b9011c866e4445074d upstream.
kmem_cache_release() tests slab_state >= FULL after kmem_cache_destroy()
has dropped slab_mutex and unlinked the cache, and for a
SLAB_TYPESAFE_BY_RCU cache after rcu_barrier(). If slab_late_init() runs
before that test it sets slab_state to FULL but skips the unlinked cache,
which never got a sysfs entry, so sysfs_slab_release() calls kobject_put()
on a kobject that was never initialized:
WARNING: lib/kobject.c:734 at kobject_put+0x64/0x2c0, CPU#1: kworker/u8:3/55
kobject: '(null)' ((____ptrval____)): is not initialized, yet kobject_put() is being called.
refcount_t: underflow; use-after-free.
kobject_put+0x64/0x2c0
sysfs_slab_release+0xc/0x20
kmem_cache_destroy+0x104/0x1e0
bioset_exit+0x13c/0x1e0
disk_release+0x54/0x140
put_disk+0x18/0x40
floppy_async_init+0xbec/0xd10
slab_state >= FULL asks whether the cache has a kobject, which cache
creation skips while slab_state <= UP. UP is the state just below FULL,
so a false sample cannot skip a kobject_put() that was owed.
Seen on sparc64 at boot, where the asynchronous floppy init tears down
its bio slab while the late initcalls are running.
Sample slab_state once, under slab_mutex which slab_late_init() holds
when it sets FULL, and use the result for both the unlink and the
release.
The history of this problem dates back to v3.2:
Commit 69cb8e6b7c29 ("slub: free slabs without holding locks") in
v3.2 moved sysfs_slab_remove() outside slub_lock and introduced
a race condition between kmem_cache_destroy() and slab_sysfs_init().
Commit 945cf2b6199be ("mm/sl[aou]b: Extract a common function for
kmem_cache_destroy") in v3.7 accidentally closed the race while
extracting a common implementation for kmem_cache_destroy().
Commit 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry")
in v3.8 re-opened the race by dropping slab_mutex around
sysfs_slab_remove() in __kmem_cache_shutdown(), to avoid a lockdep
splat between slab_mutex and the sysfs lock.
Commit 657dc2f97220 ("slab: remove synchronous rcu_barrier() call in
memcg cache release path") in v4.11 shifted from synchronous
rcu_barrier() to asynchronous RCU work for SLAB_TYPESAFE_BY_RCU caches.
That commit, again, accidentally closed the race by moving
sysfs_slab_release() to shutdown_cache(), but only for
!SLAB_TYPESAFE_BY_RCU caches because destruction of
SLAB_TYPESAFE_BY_RCU caches is done in an RCU work.
Commit 0495e337b703 ("mm/slab_common: Deleting kobject in
kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") in
v6.0 re-introduced the race for !SLAB_TYPESAFE_BY_RCU caches.
Fixes: 69cb8e6b7c29 ("slub: free slabs without holding locks")
Fixes: 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry")
Fixes: 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock")
Cc: stable@vger.kernel.org
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Link: https://patch.msgid.link/20261014150844.8536-1-kaloz@kernel.org
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slab_common.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -515,10 +515,10 @@ EXPORT_SYMBOL(kmem_buckets_create);
* and release of the kobject does not need slab_mutex or cpu_hotplug_lock
* protection. So they are now done without holding those locks.
*/
-static void kmem_cache_release(struct kmem_cache *s)
+static void kmem_cache_release(struct kmem_cache *s, bool sysfs_ready)
{
kfence_shutdown_cache(s);
- if (__is_defined(SLAB_SUPPORTS_SYSFS) && slab_state >= FULL)
+ if (__is_defined(SLAB_SUPPORTS_SYSFS) && sysfs_ready)
sysfs_slab_release(s);
else
slab_kmem_cache_release(s);
@@ -533,6 +533,7 @@ void slab_kmem_cache_release(struct kmem
void kmem_cache_destroy(struct kmem_cache *s)
{
+ bool sysfs_ready;
int err;
if (unlikely(!s) || !kasan_check_byte(s))
@@ -580,10 +581,18 @@ void kmem_cache_destroy(struct kmem_cach
list_del(&s->list);
+ /*
+ * slab_late_init() sets slab_state to FULL under slab_mutex and adds
+ * sysfs entries only for caches still on the list. Sample the state
+ * here, so that a cache unlinked before that point is not handed to
+ * sysfs_slab_release() with an uninitialized kobject.
+ */
+ sysfs_ready = slab_state >= FULL;
+
mutex_unlock(&slab_mutex);
cpus_read_unlock();
- if (slab_state >= FULL)
+ if (sysfs_ready)
sysfs_slab_unlink(s);
debugfs_slab_release(s);
@@ -593,7 +602,7 @@ void kmem_cache_destroy(struct kmem_cach
if (s->flags & SLAB_TYPESAFE_BY_RCU)
rcu_barrier();
- kmem_cache_release(s);
+ kmem_cache_release(s, sysfs_ready);
}
EXPORT_SYMBOL(kmem_cache_destroy);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 235/547] mm/truncate: look up the end-edge straddler by index
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 234/547] mm/slab: sample slab_state once in kmem_cache_destroy() Greg Kroah-Hartman
@ 2026-11-04 21:06 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 236/547] mm: khugepaged: fix folio is used after folio_put/unlock() Greg Kroah-Hartman
` (320 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Andrew Morton, Sashiko,
Jan Kara, Zi Yan, Brian Foster, David Hildenbrand,
Lorenzo Stoakes, Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Hugh Dickins, Baolin Wang,
Matthew Wilcox (Oracle), Joanne Koong, Darrick J. Wong,
yizhang089, Yang Erkun, Zhihao Cheng, Kefeng Wang, yukuai
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
commit f47dee903b9f0f1e4e7181e8a398a7678cabf0a5 upstream.
In truncate_inode_partial_folio(), after the first split at the start
edge, folio_split() unlocks and drops the refcount of the after-split
sub-folios. The sub-folio straddling the end of the truncation range is
therefore unlocked and only transiently ref'd in the page cache while the
code still derives it from a page pointer inside the original folio.
Between the first split finishing and page_folio() resolving split_at2,
that tail page can be reclaimed, freed and reallocated as a new large
folio in the same mapping at a different file offset. folio2 then points
at a folio that does not cover the end boundary, yet folio2->mapping ==
folio->mapping still holds, so the stale pointer passes the mapping check
and folio_split_or_unmap() splits a folio at a wrong position (or, with a
transient refcount, a use-after-free window opens between try_get and the
split). __folio_split()'s own folio != page_folio(split_at) check cannot
catch this either since split_at2 has been reallocated as part of the new
folio, so page_folio(split_at2) resolves back to folio2.
Look the straddler up by its page index instead. __filemap_get_folio()
returns the folio currently covering the boundary, ref'd and locked, with
the mapping validated under the lock, so the split target is always the
real folio at the end edge.
Link: https://lore.kernel.org/20260928120833.3440834-3-yi.zhang@huaweicloud.com
Link: https://lore.kernel.org/linux-mm/DLGXT0ERY79Z.3C5DYVJVX6S9Z@nvidia.com/
Fixes: 7460b470a131 ("mm/truncate: use folio_split() in truncate operation")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260916094500.C30061F00893%40smtp.kernel.org
Suggested-by: Jan Kara <jack@suse.cz>
Suggested-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Joanne Koong <joannelkoong@gmail.com>
Cc: Darrick J. Wong <djwong@kernel.org>
Cc: <yizhang089@gmail.com>
Cc: Yang Erkun <yangerkun@huawei.com>
Cc: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: <yukuai@fnnas.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/truncate.c | 30 ++++++++++++++++--------------
1 file changed, 16 insertions(+), 14 deletions(-)
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -259,30 +259,32 @@ bool truncate_inode_partial_folio(struct
* for shmem truncate
*/
struct folio *folio2;
+ pgoff_t end_idx;
if (offset + length == size)
goto no_split;
- split_at2 = folio_page(folio,
- PAGE_ALIGN_DOWN(offset + length) / PAGE_SIZE);
- folio2 = page_folio(split_at2);
-
- if (!folio_try_get(folio2))
+ /*
+ * After the first split at the start edge, the folio at the
+ * end edge may be freed and reused concurrently.
+ * __filemap_get_folio() looks up the straddler at end_idx
+ * and returns it locked and ref'd with the mapping
+ * validated.
+ */
+ end_idx = (pos + offset + length) >> PAGE_SHIFT;
+ folio2 = __filemap_get_folio(folio->mapping, end_idx,
+ FGP_LOCK | FGP_NOWAIT, 0);
+ if (IS_ERR(folio2))
goto no_split;
+ /* make sure folio2 is large */
if (!folio_test_large(folio2))
goto out;
- if (!folio_trylock(folio2))
- goto out;
-
- /* make sure folio2 is large and does not change its mapping */
- if (folio_test_large(folio2) &&
- folio2->mapping == folio->mapping)
- folio_split_or_unmap(folio2, split_at2, min_order);
-
- folio_unlock(folio2);
+ split_at2 = folio_page(folio2, (end_idx - folio2->index));
+ folio_split_or_unmap(folio2, split_at2, min_order);
out:
+ folio_unlock(folio2);
folio_put(folio2);
no_split:
return true;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 236/547] mm: khugepaged: fix folio is used after folio_put/unlock()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-11-04 21:06 ` [PATCH 7.3 235/547] mm/truncate: look up the end-edge straddler by index Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 237/547] mm: khugepaged: fix folio is used after pte_unmap_unlock() Greg Kroah-Hartman
` (319 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vernon Yang, Andrew Morton,
David Hildenbrand (Arm), Lorenzo Stoakes (ARM), Barry Song,
Dev Jain, Lance Yang, Ryan Roberts, Zach OKeefe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vernon Yang <yanglincheng@kylinos.cn>
commit 9010383e71e6ce75fcd3c8f87133c8ce6c0e6ab4 upstream.
On the rollback path, folio_put() has already dropped the last reference
of new_folio. On the success path, new_folio is already unlocked and can
be freed concurrently. The trace_mm_khugepaged_collapse_file() is left
with a dangling folio pointer.
So using the folio_pfn() before dropping the reference, closing
use-after-free window.
Link: https://lore.kernel.org/20260909025804.3233645-4-vernon2gm@gmail.com
Fixes: 4c9473e87e75 ("mm/khugepaged: add tracepoint to collapse_file()")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/huge_memory.h | 6 +++---
mm/khugepaged.c | 4 +++-
2 files changed, 6 insertions(+), 4 deletions(-)
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -211,10 +211,10 @@ TRACE_EVENT(mm_khugepaged_scan_file,
);
TRACE_EVENT(mm_khugepaged_collapse_file,
- TP_PROTO(struct mm_struct *mm, struct folio *new_folio, pgoff_t index,
+ TP_PROTO(struct mm_struct *mm, unsigned long new_pfn, pgoff_t index,
unsigned long addr, bool is_shmem, struct file *file,
int nr, int result),
- TP_ARGS(mm, new_folio, index, addr, is_shmem, file, nr, result),
+ TP_ARGS(mm, new_pfn, index, addr, is_shmem, file, nr, result),
TP_STRUCT__entry(
__field(struct mm_struct *, mm)
__field(unsigned long, hpfn)
@@ -228,7 +228,7 @@ TRACE_EVENT(mm_khugepaged_collapse_file,
TP_fast_assign(
__entry->mm = mm;
- __entry->hpfn = new_folio ? folio_pfn(new_folio) : -1;
+ __entry->hpfn = new_pfn;
__entry->index = index;
__entry->addr = addr;
__entry->is_shmem = is_shmem;
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -2245,6 +2245,7 @@ static enum scan_result collapse_file(st
struct address_space *mapping = file->f_mapping;
struct page *dst;
struct folio *folio, *tmp, *new_folio;
+ unsigned long new_pfn = -1;
pgoff_t index = 0, end = start + HPAGE_PMD_NR;
LIST_HEAD(pagelist);
XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER);
@@ -2264,6 +2265,7 @@ static enum scan_result collapse_file(st
result = alloc_charge_folio(&new_folio, mm, cc, HPAGE_PMD_ORDER);
if (result != SCAN_SUCCEED)
goto out;
+ new_pfn = folio_pfn(new_folio);
mapping_set_update(&xas, mapping);
@@ -2667,7 +2669,7 @@ rollback:
folio_put(new_folio);
out:
VM_BUG_ON(!list_empty(&pagelist));
- trace_mm_khugepaged_collapse_file(mm, new_folio, index, addr, is_shmem, file, HPAGE_PMD_NR, result);
+ trace_mm_khugepaged_collapse_file(mm, new_pfn, index, addr, is_shmem, file, HPAGE_PMD_NR, result);
return result;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 237/547] mm: khugepaged: fix folio is used after pte_unmap_unlock()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 236/547] mm: khugepaged: fix folio is used after folio_put/unlock() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 238/547] mm: khugepaged: fix swap entry value to folio_pfn() Greg Kroah-Hartman
` (318 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vernon Yang, Andrew Morton,
David Hildenbrand (Arm), Lorenzo Stoakes (ARM), Barry Song,
Dev Jain, Lance Yang, Ryan Roberts, Zach OKeefe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vernon Yang <yanglincheng@kylinos.cn>
commit ba2f1f92ddfabd340c9248fd2380104f717ee8b1 upstream.
After the page table lock has dropped, the folio can be freed
concurrently. The trace_mm_khugepaged_scan_pmd() is left with a dangling
folio pointer.
So using the folio_pfn() before dropping the page table lock, closing
use-after-free window.
And other pre-existing bug, When the `for (i = 0; i < HPAGE_PMD_NR; i++)`
iteration to terminate and the folio operation preceding is normal, but
pfn will be incorrect. so we really only trace the PFN if it really was
problematic.
Link: https://lore.kernel.org/20260909025804.3233645-3-vernon2gm@gmail.com
Fixes: 7d2eba0557c1 ("mm: add tracepoint for scanning pages")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/huge_memory.h | 6 +++---
mm/khugepaged.c | 10 +++++++++-
2 files changed, 12 insertions(+), 4 deletions(-)
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -55,10 +55,10 @@ SCAN_STATUS
TRACE_EVENT(mm_khugepaged_scan_pmd,
- TP_PROTO(struct mm_struct *mm, struct folio *folio,
+ TP_PROTO(struct mm_struct *mm, unsigned long pfn,
int referenced, int none_or_zero, int status, int unmapped),
- TP_ARGS(mm, folio, referenced, none_or_zero, status, unmapped),
+ TP_ARGS(mm, pfn, referenced, none_or_zero, status, unmapped),
TP_STRUCT__entry(
__field(struct mm_struct *, mm)
@@ -71,7 +71,7 @@ TRACE_EVENT(mm_khugepaged_scan_pmd,
TP_fast_assign(
__entry->mm = mm;
- __entry->pfn = folio ? folio_pfn(folio) : -1;
+ __entry->pfn = pfn;
__entry->referenced = referenced;
__entry->none_or_zero = none_or_zero;
__entry->status = status;
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1612,6 +1612,7 @@ static enum scan_result collapse_scan_pm
enum scan_result result = SCAN_FAIL;
struct page *page = NULL;
struct folio *folio = NULL;
+ unsigned long failed_pfn = -1;
unsigned long addr;
unsigned long enabled_orders;
spinlock_t *ptl;
@@ -1706,11 +1707,13 @@ static enum scan_result collapse_scan_pm
if (cc->is_khugepaged && !(vma->vm_flags & VM_DROPPABLE) &&
folio_test_lazyfree(folio) && !pte_dirty(pteval)) {
result = SCAN_PAGE_LAZYFREE;
+ failed_pfn = folio_pfn(folio);
goto out_unmap;
}
if (!folio_test_anon(folio)) {
result = SCAN_PAGE_ANON;
+ failed_pfn = folio_pfn(folio);
goto out_unmap;
}
@@ -1721,6 +1724,7 @@ static enum scan_result collapse_scan_pm
if (folio_maybe_mapped_shared(folio)) {
if (++shared > max_ptes_shared) {
result = SCAN_EXCEED_SHARED_PTE;
+ failed_pfn = folio_pfn(folio);
count_collapse_event(HPAGE_PMD_ORDER, THP_SCAN_EXCEED_SHARED_PTE,
MTHP_STAT_COLLAPSE_EXCEED_SHARED);
goto out_unmap;
@@ -1738,15 +1742,18 @@ static enum scan_result collapse_scan_pm
node = folio_nid(folio);
if (collapse_scan_abort(node, cc)) {
result = SCAN_SCAN_ABORT;
+ failed_pfn = folio_pfn(folio);
goto out_unmap;
}
cc->node_load[node]++;
if (!folio_test_lru(folio)) {
result = SCAN_PAGE_LRU;
+ failed_pfn = folio_pfn(folio);
goto out_unmap;
}
if (folio_test_locked(folio)) {
result = SCAN_PAGE_LOCK;
+ failed_pfn = folio_pfn(folio);
goto out_unmap;
}
@@ -1759,6 +1766,7 @@ static enum scan_result collapse_scan_pm
*/
if (folio_expected_ref_count(folio) != folio_ref_count(folio)) {
result = SCAN_PAGE_COUNT;
+ failed_pfn = folio_pfn(folio);
goto out_unmap;
}
@@ -1784,7 +1792,7 @@ out_unmap:
*lock_dropped = true;
}
out:
- trace_mm_khugepaged_scan_pmd(mm, folio, referenced,
+ trace_mm_khugepaged_scan_pmd(mm, failed_pfn, referenced,
none_or_zero, result, unmapped);
return result;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 238/547] mm: khugepaged: fix swap entry value to folio_pfn()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 237/547] mm: khugepaged: fix folio is used after pte_unmap_unlock() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 239/547] mptcp: hold MP_JOIN msk ref when cloning reqsk Greg Kroah-Hartman
` (317 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vernon Yang, Andrew Morton,
David Hildenbrand (Arm), Barry Song, Dev Jain, Lance Yang,
Lorenzo Stoakes, Ryan Roberts, Zach OKeefe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vernon Yang <yanglincheng@kylinos.cn>
commit 942c8ec27aa4ffc587511650718349964e1696e6 upstream.
Patch series "mm: khugepaged: fix tracepoint UAF", v5.
The khugepaged tracepoints take a folio pointer and call folio_pfn(), but
by then the folio may no longer be valid: freed after folio_put(),
folio_unlock() or pte_unmap_unlock(), or not a folio at all but an
xarray-encoded swap entry. On classic SPARSEMEM, dereferencing it oopses
khugepaged as soon as the trace event is enabled; on other memory models
it merely prints a bogus pfn.
Pass the pfn to the tracepoints directly, captured while the folio is
still pinned, closing the use-after-free windows in
mm_khugepaged_scan_file(), mm_khugepaged_scan_pmd() and
mm_khugepaged_collapse_file().
This patch (of 3):
When the swap entries found exceed max_ptes_swap, the loop is left via
break with folio still holding the xarray value that encodes the swap
entry, not valid folio pointer.
That value is passed to trace_mm_khugepaged_scan_file(), which feeds it to
folio_pfn(). On FLATMEM and SPARSEMEM_VMEMMAP, the page_to_pfn() is plain
pointer arithmetic, so the trace event merely prints bogus scan_pfn. On
classic SPARSEMEM, the page_to_pfn() reads page->flags, dereferencing the
tiny encoded integer and oopsing khugepaged whenever the trace event is
enabled.
So when folio is the swap entry value, simply set pfn to -1, just like
exhausted scan naturally.
And the folio_put() has maybe dropped the last reference of folio. The
trace_mm_khugepaged_scan_file() is left with a dangling folio pointer. so
using the folio_pfn() before dropping the reference, closing
use-after-free window.
Link: https://lore.kernel.org/20260909025804.3233645-1-vernon2gm@gmail.com
Link: https://lore.kernel.org/20260909025804.3233645-2-vernon2gm@gmail.com
Fixes: d41fd2016ed0 ("mm/khugepaged: add tracepoint to hpage_collapse_scan_file()")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/huge_memory.h | 6 +++---
mm/khugepaged.c | 7 ++++++-
2 files changed, 9 insertions(+), 4 deletions(-)
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -178,10 +178,10 @@ TRACE_EVENT(mm_collapse_huge_page_swapin
TRACE_EVENT(mm_khugepaged_scan_file,
- TP_PROTO(struct mm_struct *mm, struct folio *folio, struct file *file,
+ TP_PROTO(struct mm_struct *mm, unsigned long pfn, struct file *file,
int present, int swap, int result),
- TP_ARGS(mm, folio, file, present, swap, result),
+ TP_ARGS(mm, pfn, file, present, swap, result),
TP_STRUCT__entry(
__field(struct mm_struct *, mm)
@@ -194,7 +194,7 @@ TRACE_EVENT(mm_khugepaged_scan_file,
TP_fast_assign(
__entry->mm = mm;
- __entry->pfn = folio ? folio_pfn(folio) : -1;
+ __entry->pfn = pfn;
__assign_str(filename);
__entry->present = present;
__entry->swap = swap;
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -2693,6 +2693,7 @@ static enum scan_result collapse_scan_fi
int present, swap;
int node = NUMA_NO_NODE;
enum scan_result result = SCAN_SUCCEED;
+ unsigned long failed_pfn = -1;
present = 0;
swap = 0;
@@ -2725,6 +2726,7 @@ static enum scan_result collapse_scan_fi
if (is_pmd_order(folio_order(folio))) {
result = SCAN_PTE_MAPPED_HUGEPAGE;
+ failed_pfn = folio_pfn(folio);
/*
* PMD-sized THP implies that we can only try
* retracting the PTE table.
@@ -2736,6 +2738,7 @@ static enum scan_result collapse_scan_fi
node = folio_nid(folio);
if (collapse_scan_abort(node, cc)) {
result = SCAN_SCAN_ABORT;
+ failed_pfn = folio_pfn(folio);
folio_put(folio);
break;
}
@@ -2743,12 +2746,14 @@ static enum scan_result collapse_scan_fi
if (!folio_test_lru(folio)) {
result = SCAN_PAGE_LRU;
+ failed_pfn = folio_pfn(folio);
folio_put(folio);
break;
}
if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) {
result = SCAN_PAGE_COUNT;
+ failed_pfn = folio_pfn(folio);
folio_put(folio);
break;
}
@@ -2783,7 +2788,7 @@ static enum scan_result collapse_scan_fi
}
}
- trace_mm_khugepaged_scan_file(mm, folio, file, present, swap, result);
+ trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present, swap, result);
return result;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 239/547] mptcp: hold MP_JOIN msk ref when cloning reqsk
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 238/547] mm: khugepaged: fix swap entry value to folio_pfn() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 240/547] mshv_vtl: detach poll waiter on POLLFREE Greg Kroah-Hartman
` (316 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Lee, Vega,
Ruide Cao, Ren Wei, Matthieu Baerts (NGI0), Jakub Kicinski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <caoruide123@gmail.com>
commit c9c90cf437a9e6597611b6d3aad6e255fad22867 upstream.
TCP request migration clones pending request sockets with
inet_reqsk_clone(). For MPTCP MP_JOIN requests this byte-copies
subflow_req->msk, but the clone does not own a reference.
The original and cloned requests can consequently drop the same msk
reference, leaving one request with a dangling pointer. This manifests as
a KASAN slab-use-after-free in subflow_req_destructor():
BUG: KASAN: slab-use-after-free in subflow_req_destructor (net/mptcp/subflow.c:45)
Write of size 4 at addr ff1100010e008d40 by task swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5-00353-gc27e36054537 #10 PREEMPT(full)
Call Trace:
subflow_req_destructor (net/mptcp/subflow.c:45)
subflow_v4_req_destructor (net/mptcp/subflow.c:694)
__reqsk_free (net/ipv4/inet_connection_sock.c:906)
reqsk_timer_handler (include/net/request_sock.h:137 net/ipv4/inet_connection_sock.c:1147)
Allocated by task 10014:
sk_prot_alloc (net/core/sock.c:2246)
sk_clone (net/core/sock.c:2488)
mptcp_sk_clone_init (include/net/sock.h:1848 net/mptcp/protocol.c:3564)
subflow_syn_recv_sock (net/mptcp/subflow.c:883)
tcp_check_req (net/ipv4/tcp_minisocks.c:934)
Freed by task 0:
slab_free_after_rcu_debug (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6439)
rcu_core (kernel/rcu/tree.c:2645 kernel/rcu/tree.c:2897)
Last potentially related work creation:
kmem_cache_free (mm/slub.c:2638 mm/slub.c:6377 mm/slub.c:6504)
__sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
sk_destruct (net/core/sock.c:2419)
__sk_free (net/core/sock.c:2430)
sk_free (net/core/sock.c:2441)
mptcp_close (include/net/sock.h:2020 net/mptcp/protocol.c:3399)
inet_release (net/ipv4/af_inet.c:442)
The buggy address belongs to the cache MPTCP of size 2968
The buggy address is 128 bytes inside a freed 2968-byte region
A non-NULL subflow_req->msk means that the request owns one reference. The
third ACK can concurrently transfer the original request reference to the
child and release it, so taking an unconditional hold on the copied pointer
is unsafe.
MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all current inet_reqsk_clone()
callers run in an RCU read-side critical section. Document and
lockdep-check that calling-context requirement. Read the pointer from the
original request and acquire a reference only if it is still live. Use
refcount_inc_not_zero_acquire() so the subsequent ownership validation
cannot be reordered before the try-get, then re-read the original request
to verify that it still owns the same msk. If either check fails, clear the
clone pointer; otherwise its normal destructor balances the new reference.
Mark the ownership-transfer store with WRITE_ONCE() to match the lockless
reads.
The following patch completes the clone fixup for MP_CAPABLE token
ownership. Both patches carry the same Fixes tag and are required for
stable backports.
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Reported-by: Kyle Zeng <kylebot@openai.com>
Reported-by: David Lee <david.lee@trailofbits.com>
Reported-by: Vega <vega@nebusec.ai>
Closes: https://lore.kernel.org/all/20260804095051.715355-1-david.lee@trailofbits.com/
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-3-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/mptcp.h | 9 +++++++++
net/ipv4/inet_connection_sock.c | 4 ++++
net/mptcp/subflow.c | 35 ++++++++++++++++++++++++++++++++++-
3 files changed, 47 insertions(+), 1 deletion(-)
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -219,6 +219,9 @@ int mptcp_subflow_init_cookie_req(struct
struct request_sock *mptcp_subflow_reqsk_alloc(const struct request_sock_ops *ops,
struct sock *sk_listener,
bool attach_listener);
+/* Caller must hold an RCU read-side lock. */
+void mptcp_subflow_reqsk_clone(struct request_sock *req,
+ struct request_sock *new_req);
__be32 mptcp_get_reset_option(const struct sk_buff *skb);
@@ -305,6 +308,12 @@ static inline struct request_sock *mptcp
return NULL;
}
+/* Caller must hold an RCU read-side lock. */
+static inline void mptcp_subflow_reqsk_clone(struct request_sock *req,
+ struct request_sock *new_req)
+{
+}
+
static inline __be32 mptcp_reset_option(const struct sk_buff *skb) { return htonl(0u); }
static inline void mptcp_active_detect_blackhole(struct sock *sk, bool expired) { }
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -21,6 +21,7 @@
#include <net/xfrm.h>
#include <net/tcp.h>
#include <net/tcp_ecn.h>
+#include <net/mptcp.h>
#include <net/sock_reuseport.h>
#include <net/addrconf.h>
@@ -961,6 +962,9 @@ static struct request_sock *inet_reqsk_c
rcu_assign_pointer(tcp_sk(nreq->sk)->fastopen_rsk, nreq);
}
+ if (rsk_is_mptcp(req))
+ mptcp_subflow_reqsk_clone(req, nreq);
+
return nreq;
}
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -47,6 +47,39 @@ static void subflow_req_destructor(struc
mptcp_token_destroy_request(req);
}
+void mptcp_subflow_reqsk_clone(struct request_sock *req,
+ struct request_sock *new_req)
+{
+ struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
+ struct mptcp_subflow_request_sock *new_subflow_req;
+ struct mptcp_sock *msk;
+
+ new_subflow_req = mptcp_subflow_rsk(new_req);
+ RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(),
+ "MPTCP reqsk clone called without RCU");
+
+ /* A non-NULL ->msk means the request owns one reference. The clone
+ * copied only the pointer, while the original request can concurrently
+ * transfer its reference to the child. Acquire a reference for the
+ * clone, then verify that the original request still owns the same msk.
+ * MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all clone callers run in
+ * an RCU read-side critical section, keeping the memory stable here.
+ */
+ msk = READ_ONCE(subflow_req->msk);
+ if (msk) {
+ struct sock *sk = (struct sock *)msk;
+
+ if (!refcount_inc_not_zero_acquire(&sk->sk_refcnt)) {
+ msk = NULL;
+ } else if (READ_ONCE(subflow_req->msk) != msk) {
+ sock_put(sk);
+ msk = NULL;
+ }
+ }
+
+ new_subflow_req->msk = msk;
+}
+
static void subflow_generate_hmac(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
void *hmac)
{
@@ -927,7 +960,7 @@ create_child:
}
/* move the msk reference ownership to the subflow */
- subflow_req->msk = NULL;
+ WRITE_ONCE(subflow_req->msk, NULL);
ctx->conn = (struct sock *)owner;
if (subflow_use_different_sport(owner, sk)) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 240/547] mshv_vtl: detach poll waiter on POLLFREE
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 239/547] mptcp: hold MP_JOIN msk ref when cloning reqsk Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 241/547] mtd: virt-concat: unlink concat node before freeing it Greg Kroah-Hartman
` (315 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daehyeon Ko, Naman Jain, Wei Liu
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
commit efc5dc4c15713fdd6e87882686a26ed1deb22dab upstream.
MSHV_SET_POLL_FILE keeps a poll wait entry after the ioctl returns. A
file reference does not always pin the registered waitqueue:
signalfd_poll() uses current->sighand->signalfd_wqh, whose lifetime is
tied to the task.
signalfd_cleanup() sends POLLFREE before the sighand is freed. The MSHV
callback currently leaves its entry linked, so __wake_up_pollfree()
warns and a later replacement calls remove_wait_queue() through a stale
wqh pointer. A source-equivalent KASAN run reproduced:
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
_raw_spin_lock_irqsave
remove_wait_queue
harness_ioctl [mshv_pollfree_harness]
The object belonged to sighand_cache and had been released through
slab_free_after_rcu_debug() after __cleanup_sighand().
On POLLFREE, unlink the entry under the provider waitqueue lock. Preserve
the existing CPU cancellation before publishing a NULL wqh, since a NULL
load lets a racing replacement reuse the persistent poll state. Use a
matching acquire load under RCU when removing a normal registration.
The callback takes no mutex and does not sleep, so the existing
mutex-to-waitqueue-lock order is unchanged.
An LLM assisted the source audit, fix development, and validation of this
issue.
Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hv/mshv_vtl_main.c | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
--- a/drivers/hv/mshv_vtl_main.c
+++ b/drivers/hv/mshv_vtl_main.c
@@ -17,6 +17,7 @@
#include <linux/entry-virt.h>
#include <linux/eventfd.h>
#include <linux/poll.h>
+#include <linux/rcupdate.h>
#include <linux/file.h>
#include <linux/vmalloc.h>
#include <asm/debugreg.h>
@@ -448,12 +449,35 @@ static void mshv_vtl_cancel(int cpu)
static int mshv_vtl_poll_file_wake(wait_queue_entry_t *wait, unsigned int mode, int sync, void *key)
{
struct mshv_vtl_poll_file *poll_file = container_of(wait, struct mshv_vtl_poll_file, wait);
+ __poll_t pollflags = key_to_poll(key);
+
+ if (pollflags & POLLFREE)
+ list_del_init(&wait->entry);
mshv_vtl_cancel(poll_file->cpu);
+ if (pollflags & POLLFREE) {
+ /* Publish teardown last; pair with acquire in the removal path. */
+ smp_store_release(&poll_file->wqh, NULL);
+ }
+
return 0;
}
+static void mshv_vtl_poll_file_remove_wait_queue(struct mshv_vtl_poll_file *poll_file)
+{
+ wait_queue_head_t *wqh;
+
+ /* POLLFREE providers RCU-delay the waitqueue free. */
+ rcu_read_lock();
+ /* Pair with the release store in the POLLFREE callback. */
+ wqh = smp_load_acquire(&poll_file->wqh);
+ if (wqh)
+ remove_wait_queue(wqh, &poll_file->wait);
+ rcu_read_unlock();
+ WRITE_ONCE(poll_file->wqh, NULL);
+}
+
static void mshv_vtl_ptable_queue_proc(struct file *file, wait_queue_head_t *wqh, poll_table *pt)
{
struct mshv_vtl_poll_file *poll_file = container_of(pt, struct mshv_vtl_poll_file, pt);
@@ -490,9 +514,7 @@ static int mshv_vtl_ioctl_set_poll_file(
mutex_lock(&mshv_vtl_poll_file_lock);
- if (poll_file->wqh)
- remove_wait_queue(poll_file->wqh, &poll_file->wait);
- poll_file->wqh = NULL;
+ mshv_vtl_poll_file_remove_wait_queue(poll_file);
old_file = poll_file->file;
poll_file->file = file;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 241/547] mtd: virt-concat: unlink concat node before freeing it
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 240/547] mshv_vtl: detach poll waiter on POLLFREE Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 242/547] mtd: virt-concat: unlink discarded items before freeing Greg Kroah-Hartman
` (314 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Harshit Mogalapalli, Miquel Raynal
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
commit 532caaa2f445b22b74b88b4023a810426772db54 upstream.
mtd_virt_concat_create_item() links each new mtd_virt_concat_node to
concat_node_list. mtd_virt_concat_destroy() later frees the node after
destroying its concatenated MTD device, but fails to unlink it. A later
list traversal dereferences the freed node, causing a use-after-free.
Remove the node from concat_node_list before freeing it.
Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtd_virt_concat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c
index da4277ced4d6..4fad0967a96e 100644
--- a/drivers/mtd/mtd_virt_concat.c
+++ b/drivers/mtd/mtd_virt_concat.c
@@ -130,6 +130,7 @@ int mtd_virt_concat_destroy(struct mtd_info *mtd)
mtd_concat_destroy(&concat->mtd);
}
+ list_del(&item->head);
for (idx = 0; idx < item->count; idx++)
of_node_put(item->nodes[idx]);
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 242/547] mtd: virt-concat: unlink discarded items before freeing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 241/547] mtd: virt-concat: unlink concat node before freeing it Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 243/547] net: sched: prevent scheduling deactivated qdiscs Greg Kroah-Hartman
` (313 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Harshit Mogalapalli, Miquel Raynal
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
commit 112a666bd82e96e4a01e0cd8a0fb9c88dd0bce38 upstream.
mtd_virt_concat_destroy_items() frees each item without removing it
from concat_node_list. list_for_each_entry_safe() protects the
current traversal, but concat_node_list still points to the freed
items afterward.
The function also unwinds errors from mtd_virt_concat_node_create().
A later initialization can traverse a freed item in
mtd_is_part_concat(), causing a use-after-free.
Unlink each item before freeing it.
Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtd_virt_concat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c
index 4fad0967a96e..637219e20b80 100644
--- a/drivers/mtd/mtd_virt_concat.c
+++ b/drivers/mtd/mtd_virt_concat.c
@@ -202,6 +202,7 @@ void mtd_virt_concat_destroy_items(void)
int i;
list_for_each_entry_safe(item, temp, &concat_node_list, head) {
+ list_del(&item->head);
for (i = 0; i < item->count; i++)
of_node_put(item->nodes[i]);
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 243/547] net: sched: prevent scheduling deactivated qdiscs
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 242/547] mtd: virt-concat: unlink discarded items before freeing Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 244/547] scsi: dc395x: sync the waiting_timer before freeing the host Greg Kroah-Hartman
` (312 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Lee, Dave Miller
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
commit d6f81fd6abe209f9803d8f74ce9ec69b8126bad3 upstream.
TAPRIO can schedule a deactivated qdisc after some_qdisc_is_busy() has
reported it idle.
Commit 47e8dbb6e763 ("net/sched: do not reset queues in graft operations")
made graft deactivation skip queue reset, leaving TAPRIO's timer armed.
A late callback schedules NET_TX softirq work, whose dequeue path can
race the unlocked child-queue reset in taprio_reset(). The same skb can
be queued for deferred freeing by RTNL and dequeued for transmission.
In the reproducer, the TAP reader frees it before __rtnl_unlock() reads
its next pointer. KASAN reports a slab-use-after-free in
__rtnl_unlock+0xa3/0xd0, with a read of size 8 from the freed skb.
Reject deactivated qdiscs in __netif_schedule(). Callers' RCU protection
lets the existing grace period join earlier scheduling calls before the
busy check. Restart nonempty transmit queues on reactivation so suppressed
scheduling does not strand packets.
Fixes: 47e8dbb6e763 ("net/sched: do not reset queues in graft operations")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20260805102514.740834-1-david.lee@trailofbits.com/
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 3 +++
net/sched/sch_generic.c | 4 ++++
2 files changed, 7 insertions(+)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3440,6 +3440,9 @@ static void __netif_reschedule(struct Qd
void __netif_schedule(struct Qdisc *q)
{
+ if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state)))
+ return;
+
/* If q->defer_list is not empty, at least one thread is
* in __dev_xmit_skb() before llist_del_all(&q->defer_list).
* This thread will attempt to run the queue.
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -1288,6 +1288,10 @@ static void transition_one_qdisc(struct
if (need_watchdog_p) {
WRITE_ONCE(dev_queue->trans_start, jiffies);
*need_watchdog_p = 1;
+
+ /* Resume backlog left by a suppressed schedule while deactivated. */
+ if (!qdisc_is_empty(new_qdisc))
+ netif_schedule_queue(dev_queue);
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 244/547] scsi: dc395x: sync the waiting_timer before freeing the host
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 243/547] net: sched: prevent scheduling deactivated qdiscs Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 245/547] serial: core: shut down initialized port on removal Greg Kroah-Hartman
` (311 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamie Lenehan, Fan Wu,
Martin K. Petersen (Oracle)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 0b1a79f2791a06f139dce5450e487307cf0e241f upstream.
The waiting_timer callback re-arms itself and takes the host lock.
adapter_uninit() currently stops it with timer_delete(), which does not
wait for a callback already running on another CPU. The final
scsi_host_put() that frees the host (and the host lock the callback
dereferences) runs right after adapter_uninit(), so a concurrent or just
re-armed callback can fire after the free, leaving a potential
use-after-free window.
Replace timer_delete() with timer_shutdown_sync() at the top of
adapter_uninit(), before the host-lock section: the timer is dequeued,
a running callback is waited for and rearming is blocked before the chip
is halted, so it cannot fire at all once the adapter has ceased to
function. Waiting outside the lock avoids the self-deadlock that would
result from syncing a callback blocked on the lock we still hold.
No shutdown is needed for selto_timer because it has no reachable armer
or callback.
This issue was found by an in-house static analysis tool.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Cc: Jamie Lenehan <lenehan@twibble.org>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260911020544.42966-1-fanwu01@zju.edu.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/dc395x.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -3808,13 +3808,11 @@ static void adapter_uninit_chip(struct A
static void adapter_uninit(struct AdapterCtlBlk *acb)
{
unsigned long flags;
- DC395x_LOCK_IO(acb->scsi_host, flags);
- /* remove timers */
- if (timer_pending(&acb->waiting_timer))
- timer_delete(&acb->waiting_timer);
- if (timer_pending(&acb->selto_timer))
- timer_delete(&acb->selto_timer);
+ /* Drain the self-rearming timer; must not run under host_lock. */
+ timer_shutdown_sync(&acb->waiting_timer);
+
+ DC395x_LOCK_IO(acb->scsi_host, flags);
adapter_uninit_chip(acb);
adapter_remove_and_free_all_devices(acb);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 245/547] serial: core: shut down initialized port on removal
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 244/547] scsi: dc395x: sync the waiting_timer before freeing the host Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 246/547] staging: rtl8723bs: fix protected RX frame validation in decrypt path Greg Kroah-Hartman
` (310 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+843bf2f48f4d12e6682e, stable,
Igor Putko
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Putko <igorpetindev@gmail.com>
commit 810d467c11f0c85107874d08dfdd11acba6aa0c0 upstream.
When a serial port configured as a console is opened and subsequently
closed, tty_port_shutdown() skips invoking port->ops->shutdown() because
port->console is true. As a result, tty_port_initialized() remains true
and the port's interrupt handler stays registered in the irq subsystem.
If the underlying device is later unbound or removed (e.g. via sysfs
driver unbind or device hot-unplug), serial_core_remove_one_port()
unregisters the console, frees uport->name via kfree(), and tears down
the port without shutting it down or freeing its IRQ. Consequently, the
irqaction descriptor remains registered in genirq with action->name
pointing to freed memory.
This triggers a use-after-free read whenever genirq accesses action->name,
such as when reading /proc/interrupts:
BUG: KASAN: slab-use-after-free in string+0x476/0x570
Call Trace:
string+0x476/0x570
vsnprintf+0x422/0x1300
seq_printf+0x...
show_interrupts+...
Fix this by acquiring port->mutex in serial_core_remove_one_port() after
console unregistration, clearing port->console under the mutex to prevent
data races with concurrent tty_port_shutdown(), and invoking
uart_shutdown(NULL, state) if the port remains initialized. This ensures
that port->ops->shutdown() is called and the IRQ is freed before
kfree(uport->name).
Reported-by: syzbot+843bf2f48f4d12e6682e@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=843bf2f48f4d12e6682e
Fixes: 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close")
Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct")
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Link: https://patch.msgid.link/20261003163337.45577-1-igorpetindev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3241,6 +3241,13 @@ static void serial_core_remove_one_port(
if (uart_console(uport))
unregister_console(uport->cons);
+ scoped_guard(mutex, &port->mutex) {
+ port->console = false;
+
+ if (tty_port_initialized(port))
+ uart_shutdown(NULL, state);
+ }
+
/*
* Free the port IO and memory resources, if any.
*/
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 246/547] staging: rtl8723bs: fix protected RX frame validation in decrypt path
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 245/547] serial: core: shut down initialized port on removal Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 247/547] xen-blkfront: unbind irq before tearing down ring and shadow requests Greg Kroah-Hartman
` (309 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
commit 495cb31c791bdf3f9efef255a9587b05b0526c9d upstream.
The RX software decrypt path mishandles crafted protected frames from a
malicious AP in two ways:
1) decryptor() never checks that a protected frame is long enough to
hold the 802.11 header plus the per-cipher trailer. All of
rtw_wep_decrypt(), rtw_tkip_decrypt() and rtw_aes_decrypt() compute
length = hdr.len - hdrlen - iv_len;
and act on the result, and recvframe_chkmic() similarly computes
datalen = hdr.len - hdrlen - iv_len - icv_len - 8;
for TKIP (the 8-byte Michael MIC is not accounted for in icv_len).
A frame shorter than hdrlen + iv_len + icv_len (+ 8 for TKIP) underflows
these unsigned subtractions, turning into a ~4 GiB iteration count in
aes_decipher()/arc4_crypt()/rtw_seccalctkipmic() or a ~4 GiB crc32_le()
length, causing out-of-bounds reads/writes of up to ~4 GiB starting from
the rx skb. Reject such frames in decryptor() before touching the IV;
this covers all three ciphers and the TKIP MIC check, and also keeps the
unconditional iv[3] access within the frame.
2) validate_80211w_mgmt() keeps using the frame - two memcpys through
the stale rx_data pointer and a pkt_len update - before checking
whether decryptor() returned NULL. On decrypt failure (e.g. a unicast
protected deauth/disassoc/action frame with a bad MIC, which this path
always software-decrypts) the skb has already been freed, so this is a
use-after-free read/write, and the caller's error path frees the frame
a second time, drifting free_recvframe_cnt. Bail out immediately when
decryptor() fails, freeing the temporary mgmt_DATA buffer first.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8ee3bdd1c45034200cb1aa9a7e9b575b9584643a@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_recv.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -426,8 +426,21 @@ static union recv_frame *decryptor(struc
u32 res = _SUCCESS;
if (prxattrib->encrypt > 0) {
- u8 *iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
+ u8 *iv;
+ u32 min_len = prxattrib->hdrlen + prxattrib->iv_len + prxattrib->icv_len;
+ /* TKIP appends an 8-byte Michael MIC that icv_len doesn't account for */
+ if (prxattrib->encrypt == _TKIP_)
+ min_len += 8;
+
+ /* a protected frame must be long enough to hold the IV and ICV/MIC */
+ if (precv_frame->u.hdr.len < min_len) {
+ rtw_free_recvframe(precv_frame,
+ &padapter->recvpriv.free_recv_queue);
+ return NULL;
+ }
+
+ iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
prxattrib->key_index = (((iv[3]) >> 6) & 0x3);
if (prxattrib->key_index > WEP_KEYS) {
@@ -1395,6 +1408,10 @@ static signed int validate_80211w_mgmt(s
if (!mgmt_DATA)
goto validate_80211w_fail;
precv_frame = decryptor(adapter, precv_frame);
+ if (!precv_frame) {
+ kfree(mgmt_DATA);
+ goto validate_80211w_fail;
+ }
/* save actual management data frame body */
memcpy(mgmt_DATA, ptr + pattrib->hdrlen + pattrib->iv_len, data_len);
/* overwrite the iv field */
@@ -1402,8 +1419,6 @@ static signed int validate_80211w_mgmt(s
/* remove the iv and icv length */
pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
kfree(mgmt_DATA);
- if (!precv_frame)
- goto validate_80211w_fail;
} else if (is_multicast_ether_addr(GetAddr1Ptr(ptr)) &&
(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC)) {
signed int BIP_ret = _SUCCESS;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 247/547] xen-blkfront: unbind irq before tearing down ring and shadow requests
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 246/547] staging: rtl8723bs: fix protected RX frame validation in decrypt path Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 248/547] wifi: ath9k: delete channel-context timers on deinit Greg Kroah-Hartman
` (308 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuchao Zhang, Roger Pau Monné,
Juergen Gross
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchao Zhang <ndaugoing@gmail.com>
commit f3e27b7955727a4d7c0e9264a2a209fbba788bdc upstream.
In blkif_free_ring(), the driver tears down the ring's persistent grants,
shadow request arrays, and shared ring structure (xenbus_teardown_ring),
and only calls unbind_from_irqhandler() at the very end.
While blkif_free_ring() is freeing persistent grants and clearing the
shadow array, the event channel interrupt (blkif_interrupt) is still
registered and active. If an interrupt arrives from the backend during
this teardown window, blkif_interrupt() reads rinfo->ring.sring and,
via blkif_completion(), accesses rinfo->shadow[id].grants_used and
rinfo->shadow[id].sg. blkif_free_ring() tears these structures down
without holding rinfo->ring_lock, and the handler only checks
info->connected at entry, so this is a real race resulting in a
use-after-free or NULL pointer dereference.
Fix this by moving unbind_from_irqhandler() to the beginning of
blkif_free_ring(). Calling unbind_from_irqhandler() first frees the
IRQ and synchronizes with any in-flight interrupt handlers on other CPUs
before ring memory and shadow request structures are deallocated,
matching the teardown order in drivers/net/xen-netfront.c.
Fixes: 11659569f720 ("xen/blkfront: split per device io_lock")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260922072155.34625-1-ndaugoing@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkfront.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1211,6 +1211,14 @@ static void blkif_free_ring(struct blkfr
int i, j, segs;
/*
+ * Interrupt teardown must be done ahead of freeing queue-related
+ * data, otherwise the interrupt handler can race with the cleanup.
+ */
+ if (rinfo->irq)
+ unbind_from_irqhandler(rinfo->irq, rinfo);
+ rinfo->evtchn = rinfo->irq = 0;
+
+ /*
* Remove indirect pages, this only happens when using indirect
* descriptors but not persistent grants
*/
@@ -1292,10 +1300,6 @@ free_shadow:
/* Free resources associated with old device channel. */
xenbus_teardown_ring((void **)&rinfo->ring.sring, info->nr_ring_pages,
rinfo->ring_ref);
-
- if (rinfo->irq)
- unbind_from_irqhandler(rinfo->irq, rinfo);
- rinfo->evtchn = rinfo->irq = 0;
}
static void blkif_free(struct blkfront_info *info, int suspend)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 248/547] wifi: ath9k: delete channel-context timers on deinit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 247/547] xen-blkfront: unbind irq before tearing down ring and shadow requests Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 249/547] wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement Greg Kroah-Hartman
` (307 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev,
Toke Høiland-Jørgensen, Jeff Johnson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
commit 81394dfb9a7905472957628b560ae894eae3a30f upstream.
ath9k_deinit_channel_context() cancels chanctx_work but does not delete
the offchannel and sched timers set up by ath9k_init_channel_context().
If either timer fires after deinit (e.g. during driver unload or
suspend), it accesses sc->sc_ah which may already be freed by
ath9k_hw_deinit(), causing a use-after-free.
Delete both timers with timer_shutdown_sync() before cancelling the work
item.
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Cc: stable@vger.kernel.org # v6.2+
Fixes: 705d0bf83dbe ("ath9k: Add a routine for initializing channel contexts")
Link: https://patch.msgid.link/20260911213144.130192-1-rosenp@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/channel.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1363,6 +1363,8 @@ void ath9k_init_channel_context(struct a
void ath9k_deinit_channel_context(struct ath_softc *sc)
{
+ timer_shutdown_sync(&sc->sched.timer);
+ timer_shutdown_sync(&sc->offchannel.timer);
cancel_work_sync(&sc->chanctx_work);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 249/547] wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 248/547] wifi: ath9k: delete channel-context timers on deinit Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 250/547] virtio_net: atomically disable rx mode work Greg Kroah-Hartman
` (306 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Li, Felix Fietkau
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <enderaoelyther@gmail.com>
commit 022f5f8b7a0580da50fcbc34da853d03d4321fe2 upstream.
mt7996_mac_add_twt_setup() links a new flow into dev->twt_list before
asking the MCU to add the agreement, but exits without unlinking the flow
if the request fails. The flow-ID and table masks are only committed
after MCU success, so the still-linked flow is invisible to the
mask-gated teardown paths.
If the station retries the setup, the same slot is cleared and its
embedded list node reinitialized while it is still linked, corrupting
dev->twt_list. If the station disassociates instead, teardown skips the
flow and station storage can be freed while the node remains linked. A
later scheduling or debugfs twt_stats walk can then dereference the
freed flow, resulting in a use-after-free.
Unlink the flow when the MCU rejects the agreement. This restores the
list to its pre-request state while leaving the unchanged mask and
agreement accounting untouched.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260729173632.14387-3-enderaoelyther@gmail.com/
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260825112620.97568-1-enderaoelyther@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -3285,8 +3285,10 @@ void mt7996_mac_add_twt_setup(struct iee
flow->tsf = le64_to_cpu(twt_agrt->twt);
if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
- MCU_TWT_AGRT_ADD))
+ MCU_TWT_AGRT_ADD)) {
+ list_del(&flow->list);
goto unlock;
+ }
setup_cmd = TWT_SETUP_CMD_ACCEPT;
dev->twt.table_mask |= BIT(table_id);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 250/547] virtio_net: atomically disable rx mode work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 249/547] wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 251/547] vfio/nvgrace-gpu: Use a core-only open_device in fallback mode Greg Kroah-Hartman
` (305 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+d17c2bc750a9cbbb, Weiming Shi,
Paolo Abeni
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
commit 1234707482053f1d1ac7c5756207d2c29057974c upstream.
virtio-net uses a boolean to gate rx_mode_work during device teardown.
The flag is changed under RTNL, but ndo_set_rx_mode checks it under the
address-list lock. A callback can therefore pass the check and enqueue work
after teardown has flushed it. The work is also enabled before late
probe operations that can fail, allowing probe unwind to free the netdev
with work still queued.
KASAN reports the worker using a virtqueue that probe unwind already freed:
BUG: KASAN: slab-use-after-free in virtqueue_add_split
Workqueue: events virtnet_rx_mode_work
Call Trace:
virtqueue_add_split (drivers/virtio/virtio_ring.c:706)
virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2839)
virtnet_send_command_reply (drivers/net/virtio_net.c:3565)
virtnet_rx_mode_work (drivers/net/virtio_net.c:3833)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405)
Freed by task 119:
kfree (mm/slub.c:6625)
vp_del_vq.isra.0 (drivers/virtio/virtio_pci_common.c:259)
vp_del_vqs (drivers/virtio/virtio_pci_common.c:285)
virtnet_probe (drivers/net/virtio_net.c:7129)
Use the workqueue disable mechanism to atomically reject new queue attempts
and drain running work. Keep work disabled until probe succeeds or restore
has reattached the netdev, then enable it and replay receive-mode state for
a running interface. Disable it before resource teardown in freeze and
remove.
Fixes: b9f7425239a0 ("virtio-net: convert rx mode setting to use workqueue")
Cc: stable@vger.kernel.org
Reported-by: <co+d17c2bc750a9cbbb@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20261017114237.2786302-2-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/virtio_net.c | 26 +++++++++-----------------
1 file changed, 9 insertions(+), 17 deletions(-)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -441,9 +441,6 @@ struct virtnet_info {
/* Work struct for setting rx mode */
struct work_struct rx_mode_work;
- /* OK to queue work setting RX mode? */
- bool rx_mode_work_enabled;
-
/* Does the affinity hint is set for virtqueues? */
bool affinity_hint_set;
@@ -710,16 +707,13 @@ static void virtnet_rq_free_buf(struct v
static void enable_rx_mode_work(struct virtnet_info *vi)
{
- rtnl_lock();
- vi->rx_mode_work_enabled = true;
- rtnl_unlock();
+ if (enable_work(&vi->rx_mode_work) && netif_running(vi->dev))
+ schedule_work(&vi->rx_mode_work);
}
static void disable_rx_mode_work(struct virtnet_info *vi)
{
- rtnl_lock();
- vi->rx_mode_work_enabled = false;
- rtnl_unlock();
+ disable_work_sync(&vi->rx_mode_work);
}
static void virtqueue_napi_schedule(struct napi_struct *napi,
@@ -3925,8 +3919,7 @@ static void virtnet_set_rx_mode(struct n
{
struct virtnet_info *vi = netdev_priv(dev);
- if (vi->rx_mode_work_enabled)
- schedule_work(&vi->rx_mode_work);
+ schedule_work(&vi->rx_mode_work);
}
static int virtnet_vlan_rx_add_vid(struct net_device *dev,
@@ -5742,7 +5735,6 @@ static void virtnet_freeze_down(struct v
/* Make sure no work handler is accessing the device */
flush_work(&vi->config_work);
disable_rx_mode_work(vi);
- flush_work(&vi->rx_mode_work);
if (netif_running(vi->dev)) {
rtnl_lock();
@@ -5772,8 +5764,6 @@ static int virtnet_restore_up(struct vir
virtio_device_ready(vdev);
- enable_rx_mode_work(vi);
-
if (netif_running(vi->dev)) {
rtnl_lock();
err = virtnet_open(vi->dev);
@@ -5785,6 +5775,8 @@ static int virtnet_restore_up(struct vir
netif_tx_lock_bh(vi->dev);
netif_device_attach(vi->dev);
netif_tx_unlock_bh(vi->dev);
+
+ enable_rx_mode_work(vi);
return 0;
err_destroy_pools:
@@ -6880,6 +6872,7 @@ static int virtnet_probe(struct virtio_d
INIT_WORK(&vi->config_work, virtnet_config_changed_work);
INIT_WORK(&vi->rx_mode_work, virtnet_rx_mode_work);
+ disable_work(&vi->rx_mode_work);
if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) {
vi->mergeable_rx_bufs = true;
@@ -7038,8 +7031,6 @@ static int virtnet_probe(struct virtio_d
if (vi->has_rss || vi->has_rss_hash_report)
virtnet_init_default_rss(vi);
- enable_rx_mode_work(vi);
-
for (i = 0; i < ARRAY_SIZE(guest_offloads); i++) {
unsigned int fbit;
@@ -7143,6 +7134,8 @@ static int virtnet_probe(struct virtio_d
goto free_unregister_netdev;
}
+ enable_rx_mode_work(vi);
+
pr_debug("virtnet: registered device %s with %d RX and TX vq's\n",
dev->name, max_queue_pairs);
@@ -7195,7 +7188,6 @@ static void virtnet_remove(struct virtio
/* Make sure no work handler is accessing the device. */
flush_work(&vi->config_work);
disable_rx_mode_work(vi);
- flush_work(&vi->rx_mode_work);
virtnet_free_irq_moder(vi);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 251/547] vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 250/547] virtio_net: atomically disable rx mode work Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 252/547] usb: gadget: fix refcount underflow in gadgetfs_bind() error path Greg Kroah-Hartman
` (304 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson, Andrea Parri,
Ankit Agrawal
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
commit 9c48b994b66d7b585698f9aaee8ff559a7755c0a upstream.
When the ACPI memory properties are missing or the C2C link is down, the
device is exposed through nvgrace_gpu_pci_core_ops. That table opens
through nvgrace_gpu_open_device() but closes through
vfio_pci_core_close_device(), so open and close are not symmetric.
nvgrace_gpu_open_device() registers nvdev->usemem for poison handling
unconditionally. In fallback mode usemem.memlength is zero, and
register_pfn_address_space() inserts a node covering [0, ULONG_MAX].
Nothing removes it: a second open fails with -EBUSY, and once the device
is unbound the node outlives the nvdev that contains it. The next open
after a rebind reports:
BUG: KASAN: slab-use-after-free in interval_tree_iter_first+0x209/0x310
Read of size 8 at addr ffff88800894aa30 by task nvgrace_repro/203
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
print_report+0x153/0x4c6
kasan_report+0xe4/0x1a0
interval_tree_iter_first+0x209/0x310
register_pfn_address_space+0x97/0x100
nvgrace_gpu_open_device+0x21c/0x730
vfio_df_open+0x213/0x520
vfio_df_ioctl_bind_iommufd+0x3e8/0x6e0
vfio_device_fops_unl_ioctl+0x782/0x1570
__x64_sys_ioctl+0x13c/0x1c0
do_syscall_64+0x106/0x630
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 188:
...
_vfio_alloc_device+0x3a/0x500
nvgrace_gpu_probe+0xcb/0x660
local_pci_probe+0xcf/0x170
...
Freed by task 188:
...
kfree+0x20d/0x600
device_release+0xcf/0x250
kobject_put+0x152/0x2f0
pci_device_remove+0xb0/0x1c0
device_release_driver_internal+0x38d/0x540
unbind_store+0xde/0x100
...
Give the fallback table its own open_device that only calls
vfio_pci_core_enable() and vfio_pci_core_finish_enable(), the
counterpart of vfio_pci_core_close_device(). Fallback mode then never
touches the nvgrace memory regions, as Alex suggested.
This should be safe because the fallback table uses the vfio-pci core
read, write and mmap handlers, so nothing there uses the state
nvgrace_gpu_open_device() sets up. The one visible difference is that a
fallback open no longer fails when BAR0 cannot be mapped, which matches
vfio-pci.
Fixes: e5f19b619fa0 ("vfio/nvgrace-gpu: register device memory for poison handling")
Cc: stable@vger.kernel.org
Suggested-by: Alex Williamson <alex@shazbot.org>
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Reviewed-by: Ankit Agrawal <ankita@nvidia.com>
Link: https://lore.kernel.org/r/20261015081937.405320-2-parri.andrea@gmail.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/nvgrace-gpu/main.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/vfio/pci/nvgrace-gpu/main.c
+++ b/drivers/vfio/pci/nvgrace-gpu/main.c
@@ -1083,6 +1083,21 @@ static const struct vfio_device_ops nvgr
.detach_ioas = vfio_iommufd_physical_detach_ioas,
};
+static int nvgrace_gpu_core_open_device(struct vfio_device *core_vdev)
+{
+ struct vfio_pci_core_device *vdev =
+ container_of(core_vdev, struct vfio_pci_core_device, vdev);
+ int ret;
+
+ ret = vfio_pci_core_enable(vdev);
+ if (ret)
+ return ret;
+
+ vfio_pci_core_finish_enable(vdev);
+
+ return 0;
+}
+
static const struct vfio_pci_device_ops nvgrace_gpu_pci_dev_core_ops = {
.get_dmabuf_phys = vfio_pci_core_get_dmabuf_phys,
};
@@ -1091,7 +1106,7 @@ static const struct vfio_device_ops nvgr
.name = "nvgrace-gpu-vfio-pci-core",
.init = vfio_pci_core_init_dev,
.release = vfio_pci_core_release_dev,
- .open_device = nvgrace_gpu_open_device,
+ .open_device = nvgrace_gpu_core_open_device,
.close_device = vfio_pci_core_close_device,
.ioctl = vfio_pci_core_ioctl,
.get_region_info_caps = vfio_pci_ioctl_get_region_info,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 252/547] usb: gadget: fix refcount underflow in gadgetfs_bind() error path
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 251/547] vfio/nvgrace-gpu: Use a core-only open_device in fallback mode Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 253/547] ufs: use u64 for directory size in ufs_last_byte Greg Kroah-Hartman
` (303 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+8496ab5e117502750445, stable,
Nguyen Quang Le Kien, Alan Stern
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
commit cb3b441f2698455a48e9a023d5f7f4e3fcb94c73 upstream.
gadgetfs_bind() calls get_dev() only on the success path, but
gadgetfs_unbind() called from the enomem error label unconditionally
calls put_dev(). When bind fails (e.g. ENOMEM), put_dev() fires
without a matching get_dev(), leaving the refcount unbalanced.
A subsequent close of the ep0 file descriptor calls dev_release() ->
put_dev() which hits zero and frees the object; then gadgetfs_kill_sb()
calls put_dev(the_device) again on the already-freed pointer, triggering
a refcount underflow and use-after-free.
Fix by calling get_dev() at the start of gadgetfs_bind(), before any
error path that invokes gadgetfs_unbind(), so the reference is always
balanced regardless of whether bind succeeds or fails.
Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260811060810.295666-1-khiemtranzo532001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/legacy/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1692,6 +1692,8 @@ static int gadgetfs_bind(struct usb_gadg
dev->gadget = gadget;
gadget->ep0->driver_data = dev;
+ get_dev (dev);
+
/* preallocate control response and buffer */
dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
if (!dev->req)
@@ -1706,7 +1708,6 @@ static int gadgetfs_bind(struct usb_gadg
spin_lock_irq(&dev->lock);
dev->state = STATE_DEV_UNCONNECTED;
spin_unlock_irq(&dev->lock);
- get_dev (dev);
return 0;
enomem:
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 253/547] ufs: use u64 for directory size in ufs_last_byte
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 252/547] usb: gadget: fix refcount underflow in gadgetfs_bind() error path Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 254/547] spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout Greg Kroah-Hartman
` (302 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YANXIN LI, Jan Kara,
Christian Brauner (Amutable)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: YANXIN LI <fadouse@pm.me>
commit 1eff23433e73d7da4f9e3529d2701e34962b161f upstream.
ufs1_read_inode() and ufs2_read_inode() copy the untrusted 64-bit
on-disk size into inode->i_size. ufs_last_byte() then truncates that
value to an unsigned int before calculating the valid extent of a
directory folio.
A directory size of exactly 4 GiB is truncated to zero. In
ufs_find_entry(), subtracting the requested record length from that zero
forms an endpoint almost 4 GiB beyond the mapped folio. A crafted UFS2
image produces:
BUG: KASAN: use-after-free in ufs_find_entry+0x583/0x6e0 [ufs]
Read of size 1
...
ufs_find_entry
ufs_inode_by_name
ufs_lookup
__lookup_slow
path_lookupat
The KASAN classification reflects that the adjacent physical page was
free; the source-level operation is an out-of-folio read. A controlled
UFS1 test with CONFIG_UFS_FS_WRITE enabled also made ufs_find_entry()
return a directory entry from an adjacent anonymous page. unlink() then
passed that pointer to ufs_delete_entry(), which cleared the adjacent
page's 3
2-bit d_ino. This write result reproduced three out of three
times.
UFS normally requires a privileged mount path. A relevant boundary is
a privileged automounter or image-processing service handling an
attacker-supplied filesystem. The write primitive additionally requires
UFS1 to be mounted read-write with CONFIG_UFS_FS_WRITE enabled; the read
is reachable with read-only UFS2.
Keep the intermediate size arithmetic at 64 bits so non-final pages are
bounded at PAGE_SIZE. With this change, the same controlled tests reach
the real on-disk directory entry and produce no adjacent-page write or
KASAN report. A reproducer and full validation logs are available on
request.
The vulnerable helper is present in v7.2-rc3, v7.1, v6.18.38, v6.12.95,
v6.6.111, and upstream master at 1229e2e57a5c. Runtime reproduction and
fix validation were performed in an x86-64 QEMU guest running v7.2-rc3
with generic KASAN.
Fixes: b71034e5e67d ("[PATCH] ufs: directory and page cache: from blocks to pages")
Cc: stable@vger.kernel.org
Signed-off-by: YANXIN LI <fadouse@pm.me>
Link: https://patch.msgid.link/20260718190300.867109-1-fadouse@pm.me
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ufs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ufs/dir.c
+++ b/fs/ufs/dir.c
@@ -213,7 +213,7 @@ fail:
static unsigned
ufs_last_byte(struct inode *inode, unsigned long page_nr)
{
- unsigned last_byte = inode->i_size;
+ u64 last_byte = inode->i_size;
last_byte -= page_nr << PAGE_SHIFT;
if (last_byte > PAGE_SIZE)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 254/547] spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 253/547] ufs: use u64 for directory size in ufs_last_byte Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 255/547] resource: report a devm_request_resource() conflict under the lock Greg Kroah-Hartman
` (301 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
commit 0b591332a2bdc13d3f9163793131fe3651d1556a upstream.
If a DMA-mapped transfer times out waiting for DMA_TERM and neither DMA
abort interrupt arrived, pci1xxxx_spi_transfer_with_dma() returns
through the error label while both DMA engines are still enabled, the
done/abort interrupt status is still armed and the transfer state
(p->xfer, p->tx_sgl, p->rx_sgl) is still registered.
The ISRs keep firing afterwards: they reprogram the DMA engines from
p->tx_sgl / p->rx_sgl and signal completion through p->xfer and
p->spi_xfer_done, all of which the SPI core is free to unmap or reuse
once transfer_one() has returned, which is a use-after-free. A late
done interrupt can also start the next transfer queued behind the
failed one.
Stop both DMA engines, drain the pending done/abort interrupt status
and synchronize the DMA IRQs before dropping the in-progress state and
the transfer pointers, and re-enable the engines afterwards so that
subsequent transfers keep working. The engines are only turned back on
once both were confirmed to have stopped: re-enabling an engine that
failed to stop would cancel the pending stop request and let it keep
running into buffers the SPI core is about to unmap or free, which is
exactly the window this patch closes. An engine that failed to stop is
left disabled, as the abort paths already do.
The DMA interrupt status and mask registers are shared between the two
SPI instances, so the cleanup drains only this instance's done/abort
status bits instead of masking the interrupt lines, which would also
suppress the peer instance's completion interrupts.
Also make the DMA ISRs ignore interrupts while no transfer is in
progress so that a stray MSI after the cleanup can no longer act on
the cleared state.
No PCI1XXXX hardware was available for testing and QEMU has no model
of this PCIe part, so the timeout path was exercised with a userspace
replica of the timeout branch and the DMA ISRs, with the register and
interrupt accesses mocked: on the unfixed code both a wedged engine
that clears after the timeout and a late done interrupt touch the
freed transfer state, while with this fix applied neither does and an
engine that failed to stop is left disabled. The module was also
loaded and unloaded in a QEMU x86_64 guest running a kernel with this
fix applied.
Fixes: 9538edeb72c9 ("spi: mchp-pci1xxxx: DMA support for copying data to and from SPI Buf")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261016020036.1333548-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pci1xxxx.c | 71 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 71 insertions(+)
--- a/drivers/spi/spi-pci1xxxx.c
+++ b/drivers/spi/spi-pci1xxxx.c
@@ -542,6 +542,8 @@ static int pci1xxxx_spi_transfer_with_dm
struct pci1xxxx_spi_internal *p = spi_controller_get_devdata(spi_ctlr);
struct pci1xxxx_spi *par = p->parent;
dma_addr_t tx_dma_addr = 0;
+ unsigned long flags;
+ bool engines_stopped;
int ret = 0;
u32 regval;
@@ -618,12 +620,72 @@ static int pci1xxxx_spi_transfer_with_dm
p->dma_aborted_wr = false;
ret = -ECANCELED;
}
+
+ /*
+ * A timed out transfer leaves the DMA engines running and
+ * the done/abort interrupt status armed with p->xfer,
+ * p->tx_sgl and p->rx_sgl still registered. Stop the
+ * engines, drain the pending status and synchronize the
+ * IRQs before dropping the transfer state, otherwise a
+ * late interrupt makes the ISRs reprogram the engines
+ * from or signal completion through memory which the SPI
+ * core is about to unmap or free.
+ */
+ writel(SPI_DMA_ENGINE_DIS,
+ par->dma_offset_bar + SPI_DMA_GLOBAL_WR_ENGINE_EN);
+ writel(SPI_DMA_ENGINE_DIS,
+ par->dma_offset_bar + SPI_DMA_GLOBAL_RD_ENGINE_EN);
+ engines_stopped =
+ !(readl_poll_timeout(par->dma_offset_bar +
+ SPI_DMA_GLOBAL_WR_ENGINE_EN,
+ regval, regval == 0x0, 0,
+ USEC_PER_MSEC) ||
+ readl_poll_timeout(par->dma_offset_bar +
+ SPI_DMA_GLOBAL_RD_ENGINE_EN,
+ regval, regval == 0x0, 0,
+ USEC_PER_MSEC));
+ if (!engines_stopped)
+ dev_warn(&par->dev->dev,
+ "SPI DMA engines failed to stop\n");
+
+ spin_lock_irqsave(&par->dma_wr_reg_lock, flags);
+ writel((SPI_DMA_DONE_INT_MASK(p->hw_inst) |
+ SPI_DMA_ABORT_INT_MASK(p->hw_inst)),
+ par->dma_offset_bar + SPI_DMA_INTR_WR_CLR);
+ spin_unlock_irqrestore(&par->dma_wr_reg_lock, flags);
+ spin_lock_irqsave(&par->dma_rd_reg_lock, flags);
+ writel((SPI_DMA_DONE_INT_MASK(p->hw_inst) |
+ SPI_DMA_ABORT_INT_MASK(p->hw_inst)),
+ par->dma_offset_bar + SPI_DMA_INTR_RD_CLR);
+ spin_unlock_irqrestore(&par->dma_rd_reg_lock, flags);
+
+ p->spi_xfer_in_progress = false;
+ synchronize_irq(p->irq[1]);
+ synchronize_irq(p->irq[2]);
+
+ /*
+ * Turn the engines back on only once both are confirmed
+ * to have stopped: re-enabling an engine that failed to
+ * stop would cancel the pending stop request and let it
+ * run into buffers the SPI core is about to unmap or
+ * free. An engine that failed to stop is left disabled,
+ * as the abort paths already do.
+ */
+ if (engines_stopped) {
+ writel(SPI_DMA_ENGINE_EN,
+ par->dma_offset_bar + SPI_DMA_GLOBAL_WR_ENGINE_EN);
+ writel(SPI_DMA_ENGINE_EN,
+ par->dma_offset_bar + SPI_DMA_GLOBAL_RD_ENGINE_EN);
+ }
goto error;
}
ret = 0;
error:
p->spi_xfer_in_progress = false;
+ p->xfer = NULL;
+ p->tx_sgl = NULL;
+ p->rx_sgl = NULL;
return ret;
}
@@ -695,6 +757,9 @@ static irqreturn_t pci1xxxx_spi_isr_dma_
unsigned long flags;
u32 regval;
+ if (!p->spi_xfer_in_progress)
+ return IRQ_NONE;
+
/* Clear the DMA RD INT and start spi xfer*/
regval = readl(p->parent->dma_offset_bar + SPI_DMA_INTR_RD_STS);
if (regval) {
@@ -723,6 +788,9 @@ static irqreturn_t pci1xxxx_spi_isr_dma_
unsigned long flags;
u32 regval;
+ if (!p->spi_xfer_in_progress)
+ return IRQ_NONE;
+
/* Clear the DMA WR INT */
regval = readl(p->parent->dma_offset_bar + SPI_DMA_INTR_WR_STS);
if (regval) {
@@ -755,6 +823,9 @@ static irqreturn_t pci1xxxx_spi_isr_dma(
irqreturn_t spi_int_fired = IRQ_NONE;
u32 regval;
+ if (!p->spi_xfer_in_progress)
+ return IRQ_NONE;
+
/* Clear the SPI GO_BIT Interrupt */
regval = readl(p->parent->reg_base + SPI_MST_EVENT_REG_OFFSET(p->hw_inst));
if (regval & SPI_INTR) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 255/547] resource: report a devm_request_resource() conflict under the lock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 254/547] spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 256/547] phy: core: Fix race-condition between _of_phy_get() and try_module_get() Greg Kroah-Hartman
` (300 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nickolai Zeldovich, Andrew Morton,
Tejun Heo, Bradley Morgan, Bjorn Helgaas, Ilpo Järvinen,
Thierry Reding
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
commit d2f7bdfdeac8137e942b32e0badc40e181127d7b upstream.
devm_request_resource() calls request_resource_conflict(), which takes
resource_lock, tries to insert the new resource and returns a pointer to
the conflicting resource after dropping the lock. The error message is
then formatted from that pointer: conflict->name and the %pR argument
read the name, start, end, flags and desc of a resource that nothing
pins any more. The owner of the conflicting resource may call
release_resource() and free it the moment the lock is dropped.
The conflicting resource normally belongs to another device. With two
devices whose drivers claim overlapping regions (two PCI host bridges
whose "ranges" windows overlap, two instances of a controller on the
same aperture, or a stale claim an administrator is replacing), the
following interleaving reads freed memory:
CPU 0: driver B probe CPU 1: driver A unbind
devm_request_resource(devB, root, resB)
request_resource_conflict()
write_lock(&resource_lock)
__request_resource() -> resA
write_unlock(&resource_lock)
devres_release_all(devA)
devm_resource_release()
release_resource(resA)
put_device() -> kfree(resA)
dev_err(..., resA->name, resA) use after free
Both halves are reachable from userspace on any kernel: a write to the
"unbind" file of the driver that holds the region and a write to the
"bind" file of the driver that wants it. One in-tree path is
drivers/pci/bus.c devm_request_pci_bus_resources(), called from host
bridge probe for every bridge window; the windows are the embedded
struct resource of kzalloc'ed resource_entry objects that
pci_free_resource_list() frees when the other bridge is released.
In the common case the "resource collision" message is garbled; with
the slab object poisoned (CONFIG_SLUB_DEBUG) or reused, formatting
conflict->name oopses, and KASAN reports a slab-use-after-free read in
devm_request_resource(). All of this happens in a probe that is
already failing with -EBUSY. The window is a few hundred instructions
wide and exists only when two devices actually collide, so the race
has not been observed outside of analysis.
Do the same here: take resource_lock, insert with __request_resource()
and print the diagnostic while the lock still keeps the conflicting
resource in the tree, then drop the lock. The return values and the
devres handling are unchanged.
The change was built for x86_64 and RISC-V; the resource KUnit tests
pass on both.
Found by formal verification of kernel/resource.c against the kernel
binary.
Link: https://lore.kernel.org/20261016140043.790048-1-nickolai@csail.mit.edu
Fixes: 8d38821cbcf5 ("resources: Add device-managed request/release_resource()")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Assisted-by: LLM
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Cc: Thierry Reding <treding@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/resource.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1695,10 +1695,15 @@ int devm_request_resource(struct device
*ptr = new;
- conflict = request_resource_conflict(root, new);
- if (conflict) {
+ /* Report a conflict while the lock still keeps it in the tree. */
+ write_lock(&resource_lock);
+ conflict = __request_resource(root, new);
+ if (conflict)
dev_err(dev, "resource collision: %pR conflicts with %s %pR\n",
new, conflict->name, conflict);
+ write_unlock(&resource_lock);
+
+ if (conflict) {
devres_free(ptr);
return -EBUSY;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 256/547] phy: core: Fix race-condition between _of_phy_get() and try_module_get()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 255/547] resource: report a devm_request_resource() conflict under the lock Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 257/547] power: supply: pf1550: drain IRQ work before unregistering supplies Greg Kroah-Hartman
` (299 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Loic Poulain,
Bryan ODonoghue, Vinod Koul, Oleg Keri
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
commit 090055ee629523092688da42428558ba56d4272f upstream.
Sashiko asked during a patch review if the existing usage pattern had a
race condition; specifically in of_phy_get() if it was possible between
returning from _of_phy_get() and running try_module_get() that a module
might be unbound leading to use-after-free.
Looking at the code this appears to be so, there is no linkage between the
phy and module under a synchronisation primitive.
Using the phy_provider_mutex in phy_get() will ensure there is a link between
the returned phy pointer and the module_get() bumping the module reference
count.
Amend phy_get(), of_phy_get() and devm_of_phy_get_by_index() to fix the
same usage pattern.
phy_provider_unregister() must take the phy_provider_mutex so amending
phy_get()/of_phy_get() to take that same mutex guarantees there is no
use-after-free.
Fixes: ff764963479a1 ("drivers: phy: add generic PHY framework")
Cc: stable@vger.kernel.org
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Tested-by: Oleg Keri <okerixx@gmail.com> # Lenovo Yoga Slim 7x Gen 11 (Glymur)
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://patch.msgid.link/20260918-b4-linux-next-25-03-13-dtsi-x1e80100-camss-v20-1-dc244e124e71@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/phy-core.c | 45 ++++++++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 15 deletions(-)
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -124,13 +124,13 @@ static struct phy *phy_find(struct devic
const char *dev_id = dev_name(dev);
struct phy_lookup *p, *pl = NULL;
- mutex_lock(&phy_provider_mutex);
+ lockdep_assert_held(&phy_provider_mutex);
+
list_for_each_entry(p, &phys, node)
if (!strcmp(p->dev_id, dev_id) && !strcmp(p->con_id, con_id)) {
pl = p;
break;
}
- mutex_unlock(&phy_provider_mutex);
return pl ? pl->phy : ERR_PTR(-ENODEV);
}
@@ -624,6 +624,8 @@ static struct phy *_of_phy_get(struct de
struct phy *phy = NULL;
struct of_phandle_args args;
+ lockdep_assert_held(&phy_provider_mutex);
+
ret = of_parse_phandle_with_args(np, "phys", "#phy-cells",
index, &args);
if (ret)
@@ -635,11 +637,10 @@ static struct phy *_of_phy_get(struct de
goto out_put_node;
}
- mutex_lock(&phy_provider_mutex);
phy_provider = of_phy_provider_lookup(args.np);
if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) {
phy = ERR_PTR(-EPROBE_DEFER);
- goto out_unlock;
+ goto out_put_node;
}
if (!of_device_is_available(args.np)) {
@@ -653,8 +654,6 @@ static struct phy *_of_phy_get(struct de
out_put_module:
module_put(phy_provider->owner);
-out_unlock:
- mutex_unlock(&phy_provider_mutex);
out_put_node:
of_node_put(args.np);
@@ -678,15 +677,21 @@ struct phy *of_phy_get(struct device_nod
if (con_id)
index = of_property_match_string(np, "phy-names", con_id);
+ mutex_lock(&phy_provider_mutex);
+
phy = _of_phy_get(np, index);
if (IS_ERR(phy))
- return phy;
+ goto out_unlock;
- if (!try_module_get(phy->ops->owner))
- return ERR_PTR(-EPROBE_DEFER);
+ if (!try_module_get(phy->ops->owner)) {
+ phy = ERR_PTR(-EPROBE_DEFER);
+ goto out_unlock;
+ }
get_device(&phy->dev);
+out_unlock:
+ mutex_unlock(&phy_provider_mutex);
return phy;
}
EXPORT_SYMBOL_GPL(of_phy_get);
@@ -786,6 +791,7 @@ struct phy *phy_get(struct device *dev,
struct phy *phy;
struct device_link *link;
+ mutex_lock(&phy_provider_mutex);
if (dev->of_node) {
if (string)
index = of_property_match_string(dev->of_node, "phy-names",
@@ -796,15 +802,18 @@ struct phy *phy_get(struct device *dev,
} else {
if (string == NULL) {
dev_WARN(dev, "missing string\n");
- return ERR_PTR(-EINVAL);
+ phy = ERR_PTR(-EINVAL);
+ goto out_unlock;
}
phy = phy_find(dev, string);
}
if (IS_ERR(phy))
- return phy;
+ goto out_unlock;
- if (!try_module_get(phy->ops->owner))
- return ERR_PTR(-EPROBE_DEFER);
+ if (!try_module_get(phy->ops->owner)) {
+ phy = ERR_PTR(-EPROBE_DEFER);
+ goto out_unlock;
+ }
get_device(&phy->dev);
@@ -813,6 +822,8 @@ struct phy *phy_get(struct device *dev,
dev_dbg(dev, "failed to create device link to %s\n",
dev_name(phy->dev.parent));
+out_unlock:
+ mutex_unlock(&phy_provider_mutex);
return phy;
}
EXPORT_SYMBOL_GPL(phy_get);
@@ -961,15 +972,17 @@ struct phy *devm_of_phy_get_by_index(str
if (!ptr)
return ERR_PTR(-ENOMEM);
+ mutex_lock(&phy_provider_mutex);
phy = _of_phy_get(np, index);
if (IS_ERR(phy)) {
devres_free(ptr);
- return phy;
+ goto out_unlock;
}
if (!try_module_get(phy->ops->owner)) {
devres_free(ptr);
- return ERR_PTR(-EPROBE_DEFER);
+ phy = ERR_PTR(-EPROBE_DEFER);
+ goto out_unlock;
}
get_device(&phy->dev);
@@ -982,6 +995,8 @@ struct phy *devm_of_phy_get_by_index(str
dev_dbg(dev, "failed to create device link to %s\n",
dev_name(phy->dev.parent));
+out_unlock:
+ mutex_unlock(&phy_provider_mutex);
return phy;
}
EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 257/547] power: supply: pf1550: drain IRQ work before unregistering supplies
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 256/547] phy: core: Fix race-condition between _of_phy_get() and try_module_get() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 258/547] power: supply: sbs-battery: disable polling before supply teardown Greg Kroah-Hartman
` (298 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Sebastian Reichel
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 4856b49317ccd4ce96a0e8970df7d13ce8975a02 upstream.
The VBUS work calls power_supply_changed(), but its managed
cancellation is registered before the supplies. Cleanup can therefore
unregister a supply while IRQ-triggered work is still pending.
Commit 838767f50747 ("power: supply: pf1550: Fix use-after-free in
power_supply_changed()") moved IRQ requests after supply registration,
but left work cancellation before the supplies. That change protects
the direct IRQ callbacks, while this fix drains the work they queue.
Register the three work items after both supplies and before the IRQs.
Cleanup then frees the IRQ producers, drains the work, and unregisters
the supplies.
The teardown ordering issue was found by static analysis.
Fixes: 4b6b6433a97d ("power: supply: pf1550: add battery charger support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261004043728.1140015-1-mhun512@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/pf1550-charger.c | 32 ++++++++++++++++----------------
1 file changed, 16 insertions(+), 16 deletions(-)
--- a/drivers/power/supply/pf1550-charger.c
+++ b/drivers/power/supply/pf1550-charger.c
@@ -566,6 +566,22 @@ static int pf1550_charger_probe(struct p
platform_set_drvdata(pdev, chg);
+ psy_cfg.drv_data = chg;
+
+ chg->charger = devm_power_supply_register(&pdev->dev,
+ &pf1550_charger_desc,
+ &psy_cfg);
+ if (IS_ERR(chg->charger))
+ return dev_err_probe(&pdev->dev, PTR_ERR(chg->charger),
+ "failed: power supply register\n");
+
+ chg->battery = devm_power_supply_register(&pdev->dev,
+ &pf1550_battery_desc,
+ &psy_cfg);
+ if (IS_ERR(chg->battery))
+ return dev_err_probe(&pdev->dev, PTR_ERR(chg->battery),
+ "failed: power supply register\n");
+
ret = devm_delayed_work_autocancel(chg->dev, &chg->vbus_sense_work,
pf1550_chg_vbus_work);
if (ret)
@@ -584,22 +600,6 @@ static int pf1550_charger_probe(struct p
return dev_err_probe(chg->dev, ret,
"failed to add battery sense work\n");
- psy_cfg.drv_data = chg;
-
- chg->charger = devm_power_supply_register(&pdev->dev,
- &pf1550_charger_desc,
- &psy_cfg);
- if (IS_ERR(chg->charger))
- return dev_err_probe(&pdev->dev, PTR_ERR(chg->charger),
- "failed: power supply register\n");
-
- chg->battery = devm_power_supply_register(&pdev->dev,
- &pf1550_battery_desc,
- &psy_cfg);
- if (IS_ERR(chg->battery))
- return dev_err_probe(&pdev->dev, PTR_ERR(chg->battery),
- "failed: power supply register\n");
-
for (i = 0; i < PF1550_CHARGER_IRQ_NR; i++) {
irq = platform_get_irq(pdev, i);
if (irq < 0)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 258/547] power: supply: sbs-battery: disable polling before supply teardown
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 257/547] power: supply: pf1550: drain IRQ work before unregistering supplies Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 259/547] pps: generators: dont use the drivers info after unregister Greg Kroah-Hartman
` (297 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Sebastian Reichel
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 5c1c602463d597c5189ddc5a73dece588ba2c57a upstream.
The managed poll-work cancellation is registered before the power
supply, so cleanup unregisters the supply before draining polling.
A pending or running poller can then call power_supply_changed() on
the released supply.
Commit 8d59cf3887fb ("power: supply: sbs-battery: Fix use-after-free in
power_supply_changed()") moved the IRQ request after supply registration,
but did not change the poll-work cancellation order.
Add a later managed action that disables and drains polling before
supply teardown. Its retained disabled state prevents external-power
callbacks from rearming the poll work after it has been drained.
Keep the original autocancel to initialize work before supply callbacks
can run and to cover failed supply registration.
The teardown ordering issue was found by static analysis.
Fixes: 6d0c5de2fd84 ("power: supply: Clean-up few drivers by using managed work init")
Cc: stable@vger.kernel.org # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261004041019.1123723-1-mhun512@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/sbs-battery.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -1068,6 +1068,13 @@ static void sbs_alert(struct i2c_client
sbs_supply_changed(i2c_get_clientdata(client));
}
+static void sbs_disable_work(void *data)
+{
+ struct sbs_info *chip = data;
+
+ disable_delayed_work_sync(&chip->work);
+}
+
static void sbs_external_power_changed(struct power_supply *psy)
{
struct sbs_info *chip = power_supply_get_drvdata(psy);
@@ -1208,6 +1215,10 @@ static int sbs_probe(struct i2c_client *
return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
"Failed to register power supply\n");
+ rc = devm_add_action_or_reset(&client->dev, sbs_disable_work, chip);
+ if (rc)
+ return rc;
+
if (!chip->gpio_detect)
goto out;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 259/547] pps: generators: dont use the drivers info after unregister
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 258/547] power: supply: sbs-battery: disable polling before supply teardown Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 260/547] nvmem: core: Fix OOB read for bit offsets of more than one byte Greg Kroah-Hartman
` (296 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Danish Khateeb, Rodolfo Giometti
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danish Khateeb <danishkhateeb03@gmail.com>
commit 4e8063cae337cb7328e6856235cf4de5d165516e upstream.
A file that was opened before pps_gen_unregister_source() keeps
pps_gen, and with it the pointer to the driver's pps_gen_source_info.
PPS_GEN_SETENABLE and PPS_GEN_USESYSTEMCLOCK keep using that pointer
after the driver has gone:
- pps_gen_tio allocates its info with devm_kzalloc(), so after an
unbind both ioctls read freed memory, and SETENABLE calls the
driver's enable() with its freed private data.
- pps_gen-dummy does not set info->owner, so it can be unloaded while
the file is open, and the ioctls then read the unloaded module's
data and call its code.
TIO can't probe in a VM, as it needs ART. A test driver that registers
its info in devm memory like TIO does, unbound while /dev/pps-gen0 is
open, gives:
BUG: KASAN: slab-use-after-free in pps_gen_cdev_ioctl+0x4c1/0x580
Read of size 1 at addr ffff88800e647f38 by task ppsgen64/145
...
Freed by task 146:
kfree+0x25a/0x6d0
release_nodes+0xd1/0x140
devres_release_all+0x10e/0x1a0
device_unbind_cleanup+0x71/0x250
device_release_driver_internal+0x41b/0x570
unbind_store+0xd9/0x100
and unloading pps_gen-dummy while its file is open oopses:
BUG: unable to handle page fault for address: ffffffffa0203040
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pps_gen_cdev_ioctl+0x372/0x580
Protect info in the ioctl handler with a mutex, and clear it under the
mutex on unregister, so that unregister waits for the ioctls using it
and later ones fail with -ENODEV. PPS_KC_BIND does the same for a
removed PPS device since commit 3649f9a6b897 ("pps: don't allow
PPS_KC_BIND on removed devices"). The sysfs attributes need nothing
new: they are removed, and their callbacks drained, before info is
cleared.
Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-3-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pps/generators/pps_gen.c | 31 ++++++++++++++++++++++++++-----
include/linux/pps_gen_kernel.h | 2 ++
2 files changed, 28 insertions(+), 5 deletions(-)
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -69,17 +69,28 @@ static long pps_gen_cdev_ioctl(struct fi
if (ret)
return -EFAULT;
- ret = pps_gen->info->enable(pps_gen, status);
- if (ret)
- return ret;
- pps_gen->enabled = status;
+ scoped_guard(mutex, &pps_gen->info_lock) {
+ if (!pps_gen->info)
+ return -ENODEV;
+
+ ret = pps_gen->info->enable(pps_gen, status);
+ if (ret)
+ return ret;
+ pps_gen->enabled = status;
+ }
break;
case PPS_GEN_USESYSTEMCLOCK:
dev_dbg(&pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
- ret = put_user(pps_gen->info->use_system_clock, uiuarg);
+ scoped_guard(mutex, &pps_gen->info_lock) {
+ if (!pps_gen->info)
+ return -ENODEV;
+ status = pps_gen->info->use_system_clock;
+ }
+
+ ret = put_user(status, uiuarg);
if (ret)
return -EFAULT;
@@ -212,6 +223,15 @@ static void pps_gen_unregister_cdev(stru
{
pr_debug("unregistering pps-gen%d\n", pps_gen->id);
cdev_device_del(&pps_gen->cdev, &pps_gen->dev);
+
+ /*
+ * An open file keeps pps_gen around, but the driver may free info as
+ * soon as we return. The sysfs files are gone now, so wait for the
+ * ioctls using info and make later ones fail.
+ */
+ scoped_guard(mutex, &pps_gen->info_lock)
+ pps_gen->info = NULL;
+
put_device(&pps_gen->dev);
}
@@ -243,6 +263,7 @@ struct pps_gen_device *pps_gen_register_
pps_gen->info = info;
pps_gen->enabled = false;
+ mutex_init(&pps_gen->info_lock);
init_waitqueue_head(&pps_gen->queue);
spin_lock_init(&pps_gen->lock);
--- a/include/linux/pps_gen_kernel.h
+++ b/include/linux/pps_gen_kernel.h
@@ -11,6 +11,7 @@
#include <linux/pps_gen.h>
#include <linux/cdev.h>
#include <linux/device.h>
+#include <linux/mutex.h>
/*
* Global defines
@@ -44,6 +45,7 @@ struct pps_gen_source_info {
/* The main struct */
struct pps_gen_device {
const struct pps_gen_source_info *info; /* PSS generator info */
+ struct mutex info_lock; /* protects info */
bool enabled; /* PSS generator status */
unsigned int event;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 260/547] nvmem: core: Fix OOB read for bit offsets of more than one byte
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 259/547] pps: generators: dont use the drivers info after unregister Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 261/547] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF Greg Kroah-Hartman
` (295 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Sinyavin, Janne Grunau,
Srinivas Kandagatla
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
commit 24530401e8001aaa637dd5007fcdc6fbc00300be upstream.
When the bit offset is BITS_PER_BYTE or larger the read position is
advanced by `bytes_offset`. This is not taken into account in the
per-byte read loop which still reads `cell->bytes` resulting in an out of
bounds read of `bytes_offset` bytes. The information read OOB does not
leak directly as the erroneously read bits are cleared.
Detected by KASAN while looking for a use-after-free in simplefb.c.
Cc: stable@vger.kernel.org
Fixes: 7a06ef751077 ("nvmem: core: fix bit offsets of more than one byte")
Tested-by: Dmitry Sinyavin <sinyavin@gmail.com>
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101329.1084348-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1598,12 +1598,14 @@ static void nvmem_shift_read_buffer_in_p
*p = *b++ >> bit_offset;
/* setup rest of the bytes if any */
- for (i = 1; i < cell->bytes; i++) {
+ for (i = 1; i < (cell->bytes - bytes_offset); i++) {
/* Get bits from next byte and shift them towards msb */
*p++ |= *b << (BITS_PER_BYTE - bit_offset);
*p = *b++ >> bit_offset;
}
+ /* point to end of the buffer unused bits will be cleared */
+ p = buf + cell->bytes - 1;
} else if (p != b) {
memmove(p, b, cell->bytes - bytes_offset);
p += cell->bytes - 1;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 261/547] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 260/547] nvmem: core: Fix OOB read for bit offsets of more than one byte Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 262/547] media: rc: Ensure that rc_unregister_device() does not free input device Greg Kroah-Hartman
` (294 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Jérémy Jean, Keith Busch
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 53f6efe00cea0c0cf7bd99debe3cdac8567170b5 upstream.
A REPLY AUTH_SEND command can derive a dhchap_skey key while a
concurrent AUTH_RECEIVE command observing this REPLY state executes
the failure path and frees that key. The REPLY command then continues
and writes into freed memory, causing a use-after-free. KASAN reports
it as:
BUG: KASAN: slab-use-after-free in __sha256_final
Write of size 4 at addr ffff88800359c540
...
nvmet_auth_sq_free (drivers/nvme/target/auth.c:237)
nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:621)
Add a mutex to each submission queue to serialize authentication
commands and timeout handling. Unlock the mutex before completing
requests and ignore outdated timeout callbacks. Limit timeout delays
to prevent immediate expiry on 32-bit kernels.
Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/auth.c | 1 +
drivers/nvme/target/fabrics-cmd-auth.c | 32 ++++++++++++++++++++++++++++----
drivers/nvme/target/nvmet.h | 2 ++
3 files changed, 31 insertions(+), 4 deletions(-)
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -229,6 +229,7 @@ out_unlock:
void nvmet_auth_sq_free(struct nvmet_sq *sq)
{
+ sq->auth_expiry_active = false;
cancel_delayed_work(&sq->auth_expired_work);
kfree(sq->dhchap_c1);
sq->dhchap_c1 = NULL;
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -6,6 +6,7 @@
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/blkdev.h>
+#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/nvme-auth.h>
#include <crypto/kpp.h>
@@ -17,16 +18,27 @@ static void nvmet_auth_expired_work(stru
struct nvmet_sq *sq = container_of(to_delayed_work(work),
struct nvmet_sq, auth_expired_work);
+ mutex_lock(&sq->auth_lock);
+ /* A command may have cancelled or rearmed this timeout. */
+ if (!sq->auth_expiry_active ||
+ delayed_work_pending(&sq->auth_expired_work))
+ goto out_unlock;
+ sq->auth_expiry_active = false;
+
pr_debug("%s: ctrl %d qid %d transaction %u expired, resetting\n",
__func__, sq->ctrl->cntlid, sq->qid, sq->dhchap_tid);
sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
sq->dhchap_tid = -1;
+out_unlock:
+ mutex_unlock(&sq->auth_lock);
}
void nvmet_auth_sq_init(struct nvmet_sq *sq)
{
/* Initialize in-band authentication */
+ mutex_init(&sq->auth_lock);
INIT_DELAYED_WORK(&sq->auth_expired_work, nvmet_auth_expired_work);
+ sq->auth_expiry_active = false;
sq->authenticated = false;
sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
}
@@ -256,6 +268,8 @@ void nvmet_execute_auth_send(struct nvme
u16 status = 0;
u8 dhchap_status;
+ mutex_lock(&req->sq->auth_lock);
+
if (req->cmd->auth_send.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
req->error_loc =
@@ -281,8 +295,10 @@ void nvmet_execute_auth_send(struct nvme
offsetof(struct nvmf_auth_send_command, tl);
goto done;
}
- if (!nvmet_check_transfer_len(req, tl)) {
+ if (unlikely(tl != req->transfer_len)) {
pr_debug("%s: transfer length mismatch (%u)\n", __func__, tl);
+ mutex_unlock(&req->sq->auth_lock);
+ nvmet_check_transfer_len(req, tl);
return;
}
@@ -406,10 +422,12 @@ done:
status, req->error_loc);
if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
- unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
+ unsigned long auth_expire = min_t(u64, MAX_JIFFY_OFFSET,
+ (u64)(ctrl->kato ? ctrl->kato : 120) * HZ);
+ req->sq->auth_expiry_active = true;
mod_delayed_work(system_percpu_wq, &req->sq->auth_expired_work,
- auth_expire_secs * HZ);
+ auth_expire);
goto complete;
}
/* Final states, clear up variables */
@@ -418,6 +436,7 @@ done:
nvmet_ctrl_fatal_error(ctrl);
complete:
+ mutex_unlock(&req->sq->auth_lock);
nvmet_req_complete(req, status);
}
@@ -536,6 +555,8 @@ void nvmet_execute_auth_receive(struct n
u32 al;
u16 status = 0;
+ mutex_lock(&req->sq->auth_lock);
+
if (req->cmd->auth_receive.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
req->error_loc =
@@ -561,8 +582,10 @@ void nvmet_execute_auth_receive(struct n
offsetof(struct nvmf_auth_receive_command, al);
goto done;
}
- if (!nvmet_check_transfer_len(req, al)) {
+ if (unlikely(al != req->transfer_len)) {
pr_debug("%s: transfer length mismatch (%u)\n", __func__, al);
+ mutex_unlock(&req->sq->auth_lock);
+ nvmet_check_transfer_len(req, al);
return;
}
@@ -621,5 +644,6 @@ done:
nvmet_auth_sq_free(req->sq);
nvmet_ctrl_fatal_error(ctrl);
}
+ mutex_unlock(&req->sq->auth_lock);
nvmet_req_complete(req, status);
}
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -161,8 +161,10 @@ struct nvmet_sq {
u32 sqhd;
bool sqhd_disabled;
#ifdef CONFIG_NVME_TARGET_AUTH
+ struct mutex auth_lock;
bool authenticated;
struct delayed_work auth_expired_work;
+ bool auth_expiry_active;
u16 dhchap_tid;
u8 sc_c;
u8 dhchap_status;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 262/547] media: rc: Ensure that rc_unregister_device() does not free input device
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 261/547] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 263/547] media: rc: Ensure registered is cleared in error path Greg Kroah-Hartman
` (293 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 61c7ca95d2483c77dfdde1b007cbe846f145dec4 upstream.
During or after rc_unregister_device(), IR may still be reported which
results in a input event being reported. This could result in a null
pointer deref in rc_keydown() or a use-after-free of the input device if
the pointer was read before it is set to NULL.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-main.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1742,7 +1742,7 @@ void rc_free_device(struct rc_dev *dev)
if (!dev)
return;
- input_free_device(dev->input_dev);
+ input_put_device(dev->input_dev);
put_device(&dev->dev);
@@ -1854,6 +1854,8 @@ static int rc_setup_rx_device(struct rc_
if (rc)
return rc;
+ input_get_device(dev->input_dev);
+
/*
* Default delay of 250ms is too short for some protocols, especially
* since the timeout is currently set to 250ms. Increase it to 500ms,
@@ -1880,10 +1882,8 @@ static void rc_free_rx_device(struct rc_
if (!dev)
return;
- if (dev->input_dev) {
+ if (dev->input_dev)
input_unregister_device(dev->input_dev);
- dev->input_dev = NULL;
- }
ir_free_table(&dev->rc_map);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 263/547] media: rc: Ensure registered is cleared in error path
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 262/547] media: rc: Ensure that rc_unregister_device() does not free input device Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 264/547] media: rc: fintek-cir: process a full RX buffer instead of overflowing it Greg Kroah-Hartman
` (292 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 37efd09ba2c62e46e3a3a793025c186f8cd1a417 upstream.
If rc_register_device() fails, ensure that registered is not set to true.
If lirc_register() succeeded, then userspace could have an open file
descriptor open. This leads to a use-after-free.
lirc_unregister() must be called with registered = false, else there is a
possibility that an fd is open and polling, which would never return
POLLERR unless registered is false.
Note that registered must be changed under dev->lock, many functions
read registered under lock (e.g. lirc_ioctl).
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-main.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1929,7 +1929,8 @@ int rc_register_device(struct rc_dev *de
goto out_raw;
}
- dev->registered = true;
+ scoped_guard(mutex, &dev->lock)
+ dev->registered = true;
rc = device_add(&dev->dev);
if (rc)
@@ -1949,7 +1950,7 @@ int rc_register_device(struct rc_dev *de
if (dev->allowed_protocols != RC_PROTO_BIT_CEC) {
rc = lirc_register(dev);
if (rc < 0)
- goto out_dev;
+ goto out_lirc;
}
if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
@@ -1972,11 +1973,18 @@ int rc_register_device(struct rc_dev *de
out_rx:
rc_free_rx_device(dev);
out_lirc:
- if (dev->allowed_protocols != RC_PROTO_BIT_CEC)
+ scoped_guard(mutex, &dev->lock)
+ dev->registered = false;
+
+ if (device_is_registered(&dev->lirc_dev))
lirc_unregister(dev);
-out_dev:
device_del(&dev->dev);
+ /* registered already cleared above */
+ goto out_free_table;
out_rx_free:
+ scoped_guard(mutex, &dev->lock)
+ dev->registered = false;
+out_free_table:
ir_free_table(&dev->rc_map);
out_raw:
ir_raw_event_free(dev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 264/547] media: rc: fintek-cir: process a full RX buffer instead of overflowing it
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 263/547] media: rc: Ensure registered is cleared in error path Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 265/547] media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister Greg Kroah-Hartman
` (291 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Sean Young
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
commit d1febef1bcfa7bbc401729f994c375b91a833911 upstream.
fintek_get_rx_ir_data() drains the CIR RX FIFO into fintek->buf[], which
holds RX_BUF_LEN (32) bytes, for as long as CIR_STATUS reports pending
RX data:
do {
sample = fintek_cir_reg_read(fintek, CIR_RX_DATA);
...
fintek->buf[fintek->pkts] = sample;
fintek->pkts++;
...
} while (status & rx_irqs);
Nothing bounds fintek->pkts. If the hardware reports data for more than
RX_BUF_LEN reads in one interrupt, the loop writes past the end of
buf[], starting with the pkts counter that follows it in struct
fintek_dev.
Hand a full buffer to fintek_process_rx_ir_data(), which parses the
samples and resets fintek->pkts, before storing the next sample. This
keeps the parser state consistent and drops no samples. The loop still
relies on the status register to terminate.
The driver does not document the hardware FIFO depth, so it is not
known whether a working device can trigger this.
Found by static analysis tool CodeQL.
Fixes: 9bdc79ea07d9 ("[media] fintek-cir: new driver for Fintek LPC SuperIO CIR function")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/fintek-cir.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/rc/fintek-cir.c
+++ b/drivers/media/rc/fintek-cir.c
@@ -340,6 +340,10 @@ static void fintek_get_rx_ir_data(struct
sample = fintek_cir_reg_read(fintek, CIR_RX_DATA);
fit_dbg("%s: sample: 0x%02x", __func__, sample);
+ /* Process a full buffer before storing the next sample. */
+ if (fintek->pkts >= RX_BUF_LEN)
+ fintek_process_rx_ir_data(fintek);
+
fintek->buf[fintek->pkts] = sample;
fintek->pkts++;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 265/547] media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 264/547] media: rc: fintek-cir: process a full RX buffer instead of overflowing it Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 266/547] media: rc: Fix race condition during rc_register_device() Greg Kroah-Hartman
` (290 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit b3f5daf3222999d3f92f606a4eb5e35ab90fd0e4 upstream.
Mark the device as unregistered before tearing down raw IR/bpf
state, so that racing bpf(BPF_PROG_{ATTACH,DETACH,QUERY}) calls
cannot slip in between ir_raw_event_unregister() completing and
dev->registered being cleared.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-main.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -2026,18 +2026,18 @@ void rc_unregister_device(struct rc_dev
if (!dev)
return;
+ mutex_lock(&dev->lock);
+ dev->registered = false;
+ if (dev->users && dev->close)
+ dev->close(dev);
+ mutex_unlock(&dev->lock);
+
if (dev->driver_type == RC_DRIVER_IR_RAW)
ir_raw_event_unregister(dev);
timer_delete_sync(&dev->timer_keyup);
timer_delete_sync(&dev->timer_repeat);
- mutex_lock(&dev->lock);
- if (dev->users && dev->close)
- dev->close(dev);
- dev->registered = false;
- mutex_unlock(&dev->lock);
-
rc_free_rx_device(dev);
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 266/547] media: rc: Fix race condition during rc_register_device()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 265/547] media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 267/547] media: rc: mce_kbd: Fix inconsistent locking of keylock Greg Kroah-Hartman
` (289 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit ec7cb49871e5c4f85d57290320c50ee0bae4db84 upstream.
Device drivers can call ir_raw_event_store() or ir_raw_event_handle()
right after rc_allocate_device(). This means that while
rc_register_device() is being called, those functions can be called
from e.g. interrupt handlers.
Currently dev->raw is being allocated and populated by
ir_raw_event_prepare() which is called from rc_register_device(). This
is not done in a safe way, e.g. dev->raw is being set before the
raw members are populated.
Call ir_raw_event_prepare() from rc_allocate_device() instead.
Fixes: a3572c34da8d ("V4L/DVB: ir-core: Add logic to decode IR protocols at the IR core")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-ir-raw.c | 20 +-------------------
drivers/media/rc/rc-main.c | 19 +++++++++++--------
2 files changed, 12 insertions(+), 27 deletions(-)
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -71,9 +71,6 @@ static int ir_raw_event_thread(void *dat
*/
int ir_raw_event_store(struct rc_dev *dev, struct ir_raw_event *ev)
{
- if (!dev->raw)
- return -EINVAL;
-
dev_dbg(&dev->dev, "sample: (%05dus %s)\n",
ev->duration, TO_STR(ev->pulse));
@@ -102,9 +99,6 @@ int ir_raw_event_store_edge(struct rc_de
ktime_t now;
struct ir_raw_event ev = {};
- if (!dev->raw)
- return -EINVAL;
-
now = ktime_get();
ev.duration = ktime_to_us(ktime_sub(now, dev->raw->last_event));
ev.pulse = !pulse;
@@ -129,9 +123,6 @@ int ir_raw_event_store_with_timeout(stru
ktime_t now;
int rc = 0;
- if (!dev->raw)
- return -EINVAL;
-
now = ktime_get();
spin_lock(&dev->raw->edge_spinlock);
@@ -166,9 +157,6 @@ EXPORT_SYMBOL_GPL(ir_raw_event_store_wit
*/
int ir_raw_event_store_with_filter(struct rc_dev *dev, struct ir_raw_event *ev)
{
- if (!dev->raw)
- return -EINVAL;
-
/* Ignore spaces in idle mode */
if (dev->idle && !ev->pulse)
return 0;
@@ -200,9 +188,6 @@ EXPORT_SYMBOL_GPL(ir_raw_event_store_wit
*/
void ir_raw_event_set_idle(struct rc_dev *dev, bool idle)
{
- if (!dev->raw)
- return;
-
dev_dbg(&dev->dev, "%s idle mode\n", idle ? "enter" : "leave");
if (idle) {
@@ -226,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle)
*/
void ir_raw_event_handle(struct rc_dev *dev)
{
- if (!dev->raw || !dev->raw->thread)
+ if (!dev->raw->thread)
return;
wake_up_process(dev->raw->thread);
@@ -612,9 +597,6 @@ EXPORT_SYMBOL(ir_raw_encode_carrier);
*/
int ir_raw_event_prepare(struct rc_dev *dev)
{
- if (!dev)
- return -EINVAL;
-
dev->raw = kzalloc_obj(*dev->raw);
if (!dev->raw)
return -ENOMEM;
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1701,14 +1701,24 @@ static const struct device_type rc_dev_t
struct rc_dev *rc_allocate_device(enum rc_driver_type type)
{
struct rc_dev *dev;
+ int ret;
dev = kzalloc_obj(*dev);
if (!dev)
return NULL;
+ if (type == RC_DRIVER_IR_RAW) {
+ ret = ir_raw_event_prepare(dev);
+ if (ret < 0) {
+ kfree(dev);
+ return NULL;
+ }
+ }
+
if (type != RC_DRIVER_IR_RAW_TX) {
dev->input_dev = input_allocate_device();
if (!dev->input_dev) {
+ ir_raw_event_free(dev);
kfree(dev);
return NULL;
}
@@ -1724,6 +1734,7 @@ struct rc_dev *rc_allocate_device(enum r
spin_lock_init(&dev->rc_map.lock);
spin_lock_init(&dev->keylock);
}
+
mutex_init(&dev->lock);
dev->dev.type = &rc_dev_type;
@@ -1917,12 +1928,6 @@ int rc_register_device(struct rc_dev *de
dev->sysfs_groups[attr++] = &rc_dev_wakeup_filter_attr_grp;
dev->sysfs_groups[attr++] = NULL;
- if (dev->driver_type == RC_DRIVER_IR_RAW) {
- rc = ir_raw_event_prepare(dev);
- if (rc < 0)
- goto out_minor;
- }
-
if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
rc = rc_prepare_rx_device(dev);
if (rc)
@@ -1987,8 +1992,6 @@ out_rx_free:
out_free_table:
ir_free_table(&dev->rc_map);
out_raw:
- ir_raw_event_free(dev);
-out_minor:
ida_free(&rc_ida, minor);
return rc;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 267/547] media: rc: mce_kbd: Fix inconsistent locking of keylock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 266/547] media: rc: Fix race condition during rc_register_device() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 268/547] media: rc: Use after free in ir_raw_event_handle() Greg Kroah-Hartman
` (288 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 29ee25fa9beb3232808e6d0b3e8ebfb0427cb820 upstream.
data->keylock is taken with spin_lock() in ir_mce_kbd_decode(), which
runs in the raw IR decode kthread with local interrupts enabled, but
with spin_lock_irqsave() in mce_kbd_rx_timeout(), the rx_timeout timer
callback, which runs in softirq context.
If the decode kthread is holding keylock via spin_lock() when a timer
interrupt fires on the same CPU and the softirq runs
mce_kbd_rx_timeout(), the softirq spins forever waiting for a lock
that only the now-preempted kthread can release, while the kthread
cannot run again until the softirq gives up the CPU. This deadlocks
the CPU.
Fixes: 53a62800efb2 ("media: rc: mce_kbd decoder: fix race condition")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/ir-mce_kbd-decoder.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/media/rc/ir-mce_kbd-decoder.c
+++ b/drivers/media/rc/ir-mce_kbd-decoder.c
@@ -219,6 +219,7 @@ static int ir_mce_kbd_decode(struct rc_d
struct mce_kbd_dec *data = &dev->raw->mce_kbd;
u32 scancode;
unsigned long delay;
+ unsigned long flags;
struct lirc_scancode lsc = {};
if (!is_timing_event(ev)) {
@@ -319,7 +320,7 @@ again:
scancode = data->body & 0xffffff;
dev_dbg(&dev->dev, "keyboard data 0x%08x\n",
data->body);
- spin_lock(&data->keylock);
+ spin_lock_irqsave(&data->keylock, flags);
if (scancode) {
delay = usecs_to_jiffies(dev->timeout) +
msecs_to_jiffies(100);
@@ -329,7 +330,7 @@ again:
}
/* Pass data to keyboard buffer parser */
ir_mce_kbd_process_keyboard_data(dev, scancode);
- spin_unlock(&data->keylock);
+ spin_unlock_irqrestore(&data->keylock, flags);
lsc.rc_proto = RC_PROTO_MCIR2_KBD;
break;
case MCIR2_MOUSE_NBITS:
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 268/547] media: rc: Use after free in ir_raw_event_handle()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 267/547] media: rc: mce_kbd: Fix inconsistent locking of keylock Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 269/547] media: rc: After rc_unregister_device() timers can be re-armed Greg Kroah-Hartman
` (287 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 3ae19773168104fa57d2a2ec57731e89df54175f upstream.
If rc_unregister_device() is called while IR is being processed, then
ir_raw_event_handle() could call wake_up_process(dev->raw->thread)
after kthread_stop(dev->raw->thread). Avoid use after free by using
get_task_struct().
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-ir-raw.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -630,8 +630,13 @@ int ir_raw_event_register(struct rc_dev
void ir_raw_event_free(struct rc_dev *dev)
{
- kfree(dev->raw);
- dev->raw = NULL;
+ if (dev->raw) {
+ timer_delete_sync(&dev->raw->edge_handle);
+ if (dev->raw->thread)
+ put_task_struct(dev->raw->thread);
+ kfree(dev->raw);
+ dev->raw = NULL;
+ }
}
void ir_raw_event_unregister(struct rc_dev *dev)
@@ -641,6 +646,13 @@ void ir_raw_event_unregister(struct rc_d
if (!dev || !dev->raw)
return;
+ /*
+ * After ir_raw_event_unregister() is called, an sync
+ * call to ir_raw_event_handle() can still arrive. This function
+ * may call wake_up_process(dev->raw->thread). Ensure this memory
+ * is not freed by kthread_stop().
+ */
+ get_task_struct(dev->raw->thread);
kthread_stop(dev->raw->thread);
timer_delete_sync(&dev->raw->edge_handle);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 269/547] media: rc: After rc_unregister_device() timers can be re-armed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 268/547] media: rc: Use after free in ir_raw_event_handle() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 270/547] media: rc: Fix use after free in bpf progs Greg Kroah-Hartman
` (286 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit ef41a67979aed4d7d4f393c56c1e25b6754e2b78 upstream.
If rc_keydown() is called after rc_register_device(), then the timers
can be re-armed. Delete them again for a final time.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-main.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1753,6 +1753,11 @@ void rc_free_device(struct rc_dev *dev)
if (!dev)
return;
+ if (dev->input_dev) {
+ timer_delete_sync(&dev->timer_keyup);
+ timer_delete_sync(&dev->timer_repeat);
+ }
+
input_put_device(dev->input_dev);
put_device(&dev->dev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 270/547] media: rc: Fix use after free in bpf progs
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 269/547] media: rc: After rc_unregister_device() timers can be re-armed Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 271/547] media: rc: Fix ABBA deadlock by making locks more fine grained Greg Kroah-Hartman
` (285 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit f95a9f8472f97c30106513fc7494b7abad243949 upstream.
Since commit dccc0c3ddf8f ("media: rc: fix race between unregister and
urb/irq callbacks"), rcdev->raw is no longer set to NULL after device
unregister. raw->progs could point to stale data.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/bpf-lirc.c | 18 +++++++++++++-----
drivers/media/rc/rc-ir-raw.c | 11 +++--------
2 files changed, 16 insertions(+), 13 deletions(-)
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -148,12 +148,13 @@ static int lirc_bpf_attach(struct rc_dev
if (ret)
return ret;
- raw = rcdev->raw;
- if (!raw) {
+ if (!rcdev->registered) {
ret = -ENODEV;
goto unlock;
}
+ raw = rcdev->raw;
+
old_array = lirc_rcu_dereference(raw->progs);
if (old_array && bpf_prog_array_length(old_array) >= BPF_MAX_PROGS) {
ret = -E2BIG;
@@ -186,12 +187,13 @@ static int lirc_bpf_detach(struct rc_dev
if (ret)
return ret;
- raw = rcdev->raw;
- if (!raw) {
+ if (!rcdev->registered) {
ret = -ENODEV;
goto unlock;
}
+ raw = rcdev->raw;
+
old_array = lirc_rcu_dereference(raw->progs);
ret = bpf_prog_array_copy(old_array, prog, NULL, 0, &new_array);
/*
@@ -235,7 +237,8 @@ void lirc_bpf_free(struct rc_dev *rcdev)
struct bpf_prog_array_item *item;
struct bpf_prog_array *array;
- array = lirc_rcu_dereference(rcdev->raw->progs);
+ array = rcu_replace_pointer(rcdev->raw->progs, NULL,
+ lockdep_is_held(&ir_raw_handler_lock));
if (!array)
return;
@@ -316,6 +319,11 @@ int lirc_prog_query(const union bpf_attr
if (ret)
goto put;
+ if (!rcdev->registered) {
+ ret = -ENODEV;
+ goto unlock;
+ }
+
progs = lirc_rcu_dereference(rcdev->raw->progs);
cnt = progs ? bpf_prog_array_length(progs) : 0;
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -632,8 +632,11 @@ void ir_raw_event_free(struct rc_dev *de
{
if (dev->raw) {
timer_delete_sync(&dev->raw->edge_handle);
+ mutex_lock(&ir_raw_handler_lock);
if (dev->raw->thread)
put_task_struct(dev->raw->thread);
+ lirc_bpf_free(dev);
+ mutex_unlock(&ir_raw_handler_lock);
kfree(dev->raw);
dev->raw = NULL;
}
@@ -643,9 +646,6 @@ void ir_raw_event_unregister(struct rc_d
{
struct ir_raw_handler *handler;
- if (!dev || !dev->raw)
- return;
-
/*
* After ir_raw_event_unregister() is called, an sync
* call to ir_raw_event_handle() can still arrive. This function
@@ -665,11 +665,6 @@ void ir_raw_event_unregister(struct rc_d
lirc_bpf_free(dev);
- /*
- * A user can be calling bpf(BPF_PROG_{QUERY|ATTACH|DETACH}), so
- * ensure that the raw member is null on unlock; this is how
- * "device gone" is checked.
- */
mutex_unlock(&ir_raw_handler_lock);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 271/547] media: rc: Fix ABBA deadlock by making locks more fine grained
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 270/547] media: rc: Fix use after free in bpf progs Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 272/547] ocfs2/heartbeat: unlink live slots when their node is missing Greg Kroah-Hartman
` (284 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit c6d68866ad8aa1e957a3e5a6ede971148f1e3d59 upstream.
The ir_raw_event_unregister() function takes the ir_raw_handler_lock
first and then the rc_dev->lock. Other functions like change_protocol
do this in the reverse order.
This means that an ir decoder module unload and writing to the protocol
sysfs file can cause a deadlock.
ir_raw_handler_lock protects the client list, amongst other things.
Split this out into a separate lock so we can ensure the locking
order is always the same.
Fixes: 93cffffc18f6 ("[media] media: rc: fix decoder module unloading")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/rc-ir-raw.c | 39 ++++++++++++++++++++++++---------------
1 file changed, 24 insertions(+), 15 deletions(-)
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -10,7 +10,8 @@
#include <linux/sched.h>
#include "rc-core-priv.h"
-/* Used to keep track of IR raw clients, protected by ir_raw_handler_lock */
+/* Used to keep track of IR raw clients, protected by ir_raw_client_lock */
+static DEFINE_MUTEX(ir_raw_client_lock);
static LIST_HEAD(ir_raw_client_list);
/* Used to handle IR raw handler extensions */
@@ -273,13 +274,6 @@ static int change_protocol(struct rc_dev
return 0;
}
-static void ir_raw_disable_protocols(struct rc_dev *dev, u64 protocols)
-{
- mutex_lock(&dev->lock);
- dev->enabled_protocols &= ~protocols;
- mutex_unlock(&dev->lock);
-}
-
/**
* ir_raw_gen_manchester() - Encode data with Manchester (bi-phase) modulation.
* @ev: Pointer to pointer to next free event. *@ev is incremented for
@@ -615,15 +609,18 @@ int ir_raw_event_register(struct rc_dev
{
struct task_struct *thread;
+ /* Holding dev->lock could result in a dead-lock */
+ lockdep_assert_not_held(&dev->lock);
+
thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u", dev->minor);
if (IS_ERR(thread))
return PTR_ERR(thread);
dev->raw->thread = thread;
- mutex_lock(&ir_raw_handler_lock);
+ mutex_lock(&ir_raw_client_lock);
list_add_tail(&dev->raw->list, &ir_raw_client_list);
- mutex_unlock(&ir_raw_handler_lock);
+ mutex_unlock(&ir_raw_client_lock);
return 0;
}
@@ -656,16 +653,19 @@ void ir_raw_event_unregister(struct rc_d
kthread_stop(dev->raw->thread);
timer_delete_sync(&dev->raw->edge_handle);
- mutex_lock(&ir_raw_handler_lock);
+ mutex_lock(&ir_raw_client_lock);
list_del(&dev->raw->list);
+
+ mutex_lock(&ir_raw_handler_lock);
list_for_each_entry(handler, &ir_raw_handler_list, list)
if (handler->raw_unregister &&
(handler->protocols & dev->enabled_protocols))
handler->raw_unregister(dev);
lirc_bpf_free(dev);
-
mutex_unlock(&ir_raw_handler_lock);
+
+ mutex_unlock(&ir_raw_client_lock);
}
/*
@@ -688,15 +688,24 @@ void ir_raw_handler_unregister(struct ir
struct ir_raw_event_ctrl *raw;
u64 protocols = ir_raw_handler->protocols;
+ mutex_lock(&ir_raw_client_lock);
+
mutex_lock(&ir_raw_handler_lock);
list_del(&ir_raw_handler->list);
+ atomic64_andnot(protocols, &available_protocols);
+ mutex_unlock(&ir_raw_handler_lock);
+
list_for_each_entry(raw, &ir_raw_client_list, list) {
+ mutex_lock(&raw->dev->lock);
+ mutex_lock(&ir_raw_handler_lock);
if (ir_raw_handler->raw_unregister &&
(raw->dev->enabled_protocols & protocols))
ir_raw_handler->raw_unregister(raw->dev);
- ir_raw_disable_protocols(raw->dev, protocols);
+ raw->dev->enabled_protocols &= ~protocols;
+ mutex_unlock(&ir_raw_handler_lock);
+ mutex_unlock(&raw->dev->lock);
}
- atomic64_andnot(protocols, &available_protocols);
- mutex_unlock(&ir_raw_handler_lock);
+
+ mutex_unlock(&ir_raw_client_lock);
}
EXPORT_SYMBOL(ir_raw_handler_unregister);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 272/547] ocfs2/heartbeat: unlink live slots when their node is missing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 271/547] media: rc: Fix ABBA deadlock by making locks more fine grained Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 273/547] ocfs2/dlm: hold a lock reference across grant AST enqueue Greg Kroah-Hartman
` (283 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Yufan Chen, Kees Cook, Jia-Ju Bai,
jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 3ccd24c3f7a577b84a532cb027f1378385b82ef6 upstream.
o2hb_shutdown_slot() returns immediately when its node is no longer in the
configfs registry. A slot can still be linked in o2hb_live_slots when
that lookup fails. Region teardown or startup-error cleanup then frees
the slot array without removing its embedded list member.
With the same peer live in another region, the next list update can follow
a predecessor into the freed array. Reusing the node number can also make
a later insertion encounter that stale member.
Always remove the slot under o2hb_live_lock, even when node lookup fails.
Preserve aggregate membership accounting and the last-region DOWN
callback: the existing callback interface explicitly permits a NULL node
for DOWN events. Only drop the node reference when lookup returned one.
This closes both normal release and startup-abort paths without changing
the publication or callback locking protocol.
Also require a configured node before admitting a new live slot in
o2hb_check_slot(). The early live-bitmap check is not held through
admission: the last live slot in another region can be removed in between.
Without a node, admission can then queue an UP event with a NULL argument
and hit the event helper's BUG_ON. Existing live slots can still leave
and generate NULL-node DOWN events.
A controlled probe-instrumented test reproduced this while stopping one of
two regions after removing the peer from configfs. Its KASAN report
includes:
BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x1e0/0x210
Read of size 8 at addr ffff888106a4ac60 by task o2hb-pmbd0058_b/497
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
kasan_report+0xe0/0x110
__list_del_entry_valid_or_report+0x1e0/0x210
o2hb_do_disk_heartbeat+0x1591/0x2c50
o2hb_thread+0x1ed/0xe70
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 491:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_noprof+0x2de/0x780
o2hb_region_dev_store+0x7c2/0x1b60
configfs_write_iter+0x2f9/0x4f0
vfs_write+0x639/0x1010
ksys_write+0x111/0x200
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 491:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
o2hb_unmap_slot_data+0x1db/0x330
o2hb_region_release+0x14b/0x4f0
config_item_cleanup+0x14b/0x230
config_item_put+0x79/0x90
configfs_rmdir+0x58a/0x910
vfs_rmdir+0x2e8/0x820
filename_rmdir+0x3b1/0x520
__x64_sys_rmdir+0x4b/0x70
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0058-v2-9446113c2b16c817c538@gmail.com
Fixes: a7f6a5fb4bde ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Yufan Chen <ericterminal@gmail.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/cluster/heartbeat.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -880,8 +880,11 @@ static void o2hb_shutdown_slot(struct o2
int queued = 0;
node = o2nm_get_node_by_num(slot->ds_node_num);
- if (!node)
- return;
+ /*
+ * The node may have been removed from the node table while this
+ * region's slot is still linked. The list member must still be
+ * removed before the region releases its slot array.
+ */
spin_lock(&o2hb_live_lock);
if (!list_empty(&slot->ds_live_item)) {
@@ -903,7 +906,8 @@ static void o2hb_shutdown_slot(struct o2
if (queued)
o2hb_run_event_list(&event);
- o2nm_node_put(node);
+ if (node)
+ o2nm_node_put(node);
}
static void o2hb_set_quorum_device(struct o2hb_region *reg)
@@ -1038,7 +1042,7 @@ static int o2hb_check_slot(struct o2hb_r
fire_callbacks:
/* dead nodes only come to life after some number of
* changes at any time during their dead time */
- if (list_empty(&slot->ds_live_item) &&
+ if (node && list_empty(&slot->ds_live_item) &&
slot->ds_changed_samples >= O2HB_LIVE_THRESHOLD) {
mlog(ML_HEARTBEAT, "Node %d (id 0x%llx) joined my region\n",
slot->ds_node_num, (long long)slot->ds_last_generation);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 273/547] ocfs2/dlm: hold a lock reference across grant AST enqueue
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 272/547] ocfs2/heartbeat: unlink live slots when their node is missing Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 274/547] ocfs2/dlm: hold the lookup reference across convert " Greg Kroah-Hartman
` (282 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Kees Cook, Sunil Mushran,
Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 71743471204e21113295c786e5cfa570294234a4 upstream.
A newly granted remote lock must remain alive until its grant AST is
queued. dlmlock_master() publishes the lock on res->granted with its base
and queue references, then drops res->spinlock before calling
dlm_queue_ast(). The resource's reserved AST count does not retain the
lock itself.
This can fail when a peer dies with an immediately grantable CREATE
buffered on its socket. O2NET's node-down callback flushes receive work
before DLM cleanup, but the flush only waits for work queued on entry. A
data-ready callback that already selected the socket container can queue
new receive work after the flush advances its work color. Socket shutdown
does not discard bytes already queued for TCP receive.
The late receive work and DLM node-down cleanup can interleave as
follows (the lock reference operations shown are before this fix):
Socket data-ready Node-down thread Receive worker
----------------- ---------------- --------------
o2net_data_ready()
select sc under
callback read lock
o2net_disconnect_node()
queue shutdown
begin flush; new color
queue sc_rx_work
in the new color
release callback lock
shutdown socket
flush returns
read buffered CREATE
dlmlock_master()
lock res->spinlock
add lock to granted
unlock res->spinlock
DLM node-down cleanup
lock res->spinlock
dlm_free_dead_locks()
unlink lock
put queue/base refs
free lock
unlock res->spinlock
dlm_queue_ast()
__dlm_queue_ast()
read lock->lockres
(use-after-free)
DLM cleanup holds res->spinlock while dlm_free_dead_locks() drops the
queue and base references. The CREATE handler no longer holds that
spinlock when __dlm_queue_ast() reads the lock, before taking its AST list
reference.
Take a temporary lock reference under res->spinlock when a grant AST will
be queued, and drop it after dlm_queue_ast(). This keeps the lock alive
across cleanup until the AST path has taken its own reference, without
reversing the existing AST/resource lock order.
KASAN report as below:
BUG: KASAN: slab-use-after-free in __dlm_queue_ast+0x8a4/0xc00
Read of size 8 at addr ffff88810ead5940 by task kworker/u16:3/52
CPU: 3 UID: 0 PID: 52 Comm: kworker/u16:3 Not tainted 7.3.0-rc4-next-20260921-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: o2net o2net_rx_until_empty
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? __dlm_queue_ast+0x8a4/0xc00
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? __dlm_queue_ast+0x8a4/0xc00
kasan_report+0xe0/0x110
? __dlm_queue_ast+0x8a4/0xc00
__dlm_queue_ast+0x8a4/0xc00
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? do_raw_spin_lock+0x130/0x270
? __pfx___dlm_queue_ast+0x10/0x10
? __pfx_do_raw_spin_lock+0x10/0x10
? _raw_spin_unlock_irqrestore+0x45/0x60
? srso_alias_return_thunk+0x5/0xfbef5
? lockdep_hardirqs_on_prepare+0xeb/0x1a0
dlm_queue_ast+0x46/0x70
dlmlock_master+0x51f/0xf50
? __pfx_dlmlock_master+0x10/0x10
? dlm_create_lock_handler+0x2b2/0x870
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
dlm_create_lock_handler+0x35b/0x870
? __pfx_dlm_create_lock_handler+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? trace_hardirqs_on+0x18/0x160
? srso_alias_return_thunk+0x5/0xfbef5
? kvm_clock_get_cycles+0x31/0x60
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_dlm_create_lock_handler+0x10/0x10
o2net_rx_until_empty+0x1dae/0x32c0
? reacquire_held_locks+0xdd/0x200
? __pfx_o2net_rx_until_empty+0x10/0x10
? lock_acquire+0x190/0x300
? process_one_work+0x935/0x1b40
? process_one_work+0x834/0x1b40
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
? srso_alias_return_thunk+0x5/0xfbef5
process_one_work+0x9a8/0x1b40
? __pfx_process_one_work+0x10/0x10
? lock_acquire+0x190/0x300
? lock_is_held_type+0x8f/0x100
? srso_alias_return_thunk+0x5/0xfbef5
worker_thread+0x65c/0xe40
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0x177/0x220
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_worker_thread+0x10/0x10
kthread+0x351/0x460
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_kthread+0x10/0x10
ret_from_fork+0x659/0x940
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x74f/0xf70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 52:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x89/0x90
kmem_cache_alloc_noprof+0x20b/0x5c0
dlm_new_lock+0x39/0x5f0
dlm_create_lock_handler+0x16e/0x870
o2net_rx_until_empty+0x1dae/0x32c0
process_one_work+0x9a8/0x1b40
worker_thread+0x65c/0xe40
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
Freed by task 603:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kmem_cache_free+0x242/0x580
dlm_lock_release+0x1df/0x2f0
dlm_lock_put+0x51/0x80
__dlm_hb_node_down+0x15be/0x2710
dlm_hb_node_down_cb+0x6c/0xa0
o2hb_run_event_list+0x34a/0x500
o2hb_do_disk_heartbeat+0x1a07/0x2950
o2hb_thread+0x1ed/0xdc0
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
The buggy address belongs to the object at ffff88810ead5900
which belongs to the cache o2dlm_lock of size 184
The buggy address is located 64 bytes inside of
freed 184-byte region [ffff88810ead5900, ffff88810ead59b8)
[Page and shadow memory dumps omitted.]
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0043-v5-1ad07df761ff49638789@gmail.com
Fixes: 2c5c54aca9d0 ("ocfs2/dlm: Add missing dlm_lock_put()s")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmlock.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -138,6 +138,8 @@ static enum dlm_status dlmlock_master(st
res->lockname.len)) {
kick_thread = 1;
call_ast = 1;
+ /* Keep the lock alive through AST enqueue. */
+ dlm_lock_get(lock);
} else {
mlog(0, "%s: returning DLM_NORMAL to "
"node %u for reco lock\n", dlm->name,
@@ -166,10 +168,12 @@ static enum dlm_status dlmlock_master(st
wake_up(&res->wq);
/* either queue the ast or release it */
- if (call_ast)
+ if (call_ast) {
dlm_queue_ast(dlm, lock);
- else
+ dlm_lock_put(lock);
+ } else {
dlm_lockres_release_ast(dlm, res);
+ }
dlm_lockres_calc_usage(dlm, res);
if (kick_thread)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 274/547] ocfs2/dlm: hold the lookup reference across convert AST enqueue
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 273/547] ocfs2/dlm: hold a lock reference across grant AST enqueue Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 275/547] ocfs2: cancel quota sync work before freeing quota info Greg Kroah-Hartman
` (281 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Mark Fasheh, Joel Becker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
commit 125fe08ff6cfa064e1212f586f01993ee45c0330 upstream.
dlm_convert_lock_handler() drops the reference it took when it found the
lock on res->granted at its leave label, one statement before it calls
dlm_queue_ast(). dlm_free_dead_locks() takes res->spinlock and drops the
list and base references, so a peer death landing in that gap leaves the
handler's own put as the one that frees the lock, and __dlm_queue_ast()
then reads lock->lockres from freed memory.
The handler is registered next to dlm_create_lock_handler(), so a convert
message buffered on a dying peer's socket arrives on the same o2net
receive work that o2net_disconnect_node() does not wait for. The two can
interleave as follows, with the reference counts as they are before this
fix:
Socket data-ready Node-down thread Receive worker
----------------- ---------------- --------------
o2net_data_ready()
select sc under
callback read lock
o2net_disconnect_node()
queue shutdown
begin flush; new color
queue sc_rx_work
in the new color
release callback lock
shutdown socket
flush returns
read buffered convert_lock
dlm_convert_lock_handler()
find lock on res->granted
dlm_lock_get() refs = 3
lock res->spinlock
__dlmconvert_master()
call_ast = 1
unlock res->spinlock
DLM node-down cleanup
lock res->spinlock
dlm_free_dead_locks()
unlink lock
put list ref refs = 2
put base ref refs = 1
unlock res->spinlock
dlm_lock_put() refs = 0
free lock
dlm_queue_ast()
__dlm_queue_ast()
read lock->lockres
(use-after-free)
__dlmconvert_master() only moves the lock between lists, so the count
entering the gap is base, list and lookup. Drop the lookup reference
after the AST is queued instead of before it and the race ends with the
one __dlm_queue_ast() took, which dlm_flush_asts() releases later with
ast_pending cleared and ast_list unlinked. No extra get is needed, and
the normal case ends with the same count as before.
dlmconvert_master() has the same shape but is only reached from dlmlock()
for a lock this node owns, which dlm_free_dead_locks() never matches.
Link: https://lore.kernel.org/20261014112321.2955584-1-joseph.qi@linux.alibaba.com
Fixes: 2c5c54aca9d0 ("ocfs2/dlm: Add missing dlm_lock_put()s")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmconvert.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -534,15 +534,19 @@ int dlm_convert_lock_handler(struct o2ne
}
leave:
- if (lock)
- dlm_lock_put(lock);
-
/* either queue the ast or release it, if reserved */
if (call_ast)
dlm_queue_ast(dlm, lock);
else if (ast_reserved)
dlm_lockres_release_ast(dlm, res);
+ /*
+ * Keep the lock alive through AST enqueue: a concurrent
+ * dlm_free_dead_locks() drops the list and base references.
+ */
+ if (lock)
+ dlm_lock_put(lock);
+
if (kick_thread)
dlm_kick_thread(dlm, res);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 275/547] ocfs2: cancel quota sync work before freeing quota info
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 274/547] ocfs2/dlm: hold the lookup reference across convert " Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 276/547] ocfs2: fix chunk number of the first chunk in a local quota file Greg Kroah-Hartman
` (280 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Jan Kara, Mark Fasheh, Joel Becker, Heming Zhao, Chao Yu,
Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 1dd1f005026d52642b994d63baa16b0b31f3b14f upstream.
OCFS2 quota info owns dqi_sync_work and must outlive both its timer and
qsync_work_fn(). ocfs2_local_free_info() frees that owner without
cancelling the work, relying on the quota suspend/disable wrappers.
Loading quotas on a read-only to read-write remount can successfully queue
the work in ocfs2_global_read_info() and then fail while attaching a dquot
to an existing inode in add_dquot_ref(). The quota core unwinds that
failure directly through dquot_disable(), bypassing the OCFS2 wrapper:
Remount task (s_umount write) Timer/workqueue
ocfs2_global_read_info()
schedules dqi_sync_work
add_dquot_ref() returns an error
dquot_disable()
ocfs2_local_free_info()
frees oinfo
delayed-work timer expires
qsync_work_fn() reads oinfo
The timer core can then write to the freed embedded timer, or
qsync_work_fn() can read oinfo->dqi_gqinode before its s_umount trylock.
The outer ocfs2_disable_quotas() cleanup skips the failed type because
dquot_disable() has already cleared its loaded state.
Cancel dqi_sync_work synchronously at the start of
ocfs2_local_free_info(), before dropping the global inode or freeing any
owner state. The work is initialized whenever read_file_info() succeeds.
dquot_disable() holds s_umount for write, so the callback skips its quota
scan via down_read_trylock() and can finish without waiting for teardown.
The synchronous cancel also handles its self-rearm.
KASAN report as below:
BUG: KASAN: slab-use-after-free in __run_timers+0x9e9/0xa10
Write of size 8 at addr ffff888111b0aad0 by task swapper/3/0
Call Trace:
<IRQ>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? __run_timers+0x9e9/0xa10
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? __run_timers+0x9e9/0xa10
kasan_report+0xe0/0x110
? __run_timers+0x9e9/0xa10
__run_timers+0x9e9/0xa10
? __pfx___run_timers+0x10/0x10
? __lock_acquire+0x5a3/0x2140
? __pfx_do_raw_spin_lock+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
timer_expire_remote+0xfa/0x160
? __pfx_timer_expire_remote+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? trace_hardirqs_on+0x18/0x160
tmigr_handle_remote_up+0x4ba/0x9d0
? __pfx_tmigr_handle_remote_up+0x10/0x10
? tmigr_handle_remote+0x21a/0x340
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
? __pfx_tmigr_handle_remote_up+0x10/0x10
__walk_groups_from+0x5a/0x160
tmigr_handle_remote+0x24f/0x340
? __pfx_tmigr_handle_remote+0x10/0x10
? lock_acquire+0x190/0x300
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
run_timer_softirq+0x222/0x270
? __pfx_run_timer_softirq+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? lockdep_hardirqs_on_prepare+0xb8/0x1a0
? srso_alias_return_thunk+0x5/0xfbef5
handle_softirqs+0x1fa/0x8d0
? __pfx_handle_softirqs+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? _raw_spin_unlock+0x23/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? __hrtimer_rearm_deferred+0x1fb/0x5d0
__irq_exit_rcu+0x113/0x1e0
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0x6c/0x80
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
? ct_kernel_exit.constprop.0+0xc5/0xf0
? do_idle+0x3ae/0x650
default_idle+0x9/0x10
default_idle_call+0x6c/0xb0
do_idle+0x3ae/0x650
? cpuhp_online_idle+0x9c/0xb0
? __pfx_do_idle+0x10/0x10
? __entry_text_end+0x1020f6/0x1020f9
? lockdep_hardirqs_on_prepare+0xeb/0x1a0
? srso_alias_return_thunk+0x5/0xfbef5
? trace_hardirqs_on+0x18/0x160
? srso_alias_return_thunk+0x5/0xfbef5
cpu_startup_entry+0x54/0x60
start_secondary+0x223/0x2d0
? __pfx_start_secondary+0x10/0x10
common_startup_64+0x13e/0x158
</TASK>
Allocated by task 523:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x28d/0x610
ocfs2_local_read_info+0x181/0x1580
dquot_load_quota_sb+0x69e/0x11c0
dquot_load_quota_inode+0x227/0x3e0
ocfs2_enable_quotas+0x27c/0x520
ocfs2_reconfigure+0x964/0xd00
reconfigure_super+0x3ca/0xa70
path_mount+0x141e/0x1e80
__x64_sys_mount+0x24b/0x2d0
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 523:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
ocfs2_local_free_info+0x47b/0x800
dquot_disable+0x5d9/0x17a0
dquot_load_quota_sb+0xd3c/0x11c0
dquot_load_quota_inode+0x227/0x3e0
ocfs2_enable_quotas+0x27c/0x520
ocfs2_reconfigure+0x964/0xd00
reconfigure_super+0x3ca/0xa70
path_mount+0x141e/0x1e80
__x64_sys_mount+0x24b/0x2d0
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888111b0a800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 720 bytes inside of
freed 1024-byte region [ffff888111b0a800, ffff888111b0ac00)
Host details, register and page dumps omitted.
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0052-v3-b4904bd6c85daf033adf@gmail.com
Fixes: 1a6152d36dee ("quota: propagate error from __dquot_initialize")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Chao Yu <chao@kernel.org>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/quota_local.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -816,6 +816,9 @@ static int ocfs2_local_free_info(struct
int mark_clean = 1, len;
int status = 0;
+ /* Quota-core error paths can bypass ocfs2_disable_quotas(). */
+ cancel_delayed_work_sync(&oinfo->dqi_sync_work);
+
iput(oinfo->dqi_gqinode);
ocfs2_simple_drop_lockres(OCFS2_SB(sb), &oinfo->dqi_gqlock);
ocfs2_lock_res_free(&oinfo->dqi_gqlock);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 276/547] ocfs2: fix chunk number of the first chunk in a local quota file
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 275/547] ocfs2: cancel quota sync work before freeing quota info Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 277/547] ocfs2: pin refcount trees before dropping the lookup lock Greg Kroah-Hartman
` (279 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiaming Zhang, Andrew Morton,
Joseph Qi, Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge,
Jun Piao, Heming Zhao
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <r772577952@gmail.com>
commit 4effccfd50baee4f325694964aeee997dca7bd96 upstream.
Mounting a crafted OCFS2 image can corrupt kernel memory. When the
local quota file header of such an image claims zero chunks, the first
quota entry allocated during the mount gets a chunk number taken from a
kernel pointer, and releasing that entry clears a bit far outside the
chunk bitmap.
The write will corrupt the data stored at that address, and the
corruption may lead to a system crash or damage unrelated data.
Mounting requires CAP_SYS_ADMIN, so it takes an untrusted image, such
as removable media or a loop mount of a file from elsewhere.
Since the chunk number comes from a kernel pointer, the address of the
bit that gets cleared differs from boot to boot, and the issue has been
reported under several titles:
- BUG: unable to handle kernel paging request in ocfs2_local_release_dquot
- KASAN: use-after-free Write in ocfs2_local_release_dquot
- KASAN: slab-out-of-bounds Write in ocfs2_local_release_dquot
- KASAN: slab-use-after-free Write in ocfs2_local_release_dquot
- KFENCE: use-after-free write in ocfs2_local_release_dquot
Note that none of these is a use-after-free in the quota code: the
chunk and its buffer head are alive. The bit that gets cleared lies
far outside the bitmap. KASAN and KFENCE name each report based on the
object occupying that address, which explains why the same issue is
reported under so many different titles. In the report I sent, the
address fell in a free page, which KASAN labels use-after-free.
There are known reproducers. Both a syzkaller and a C reproducer are
available from the Google Drive link [1] in my report thread. The
issue was found by our modified syzkaller, not a theoretical thing
found by an LLM. I have not seen it outside fuzzing, so it is not
affecting me in the real world.
The local quota file in OCFS2 is divided into chunks, and each chunk
begins with a header block holding a bitmap of the quota entries that
chunk has handed out. Chunks are numbered from zero, and that number is
used to convert the file offset of an entry back into a bit position in
the bitmap. ocfs2_local_quota_add_chunk() appends a new chunk to the
in-memory list and numbers it one past the chunk that was last:
list_add_tail(&chunk->qc_chunk, &oinfo->dqi_chunk);
chunk->qc_num = list_entry(chunk->qc_chunk.prev,
struct ocfs2_quota_chunk,
qc_chunk)->qc_num + 1;
The predecessor is looked up after the new chunk is added to the list, so
if the list was empty, the prev pointer is the list head itself. The head
is the dqi_chunk member of struct ocfs2_mem_dqinfo and is not a chunk, so
reading qc_num through it lands 16 bytes past the start of the head, on
the dqi_gqinode pointer that follows it. The first chunk of the file is
then numbered with the lower half of a kernel pointer instead of 0.
The list is empty when the local quota file header claims the file has no
chunks. ocfs2_local_read_info() takes dqi_chunks from that header without
validating it, so an image with dqi_chunks == 0 takes this path when the
first quota entry is allocated.
ocfs2_create_local_dquot() turns the bad number into a file offset with
ol_dqblk_off(), which shifts a 32-bit block number left by the block size
bits, so the top bits of such a large block number are lost.
ocfs2_local_release_dquot() turns the offset back into a bit index with
ol_dqblk_chunk_off(), using the full chunk number, so the lost bits push
that index far outside the bitmap, and clearing it corrupts unrelated
memory.
Compute the chunk number before putting the chunk on the list, and use 0
when the list is empty.
Link: https://lore.kernel.org/20260914034940.4070970-1-r772577952@gmail.com
Link: https://drive.google.com/drive/folders/1-LzPTgOALEc3eOjmgM6oOfRKkYXJ-bnO?usp=drive_link [1]
Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling")
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://lore.kernel.org/lkml/CANypQFZ05tpth0Xc33gmP6jgPnkY4VuezyHcsajV-SqCsmN_gg@mail.gmail.com/
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: Claude Code:claude-opus-5
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/quota_local.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -1074,10 +1074,13 @@ static struct ocfs2_quota_chunk *ocfs2_l
goto out;
}
+ if (list_empty(&oinfo->dqi_chunk))
+ chunk->qc_num = 0;
+ else
+ chunk->qc_num = list_entry(oinfo->dqi_chunk.prev,
+ struct ocfs2_quota_chunk,
+ qc_chunk)->qc_num + 1;
list_add_tail(&chunk->qc_chunk, &oinfo->dqi_chunk);
- chunk->qc_num = list_entry(chunk->qc_chunk.prev,
- struct ocfs2_quota_chunk,
- qc_chunk)->qc_num + 1;
chunk->qc_headerbh = bh;
*offset = 0;
return chunk;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 277/547] ocfs2: pin refcount trees before dropping the lookup lock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 276/547] ocfs2: fix chunk number of the first chunk in a local quota file Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 278/547] ocfs2: snapshot dentry names in file and setattr traces Greg Kroah-Hartman
` (278 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Tao Ma, Jia-Ju Bai,
jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 8c714a074074af7ae59233c1fa6ef9d7aa710462 upstream.
A refcount tree returned to ocfs2_lock_refcount_tree() must stay alive
until that caller releases its operation reference. However,
ocfs2_get_refcount_tree() returns the cached pointer after dropping
osb_lock, and the caller only takes its kref afterwards. The registry
reference does not protect this gap from concurrent removal.
This can happen when another node frees a refcount root and reuses its
block with a different generation while this mount retains the old
cached tree. Two local operations on different inodes sharing the new
root, such as data CoW and an external xattr update, can then look up
the same stale tree. Their inode locks are independent, and both the
REFCOUNT DLM lock and rf_sem are acquired after the first operation
reference.
The following ordering is possible, with no other operation references:
Data CoW Xattr update
-------- ------------
Look up the old tree under
osb_lock, then drop osb_lock
Look up the same tree and take a kref
Acquire the tree locks and read the
new on-disk generation
Erase the old tree under osb_lock
Unlock and drop the operation kref
Drop the registry kref, freeing tree
Take a kref through the
freed tree pointer
The final kref_get() accesses freed rf_getcnt storage, and subsequent
accesses in ocfs2_lock_refcount_tree() also use the freed allocation.
Take the operation reference in ocfs2_get_refcount_tree() before
releasing osb_lock, including when an insertion loses to another lookup.
Removal must acquire the same lock, so it cannot drop the registry
reference before the lookup has pinned the tree. Keep the existing
unlock and error path puts. The two callers that already hold the
refcount tree lock keep their borrowed lookup behavior and do not
acquire an extra reference.
KASAN report as below:
BUG: KASAN: slab-use-after-free in ocfs2_lock_refcount_tree+0x94a/0x9b0
Read of size 4 at addr ffff888117212820 by task python3/497
[Kernel and hardware identification omitted.]
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? ocfs2_lock_refcount_tree+0x94a/0x9b0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? ocfs2_lock_refcount_tree+0x94a/0x9b0
kasan_report+0xe0/0x110
? ocfs2_lock_refcount_tree+0x94a/0x9b0
ocfs2_lock_refcount_tree+0x94a/0x9b0
? __pfx_ocfs2_lock_refcount_tree+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? ocfs2_refcount_cow+0x3b6/0xd90
? srso_alias_return_thunk+0x5/0xfbef5
? __kmalloc_cache_noprof+0x28d/0x610
? ocfs2_refcount_cow+0x3b6/0xd90
ocfs2_refcount_cow+0x410/0xd90
? __pfx_ocfs2_refcount_cow+0x10/0x10
? __pfx___might_resched+0x10/0x10
? down_write+0x11a/0x1f0
? __pfx_down_write+0x10/0x10
? ocfs2_inode_unlock+0x1a9/0x260
? __pfx_ocfs2_inode_unlock+0x10/0x10
? ocfs2_file_write_iter+0x1413/0x1d30
ocfs2_file_write_iter+0x157b/0x1d30
? __pfx_ocfs2_file_write_iter+0x10/0x10
? lock_acquire+0x190/0x300
? __x64_sys_pwrite64+0x1b7/0x220
? __pfx___might_resched+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? security_file_permission+0x26/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? lock_is_held_type+0x8f/0x100
vfs_write+0x639/0x1010
? __pfx_ocfs2_file_write_iter+0x10/0x10
? lock_vma_under_rcu+0x154/0x4a0
? __pfx_vfs_write+0x10/0x10
? lock_release+0x121/0x290
? srso_alias_return_thunk+0x5/0xfbef5
__x64_sys_pwrite64+0x1b7/0x220
? __pfx___x64_sys_pwrite64+0x10/0x10
? irqentry_exit+0xbe/0x820
? srso_alias_return_thunk+0x5/0xfbef5
? trace_hardirqs_on_prepare+0x11d/0x150
? srso_alias_return_thunk+0x5/0xfbef5
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Register dump omitted.]
</TASK>
Allocated by task 491:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x28d/0x610
ocfs2_allocate_refcount_tree+0x49/0x1a0
ocfs2_create_refcount_tree+0x5d7/0x1630
ocfs2_attach_refcount_tree+0x57d/0x1100
__ocfs2_reflink.isra.0+0x1c4/0x1940
ocfs2_reflink+0x501/0x9b0
ocfs2_reflink_ioctl+0x6b2/0x920
ocfs2_ioctl+0x538/0x640
__x64_sys_ioctl+0x163/0x1d0
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 498:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
ocfs2_lock_refcount_tree+0x672/0x9b0
ocfs2_xattr_set+0x72c/0x2530
ocfs2_xattr_user_set+0xaf/0xf0
__vfs_setxattr+0x143/0x1b0
__vfs_setxattr_noperm+0x112/0x5b0
__vfs_setxattr_locked+0xfe/0x2b0
vfs_setxattr+0x13c/0x370
do_setxattr+0x128/0x170
filename_setxattr+0x147/0x190
path_setxattrat+0x1ac/0x260
__x64_sys_setxattr+0xcb/0x140
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888117212800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 32 bytes inside of
freed 1024-byte region [ffff888117212800, ffff888117212c00)
[Page and memory dumps omitted.]
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0037-v4-9f1a261dfbc341721689@gmail.com
Fixes: 374a263e790c ("ocfs2: Add refcount tree lock mechanism.")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Tao Ma <tao.ma@oracle.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/refcounttree.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -348,8 +348,10 @@ ocfs2_allocate_refcount_tree(struct ocfs
return new;
}
+/* Callers without the refcount tree lock must request a reference. */
static int ocfs2_get_refcount_tree(struct ocfs2_super *osb, u64 rf_blkno,
- struct ocfs2_refcount_tree **ret_tree)
+ struct ocfs2_refcount_tree **ret_tree,
+ bool get_ref)
{
int ret = 0;
struct ocfs2_refcount_tree *tree, *new = NULL;
@@ -406,6 +408,8 @@ static int ocfs2_get_refcount_tree(struc
new = NULL;
out:
+ if (get_ref)
+ ocfs2_refcount_tree_get(tree);
*ret_tree = tree;
osb->osb_ref_tree_lru = tree;
@@ -479,14 +483,12 @@ int ocfs2_lock_refcount_tree(struct ocfs
struct ocfs2_refcount_block *rb;
again:
- ret = ocfs2_get_refcount_tree(osb, ref_blkno, &tree);
+ ret = ocfs2_get_refcount_tree(osb, ref_blkno, &tree, true);
if (ret) {
mlog_errno(ret);
return ret;
}
- ocfs2_refcount_tree_get(tree);
-
ret = __ocfs2_lock_refcount_tree(osb, tree, rw);
if (ret) {
mlog_errno(ret);
@@ -2328,7 +2330,8 @@ int ocfs2_decrease_refcount(struct inode
goto out;
}
- ret = ocfs2_get_refcount_tree(OCFS2_SB(inode->i_sb), ref_blkno, &tree);
+ ret = ocfs2_get_refcount_tree(OCFS2_SB(inode->i_sb), ref_blkno,
+ &tree, false);
if (ret) {
mlog_errno(ret);
goto out;
@@ -2563,7 +2566,7 @@ int ocfs2_prepare_refcount_change_for_de
BUG_ON(!ocfs2_is_refcount_inode(inode));
ret = ocfs2_get_refcount_tree(OCFS2_SB(inode->i_sb),
- refcount_loc, &tree);
+ refcount_loc, &tree, false);
if (ret) {
mlog_errno(ret);
goto out;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 278/547] ocfs2: snapshot dentry names in file and setattr traces
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 277/547] ocfs2: pin refcount trees before dropping the lookup lock Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 279/547] smb: client: fix OOB last_entry pointer from unbounded LastNameOffset Greg Kroah-Hartman
` (277 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Jia-Ju Bai, jjzuming
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
commit 8cd3ff30659775a6831c66687a69d2b83d163591 upstream.
Patch series "ocfs2: stabilize dentry names in file and setattr traces",
v4.
Snapshot names at all six users of ocfs2__file_ops and at the separate
setattr event. Patch 1 handles the five ordinary file-operation callers
and setattr. Patch 2 handles release separately to preserve its locked
open-count sample and take the snapshot outside that critical section.
The release explanation distinguishes its existing RCU lifetime coverage
from name/length consistency. It does not claim that the ordinary
callers' external-name UAF interleaving crosses the held inode spinlock.
The release source change is unchanged from v3.
Patch 1 also removes the read callback's redundant NULL-inode check.
The two patches apply independently and leave trace formats unchanged.
This patch (of 2):
The open, fsync, read, write and splice-read trace calls pass the live
dentry name and length to the shared ocfs2__file_ops event class.
ocfs2_setattr() passes the same unprotected arguments to its own event.
Both events size and copy a __string field separately. A reference to
the dentry does not pin the external storage backing an individual name.
With an event enabled, a caller can be preempted after loading the name
pointer. A long-to-short rename can then replace the name and reclaim its
old external allocation before the trace callback sizes or copies it,
provided no other snapshot retains that allocation.
The setattr inode lock does not exclude every rename: a same-directory
rename of a source directory need not take that directory's inode lock.
It can therefore change the dentry name while setattr records its event.
Inline names and separately loaded lengths can also change during trace
record sizing and copying.
Take a dentry name snapshot around each of these six trace calls and
pass both the string and length from the snapshot. Check event enablement
before taking a snapshot. Keep the event classes and formats unchanged.
Also remove the redundant NULL-inode check in the read callback.
file_inode() returns the open file's inode, which is already used by the
trace call above the check.
The historical report below is from the read path.
KASAN report as below:
BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0
Read of size 1 at addr ffff88810a5b2b18 by task python3/496
[CPU and host details omitted.]
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? strlen+0x85/0xa0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? strlen+0x85/0xa0
kasan_report+0xe0/0x110
? strlen+0x85/0xa0
strlen+0x85/0xa0
trace_event_raw_event_ocfs2__file_ops+0xf0/0x480
? __pfx_trace_event_raw_event_ocfs2__file_ops+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? pmbd_probe_hit_cookie+0xe7/0x1c0
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_pmbd_probe_hit_cookie+0x10/0x10
ocfs2_file_read_iter+0x6cd/0xb30
? __pfx_ocfs2_file_read_iter+0x10/0x10
? selinux_file_permission+0x11d/0x540
? srso_alias_return_thunk+0x5/0xfbef5
? security_file_permission+0x26/0x80
vfs_read+0x7d2/0xc20
? __pfx_vfs_read+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_do_sys_openat2+0x10/0x10
ksys_read+0x111/0x200
? __pfx_ksys_read+0x10/0x10
? irqentry_exit+0xbe/0x820
? srso_alias_return_thunk+0x5/0xfbef5
? trace_hardirqs_on_prepare+0x11d/0x150
? srso_alias_return_thunk+0x5/0xfbef5
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[User register dump omitted.]
</TASK>
Allocated by task 489:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_noprof+0x2de/0x780
__d_alloc+0x5fc/0x8c0
d_alloc_parallel+0x106/0x11d0
lookup_open+0x3ff/0x13e0
path_openat+0x95e/0x2020
do_file_open+0x21e/0x470
do_sys_openat2+0xf4/0x1b0
__x64_sys_openat+0x136/0x1e0
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 0:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
__rcu_free_sheaf_prepare+0x65/0x2a0
rcu_free_sheaf_nobarn+0x1d/0x50
rcu_core+0x6be/0x1ed0
handle_softirqs+0x1fa/0x8d0
__irq_exit_rcu+0x113/0x1e0
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0x6c/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
The buggy address belongs to the object at ffff88810a5b2b00
which belongs to the cache kmalloc-rcl-192 of size 192
The buggy address is located 24 bytes inside of
freed 192-byte region [ffff88810a5b2b00, ffff88810a5b2bc0)
[Page and shadow-memory dumps omitted.]
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0088-v7-6324344256f0c3b1c3d8-0@gmail.com
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0088-v7-6324344256f0c3b1c3d8-1@gmail.com
Fixes: 468eedde23d6 ("ocfs2: Remove mlog(0) from fs/ocfs2/file.c")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/file.c | 102 +++++++++++++++++++++++++++++++++++---------------------
1 file changed, 65 insertions(+), 37 deletions(-)
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -85,10 +85,17 @@ static int ocfs2_file_open(struct inode
int mode = file->f_flags;
struct ocfs2_inode_info *oi = OCFS2_I(inode);
- trace_ocfs2_file_open(inode, file, file->f_path.dentry,
- (unsigned long long)oi->ip_blkno,
- file->f_path.dentry->d_name.len,
- file->f_path.dentry->d_name.name, mode);
+ if (trace_ocfs2_file_open_enabled()) {
+ struct dentry *dentry = file->f_path.dentry;
+ struct name_snapshot name;
+
+ take_dentry_name_snapshot(&name, dentry);
+ trace_ocfs2_file_open(inode, file, dentry,
+ oi->ip_blkno,
+ name.name.len, name.name.name,
+ mode);
+ release_dentry_name_snapshot(&name);
+ }
if (file->f_mode & FMODE_WRITE) {
status = dquot_initialize(inode);
@@ -174,11 +181,17 @@ static int ocfs2_sync_file(struct file *
tid_t commit_tid;
bool needs_barrier = false;
- trace_ocfs2_sync_file(inode, file, file->f_path.dentry,
- oi->ip_blkno,
- file->f_path.dentry->d_name.len,
- file->f_path.dentry->d_name.name,
- (unsigned long long)datasync);
+ if (trace_ocfs2_sync_file_enabled()) {
+ struct dentry *dentry = file->f_path.dentry;
+ struct name_snapshot name;
+
+ take_dentry_name_snapshot(&name, dentry);
+ trace_ocfs2_sync_file(inode, file, dentry,
+ oi->ip_blkno,
+ name.name.len, name.name.name,
+ (unsigned long long)datasync);
+ release_dentry_name_snapshot(&name);
+ }
if (unlikely(ocfs2_emergency_state(osb)))
return -EROFS;
@@ -1132,15 +1145,19 @@ int ocfs2_setattr(struct mnt_idmap *idma
int had_lock;
struct ocfs2_lock_holder oh;
- trace_ocfs2_setattr(inode, dentry,
- (unsigned long long)OCFS2_I(inode)->ip_blkno,
- dentry->d_name.len, dentry->d_name.name,
- attr->ia_valid,
- attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0,
- attr->ia_valid & ATTR_UID ?
+ if (trace_ocfs2_setattr_enabled()) {
+ struct name_snapshot name;
+
+ take_dentry_name_snapshot(&name, dentry);
+ trace_ocfs2_setattr(inode, dentry, OCFS2_I(inode)->ip_blkno,
+ name.name.len, name.name.name, attr->ia_valid,
+ attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0,
+ attr->ia_valid & ATTR_UID ?
from_kuid(&init_user_ns, attr->ia_uid) : 0,
- attr->ia_valid & ATTR_GID ?
+ attr->ia_valid & ATTR_GID ?
from_kgid(&init_user_ns, attr->ia_gid) : 0);
+ release_dentry_name_snapshot(&name);
+ }
status = ocfs2_emergency_state(osb);
if (unlikely(status)) {
@@ -2392,11 +2409,17 @@ static ssize_t ocfs2_file_write_iter(str
int direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
int nowait = iocb->ki_flags & IOCB_NOWAIT ? 1 : 0;
- trace_ocfs2_file_write_iter(inode, file, file->f_path.dentry,
- (unsigned long long)OCFS2_I(inode)->ip_blkno,
- file->f_path.dentry->d_name.len,
- file->f_path.dentry->d_name.name,
- (unsigned int)from->nr_segs); /* GRRRRR */
+ if (trace_ocfs2_file_write_iter_enabled()) {
+ struct dentry *dentry = file->f_path.dentry;
+ struct name_snapshot name;
+
+ take_dentry_name_snapshot(&name, dentry);
+ trace_ocfs2_file_write_iter(inode, file, dentry,
+ OCFS2_I(inode)->ip_blkno,
+ name.name.len, name.name.name,
+ (unsigned int)from->nr_segs);
+ release_dentry_name_snapshot(&name);
+ }
if (!direct_io && nowait)
return -EOPNOTSUPP;
@@ -2542,17 +2565,16 @@ static ssize_t ocfs2_file_read_iter(stru
int direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
int nowait = iocb->ki_flags & IOCB_NOWAIT ? 1 : 0;
- trace_ocfs2_file_read_iter(inode, filp, filp->f_path.dentry,
- (unsigned long long)OCFS2_I(inode)->ip_blkno,
- filp->f_path.dentry->d_name.len,
- filp->f_path.dentry->d_name.name,
- to->nr_segs); /* GRRRRR */
-
-
- if (!inode) {
- ret = -EINVAL;
- mlog_errno(ret);
- goto bail;
+ if (trace_ocfs2_file_read_iter_enabled()) {
+ struct dentry *dentry = filp->f_path.dentry;
+ struct name_snapshot name;
+
+ take_dentry_name_snapshot(&name, dentry);
+ trace_ocfs2_file_read_iter(inode, filp, dentry,
+ OCFS2_I(inode)->ip_blkno,
+ name.name.len, name.name.name,
+ to->nr_segs);
+ release_dentry_name_snapshot(&name);
}
if (!direct_io && nowait)
@@ -2624,11 +2646,17 @@ static ssize_t ocfs2_file_splice_read(st
ssize_t ret = 0;
int lock_level = 0;
- trace_ocfs2_file_splice_read(inode, in, in->f_path.dentry,
- (unsigned long long)OCFS2_I(inode)->ip_blkno,
- in->f_path.dentry->d_name.len,
- in->f_path.dentry->d_name.name,
- flags);
+ if (trace_ocfs2_file_splice_read_enabled()) {
+ struct dentry *dentry = in->f_path.dentry;
+ struct name_snapshot name;
+
+ take_dentry_name_snapshot(&name, dentry);
+ trace_ocfs2_file_splice_read(inode, in, dentry,
+ OCFS2_I(inode)->ip_blkno,
+ name.name.len, name.name.name,
+ flags);
+ release_dentry_name_snapshot(&name);
+ }
/*
* We're fine letting folks race truncates and extending writes with
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 279/547] smb: client: fix OOB last_entry pointer from unbounded LastNameOffset
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 278/547] ocfs2: snapshot dentry names in file and setattr traces Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 280/547] smb: client: hold server info until cifsd exits Greg Kroah-Hartman
` (276 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
commit 570c783a96f054dd3ac409a92772e9afb705d21c upstream.
CIFSFindFirst() and CIFSFindNext() locate the last entry of a
TRANS2_FIND_FIRST2 or TRANS2_FIND_NEXT2 response by adding the
LastNameOffset of the response parameters to the start of the data
area, and store the result in psrch_inf->last_entry. MS-CIFS 2.2.6.2.2
defines that offset as the offset of the entry's file name; the client
follows the reading of NT and Samba servers, which point it at the
entry. LastNameOffset is only checked against CIFSMaxBufSize, which
says nothing about the response actually received: validate_t2() lets
the data area start up to 1024 bytes into the buffer, and SendReceive()
copies at most CIFSMaxBufSize + MAX_CIFS_HDR_SIZE bytes of a response,
16468 by default, into a cifs_request allocation of CIFSMaxBufSize +
MAX_SMB2_HDR_SIZE bytes, 16588 by default. The pointer itself can
therefore be placed anywhere from the end of the received data to 820
bytes past the end of the allocation.
The read through that pointer is far larger than its displacement.
find_cifs_entry() hands last_entry to cifs_save_resume_key() after every
FindNext and after the FindFirst of a search rewind, and
cifs_fill_dirent() takes the length of the name from the entry itself: a
__le32 FileNameLength for most levels, a __u8 for
SMB_FIND_FILE_INFO_STANDARD, and for SMB_FIND_FILE_UNIX the result of a
scan for the terminating NUL over up to PATH_MAX + 1 UTF-16 units. The
name is recorded as the resume name of the search, and the next
CIFSFindNext() rejects only a recorded length of PATH_MAX or more before
copying the name into the ResumeFileName of its request and sending it
with the resume key taken from the same entry: up to 4 KiB of memory
from past the end of the allocation leaks to the server, and for
SMB_FIND_FILE_UNIX the NUL scan runs about twice as far before the
length is even known. The entry does not have to lie outside the
response for that either: a maximal response ends about 120 bytes before
the end of the allocation, so an entry in its last bytes with a name
just under PATH_MAX has nearly all of that name copied from past the
allocation.
It needs nothing unusual from the client: a FindNext response that
reports no entries and does not end the search makes find_cifs_entry()
send the next FindNext at once, carrying whatever was parsed at
LastNameOffset, and a search rewind can do the same after its
FindFirst. SMB1 is not negotiated by default: this takes a malicious
or compromised server, a mount of it with an explicit vers=1.0, which
CONFIG_CIFS_ALLOW_INSECURE_LEGACY (default y) permits, and a directory
listing on that mount.
With KASAN enabled, a response that places the last entry past the
buffer, with a large DataOffset and a LastNameOffset near the end of
its range, gives:
==================================================================
BUG: KASAN: slab-out-of-bounds in cifs_save_resume_key.isra.0+0x7aa/0x7f0
Read of size 4 at addr ffff88807b55c33b by task ls/83
CPU: 1 UID: 0 PID: 83 Comm: ls Not tainted 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
Call Trace:
<TASK>
kasan_report+0xdf/0x1a0
cifs_save_resume_key.isra.0+0x7aa/0x7f0
cifs_readdir+0x1ed6/0x29c0
iterate_dir+0x1c0/0x570
__x64_sys_getdents64+0x133/0x270
do_syscall_64+0x109/0x5d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 83 on cpu 0 at 19.317556s:
cifs_buf_get+0x36/0x90
smb_init+0x4f/0x110
CIFSFindNext+0xf7/0x14c0
cifs_readdir+0xf51/0x29c0
The buggy address belongs to the object at ffff88807b558000
which belongs to the cache cifs_request of size 16588
The buggy address is located 623 bytes to the right of
allocated 16588-byte region [ffff88807b558000, ffff88807b55c0cc)
==================================================================
The four bytes read there are the FileNameLength of the entry, which
cifs_fill_dirent() takes before anything checks where the entry lies.
Ignore the last entry when it does not start inside the received
response or the response holds no entries; for a response without
entries, last_entry pointed into or past its empty data area and
cifs_save_resume_key() parsed whatever the buffer held there. The
entry is bounded by the response that was received, which is what the
buffer holds, rather than by the data area the response declares,
which a later patch checks against the received length. Record the
search handle before the last entry is examined, since a response
without a usable last entry still carries the handle that the search
is continued and closed with; leaving the assignment in the else
branch would drop the handle of every response without entries.
This bounds where the last entry starts, not how far it is parsed: an
entry that starts within the final bytes of the response still has
its fixed part read past the end of the received data and its name,
up to 4095 bytes, copied from past the end of the allocation, until
the following patch bounds the parse itself. A response without a
usable last entry continues the search with an empty resume name,
since the preceding patch, "smb: client: fix use-after-free infoleak
via the readdir resume name", drops the recorded name whenever a new
response is installed. This patch applies on top of that one and
relies on it: without it, every response rejected here would leave
the previous name in place, pointing into a buffer that has been
released.
A conforming server is not affected: the last entry lies inside the
data area of the response.
Fixes: 0752f1522a91 ("[CIFS] make sure we have the right resume info before calling CIFSFindNext")
Fixes: b77d753c413e ("[CIFS] Check that last search entry resume key is valid")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -4546,14 +4546,17 @@ findFirstRetry:
psrch_inf->presume_name = NULL;
psrch_inf->resume_name_len = 0;
psrch_inf->resume_key = 0;
+ if (pnetfid)
+ *pnetfid = parms->SearchHandle;
lnoff = le16_to_cpu(parms->LastNameOffset);
- if (CIFSMaxBufSize < lnoff) {
+ if (!psrch_inf->entries_in_buffer) {
+ psrch_inf->last_entry = NULL;
+ } else if (psrch_inf->srch_entries_start + lnoff >=
+ psrch_inf->ntwrk_buf_start + bytes_returned) {
cifs_dbg(VFS, "ignoring corrupt resume name\n");
psrch_inf->last_entry = NULL;
} else {
psrch_inf->last_entry = psrch_inf->srch_entries_start + lnoff;
- if (pnetfid)
- *pnetfid = parms->SearchHandle;
}
return 0;
}
@@ -4672,7 +4675,10 @@ int CIFSFindNext(const unsigned int xid,
psrch_inf->resume_name_len = 0;
psrch_inf->resume_key = 0;
lnoff = le16_to_cpu(parms->LastNameOffset);
- if (CIFSMaxBufSize < lnoff) {
+ if (!psrch_inf->entries_in_buffer) {
+ psrch_inf->last_entry = NULL;
+ } else if (psrch_inf->srch_entries_start + lnoff >=
+ psrch_inf->ntwrk_buf_start + bytes_returned) {
cifs_dbg(VFS, "ignoring corrupt resume name\n");
psrch_inf->last_entry = NULL;
} else {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 280/547] smb: client: hold server info until cifsd exits
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 279/547] smb: client: fix OOB last_entry pointer from unbounded LastNameOffset Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 281/547] smb: client: stop processing a read response after a receive error Greg Kroah-Hartman
` (275 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5c3ed2a0de3270efc921,
syzbot+c2ec61adfbcb24e5ec20, Eduard Zateev,
Michail Andreas Michalopoulos, Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zateev <hackerowskiy@gmail.com>
commit 482c117c6dbeee382790168af10959810450ab09 upstream.
The last session reference can be dropped while the cifsd demultiplex
thread is still running clean_demultiplex_info(). That thread frees
TCP_Server_Info there, racing with cifs_put_tcp_session() as it releases
the server crypto state. syzbot reported a KASAN use-after-free in
cifs_crypto_secmech_release().
Keep an object reference for the cifsd thread. Defer final crypto,
session-key, network namespace, string, and structure cleanup until both
the last session reference and the thread reference are dropped. Drop the
thread reference after clean_demultiplex_info() has finished using the
server.
Build-tested with ARCH=arm64 and W=1 for
fs/smb/client/connect.o. The KASAN reproducer was not run on the patched
kernel.
Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
Reported-by: syzbot+5c3ed2a0de3270efc921@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c3ed2a0de3270efc921
Reported-by: syzbot+c2ec61adfbcb24e5ec20@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=c2ec61adfbcb24e5ec20
Assisted-by: LLM OpenAI Codex
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Cc: stable@vger.kernel.org
Tested-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsglob.h | 2 ++
fs/smb/client/connect.c | 33 +++++++++++++++++++++------------
2 files changed, 23 insertions(+), 12 deletions(-)
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -16,6 +16,7 @@
#include <linux/scatterlist.h>
#include <linux/mm.h>
#include <linux/mempool.h>
+#include <linux/refcount.h>
#include <linux/workqueue.h>
#include <linux/utsname.h>
#include <linux/sched/mm.h>
@@ -679,6 +680,7 @@ struct TCP_Server_Info {
spinlock_t srv_lock; /* protect anything here that is not protected */
__u64 conn_id; /* connection identifier (useful for debugging) */
int srv_count; /* reference counter */
+ refcount_t obj_refs; /* struct lifetime: srv_count users + cifsd */
int rfc1001_sessinit; /* whether to estasblish netbios session */
bool with_rfc1001; /* if netbios session is used */
/* 15 character server name + 0x20 16th byte indicating type = srv */
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1062,6 +1062,19 @@ cifs_enable_signing(struct TCP_Server_In
return 0;
}
+static void cifs_tcp_server_put(struct TCP_Server_Info *server)
+{
+ if (!refcount_dec_and_test(&server->obj_refs))
+ return;
+
+ cifs_crypto_secmech_release(server);
+ kfree_sensitive(server->session_key.response);
+ put_net(cifs_net_ns(server));
+ kfree(server->leaf_fullpath);
+ kfree(server->hostname);
+ kfree_sensitive(server);
+}
+
static noinline_for_stack void
clean_demultiplex_info(struct TCP_Server_Info *server)
{
@@ -1147,14 +1160,11 @@ clean_demultiplex_info(struct TCP_Server
*/
}
- put_net(cifs_net_ns(server));
- kfree(server->leaf_fullpath);
- kfree(server->hostname);
- kfree_sensitive(server);
-
length = atomic_dec_return(&tcpSesAllocCount);
if (length > 0)
mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ cifs_tcp_server_put(server);
}
static int
@@ -1731,7 +1741,7 @@ cifs_put_tcp_session(struct TCP_Server_I
else
cancel_delayed_work_sync(&server->reconnect);
- /* For secondary channels, we pick up ref-count on the primary server */
+ /* For secondary channels, drop the reference on the primary server */
if (SERVER_IS_CHAN(server))
cifs_put_tcp_session(server->primary_server, from_reconnect);
@@ -1739,15 +1749,11 @@ cifs_put_tcp_session(struct TCP_Server_I
server->tcpStatus = CifsExiting;
spin_unlock(&server->srv_lock);
- cifs_crypto_secmech_release(server);
-
- kfree_sensitive(server->session_key.response);
- server->session_key.response = NULL;
- server->session_key.len = 0;
-
task = xchg(&server->tsk, NULL);
if (task)
send_sig(SIGKILL, task, 1);
+
+ cifs_tcp_server_put(server);
}
struct TCP_Server_Info *
@@ -1769,6 +1775,7 @@ cifs_get_tcp_session(struct smb3_fs_cont
rc = -ENOMEM;
goto out_err;
}
+ refcount_set(&tcp_ses->obj_refs, 1);
tcp_ses->hostname = kstrdup(ctx->server_hostname, GFP_KERNEL);
if (!tcp_ses->hostname) {
@@ -1907,6 +1914,8 @@ smbd_connected:
module_put(THIS_MODULE);
goto out_err_crypto_release;
}
+ /* Keep the server alive until the demultiplex thread has exited */
+ refcount_inc(&tcp_ses->obj_refs);
/* thread created, put it on the list */
spin_lock(&cifs_tcp_ses_lock);
list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 281/547] smb: client: stop processing a read response after a receive error
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 280/547] smb: client: hold server info until cifsd exits Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 282/547] ovl: hold a reference on the parent in readdir Greg Kroah-Hartman
` (274 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+24c7c12d69e63c6d, Weiming Shi,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
commit 51efca72345acdbedc4af76782d464bd15ba50ff upstream.
cifs_read_iter_from_socket() may call cifs_reconnect() before returning an
error. The reconnect path aborts pending mids and invokes their callbacks.
The callback can then release the cifs_io_subrequest containing rdata.
cifs_readv_receive() nevertheless continues after a negative return and may
dereference rdata in cifs_readv_discard(). KASAN reports the resulting
UAF:
BUG: KASAN: slab-use-after-free in cifs_readv_receive
Read of size 4 by task cifsd
cifs_readv_receive (fs/smb/client/transport.c:1284)
cifs_demultiplex_thread (fs/smb/client/connect.c:1355)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
Freed by task 148:
netfs_put_subrequest (fs/netfs/objects.c:267)
netfs_read_collection (fs/netfs/read_collect.c:460)
netfs_wait_for_in_progress (fs/netfs/misc.c:462)
Return the socket error immediately, as this path did before the iterator
conversion. This also avoids adding a negative length to total_read.
Cc: stable@vger.kernel.org
Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Reported-by: co+24c7c12d69e63c6d@bugs.sh
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/transport.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/transport.c
+++ b/fs/smb/client/transport.c
@@ -1317,6 +1317,8 @@ cifs_readv_receive(struct TCP_Server_Inf
#endif
length = cifs_read_iter_from_socket(server, &rdata->subreq.io_iter,
data_len);
+ if (length < 0)
+ return length;
if (length > 0)
rdata->got_bytes += length;
server->total_read += length;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 282/547] ovl: hold a reference on the parent in readdir
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 281/547] smb: client: stop processing a read response after a receive error Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 283/547] ovl: set OVL_WHITEOUTS before publishing the upper dir Greg Kroah-Hartman
` (273 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 16d319e12328acafeafd3eecdf09c46d7fb43452 upstream.
Listing a directory on an overlay uses a freed dentry and crashes the
kernel when a lookup moves the directory at the same time.
Code that can sleep may only use d_parent without a reference while
something stops a move of the dentry. ovl_iterate_real(),
ovl_need_adjust_d_ino() and ovl_cache_update() use the d_parent of the
listed directory and hold only the lock of that directory. When a
lookup finds the directory under another parent after a change to a
layer, d_splice_alias() moves it without that lock and drops its
reference on the old parent.
With a delay in ovl_iterate_real(), getdents64 on an overlay directory
raced a rename in the lower layer and a lookup that moved its dentry,
and after an rmdir of the old parent KASAN reported a use-after-free in
security_inode_getattr().
Fix this by using dget_parent() in the three functions.
Fixes: b5efccbe0a12 ("ovl: constant d_ino across copy up")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: fix comments in ovl_need_adjust_d_ino()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/readdir.c | 33 +++++++++++++++++++++++++--------
1 file changed, 25 insertions(+), 8 deletions(-)
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -568,8 +568,8 @@ static int ovl_cache_update(const struct
goto get;
}
if (p->len == 2) {
- /* we shall not be moved */
- this = dget(dir->d_parent);
+ /* d_splice_alias() can move even a locked dir */
+ this = dget_parent(dir);
goto get;
}
}
@@ -797,6 +797,7 @@ static int ovl_iterate_real(struct file
struct dentry *dir = file->f_path.dentry;
struct ovl_fs *ofs = OVL_FS(dir->d_sb);
const struct ovl_layer *lower_layer = ovl_layer_lower(dir);
+ struct dentry *parent;
struct ovl_readdir_translate rdt = {
.ctx.actor = ovl_fill_real,
.ctx.count = ctx->count,
@@ -808,18 +809,26 @@ static int ovl_iterate_real(struct file
if (rdt.xinobits && lower_layer)
rdt.fsid = lower_layer->fsid;
- if (OVL_TYPE_MERGE(ovl_path_type(dir->d_parent))) {
+ /*
+ * The lock on dir does not stop d_splice_alias() from moving it to
+ * another parent, which drops the reference dir holds on this one.
+ */
+ parent = dget_parent(dir);
+ if (OVL_TYPE_MERGE(ovl_path_type(parent))) {
struct kstat stat;
struct path statpath = file->f_path;
- statpath.dentry = dir->d_parent;
+ statpath.dentry = parent;
err = vfs_getattr(&statpath, &stat, STATX_INO, 0);
- if (err)
+ if (err) {
+ dput(parent);
return err;
+ }
WARN_ON_ONCE(dir->d_sb->s_dev != stat.dev);
rdt.parent_ino = stat.ino;
}
+ dput(parent);
if (ovl_is_impure_dir(file)) {
rdt.cache = ovl_cache_get_impure(&file->f_path);
@@ -875,8 +884,10 @@ static bool ovl_need_adjust_d_ino(struct
{
struct dentry *dentry = file->f_path.dentry;
struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
+ struct dentry *parent;
+ enum ovl_path_type type;
- /* If parent is merge, then need to adjust d_ino for '..' */
+ /* With xino, need to map real d_ino to the unified overlay ino space */
if (ovl_xino_bits(ofs))
return true;
@@ -885,8 +896,14 @@ static bool ovl_need_adjust_d_ino(struct
return false;
/* If dir is impure then need to adjust d_ino for copied up entries */
- if (ovl_is_impure_dir(file) ||
- OVL_TYPE_MERGE(ovl_path_type(dentry->d_parent)))
+ if (ovl_is_impure_dir(file))
+ return true;
+
+ /* If parent is merge, then need to adjust d_ino for '..' */
+ parent = dget_parent(dentry);
+ type = ovl_path_type(parent);
+ dput(parent);
+ if (OVL_TYPE_MERGE(type))
return true;
/* Pure: no need to adjust d_ino */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 283/547] ovl: set OVL_WHITEOUTS before publishing the upper dir
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 282/547] ovl: hold a reference on the parent in readdir Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 284/547] ovl: take a snapshot of the name for copy up Greg Kroah-Hartman
` (272 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit cbec8610ec5aaf35df50094ff639febc23f20773 upstream.
Listing a directory while it is copied up causes a use-after-free of
the readdir cache.
A merge directory must never be iterated as a real upper directory:
that mode frees the cache in OVL_I(inode)->cache without looking at
its refcount, while files opened in merged mode still use it.
ovl_copy_up_workdir() publishes the upper dentry before it sets
OVL_WHITEOUTS, and ovl_dir_open() samples both without a lock, so an
open between the two stores finds the upper directory and takes it
for a real one.
With a delay between the two stores, an unprivileged process that
listed a directory during its copy-up saw only "." and "..", and its
next getdents freed the readdir cache of another descriptor.
Fix this by setting OVL_WHITEOUTS before ovl_inode_update(), so that
ovl_dir_reset() agrees with ovl_dir_open(), and by testing
OVL_TYPE_MERGE() of the path type in ovl_dir_open(), so that an open
that observes the upper dentry never iterates a merge dir as a real
dir, regardless of the order in which it observes the flag.
Fixes: b79e05aaa166 ("ovl: no direct iteration for dir with origin xattr")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: test OVL_TYPE_MERGE() instead of smp_rmb() in ovl_dir_open()]
Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxh-1J2OBjnDVbrrrjy1puSOW0kABvghN85ih6dtKUBTyA@mail.gmail.com/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 2 +-
fs/overlayfs/readdir.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -834,9 +834,9 @@ static int ovl_copy_up_workdir(struct ov
if (!c->metacopy)
ovl_set_upperdata(inode);
- ovl_inode_update(inode, temp);
if (S_ISDIR(inode->i_mode))
ovl_set_flag(OVL_WHITEOUTS, inode);
+ ovl_inode_update(inode, temp);
out:
ovl_end_write(c->dentry);
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -1072,7 +1072,8 @@ static int ovl_dir_open(struct inode *in
return PTR_ERR(realfile);
}
od->realfile = realfile;
- od->is_real = ovl_dir_is_real(inode);
+ od->is_real = !OVL_TYPE_MERGE(type) &&
+ !ovl_test_flag(OVL_WHITEOUTS, inode);
od->is_upper = OVL_TYPE_UPPER(type);
file->private_data = od;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 284/547] ovl: take a snapshot of the name for copy up
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 283/547] ovl: set OVL_WHITEOUTS before publishing the upper dir Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 285/547] ovl: use the pinned upper dir in ovl_fix_origin() Greg Kroah-Hartman
` (271 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 65bf000962a33ec9d2488e4e1797b6cf630abcbb upstream.
The copy up of a directory reads a freed dentry name when a lookup
moves the directory at the same time.
A pointer to the name of a dentry is only valid while something stops
a move of the dentry. ovl_do_copy_up() keeps a plain copy of
c->dentry->d_name in c->destname, and ovl_copy_up_start() only keeps
ovl_rename() away. When a lookup finds the same directory under another
name after a change to the lower layer, d_splice_alias() moves the
dentry and frees its external name.
With a delay in ovl_do_copy_up(), a chmod of a lower-only directory with
a 60 byte name raced with a rename of that directory in the lower layer
and a stat of the new name, and KASAN reported a use-after-free in
lookup_noperm_common().
Fix this by using take_dentry_name_snapshot() for c->destname.
Fixes: 829c28be9bb9 ("ovl: use d_splice_alias() in place of d_add() in lookup")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -935,6 +935,7 @@ static int ovl_do_copy_up(struct ovl_cop
struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
struct dentry *origin = c->lowerpath.dentry;
struct ovl_fh *fh = NULL;
+ struct name_snapshot name;
bool to_index = false;
/*
@@ -972,12 +973,15 @@ static int ovl_do_copy_up(struct ovl_cop
goto out_free_fh;
} else {
/*
- * c->dentry->d_name is stabilzed by ovl_copy_up_start(),
- * because if we got here, it means that c->dentry has no upper
- * alias and changing ->d_name means going through ovl_rename()
- * that will call ovl_copy_up() on source and target dentry.
+ * ovl_copy_up_start() keeps ovl_rename() away from c->dentry,
+ * because ovl_rename() calls ovl_copy_up() on source and target
+ * dentry. It does not stop d_splice_alias() from moving a
+ * directory that a lookup found under another name after a
+ * change to the lower layer. That move frees an external name,
+ * so take a snapshot.
*/
- c->destname = c->dentry->d_name;
+ take_dentry_name_snapshot(&name, c->dentry);
+ c->destname = name.name;
/*
* Mark parent "impure" because it may now contain non-pure
* upper
@@ -986,7 +990,7 @@ static int ovl_do_copy_up(struct ovl_cop
err = ovl_set_impure(c->parent, c->destdir);
ovl_end_write(c->dentry);
if (err)
- goto out_free_fh;
+ goto out;
}
/* Should we copyup with O_TMPFILE or with workdir? */
@@ -1020,6 +1024,8 @@ static int ovl_do_copy_up(struct ovl_cop
out:
if (to_index)
kfree(c->destname.name);
+ else
+ release_dentry_name_snapshot(&name);
out_free_fh:
kfree(fh);
return err;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 285/547] ovl: use the pinned upper dir in ovl_fix_origin()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 284/547] ovl: take a snapshot of the name for copy up Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 286/547] ovl: always encode the origin fh when index is enabled Greg Kroah-Hartman
` (270 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 4f61ff2ebfb3d2967b83b6a4d456242244d5a61f upstream.
Renames made directly on the upper filesystem during a lookup crash the
kernel.
A dentry that is passed to vfs_setxattr() must be pinned.
ovl_fix_origin() passes upper->d_parent to ovl_set_impure() without a
reference, and the lookup holds no lock of the upper directory. A
rename on the upper filesystem changes d_parent, and only the child
pins the new parent, so a second rename and an rmdir free it.
With delays in ovl_fix_origin() and ovl_set_impure(), renaming the upper
directory twice and removing the intermediate parent during the lookup
of a merge directory without an origin xattr gave a KASAN
use-after-free in vfs_setxattr().
Fix this by passing the upper dentry that the overlay parent holds.
Fixes: 9678e6303057 ("ovl: fix inconsistent d_ino for legacy merge dir")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: add helper ovl_set_impure_dir()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/namei.c | 6 ++++--
fs/overlayfs/overlayfs.h | 6 ++++++
2 files changed, 10 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -942,8 +942,10 @@ static int ovl_fix_origin(struct ovl_fs
goto out;
err = ovl_set_origin_fh(ofs, fh, upper);
- if (!err)
- err = ovl_set_impure(dentry->d_parent, upper->d_parent);
+ if (!err) {
+ /* upper->d_parent is not stable, use the overlay parent */
+ err = ovl_set_impure_dir(dentry->d_parent);
+ }
ovl_drop_write(dentry);
out:
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -572,6 +572,12 @@ int ovl_check_setxattr(struct ovl_fs *of
enum ovl_xattr ox, const void *value, size_t size,
int xerr);
int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
+
+static inline int ovl_set_impure_dir(struct dentry *dentry)
+{
+ return ovl_set_impure(dentry, ovl_dentry_upper(dentry));
+}
+
bool ovl_inuse_trylock(struct dentry *dentry);
void ovl_inuse_unlock(struct dentry *dentry);
bool ovl_is_inuse(struct dentry *dentry);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 286/547] ovl: always encode the origin fh when index is enabled
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 285/547] ovl: use the pinned upper dir in ovl_fix_origin() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 287/547] ovl: check that the parents of volatile/dirty are dirs Greg Kroah-Hartman
` (269 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 949f9d8a5580c77a45fa759123367682aba4d173 upstream.
On an overlay with index=on,nfs_export=on, copy up of a directory
crashes the kernel once an LSM has started to deny CAP_DAC_READ_SEARCH
to the mounter, the task that mounted the overlay. The mount and the LSM
policy change require root. After that, any user who can write to a
directory that exists only in a lower layer triggers the oops by doing
so.
Before a file or directory that exists only in a lower layer is changed
for the first time, overlayfs copies it to the writable upper layer.
This is called copy up.
On copy up, ovl_get_origin_fh() encodes the file handle of the lower
inode, called the origin. It returns NULL if ovl_can_decode_fh() says
that the lower filesystem cannot decode handles. Whether the callers can
handle NULL depends on the index option:
- Without an index, NULL is fine: the callers store an empty origin
xattr.
- With index enabled, overlayfs keeps entries for copied up inodes in an
internal index directory. The name of an index entry is derived from
the handle, so ovl_get_origin_fh() must return a handle or an error.
The mount only enables the index if ovl_can_decode_fh() succeeds for all
layers, but the result can change later. The function checks the export
operations of the filesystem and capable(CAP_DAC_READ_SEARCH). Copy up
runs with the mounter's credentials, and an LSM can start to deny the
capability to those credentials after the mount. ovl_get_origin_fh()
then returns NULL with index enabled.
This goes wrong in two callers:
- With nfs_export=on, copy up of a directory creates an index entry for
the directory. ovl_create_index() passes the NULL handle to
ovl_get_index_name_fh(), which dereferences it.
- If the result changes while mount(2) is still running,
ovl_get_indexdir() passes a NULL from ovl_get_origin_fh() to
ovl_verify_set_fh() in the same way.
Before the commit in the Fixes tag, these two callers encoded the handle
themselves, without consulting ovl_can_decode_fh().
Reproduced with a BPF LSM program that started to deny the capability
after the mount. An unprivileged touch in a directory that had not been
copied up yet oopsed in ovl_get_index_name_fh(). With this patch the
touch succeeds and the directory gets its index entry.
Fix this by calling ovl_can_decode_fh() in ovl_get_origin_fh() only when
index is disabled.
Fixes: 5b02bfc1e7e3 ("ovl: do not encode lower fh with upper sb_writers held")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -476,8 +476,12 @@ struct ovl_fh *ovl_get_origin_fh(struct
* When lower layer doesn't support export operations store a 'null' fh,
* so we can use the overlay.origin xattr to distignuish between a copy
* up and a pure upper inode.
+ *
+ * With index enabled, mount already found that all layers can decode
+ * file handles. Do not ask again, because an LSM may change its answer
+ * about CAP_DAC_READ_SEARCH and index users cannot cope with a 'null' fh.
*/
- if (!ovl_can_decode_fh(origin->d_sb))
+ if (!ofs->config.index && !ovl_can_decode_fh(origin->d_sb))
return NULL;
return ovl_encode_real_fh(ofs, d_inode(origin), false);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 287/547] ovl: check that the parents of volatile/dirty are dirs
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 286/547] ovl: always encode the origin fh when index is enabled Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 288/547] ovl: check the casefold flag of directories only Greg Kroah-Hartman
` (268 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit e34d2ef818e4c7676d8d8e1bf43e6a1ed39efb2a upstream.
An unprivileged user crashes the kernel by mounting overlayfs with the
volatile option.
A dentry that serves as the parent of a lookup must be a directory.
ovl_create_volatile_dirty() walks work/incompat/volatile/dirty by name,
and ovl_lookup_or_create() returns an existing entry whatever its type.
A file or a symlink that another task creates during the mount becomes
the parent of the next lookup, which calls a NULL ->lookup.
An unprivileged user mounted overlayfs with "volatile" in a user
namespace while a second process created a symlink named work/incompat,
and the mount task oopsed on a NULL ->lookup call.
Fix this by returning -ENOTDIR from ovl_lookup_or_create() when the
caller asked for a directory and the existing entry is a non-dir.
Fixes: c86243b090bc ("ovl: provide a mount option "volatile"")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -621,16 +621,21 @@ cleanup_temp:
static struct dentry *ovl_lookup_or_create(struct ovl_fs *ofs,
struct dentry *parent,
- const char *name, umode_t mode)
+ const char *name, bool is_dir)
{
struct dentry *child;
child = ovl_start_creating_upper(ofs, parent, &QSTR(name));
if (!IS_ERR(child)) {
- if (!child->d_inode)
+ if (!child->d_inode) {
child = ovl_create_real(ofs, parent, child,
&QSTR(name),
- OVL_CATTR(mode));
+ OVL_CATTR(is_dir ? S_IFDIR :
+ S_IFREG));
+ } else if (is_dir && !d_can_lookup(child)) {
+ end_creating(child);
+ child = ERR_PTR(-ENOTDIR);
+ }
end_creating_keep(child);
}
dput(parent);
@@ -652,7 +657,7 @@ static int ovl_create_volatile_dirty(str
const char *const *name = volatile_path;
for (ctr = ARRAY_SIZE(volatile_path); ctr; ctr--, name++) {
- d = ovl_lookup_or_create(ofs, d, *name, ctr > 1 ? S_IFDIR : S_IFREG);
+ d = ovl_lookup_or_create(ofs, d, *name, ctr > 1);
if (IS_ERR(d))
return PTR_ERR(d);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 288/547] ovl: check the casefold flag of directories only
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 287/547] ovl: check that the parents of volatile/dirty are dirs Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 289/547] ovl: do not copy up a dentry that was removed Greg Kroah-Hartman
` (267 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 1d27da7de3f74405b1de85ad26c5ea90f826114b upstream.
On an overlay over casefolded (case-insensitive) directories, every
lookup of a file that is not a directory fails with EREMOTE, and the
first file create triggers a kernel warning. No privilege is needed: an
unprivileged user can cause both in a user namespace, with the layers on
a tmpfs that they have mounted with the casefold option.
Some filesystems support casefolding, which is case-insensitive name
lookup. It is enabled per directory, and the inode of a casefolded
directory has the S_CASEFOLD flag.
overlayfs accepts layers on a filesystem that supports casefolding as
long as casefolding is enabled on every directory of the layers, or on
none. The mount records which of the two applies in ofs->casefold.
ovl_lookup_single() compares the S_CASEFOLD flag of each file that it
finds against ofs->casefold and returns -EREMOTE on a mismatch.
Filesystems only set S_CASEFOLD on directories, so with casefolded
layers a regular file, a symlink or a special file never matches and its
lookup fails.
ovl_get_inode() does the same comparison in a WARN_ON_ONCE() for each
new overlay inode. A failed lookup never gets that far, so it is the
first file create that trips the warning.
Reproduced on an overlay over casefolded tmpfs or ext4 directories, with
stat() of a regular file, a symlink and a FIFO, and with a file create:
each stat() failed with EREMOTE. For an unprivileged user in a user
namespace, on tmpfs, stat() of a regular file failed in the same way,
and the file create triggered the warning.
Fix this by limiting both checks to directories.
Fixes: 16754d61dc69 ("ovl: Support mounting case-insensitive enabled layers")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 2 +-
fs/overlayfs/namei.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -1279,7 +1279,7 @@ struct inode *ovl_get_inode(struct super
}
ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev);
ovl_inode_init(inode, oip, ino, fsid);
- WARN_ON_ONCE(!!IS_CASEFOLDED(inode) != ofs->casefold);
+ WARN_ON_ONCE(is_dir && !!IS_CASEFOLDED(inode) != ofs->casefold);
if (upperdentry && ovl_is_impuredir(sb, upperdentry))
ovl_set_flag(OVL_IMPURE, inode);
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -266,7 +266,8 @@ static int ovl_lookup_single(struct dent
goto out_err;
}
- if (ofs->casefold != ovl_dentry_casefolded(this)) {
+ /* Filesystems set the casefold flag only on directories */
+ if (d_is_dir(this) && ofs->casefold != ovl_dentry_casefolded(this)) {
warn = "child wrong casefold";
err = -EREMOTE;
goto out_warn;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 289/547] ovl: do not copy up a dentry that was removed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 288/547] ovl: check the casefold flag of directories only Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 290/547] ovl: do not copy up an xattr value that was never read Greg Kroah-Hartman
` (266 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit f635192ad223d2009ee640b63adf5ce3198aa338 upstream.
A change to a removed file through an open descriptor replaces whatever
has its old name in the upper layer.
Copy up must only create a name in the upper directory, never replace
one. After an unlink, an rmdir or a rename over a lower dentry, a
dentry that an open file keeps alive still has its old parent and name,
but in the upper directory that name is now a whiteout or a new object.
ovl_copy_up_workdir() renames the copy over it, which brings back the
removed object and destroys whatever took its name.
An unprivileged user opened a lower FIFO and unlinked it, root created
a file at that name, and fchmod on the old descriptor replaced the file
of root with the FIFO.
Fix this by looking up the target name of the rename in
ovl_copy_up_workdir() with LOOKUP_EXCL, so that copy up fails with
-EEXIST if the name is taken, as copy up with O_TMPFILE already does
when it links the copy to the name.
Fixes: e9be9d5e76e3 ("overlay filesystem")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: use LOOKUP_EXCL instead of relying on d_unhashed()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -812,9 +812,10 @@ static int ovl_copy_up_workdir(struct ov
rd.old_parent = c->workdir;
rd.new_parent = c->destdir;
rd.flags = 0;
- err = start_renaming_dentry(&rd, 0, temp,
+ /* The name may have been taken since lookup, never replace it */
+ err = start_renaming_dentry(&rd, LOOKUP_EXCL, temp,
&QSTR_LEN(c->destname.name, c->destname.len));
- if (err) {
+ if (err && err != -EEXIST) {
/* temp or workdir moved underneath us? map to -EIO */
err = -EIO;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 290/547] ovl: do not copy up an xattr value that was never read
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 289/547] ovl: do not copy up a dentry that was removed Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 291/547] ovl: fix a torn path in ovl_get_redirect() Greg Kroah-Hartman
` (265 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fahad Alharbi, Chris Mason,
Josef Bacik, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 755b5c5c9277be251a51623d6065abab948c61bc upstream.
Copy-up stores uninitialized kernel memory in an xattr of the upper
file, where the user can read it.
ovl_copy_xattr() may only pass bytes to ovl_do_setxattr() that
ovl_do_getxattr() has read. When the read fails with -ERANGE the
function asks for the size again, and if the new size fits the buffer
it stores the buffer although nothing was read into it. The buffer
comes from kvmalloc(), or it still holds the value of the previous
xattr.
A FUSE lower layer that answers every sized GETXATTR with -ERANGE made
copy-up store 4096 bytes that the server never sent, with a kernel
pointer in them, as an xattr of the upper file.
Fix this by failing the copy-up with -EIO when the size that follows
-ERANGE fits the buffer.
Reported-by: Fahad Alharbi <fahad@codepure.com>
Closes: https://lore.kernel.org/linux-fsdevel/CAOQ4uxjhfpNVvoVrTayj46H2CViTOc3oxzM6xdb8+E7ikE2CSA@mail.gmail.com/
Fixes: e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -131,8 +131,12 @@ int ovl_copy_xattr(struct super_block *s
retry:
size = ovl_do_getxattr(oldpath, name, value, value_size);
- if (size == -ERANGE)
+ if (size == -ERANGE) {
size = ovl_do_getxattr(oldpath, name, NULL, 0);
+ /* Nothing was read into value, so it must not be used */
+ if (size >= 0 && size <= value_size)
+ size = -EIO;
+ }
if (size < 0) {
error = size;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 291/547] ovl: fix a torn path in ovl_get_redirect()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 290/547] ovl: do not copy up an xattr value that was never read Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 292/547] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN Greg Kroah-Hartman
` (264 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Josef Bacik,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 2001cd7ca5560198131e46c6ca3c3472b06145c2 upstream.
A hard link of a metacopy file that races with a rename of an ancestor
stores a redirect to the wrong lower file.
Each component of an absolute redirect must be the name that a dentry
has in the parent that the walk continues with. ovl_get_redirect()
copies the name under d_lock and calls dget_parent() after the unlock,
and the callers for a hard link hold no lock that stops a rename across
directories. A rename between the two steps combines the old name with
the new parent.
With delays in ovl_get_redirect(), an unprivileged user hard-linked a
metacopy file while renaming its ancestor to another directory, the
stored redirect named another lower path, and after a remount the file
showed the data of a root-only file.
Fix this by taking the parent first and checking it again under d_lock.
Fixes: e04527fefba6 ("ovl: fix dentry leak in ovl_get_redirect")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/dir.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1027,7 +1027,19 @@ static char *ovl_get_redirect(struct den
const char *name;
int thislen;
+ /*
+ * A rename can move d to another directory at any time. Hold
+ * d_lock to copy the name that d has in this very parent, or
+ * else the path mixes the old name with the new parent.
+ */
+ tmp = dget_parent(d);
spin_lock(&d->d_lock);
+ if (unlikely(tmp != d->d_parent)) {
+ spin_unlock(&d->d_lock);
+ dput(tmp);
+ continue;
+ }
+
name = ovl_dentry_get_redirect(d);
if (name) {
thislen = strlen(name);
@@ -1040,13 +1052,13 @@ static char *ovl_get_redirect(struct den
if (thislen + (name[0] != '/') > buflen) {
ret = ERR_PTR(-EXDEV);
spin_unlock(&d->d_lock);
+ dput(tmp);
goto out_put;
}
buflen -= thislen;
memcpy(&buf[buflen], name, thislen);
spin_unlock(&d->d_lock);
- tmp = dget_parent(d);
dput(d);
d = tmp;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 292/547] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 291/547] ovl: fix a torn path in ovl_get_redirect() Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 293/547] ovl: fortify ovl_copy_xattr() against underlying layer modifications Greg Kroah-Hartman
` (263 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Disha Goel,
Christian Brauner (Amutable), Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
commit 333ad304d4794d6384087ea7fc16e58ab642809b upstream.
When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG,
"override_creds"), overlayfs saves those restricted credentials in
ofs->creator_cred. ovl_fill_super() then wraps the entire mount setup in
with_ovl_creds(), switching to those restricted credentials for the
duration.
Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN
against current credentials. With restricted credentials active, this
check fails with -EPERM even though the task issuing
FSCONFIG_CMD_CREATE is fully privileged.
Use the mounter's real credentials only for cloning the private layer
mounts. Keep all other backing filesystem operations during mount setup
under the stashed credentials.
Reported-by: Disha Goel <disgoel@linux.ibm.com>
Closes: https://lore.kernel.org/linux-unionfs/20260924112858.51392-1-disgoel@linux.ibm.com
Fixes: c28f922c9dcee ("clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -497,6 +497,20 @@ static int ovl_report_in_use(struct ovl_
}
}
+/*
+ * clone_private_mount() checks CAP_SYS_ADMIN in current->cred.
+ * ovl_fill_super_creds() runs under the stashed creator cred, which
+ * override_creds may have dropped.
+ * The task that issued FSCONFIG_CMD_CREATE is still current->real_cred, so
+ * use that only for the clone. creator_cred stays in effect for every other
+ * backing-fs operation.
+ */
+static struct vfsmount *ovl_clone_private_mount(const struct path *path)
+{
+ scoped_with_creds(current_real_cred())
+ return clone_private_mount(path);
+}
+
static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
struct ovl_layer *upper_layer,
const struct path *upperpath)
@@ -520,7 +534,7 @@ static int ovl_get_upper(struct super_bl
if (err)
goto out;
- upper_mnt = clone_private_mount(upperpath);
+ upper_mnt = ovl_clone_private_mount(upperpath);
err = PTR_ERR(upper_mnt);
if (IS_ERR(upper_mnt)) {
pr_err("failed to clone upperpath\n");
@@ -1098,7 +1112,7 @@ static int ovl_get_layers(struct super_b
}
}
- mnt = clone_private_mount(&l->path);
+ mnt = ovl_clone_private_mount(&l->path);
err = PTR_ERR(mnt);
if (IS_ERR(mnt)) {
pr_err("failed to clone lowerpath\n");
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 293/547] ovl: fortify ovl_copy_xattr() against underlying layer modifications
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 292/547] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 294/547] ovl: read the nlink xattr of every indexed non-dir Greg Kroah-Hartman
` (262 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fahad Alharbi, Miklos Szeredi,
Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
commit e6b9117076fb4c0ff4a670efa9c876d9a50d79ab upstream.
Adapt ovl_getxattr_value() to be used from ovl_copy_xattr(), by
allowing to pass it a pre-allocated buffer, which can be resized
and by handling the ENODATA/EOPNOTSUPP return codes in the caller.
This replaces the retry loop in ovl_copy_xattr() with a single retry
after resizing the buffer. If the value changed again by then, the
underlying layer was modified, so return -EIO instead of retrying.
As a side effect, ovl_copy_up_meta_inode_data() now returns -EIO instead
of -ERANGE in this case of underlying xattr size changes.
Reported-by: Fahad Alharbi <fahad@codepure.com>
Tested-by: Fahad Alharbi <fahad@codepure.com>
Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
Link: https://lore.kernel.org/linux-fsdevel/CAJfpegsVoUyqy0dYkTvBGRZvgdv_nmzmCw_uF+LP-Vq3EhEkSg@mail.gmail.com/
Fixes: e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")
Cc: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 68 +++++++++++++++++++++++--------------------------
1 file changed, 32 insertions(+), 36 deletions(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -72,6 +72,9 @@ static int ovl_copy_acl(struct ovl_fs *o
return err;
}
+static ssize_t ovl_getxattr_value(const struct path *path, char *name,
+ char **value, ssize_t *value_size);
+
int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct dentry *new)
{
struct dentry *old = oldpath->dentry;
@@ -129,34 +132,12 @@ int ovl_copy_xattr(struct super_block *s
break;
}
-retry:
- size = ovl_do_getxattr(oldpath, name, value, value_size);
- if (size == -ERANGE) {
- size = ovl_do_getxattr(oldpath, name, NULL, 0);
- /* Nothing was read into value, so it must not be used */
- if (size >= 0 && size <= value_size)
- size = -EIO;
- }
-
+ size = ovl_getxattr_value(oldpath, name, &value, &value_size);
if (size < 0) {
error = size;
break;
}
- if (size > value_size) {
- void *new;
-
- new = kvmalloc(size, GFP_KERNEL);
- if (!new) {
- error = -ENOMEM;
- break;
- }
- kvfree(value);
- value = new;
- value_size = size;
- goto retry;
- }
-
error = ovl_do_setxattr(OVL_FS(sb), new, name, value, size, 0);
if (error) {
if (error != -EOPNOTSUPP || ovl_must_copy_xattr(name))
@@ -1070,26 +1051,39 @@ static bool ovl_need_meta_copy_up(struct
return true;
}
-static ssize_t ovl_getxattr_value(const struct path *path, char *name, char **value)
+static ssize_t ovl_getxattr_value(const struct path *path, char *name,
+ char **value, ssize_t *value_size)
{
ssize_t res;
char *buf;
- res = ovl_do_getxattr(path, name, NULL, 0);
- if (res == -ENODATA || res == -EOPNOTSUPP)
- res = 0;
+ res = ovl_do_getxattr(path, name, *value, *value_size);
+ if (res == -ERANGE) {
+ res = ovl_do_getxattr(path, name, NULL, 0);
+ /* Xattr changed underneath us? */
+ if (res >= 0 && res <= *value_size)
+ return -EIO;
+ }
- if (res > 0) {
- buf = kzalloc(res, GFP_KERNEL);
+ if (res > *value_size) {
+ buf = kvmalloc(res, GFP_KERNEL);
if (!buf)
return -ENOMEM;
res = ovl_do_getxattr(path, name, buf, res);
- if (res < 0)
- kfree(buf);
- else
- *value = buf;
+ if (res < 0) {
+ kvfree(buf);
+ /* Xattr changed underneath us? */
+ if (res == -ERANGE)
+ return -EIO;
+ return res;
+ }
+
+ kvfree(*value);
+ *value = buf;
+ *value_size = res;
}
+
return res;
}
@@ -1100,7 +1094,7 @@ static int ovl_copy_up_meta_inode_data(s
struct path upperpath;
int err;
char *capability = NULL;
- ssize_t cap_size;
+ ssize_t cap_size = 0;
ovl_path_upper(c->dentry, &upperpath);
if (WARN_ON(upperpath.dentry == NULL))
@@ -1108,7 +1102,9 @@ static int ovl_copy_up_meta_inode_data(s
if (c->stat.size) {
err = cap_size = ovl_getxattr_value(&upperpath, XATTR_NAME_CAPS,
- &capability);
+ &capability, &cap_size);
+ if (cap_size == -ENODATA || cap_size == -EOPNOTSUPP)
+ cap_size = 0;
if (cap_size < 0)
goto out;
}
@@ -1138,7 +1134,7 @@ static int ovl_copy_up_meta_inode_data(s
ovl_clear_flag(OVL_VERIFIED_DIGEST, d_inode(c->dentry));
ovl_set_upperdata(d_inode(c->dentry));
out_free:
- kfree(capability);
+ kvfree(capability);
out:
return err;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 294/547] ovl: read the nlink xattr of every indexed non-dir
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 293/547] ovl: fortify ovl_copy_xattr() against underlying layer modifications Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 295/547] ovl: reserve space for the casefolded name terminator Greg Kroah-Hartman
` (261 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit eb644ed5c6d9afdb1554c41cef1f39d150fbc554 upstream.
With nfs_export=on, data written through a file handle to a lower file,
i.e. a file that exists only in a lower layer of the overlay, can be
lost on the next mount. A lookup of the file by name then returns -EIO.
Also, a file with one name reports st_nlink 2 once it has been copied to
the upper layer. After such a file is removed, its file handle can still
open it until the next mount.
Before a lower file is changed for the first time, overlayfs copies it
to the writable upper layer. This is called copy up.
The index directory is $workdir/index, where $workdir is the directory
given by the workdir= option. Each entry is named after the file handle
of a lower inode, so that overlayfs can get from the handle to the
copied up inode.
With nfs_export=on, copy up indexes every non-directory: it copies the
file to an entry in the index directory and then hard links that entry
into the upper directory. The index entry is an extra link to the upper
inode, so overlayfs stores the link count that users should see in the
overlay.nlink xattr.
A file can also be opened by handle, either by an NFS client or by a
process with CAP_DAC_READ_SEARCH calling open_by_handle_at(). If the
file is not in the dcache, its overlay dentry is disconnected, i.e. it
has no parent yet. Copy up then creates the index entry but no hard link
in the upper directory. The index entry has i_nlink 1 and holds the only
copy of the data written to the file.
ovl_get_nlink() reads the stored count. Its caller passes a default,
which the function returns if there is no stored count. If the lower
inode has i_nlink 1, the function returns the default without reading
the xattr. That was correct as long as only lower files with multiple
links were indexed.
On the next mount, ovl_verify_index() looks for orphans, i.e. index
entries of files whose last name was removed. For an index entry with
i_nlink 1, it passes a default of 0 to ovl_get_nlink() and treats a
result of 0 as an orphan. Here the lower inode also has i_nlink 1, so
the result is the default. ovl_indexdir_cleanup() then replaces the
entry with a whiteout, which in the index marks a file as deleted. The
written data is lost.
A lookup by name then returns -EIO, because a whiteout as the index
entry of a lower file that still exists is a bad index.
ovl_get_inode() gets the wrong count the same way. Its default is the
i_nlink of the upper inode, which includes the index entry, so a copied
up file with one name reports st_nlink 2.
When that name is removed, the count drops to 1 rather than 0.
ovl_nlink_end() replaces the index entry with a whiteout only at a count
of 0, so the entry stays, and the handle of the removed file still opens
it.
Reproduced by writing through open_by_handle_at() to an uncached lower
file with one link. After a remount the data was lost, and the name
returned EIO.
Fix this by adding an argument to ovl_get_nlink() that says whether the
caller found an index entry, and by skipping the xattr only if the
caller found none.
Known gaps:
- An index entry that a kernel without this patch left behind for a
removed file now stays, and the handle of that file keeps working. The
entry has i_nlink 1 and a stored count of 1, just like the entry of a
file that was only written by handle. Without this patch, the next
mount treated it as an orphan.
Fixes: fbd2d2074bde ("ovl: index all non-dir on copy up for NFS export")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 14 +++++++++++---
fs/overlayfs/namei.c | 2 +-
fs/overlayfs/overlayfs.h | 2 +-
3 files changed, 13 insertions(+), 5 deletions(-)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -999,7 +999,7 @@ int ovl_set_nlink_lower(struct dentry *d
}
unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry,
- struct dentry *upperdentry,
+ struct dentry *upperdentry, bool indexed,
unsigned int fallback)
{
int nlink_diff;
@@ -1007,7 +1007,15 @@ unsigned int ovl_get_nlink(struct ovl_fs
char buf[13];
int err;
- if (!lowerdentry || !upperdentry || d_inode(lowerdentry)->i_nlink == 1)
+ if (!lowerdentry || !upperdentry)
+ return fallback;
+
+ /*
+ * A lower inode with one link is not indexed on copy up, unless all
+ * files are indexed for NFS export. If the caller found an index entry,
+ * then the xattr holds the union nlink, whatever the lower nlink is.
+ */
+ if (!indexed && d_inode(lowerdentry)->i_nlink == 1)
return fallback;
err = ovl_getxattr_upper(ofs, upperdentry, OVL_XATTR_NLINK,
@@ -1264,7 +1272,7 @@ struct inode *ovl_get_inode(struct super
/* Recalculate nlink for non-dir due to indexing */
if (!is_dir)
nlink = ovl_get_nlink(ofs, lowerdentry, upperdentry,
- nlink);
+ oip->index, nlink);
set_nlink(inode, nlink);
ino = key->i_ino;
} else {
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -713,7 +713,7 @@ int ovl_verify_index(struct ovl_fs *ofs,
if (err)
goto fail;
- if (ovl_get_nlink(ofs, origin.dentry, index, 0) == 0)
+ if (ovl_get_nlink(ofs, origin.dentry, index, true, 0) == 0)
goto orphan;
}
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -808,7 +808,7 @@ static inline bool ovl_dir_is_real(struc
int ovl_set_nlink_upper(struct dentry *dentry);
int ovl_set_nlink_lower(struct dentry *dentry);
unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry,
- struct dentry *upperdentry,
+ struct dentry *upperdentry, bool indexed,
unsigned int fallback);
int ovl_permission(struct mnt_idmap *idmap, struct inode *inode,
int mask);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 295/547] ovl: reserve space for the casefolded name terminator
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 294/547] ovl: read the nlink xattr of every indexed non-dir Greg Kroah-Hartman
@ 2026-11-04 21:07 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 296/547] ovl: set the revalidate flags after d_instantiate() Greg Kroah-Hartman
` (260 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hungyu Lin, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hungyu Lin <dennylin0707@gmail.com>
commit a65eb1808177a4381718abe563dddebf840598f9 upstream.
ovl_casefold() allocates NAME_MAX bytes and passes that capacity to
utf8_casefold(), which also needs room for a terminating NUL. A valid
name whose folded form is exactly NAME_MAX bytes therefore fails to
fold, and ovl_fill_merge() falls back to comparing the original bytes.
For example, when two casefolded layers contain directories named with
255 uppercase and lowercase ASCII letters respectively, readdir lists
both names even though lookup treats them as the same directory. The
same names merge correctly at 254 bytes.
Reserve one additional byte in both the allocation and the folding
capacity so that NAME_MAX-byte folded names use the canonical merge key.
Fixes: ee95c5fc86dd ("ovl: Create ovl_casefold() to support casefolded strncmp()")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/readdir.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -81,13 +81,13 @@ static int ovl_casefold(struct ovl_readd
name_is_dot_dotdot(str, len))
return 0;
- cf_name = kmalloc(NAME_MAX, GFP_KERNEL);
+ cf_name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
if (!cf_name) {
rdd->err = -ENOMEM;
return -ENOMEM;
}
- cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX);
+ cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX + 1);
if (cf_len > 0)
*dst = cf_name;
else
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 296/547] ovl: set the revalidate flags after d_instantiate()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-11-04 21:07 ` [PATCH 7.3 295/547] ovl: reserve space for the casefolded name terminator Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 297/547] ovl: skip copy up of empty security.capability Greg Kroah-Hartman
` (259 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 75e89c0055c1d7f7eeb462995f11253ca5864f79 upstream.
stat() of a file on an overlayfs mount triggers a kernel warning and
fails with ECHILD if another task is creating that file at the same
time. This happens on an overlay with a FUSE upper layer, which is the
layer where overlayfs creates new files. Write access to a directory on
such an overlay is all a user needs to run the two tasks.
The revalidate flags are DCACHE_OP_REVALIDATE and
DCACHE_OP_WEAK_REVALIDATE. They tell path walk to call ->d_revalidate()
or ->d_weak_revalidate() on a dentry, so that the filesystem can check
that the cached dentry is still valid. An overlay dentry only has one of
these flags if a dentry in one of its layers has it. FUSE dentries have
the first one.
When a flag is set on an overlay dentry, path walk calls
ovl_dentry_revalidate_common(). That function only expects a dentry
without an inode in RCU walk, while the dentry is being destroyed. For
such a dentry outside of RCU walk, it hits a WARN_ON() and
returns -ECHILD. So a negative overlay dentry must never have the flags
set.
ovl_instantiate() breaks this rule. When a task creates a file, the
overlay dentry for the new name is hashed but still negative.
ovl_instantiate() then works in this order:
- It copies the flags from the new upper dentry to the overlay dentry.
- It calls ovl_get_inode(), which can sleep in a getxattr request to the
FUSE server.
- Only then does it call d_instantiate().
A second task that looks up the name between the first step and the last
finds a negative dentry with the flags set and revalidates it.
Reproduced with a FUSE server that delays its getxattr reply: stat() of
a name that was being created hit the WARN_ON() and failed with ECHILD.
Fix this by setting the flags after d_instantiate().
Fixes: bccece1ead36 ("ovl: allow remote upper")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/dir.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -304,7 +304,6 @@ static int ovl_instantiate(struct dentry
};
ovl_dentry_set_upper_alias(dentry);
- ovl_dentry_init_reval(dentry, newdentry, NULL);
if (!hardlink) {
/*
@@ -335,6 +334,13 @@ static int ovl_instantiate(struct dentry
d_mark_tmpfile(tmpfile, inode);
d_instantiate(dentry, inode);
+ /*
+ * Unless it is a tmpfile, the dentry is hashed and a path walk can find
+ * it at any time. Set the revalidate flags only now, because
+ * ovl_dentry_revalidate_common() does not expect them on a negative
+ * dentry.
+ */
+ ovl_dentry_init_reval(dentry, ovl_dentry_upper(dentry), NULL);
if (inode != oip.newinode) {
pr_warn_ratelimited("newly created inode found in cache (%pd2)\n",
dentry);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 297/547] ovl: skip copy up of empty security.capability
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 296/547] ovl: set the revalidate flags after d_instantiate() Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 298/547] xfs: clear the symlink zapped flag if inline symlink is ok Greg Kroah-Hartman
` (258 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Amir Goldstein
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
commit 50912a1715b8a7c614b654011a0db750e372b43e upstream.
ovl_copy_xattr() gives up if it can't read an attribute that
listxattr() has named. An empty security.capability, which anybody has
been able to store on any file for a long time, is such a case: it is
listed, and getxattr() has nothing to return for it. A file in a lower
layer that carries one can't be copied up: it can't be written to,
renamed or have its mode changed.
There is nothing to copy if there are no data. Go on with the next
one.
Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
Cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: treat -EINVAL as no capability too, and do the same in
ovl_copy_up_meta_inode_data()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -75,6 +75,15 @@ static int ovl_copy_acl(struct ovl_fs *o
static ssize_t ovl_getxattr_value(const struct path *path, char *name,
char **value, ssize_t *value_size);
+/*
+ * Any user can store an empty security.capability, which fails to read with
+ * -EINVAL. It grants no capability, so treat it as none, like no xattr.
+ */
+static bool ovl_no_fscap(ssize_t err)
+{
+ return err == -ENODATA || err == -EOPNOTSUPP || err == -EINVAL;
+}
+
int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct dentry *new)
{
struct dentry *old = oldpath->dentry;
@@ -134,6 +143,10 @@ int ovl_copy_xattr(struct super_block *s
size = ovl_getxattr_value(oldpath, name, &value, &value_size);
if (size < 0) {
+ if (!strcmp(name, XATTR_NAME_CAPS) && ovl_no_fscap(size)) {
+ error = 0;
+ continue;
+ }
error = size;
break;
}
@@ -1103,9 +1116,9 @@ static int ovl_copy_up_meta_inode_data(s
if (c->stat.size) {
err = cap_size = ovl_getxattr_value(&upperpath, XATTR_NAME_CAPS,
&capability, &cap_size);
- if (cap_size == -ENODATA || cap_size == -EOPNOTSUPP)
+ if (ovl_no_fscap(cap_size))
cap_size = 0;
- if (cap_size < 0)
+ else if (cap_size < 0)
goto out;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 298/547] xfs: clear the symlink zapped flag if inline symlink is ok
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 297/547] ovl: skip copy up of empty security.capability Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 299/547] xfs: mark cow extents bad if theres no rmap mapping for them Greg Kroah-Hartman
` (257 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit f8d0d90f2e24b1f4a14796ae63cebfd820cadfcd upstream.
LOLLM noticed that we fail to clear the SYMLINK_ZAPPED flag if an inline
symlink checks out ok, even after a repair. Fix that.
Cc: stable@vger.kernel.org # v6.8
Fixes: d9041681dd2f53 ("xfs: set inode sick state flags when we zap either ondisk fork")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/symlink.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
--- a/fs/xfs/scrub/symlink.c
+++ b/fs/xfs/scrub/symlink.c
@@ -70,21 +70,20 @@ xchk_symlink(
return 0;
}
- /* Inline symlink? */
if (ifp->if_format == XFS_DINODE_FMT_LOCAL) {
+ /* Inline symlink? */
if (len > xfs_inode_data_fork_size(ip) ||
len > strnlen(ifp->if_data, xfs_inode_data_fork_size(ip)))
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
- return 0;
+ } else {
+ /* Remote symlink; must read the contents. */
+ error = xfs_symlink_remote_read(sc->ip, sc->buf);
+ if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
+ return error;
+ if (strnlen(sc->buf, XFS_SYMLINK_MAXLEN) < len)
+ xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
}
- /* Remote symlink; must read the contents. */
- error = xfs_symlink_remote_read(sc->ip, sc->buf);
- if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
- return error;
- if (strnlen(sc->buf, XFS_SYMLINK_MAXLEN) < len)
- xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
-
/* If a remote symlink is clean, it is clearly not zapped. */
xchk_mark_healthy_if_clean(sc, XFS_SICK_INO_SYMLINK_ZAPPED);
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 299/547] xfs: mark cow extents bad if theres no rmap mapping for them
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 298/547] xfs: clear the symlink zapped flag if inline symlink is ok Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 300/547] xfs: compute the correct fdblocks/frextents for repair when theyre negative Greg Kroah-Hartman
` (256 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 2ffc0619c9c2881443c5fffb10db8f2bc0aa2ce8 upstream.
LOLLM noticed that we fail to mark cow staging extents as bad if there's
a cow staging extent but no rmap record for the cow staging event.
Close this gap.
Cc: stable@vger.kernel.org # v6.8
Fixes: dbbdbd0086320a ("xfs: repair problems in CoW forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/cow_repair.c | 84 ++++++++++++++++++++++++++++++----------------
1 file changed, 55 insertions(+), 29 deletions(-)
--- a/fs/xfs/scrub/cow_repair.c
+++ b/fs/xfs/scrub/cow_repair.c
@@ -200,29 +200,35 @@ xrep_cow_mark_missing_staging_rmap(
void *priv)
{
struct xrep_cow *xc = priv;
- xfs_agblock_t rec_bno;
- xfs_extlen_t rec_len;
- unsigned int adj;
-
- if (rec->rm_owner == XFS_RMAP_OWN_COW)
- return 0;
+ const xfs_agblock_t rec_end =
+ rec->rm_startblock + rec->rm_blockcount;
+ int error = 0;
- rec_bno = rec->rm_startblock;
- rec_len = rec->rm_blockcount;
- if (rec_bno < xc->irec_startbno) {
- adj = xc->irec_startbno - rec_bno;
- rec_len -= adj;
- rec_bno += adj;
+ /* Was there a gap since the last rmap? */
+ if (xc->next_bno < rec->rm_startblock) {
+ error = xrep_cow_mark_file_range(xc,
+ xfs_gbno_to_fsb(cur->bc_group, xc->next_bno),
+ rec->rm_startblock - xc->next_bno);
+ if (error)
+ return error;
}
- if (rec_bno + rec_len > xc->irec_startbno + xc->irec.br_blockcount) {
- adj = (rec_bno + rec_len) -
- (xc->irec_startbno + xc->irec.br_blockcount);
- rec_len -= adj;
+ if (rec->rm_owner != XFS_RMAP_OWN_COW) {
+ const xfs_agblock_t bad_bno =
+ max(xc->irec_startbno, rec->rm_startblock);
+ const xfs_agblock_t irec_end =
+ xc->irec_startbno + xc->irec.br_blockcount;
+ const xfs_extlen_t bad_end = min(irec_end, rec_end);
+
+ error = xrep_cow_mark_file_range(xc,
+ xfs_gbno_to_fsb(cur->bc_group, bad_bno),
+ bad_end - bad_bno);
+ if (error)
+ return error;
}
- return xrep_cow_mark_file_range(xc,
- xfs_gbno_to_fsb(cur->bc_group, rec_bno), rec_len);
+ xc->next_bno = max(xc->next_bno, rec_end);
+ return error;
}
/*
@@ -263,10 +269,12 @@ xrep_cow_find_bad(
struct xfs_perag *pag;
struct xfs_scrub *sc = xc->sc;
xfs_agnumber_t agno;
+ xfs_agblock_t irec_end;
int error;
agno = XFS_FSB_TO_AGNO(sc->mp, xc->irec.br_startblock);
xc->irec_startbno = XFS_FSB_TO_AGBNO(sc->mp, xc->irec.br_startblock);
+ irec_end = xc->irec_startbno + xc->irec.br_blockcount;
pag = xfs_perag_get(sc->mp, agno);
if (!pag)
@@ -278,7 +286,7 @@ xrep_cow_find_bad(
/* Mark any CoW fork extents that are shared. */
rc_low.rc_startblock = xc->irec_startbno;
- rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+ rc_high.rc_startblock = irec_end - 1;
rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_SHARED;
error = xfs_refcount_query_range(sc->sa.refc_cur, &rc_low, &rc_high,
xrep_cow_mark_shared_staging, xc);
@@ -287,7 +295,7 @@ xrep_cow_find_bad(
/* Make sure there are CoW staging extents for the whole mapping. */
rc_low.rc_startblock = xc->irec_startbno;
- rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+ rc_high.rc_startblock = irec_end - 1;
rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_COW;
xc->next_bno = xc->irec_startbno;
error = xfs_refcount_query_range(sc->sa.refc_cur, &rc_low, &rc_high,
@@ -295,11 +303,10 @@ xrep_cow_find_bad(
if (error)
goto out_sa;
- if (xc->next_bno < xc->irec_startbno + xc->irec.br_blockcount) {
+ if (xc->next_bno < irec_end) {
error = xrep_cow_mark_file_range(xc,
xfs_agbno_to_fsb(pag, xc->next_bno),
- xc->irec_startbno + xc->irec.br_blockcount -
- xc->next_bno);
+ irec_end - xc->next_bno);
if (error)
goto out_sa;
}
@@ -308,11 +315,20 @@ xrep_cow_find_bad(
rm_low.rm_startblock = xc->irec_startbno;
memset(&rm_high, 0xFF, sizeof(rm_high));
rm_high.rm_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+ xc->next_bno = xc->irec_startbno;
error = xfs_rmap_query_range(sc->sa.rmap_cur, &rm_low, &rm_high,
xrep_cow_mark_missing_staging_rmap, xc);
if (error)
goto out_sa;
+ if (xc->next_bno < irec_end) {
+ error = xrep_cow_mark_file_range(xc,
+ xfs_agbno_to_fsb(pag, xc->next_bno),
+ irec_end - xc->next_bno);
+ if (error)
+ goto out_sa;
+ }
+
/*
* If userspace is forcing us to rebuild the CoW fork or someone turned
* on the debugging knob, replace everything in the CoW fork.
@@ -344,9 +360,11 @@ xrep_cow_find_bad_rt(
struct xfs_rmap_irec rm_high = { 0 };
struct xfs_scrub *sc = xc->sc;
struct xfs_rtgroup *rtg;
+ xfs_agblock_t irec_end;
int error = 0;
xc->irec_startbno = xfs_rtb_to_rgbno(sc->mp, xc->irec.br_startblock);
+ irec_end = xc->irec_startbno + xc->irec.br_blockcount;
rtg = xfs_rtgroup_get(sc->mp,
xfs_rtb_to_rgno(sc->mp, xc->irec.br_startblock));
@@ -360,7 +378,7 @@ xrep_cow_find_bad_rt(
/* Mark any CoW fork extents that are shared. */
rc_low.rc_startblock = xc->irec_startbno;
- rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+ rc_high.rc_startblock = irec_end - 1;
rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_SHARED;
error = xfs_refcount_query_range(sc->sr.refc_cur, &rc_low, &rc_high,
xrep_cow_mark_shared_staging, xc);
@@ -369,7 +387,7 @@ xrep_cow_find_bad_rt(
/* Make sure there are CoW staging extents for the whole mapping. */
rc_low.rc_startblock = xc->irec_startbno;
- rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+ rc_high.rc_startblock = irec_end - 1;
rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_COW;
xc->next_bno = xc->irec_startbno;
error = xfs_refcount_query_range(sc->sr.refc_cur, &rc_low, &rc_high,
@@ -377,11 +395,10 @@ xrep_cow_find_bad_rt(
if (error)
goto out_sr;
- if (xc->next_bno < xc->irec_startbno + xc->irec.br_blockcount) {
+ if (xc->next_bno < irec_end) {
error = xrep_cow_mark_file_range(xc,
xfs_rgbno_to_rtb(rtg, xc->next_bno),
- xc->irec_startbno + xc->irec.br_blockcount -
- xc->next_bno);
+ irec_end - xc->next_bno);
if (error)
goto out_sr;
}
@@ -389,12 +406,21 @@ xrep_cow_find_bad_rt(
/* Mark any area has an rmap that isn't a COW staging extent. */
rm_low.rm_startblock = xc->irec_startbno;
memset(&rm_high, 0xFF, sizeof(rm_high));
- rm_high.rm_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+ rm_high.rm_startblock = irec_end - 1;
+ xc->next_bno = xc->irec_startbno;
error = xfs_rmap_query_range(sc->sr.rmap_cur, &rm_low, &rm_high,
xrep_cow_mark_missing_staging_rmap, xc);
if (error)
goto out_sr;
+ if (xc->next_bno < irec_end) {
+ error = xrep_cow_mark_file_range(xc,
+ xfs_rgbno_to_rtb(rtg, xc->next_bno),
+ irec_end - xc->next_bno);
+ if (error)
+ goto out_sr;
+ }
+
/*
* If userspace is forcing us to rebuild the CoW fork or someone
* turned on the debugging knob, replace everything in the
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 300/547] xfs: compute the correct fdblocks/frextents for repair when theyre negative
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 299/547] xfs: mark cow extents bad if theres no rmap mapping for them Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 301/547] xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork Greg Kroah-Hartman
` (255 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit f98d007017acf0eaec2e116ff9c0ece735f61bb3 upstream.
LOLLM observed that if either fdblocks or frextents are negative, we'll
set the CORRUPT flag and exit immediately. This doesn't work for a
repair because we still have to walk the filesystem metadata to compute
the correct summary counters so that we can install the new values.
Currently we just write zeroes into the summary counters, which isn't
right.
Cc: stable@vger.kernel.org # v6.9
Fixes: 4ed080cd7cb077 ("xfs: repair summary counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/fscounters.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -541,7 +541,10 @@ xchk_fscounters(
return -EDEADLOCK;
xchk_set_corrupt(sc);
- return 0;
+
+ /* Need to compute all the fields in fsc for a repair */
+ if (!xchk_could_repair(sc))
+ return 0;
}
/* See if icount is obviously wrong. */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 301/547] xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 300/547] xfs: compute the correct fdblocks/frextents for repair when theyre negative Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 302/547] xfs: fix xfs_rename_space_res for non-pptr filesystems Greg Kroah-Hartman
` (254 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Dave Chinner, Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit aafe21c23ad8263251085291019d8860ddc51da9 upstream.
LOLLM noticed that online repair of a broken symlink file could fail
unnecessarily if a local-format symlink target isn't null terminated.
The ondisk target isn't required to be null terminated, but repair
enforces that anyway because it uses the validator for the incore
symlink target. (The incore buffer is always null-terminated). Fix
this by reverting the changes to xfs_symlink_shortform_verify and adding
an ondisk-specific helper in inode_repair.c.
Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <dgc@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_inode_fork.c | 4 +---
fs/xfs/libxfs/xfs_symlink_remote.c | 8 ++++++--
fs/xfs/libxfs/xfs_symlink_remote.h | 2 +-
fs/xfs/scrub/inode_repair.c | 26 +++++++++++++++++++++++++-
4 files changed, 33 insertions(+), 7 deletions(-)
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -683,9 +683,7 @@ xfs_ifork_verify_local_data(
break;
}
case S_IFLNK: {
- struct xfs_ifork *ifp = xfs_ifork_ptr(ip, XFS_DATA_FORK);
-
- fa = xfs_symlink_shortform_verify(ifp->if_data, ifp->if_bytes);
+ fa = xfs_symlink_shortform_verify(ip);
break;
}
default:
--- a/fs/xfs/libxfs/xfs_symlink_remote.c
+++ b/fs/xfs/libxfs/xfs_symlink_remote.c
@@ -208,11 +208,15 @@ xfs_symlink_local_to_remote(
*/
xfs_failaddr_t
xfs_symlink_shortform_verify(
- void *sfp,
- int64_t size)
+ struct xfs_inode *ip)
{
+ struct xfs_ifork *ifp = xfs_ifork_ptr(ip, XFS_DATA_FORK);
+ char *sfp = (char *)ifp->if_data;
+ int size = ifp->if_bytes;
char *endp = sfp + size;
+ ASSERT(ifp->if_format == XFS_DINODE_FMT_LOCAL);
+
/*
* Zero length symlinks should never occur in memory as they are
* never allowed to exist on disk.
--- a/fs/xfs/libxfs/xfs_symlink_remote.h
+++ b/fs/xfs/libxfs/xfs_symlink_remote.h
@@ -18,7 +18,7 @@ bool xfs_symlink_hdr_ok(xfs_ino_t ino, u
void xfs_symlink_local_to_remote(struct xfs_trans *tp, struct xfs_buf *bp,
struct xfs_inode *ip, struct xfs_ifork *ifp,
void *priv);
-xfs_failaddr_t xfs_symlink_shortform_verify(void *sfp, int64_t size);
+xfs_failaddr_t xfs_symlink_shortform_verify(struct xfs_inode *ip);
int xfs_symlink_remote_read(struct xfs_inode *ip, char *link);
int xfs_symlink_write_target(struct xfs_trans *tp, struct xfs_inode *ip,
xfs_ino_t owner, const char *target_path, int pathlen,
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1024,6 +1024,30 @@ xrep_dinode_bad_metabt_fork(
return false;
}
+static xfs_failaddr_t
+xrep_symlink_shortform_verify(
+ void *sfp,
+ int64_t size)
+{
+ /*
+ * Zero length symlinks should never occur in memory as they are
+ * never allowed to exist on disk.
+ */
+ if (!size)
+ return __this_address;
+
+ /* No negative sizes or overly long symlink targets. */
+ if (size < 0 || size > XFS_SYMLINK_MAXLEN)
+ return __this_address;
+
+ /* No NULLs in the target either. */
+ if (memchr(sfp, 0, size))
+ return __this_address;
+
+ /* ondisk symlink target isn't null terminated, unlike incore */
+ return NULL;
+}
+
/*
* Check the data fork for things that will fail the ifork verifiers or the
* ifork formatters.
@@ -1099,7 +1123,7 @@ xrep_dinode_check_dfork(
return true;
/* symlink structure must pass verification. */
if (S_ISLNK(mode) &&
- xfs_symlink_shortform_verify(dfork_ptr, data_size) != NULL)
+ xrep_symlink_shortform_verify(dfork_ptr, data_size) != NULL)
return true;
break;
case XFS_DINODE_FMT_EXTENTS:
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 302/547] xfs: fix xfs_rename_space_res for non-pptr filesystems
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 301/547] xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 303/547] xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair Greg Kroah-Hartman
` (253 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit a800b926346c3aa2482421f5c0272280ee7d32e8 upstream.
We don't need to reserve space for a parent pointer update for an
existing target if parent pointers are disabled. Fix this regression
(which LOLLM noticed) so that rename reservations go back to what they
were before parent pointers.
Cc: stable@vger.kernel.org # v6.10
Fixes: 5a8338c88284df ("xfs: Add parent pointers to rename")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_trans_space.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/xfs/libxfs/xfs_trans_space.c
+++ b/fs/xfs/libxfs/xfs_trans_space.c
@@ -127,10 +127,10 @@ xfs_rename_space_res(
if (has_whiteout)
ret += xfs_parent_calc_space_res(mp, src_namelen);
ret += 2 * xfs_parent_calc_space_res(mp, target_namelen);
- }
- if (target_exists)
- ret += xfs_parent_calc_space_res(mp, target_namelen);
+ if (target_exists)
+ ret += xfs_parent_calc_space_res(mp, target_namelen);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 303/547] xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 302/547] xfs: fix xfs_rename_space_res for non-pptr filesystems Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 304/547] xfs: fix buffer overruns in xfs_ioc_attr_list Greg Kroah-Hartman
` (252 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit da483b8a9c2c3e7b23655699680feb57a194000c upstream.
LOLLM noticed that everywhere else in the kernel, a call to
xfs_qm_adjust_dqlimits precedes every call to xfs_qm_adjust_dqtimers.
In particular, mount-time quotacheck does this, but online quotacheck
does not.
Looking at xfs_qm_adjust_dqlimits, that function is in charge of
conveying default limits to a dquot if that dquot's limits have been
zeroed. That's quite possible in a repair, so we actually need to do
that.
However, there's a pre-existing pattern in the kernel -- for non-root
dquots, first we call xfs_qm_adjust_dqlimits to set the dquot's limits
to the defaults if they are zero, and then xfs_qm_adjust_dqtimers to
start grace periods if the dquot's usage is above the softlimit. The
grace period decision cannot be made correctly if we forget to import
the default limits.
Therefore, let's combine both into a single xfs_qm_adjust_dqenforcement
helper that takes care of both pieces, which fixes quotacheck and makes
it hard to repeat this mistake.
Cc: stable@vger.kernel.org # v6.9
Fixes: 96ed2ae4a9b06b ("xfs: repair dquots based on live quotacheck results")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/quota_repair.c | 5 +----
fs/xfs/scrub/quotacheck_repair.c | 3 +--
fs/xfs/xfs_dquot.c | 20 +++++++++++++++-----
fs/xfs/xfs_dquot.h | 2 +-
fs/xfs/xfs_qm.c | 6 +-----
fs/xfs/xfs_trans_dquot.c | 6 +-----
6 files changed, 20 insertions(+), 22 deletions(-)
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -248,10 +248,7 @@ xrep_quota_item(
dq->q_flags |= XFS_DQFLAG_DIRTY;
xfs_trans_dqjoin(sc->tp, dq);
- if (dq->q_id) {
- xfs_qm_adjust_dqlimits(dq);
- xfs_qm_adjust_dqtimers(dq);
- }
+ xfs_qm_adjust_dqenforcement(dq);
xfs_trans_log_dquot(sc->tp, dq);
return xfs_trans_roll(&sc->tp);
--- a/fs/xfs/scrub/quotacheck_repair.c
+++ b/fs/xfs/scrub/quotacheck_repair.c
@@ -110,8 +110,7 @@ xqcheck_commit_dquot(
/* Commit the dirty dquot to disk. */
dq->q_flags |= XFS_DQFLAG_DIRTY;
- if (dq->q_id)
- xfs_qm_adjust_dqtimers(dq);
+ xfs_qm_adjust_dqenforcement(dq);
xfs_trans_log_dquot(xqc->sc->tp, dq);
return xrep_trans_commit(xqc->sc);
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -115,18 +115,15 @@ xfs_qm_dqdestroy(
* We overwrite the dquot limits only if they are zero and this
* is not the root dquot.
*/
-void
+static void
xfs_qm_adjust_dqlimits(
struct xfs_dquot *dq)
{
struct xfs_mount *mp = dq->q_mount;
struct xfs_quotainfo *q = mp->m_quotainfo;
- struct xfs_def_quota *defq;
+ struct xfs_def_quota *defq = xfs_get_defquota(q, xfs_dquot_type(dq));
int prealloc = 0;
- ASSERT(dq->q_id);
- defq = xfs_get_defquota(q, xfs_dquot_type(dq));
-
if (!dq->q_blk.softlimit) {
dq->q_blk.softlimit = defq->blk.soft;
prealloc = 1;
@@ -223,6 +220,19 @@ xfs_qm_adjust_dqtimers(
xfs_qm_adjust_res_timer(dq->q_mount, &dq->q_rtb, &defq->rtb);
}
+/* Adjust enforcement limits and timers after a change in usage. */
+void
+xfs_qm_adjust_dqenforcement(
+ struct xfs_dquot *dq)
+{
+ if (dq->q_id == 0)
+ return;
+
+ xfs_qm_adjust_dqlimits(dq);
+ xfs_qm_adjust_dqtimers(dq);
+ dq->q_flags |= XFS_DQFLAG_DIRTY;
+}
+
/*
* initialize a buffer full of dquots and log the whole thing
*/
--- a/fs/xfs/xfs_dquot.h
+++ b/fs/xfs/xfs_dquot.h
@@ -205,7 +205,7 @@ void xfs_qm_dqdestroy(struct xfs_dquot
int xfs_qm_dqflush(struct xfs_dquot *dqp, struct xfs_buf *bp);
void xfs_qm_dqunpin_wait(struct xfs_dquot *dqp);
void xfs_qm_adjust_dqtimers(struct xfs_dquot *d);
-void xfs_qm_adjust_dqlimits(struct xfs_dquot *d);
+void xfs_qm_adjust_dqenforcement(struct xfs_dquot *d);
xfs_dqid_t xfs_qm_id_for_quotatype(struct xfs_inode *ip,
xfs_dqtype_t type);
int xfs_qm_dqget(struct xfs_mount *mp, xfs_dqid_t id,
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -1294,11 +1294,7 @@ xfs_qm_quotacheck_dqadjust(
*
* There are no timers for the default values set in the root dquot.
*/
- if (dqp->q_id) {
- xfs_qm_adjust_dqlimits(dqp);
- xfs_qm_adjust_dqtimers(dqp);
- }
-
+ xfs_qm_adjust_dqenforcement(dqp);
dqp->q_flags |= XFS_DQFLAG_DIRTY;
out_unlock:
mutex_unlock(&dqp->q_qlock);
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -566,11 +566,7 @@ xfs_trans_apply_dquot_deltas(
* Get any default limits in use.
* Start/reset the timer(s) if needed.
*/
- if (dqp->q_id) {
- xfs_qm_adjust_dqlimits(dqp);
- xfs_qm_adjust_dqtimers(dqp);
- }
-
+ xfs_qm_adjust_dqenforcement(dqp);
dqp->q_flags |= XFS_DQFLAG_DIRTY;
/*
* add this to the list of items to get logged
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 304/547] xfs: fix buffer overruns in xfs_ioc_attr_list
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 303/547] xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 305/547] xfs: online quotacheck must dirty dquot if enforcement adjustments needed Greg Kroah-Hartman
` (251 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 0b9081a774ee7b9dff1e9ac3765b73c1d6bba5b2 upstream.
When we converted the al_offset array in struct xfs_attrlist into a VLA,
the size of the object shrank by 4 bytes. Unfortunately, the buffer
size validation in the attrlist ioctl wasn't updated to notice this, so
the al_offset[0] assignment blindly writes off the end of the buffer.
LOLLM noticed the omitted check and complained.
Cc: stable@vger.kernel.org # v6.5
Fixes: 371baf5c9750a2 ("xfs: convert flex-array declarations in struct xfs_attrlist*")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_handle.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/xfs_handle.c
+++ b/fs/xfs/xfs_handle.c
@@ -409,7 +409,7 @@ xfs_ioc_attr_list(
void *buffer;
int error;
- if (bufsize < sizeof(struct xfs_attrlist) ||
+ if (bufsize < struct_size(alist, al_offset, 1) ||
bufsize > XFS_XATTR_LIST_MAX)
return -EINVAL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 305/547] xfs: online quotacheck must dirty dquot if enforcement adjustments needed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 304/547] xfs: fix buffer overruns in xfs_ioc_attr_list Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 306/547] xfs: avoid cross-rtgroup reaping after a repair Greg Kroah-Hartman
` (250 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 244425cf63d7e3a0ff5736b41f0e0afe807f7031 upstream.
LOLLM noticed that we have no way to force xchk_commit_dquot to call
xfs_qm_adjust_dqenforcement if nothing else is wrong with the dquot.
Therefore, add a new predicate to force the dirty flag if the dquot has
zero limits and there are default limits; or if the grace period timer
needs adjusting.
Cc: stable@vger.kernel.org # v6.9
Fixes: 96ed2ae4a9b06b ("xfs: repair dquots based on live quotacheck results")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/quotacheck_repair.c | 51 +++++++++++++++++++++++++++++++++++++++
1 file changed, 51 insertions(+)
--- a/fs/xfs/scrub/quotacheck_repair.c
+++ b/fs/xfs/scrub/quotacheck_repair.c
@@ -39,6 +39,54 @@
* dquot is locked.
*/
+static bool
+xqcheck_dqres_force_dirty(
+ const struct xfs_dquot_res *res,
+ const struct xfs_quota_limits *qlim)
+{
+ /* zero limits mean that we should set the default limits */
+ if (res->softlimit == 0 && qlim->soft != 0)
+ return true;
+ if (res->hardlimit == 0 && qlim->hard != 0)
+ return true;
+
+ /* do we need to adjust the timer setting? */
+ if ((res->softlimit && res->count > res->softlimit) ||
+ (res->hardlimit && res->count > res->hardlimit)) {
+ if (!res->timer)
+ return true;
+ } else {
+ if (res->timer)
+ return true;
+ }
+
+ return false;
+}
+
+/* Decide if we need to adjust the dquot limits or timers */
+static bool
+xqcheck_dquot_force_dirty(
+ const struct xfs_dquot *dq)
+{
+ struct xfs_quotainfo *qi = dq->q_mount->m_quotainfo;
+ struct xfs_def_quota *defq;
+
+ /* root dquot does not enforce limits */
+ if (dq->q_id == 0)
+ return false;
+
+ defq = xfs_get_defquota(qi, xfs_dquot_type(dq));
+
+ if (xqcheck_dqres_force_dirty(&dq->q_blk, &defq->blk))
+ return true;
+ if (xqcheck_dqres_force_dirty(&dq->q_ino, &defq->ino))
+ return true;
+ if (xqcheck_dqres_force_dirty(&dq->q_rtb, &defq->rtb))
+ return true;
+
+ return false;
+}
+
/* Commit new counters to a dquot. */
static int
xqcheck_commit_dquot(
@@ -91,6 +139,9 @@ xqcheck_commit_dquot(
dirty = true;
}
+ if (!dirty && xqcheck_dquot_force_dirty(dq))
+ dirty = true;
+
xcdq.flags |= (XQCHECK_DQUOT_REPAIR_SCANNED | XQCHECK_DQUOT_WRITTEN);
error = xfarray_store(counts, dq->q_id, &xcdq);
if (error == -EFBIG) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 306/547] xfs: avoid cross-rtgroup reaping after a repair
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 305/547] xfs: online quotacheck must dirty dquot if enforcement adjustments needed Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 307/547] xfs: actually lock the metafile reservation when adjusting after repair Greg Kroah-Hartman
` (249 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit d7c204d4ea7ef0cf0dac908388984c2936f1f94e upstream.
LOLLM notices that the extents stored in a xrtb_bitmap (aka xfs_rtblock
bitmap) can span multiple rtgroups due to two circumstances. The first
is that the size of an rtgroup is an exact power of two, which means
that rtgroups are adjacent in the segmented xfs_rtblock_t address space.
This is fairly common to reduce the amount of multiplication and
division needed to handle space on the rt volume.
The second is that (unlike in the original rtgroups design), rtgroups do
not have fixed-location metadata like AGs do, which means that there's
nothing to force a break between rtgroups.
Therefore, we must loop through the rtgroups in xreap_rtmeta_extent to
avoid running off the end of an rtgroup while reaping.
Cc: stable@vger.kernel.org # v6.14
Fixes: fd97fe1112088c ("xfs: fix CoW forks for realtime files")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/reap.c | 59 ++++++++++++++++++++++++++++++++++++++++++----------
1 file changed, 48 insertions(+), 11 deletions(-)
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -1080,26 +1080,23 @@ xreap_configure_rgcow_limits(
XFS_RTGLOCK_RMAP | \
XFS_RTGLOCK_REFCOUNT)
-/*
- * Break a rt file metadata extent into sub-extents by fate (crosslinked, not
- * crosslinked), and dispose of each sub-extent separately. The extent must
- * be aligned to a realtime extent.
- */
-STATIC int
-xreap_rtmeta_extent(
- uint64_t rtbno,
+static int
+xreap_rtgroup_extent(
+ struct xreap_state *rs,
+ xfs_rtblock_t rtbno,
uint64_t len,
- void *priv)
+ xfs_rgblock_t *done)
{
- struct xreap_state *rs = priv;
struct xfs_scrub *sc = rs->sc;
xfs_rgblock_t rgbno = xfs_rtb_to_rgbno(sc->mp, rtbno);
- xfs_rgblock_t rgbno_next = rgbno + len;
+ xfs_rgblock_t rgbno_next;
int error = 0;
ASSERT(sc->ip != NULL);
ASSERT(!sc->sr.rtg);
+ *done = 0;
+
/*
* We're reaping blocks after repairing file metadata, which means that
* we have to init the xchk_ag structure ourselves.
@@ -1110,6 +1107,7 @@ xreap_rtmeta_extent(
xfs_rtgroup_lock(sc->sr.rtg, XREAP_RTGLOCK_ALL);
+ rgbno_next = rgbno + min(len, (uint64_t)rtg_blocks(sc->sr.rtg) - rgbno);
while (rgbno < rgbno_next) {
xfs_extlen_t rglen;
bool crosslinked;
@@ -1136,6 +1134,7 @@ xreap_rtmeta_extent(
}
rgbno += rglen;
+ *done += rglen;
}
out_unlock:
@@ -1146,6 +1145,44 @@ out_unlock:
}
/*
+ * Break a rt file metadata extent into sub-extents by fate (crosslinked, not
+ * crosslinked), and dispose of each sub-extent separately. The extent must
+ * be aligned to a realtime extent.
+ */
+STATIC int
+xreap_rtmeta_extent(
+ uint64_t rtbno,
+ uint64_t len,
+ void *priv)
+{
+ struct xreap_state *rs = priv;
+ int error;
+
+ /*
+ * Space from adjacent rtgroups can be stored as a single bitmap extent
+ * because rtgroups do not have fixed-location metadata such as a
+ * per-group superblock that cannot be reaped. Handle these overlaps
+ * by only reaping within a single rtgroup at a time.
+ *
+ * In the somewhat unlikely event that an rtgroup size is not a power
+ * of two, the segmented nature of xfs_rtblock_t prevents space in
+ * adjacent rtgroups from merging in the bitmap.
+ */
+ while (len > 0) {
+ xfs_rgblock_t done = 0;
+
+ error = xreap_rtgroup_extent(rs, rtbno, len, &done);
+ if (error)
+ return error;
+
+ rtbno += done;
+ len -= done;
+ }
+
+ return 0;
+}
+
+/*
* Dispose of every block of every rt metadata extent in the bitmap.
* Do not use this to dispose of the mappings in an ondisk inode fork.
*/
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 307/547] xfs: actually lock the metafile reservation when adjusting after repair
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 306/547] xfs: avoid cross-rtgroup reaping after a repair Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 308/547] xfs: fix unnecessary dapos truncation in xchk_dir_walk Greg Kroah-Hartman
` (248 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, hch, Darrick J. Wong,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit e53c620b3670fc0c162b5f768a10a3a17d0c04f6 upstream.
LOLLM reported that xrep_reset_metafile_resv performs unlocked loads
and stores to the metadata file space reservation counters and thus can
race with other threads. Fix this by taking the lock.
Cc: hch@lst.de
Cc: stable@vger.kernel.org # v6.15
Fixes: 1df8d75030b787 ("xfs: make metabtree reservations global")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/repair.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/fs/xfs/scrub/repair.c
+++ b/fs/xfs/scrub/repair.c
@@ -1377,12 +1377,14 @@ xrep_reset_metafile_resv(
{
struct xfs_mount *mp = sc->mp;
int64_t delta;
- int error;
+ int error = 0;
+
+ mutex_lock(&mp->m_metafile_resv_lock);
delta = mp->m_metafile_resv_used + mp->m_metafile_resv_avail -
mp->m_metafile_resv_target;
if (delta == 0)
- return 0;
+ goto out_resv_lock;
/*
* Too many blocks have been reserved, transfer some from the incore
@@ -1398,7 +1400,7 @@ xrep_reset_metafile_resv(
mp->m_metafile_resv_avail -= give_back;
}
- return 0;
+ goto out_resv_lock;
}
/*
@@ -1412,14 +1414,18 @@ xrep_reset_metafile_resv(
if (delta == 0) {
xfs_warn(sc->mp,
"Insufficient free space to reset metabtree reservation after repair.");
- return 0;
+ error = 0;
+ goto out_resv_lock;
}
error = xfs_dec_fdblocks(mp, delta, true);
}
if (error)
- return error;
+ goto out_resv_lock;
xfs_mod_sb_delalloc(mp, delta);
mp->m_metafile_resv_avail += delta;
- return 0;
+
+out_resv_lock:
+ mutex_unlock(&mp->m_metafile_resv_lock);
+ return error;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 308/547] xfs: fix unnecessary dapos truncation in xchk_dir_walk
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 307/547] xfs: actually lock the metafile reservation when adjusting after repair Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 309/547] xfs: fix buffer overflow in corrupt inline attr structure Greg Kroah-Hartman
` (247 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit f60a2ef8d8a7ac6dedf4d0c3325cc3fc2fe0d948 upstream.
LOLLM points out that the all the implementations of xchk_dirent_fn can
handle a signed @dapos parameter, so the truncation here breaks the
information captured in scrub tracepoints if the directory is very
large. I don't think it ever made sense to do the truncation for the
VFS readdir code for programs that can handle 64-bit offsets, but commit
15440319767942 has been around for 17 years without complaints so I'll
leave that alone.
Stumbled-over: 15440319767942 ("[XFS] truncate readdir offsets to signed 32 bit values")
Cc: stable@vger.kernel.org # v6.4
Fixes: 4c233b5c4f29df ("xfs: streamline the directory iteration code for scrub")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/readdir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/readdir.c
+++ b/fs/xfs/scrub/readdir.c
@@ -238,7 +238,7 @@ xchk_dir_walk_leaf(
dep = bp->b_addr + offset;
length = xfs_dir2_data_entsize(mp, dep->namelen);
- dapos = xfs_dir2_byte_to_dataptr(curoff) & 0x7fffffff;
+ dapos = xfs_dir2_byte_to_dataptr(curoff);
ino = be64_to_cpu(dep->inumber);
name.name = dep->name;
name.len = dep->namelen;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 309/547] xfs: fix buffer overflow in corrupt inline attr structure
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 308/547] xfs: fix unnecessary dapos truncation in xchk_dir_walk Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 310/547] xfs: actually report corrupt xattrs as XFAIL during cross-referencing Greg Kroah-Hartman
` (246 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 017dd7a84ff4cd2275eb62f4ee6d63c705bac107 upstream.
LOLLM noticed a buffer overrun if the xattr scrubber encounters a file
with a shortform attr fork with sf->count > 0 but if_bytes ==
sizeof(struct xfs_attr_sf_hdr). Basically, we have enough data to have
a header with a nonzero count, but no space for any of those shortform
entries. In this case, the xfs_attr_sf_nextentry() call will run off
the end of if_data and blow up.
Cc: stable@vger.kernel.org # v6.4
Fixes: ae0506eba78fd1 ("xfs: check used space of shortform xattr structures")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/attr.c | 11 +++++++++--
fs/xfs/scrub/attr_repair.c | 3 +++
2 files changed, 12 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -590,12 +590,17 @@ xchk_xattr_check_sf(
}
for (i = 0; i < sf->count; i++) {
- unsigned char *name = sfe->nameval;
- unsigned char *value = &sfe->nameval[sfe->namelen];
+ unsigned char *name;
+ unsigned char *value;
if (xchk_should_terminate(sc, &error))
return error;
+ if ((unsigned char *)(sfe + 1) >= end) {
+ xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, 0);
+ break;
+ }
+
next = xfs_attr_sf_nextentry(sfe);
if ((unsigned char *)next > end) {
xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, 0);
@@ -618,6 +623,7 @@ xchk_xattr_check_sf(
break;
}
+ name = sfe->nameval;
if (!xchk_xattr_set_map(sc, ab->usedmap,
(char *)name - (char *)sf,
sfe->namelen)) {
@@ -625,6 +631,7 @@ xchk_xattr_check_sf(
break;
}
+ value = &sfe->nameval[sfe->namelen];
if (!xchk_xattr_set_map(sc, ab->usedmap,
(char *)value - (char *)sf,
sfe->valuelen)) {
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -477,6 +477,9 @@ xrep_xattr_recover_sf(
if (xchk_should_terminate(sc, &error))
return error;
+ if ((unsigned char *)(sfe + 1) >= end)
+ break;
+
next = xfs_attr_sf_nextentry(sfe);
if ((unsigned char *)next > end)
break;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 310/547] xfs: actually report corrupt xattrs as XFAIL during cross-referencing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 309/547] xfs: fix buffer overflow in corrupt inline attr structure Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 311/547] xfs: fix inode btree repair when a cluster is larger than a chunk Greg Kroah-Hartman
` (245 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit b339cc253019518c61b8b150fb7ea727fdae59f4 upstream.
Some LLM reports that xchk_dir_parent_pointer really ought to report
xattr corruption errors as XFAIL (cross-referencing failed) when a
directory scrub tries to find the parent pointer for a dirent name.
Let's do that.
Cc: stable@vger.kernel.org # v6.10
Fixes: 61b3f0df5c2358 ("xfs: check dirents have parent pointers")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dir.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -155,6 +155,8 @@ xchk_dir_parent_pointer(
&sd->pptr_args);
if (error == -ENOATTR)
xchk_fblock_xref_set_corrupt(sc, XFS_DATA_FORK, 0);
+ else
+ xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error);
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 311/547] xfs: fix inode btree repair when a cluster is larger than a chunk
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 310/547] xfs: actually report corrupt xattrs as XFAIL during cross-referencing Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 312/547] xfs: always reset incore attr fork buffer when resetting fork Greg Kroah-Hartman
` (244 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 65b89ac3e8c2f041384f715a71b9d113edfa32e5 upstream.
LOLLM noticed that on filesystems where an inode cluster buffer is
larger than an inode chunk, we can run through the loop body in
xrep_ibt_process_cluster more than once, and the number of inodes that
we pass to xrep_ibt_cluster_record is incorrectly large. In this case
we can run right off the end of the buffer. Fix this by moving the
nr_inodes computation inside the loop.
Note that this is only likely to happen on filesystems with (say) 512b
inodes and 64k fsblocks.
Cc: stable@vger.kernel.org # v6.8
Fixes: dbfbf3bdf639a2 ("xfs: repair inode btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/ialloc_repair.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/xfs/scrub/ialloc_repair.c
+++ b/fs/xfs/scrub/ialloc_repair.c
@@ -293,12 +293,8 @@ xrep_ibt_process_cluster(
struct xfs_ino_geometry *igeo = M_IGEO(mp);
xfs_agino_t cluster_ag_base;
xfs_agino_t irec_index;
- unsigned int nr_inodes;
int error;
- nr_inodes = min_t(unsigned int, igeo->inodes_per_cluster,
- XFS_INODES_PER_CHUNK);
-
/*
* Grab the inode cluster buffer. This is safe to do with a broken
* inobt because imap_to_bp directly maps the buffer without touching
@@ -317,6 +313,10 @@ xrep_ibt_process_cluster(
for (irec_index = 0;
irec_index < igeo->inodes_per_cluster;
irec_index += XFS_INODES_PER_CHUNK) {
+ unsigned int nr_inodes =
+ min_t(unsigned int, XFS_INODES_PER_CHUNK,
+ igeo->inodes_per_cluster - irec_index);
+
error = xrep_ibt_cluster_record(ri,
cluster_ag_base + irec_index, cluster_bp,
nr_inodes);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 312/547] xfs: always reset incore attr fork buffer when resetting fork
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 311/547] xfs: fix inode btree repair when a cluster is larger than a chunk Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 313/547] xfs: dont pass iget failures up when marking ondisk inodes Greg Kroah-Hartman
` (243 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 71cb13685e72a3c5d118732559c727a0c9090b7f upstream.
LOLLM noticed that the local format attr fork verifier depends on
if_bytes being set correctly. However, the fork reset function doesn't
reset that correctly, which can cause post-repair verifier failures.
Fix that.
Cc: stable@vger.kernel.org # v6.10
Fixes: e5d7ce0364d8ee ("xfs: replay unlocked parent pointer updates that accrue during xattr repair")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/attr_repair.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -840,11 +840,11 @@ xrep_xattr_full_reset(
ASSERT(ifp->if_bytes == 0);
ifp->if_format = XFS_DINODE_FMT_LOCAL;
- xfs_idata_realloc(sc->tempip, sizeof(*hdr), XFS_ATTR_FORK);
}
/* Reinitialize the attr fork to an empty shortform structure. */
- hdr = ifp->if_data;
+ hdr = xfs_idata_realloc(sc->tempip,
+ (int64_t)sizeof(*hdr) - ifp->if_bytes, XFS_ATTR_FORK);
memset(hdr, 0, sizeof(*hdr));
hdr->totsize = cpu_to_be16(sizeof(*hdr));
xfs_trans_log_inode(sc->tp, sc->tempip, XFS_ILOG_CORE | XFS_ILOG_ADATA);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 313/547] xfs: dont pass iget failures up when marking ondisk inodes
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 312/547] xfs: always reset incore attr fork buffer when resetting fork Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 314/547] xfs: zero out di_metatype when removing the metadir file iflag Greg Kroah-Hartman
` (242 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 7f5e8bf335e5e257fb82cf5b3521980ded60e863 upstream.
LOLLM observes a couple of problems with this callsite -- an ENOMEM
return is completely ignored and a subsequent run through the loop body
obliterates the return value completely. Also, an error value
indicating that the list is corrupt can get passed up (thus terminating
the repair) even though we can handle corrupt lists. Fix the callsite
not to have these problems.
Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
| 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -1325,8 +1325,12 @@ xrep_iunlink_mark_ondisk_rec(
*/
error = xchk_iget(ragi->sc, xfs_agino_to_ino(sc->sa.pag, agino),
&ip);
- if (error)
+ if (error == -ENOMEM)
+ return error;
+ if (error) {
+ error = 0;
continue;
+ }
trace_xrep_iunlink_reload_ondisk(ip);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 314/547] xfs: zero out di_metatype when removing the metadir file iflag
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 313/547] xfs: dont pass iget failures up when marking ondisk inodes Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 315/547] xfs: flag excessive delalloc rt extents as corruption Greg Kroah-Hartman
` (241 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit f5b4d8c8ce16675f77c25a4ff06caaa9a2739f31 upstream.
LOLLM pointed out that we should zero di_metatype (fka di_onlink) when
we're clearing the METADIR inode flag because the file is no longer a
metadata file.
Cc: stable@vger.kernel.org # v6.13
Fixes: 7297fd0bebbd70 ("xfs: enforce metadata inode flag")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -579,8 +579,10 @@ xrep_dinode_flags(
fa = xfs_dinode_verify_metadir(sc->mp, dip, mode, flags,
flags2);
- if (fa)
+ if (fa) {
flags2 &= ~XFS_DIFLAG2_METADATA;
+ dip->di_metatype = cpu_to_be16(XFS_METAFILE_UNKNOWN);
+ }
}
dip->di_flags = cpu_to_be16(flags);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 315/547] xfs: flag excessive delalloc rt extents as corruption
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 314/547] xfs: zero out di_metatype when removing the metadir file iflag Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 316/547] xfs: dont fix the directory tree if live update fails Greg Kroah-Hartman
` (240 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 2b47be015a5e54f4a3d62afa636ba593de9b67f6 upstream.
LOLLM observed that we should not allow repairs to proceed if the count
of delayed-allocation realtime extents exceeds the number of free rt
extents because we can't install negative numbers into the superblock.
It's unclear how we could end up in that state in real life, but let's
at least complain loudly about it if we ever encounter it.
Cc: stable@vger.kernel.org # v6.2
Fixes: e74331d6fa2c21 ("xfs: online checking of the free rt extent count")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/fscounters.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -607,6 +607,13 @@ xchk_fscounters(
try_again = true;
}
+ if (!xfs_has_zoned(mp) && fsc->frextents < fsc->frextents_delayed) {
+ if (fsc->frozen)
+ xchk_set_incomplete(sc);
+ else
+ try_again = true;
+ }
+
if (!xfs_has_zoned(mp) &&
!xchk_fscount_within_range(sc, frextents,
&mp->m_free[XC_FREE_RTEXTENTS].count,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 316/547] xfs: dont fix the directory tree if live update fails
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 315/547] xfs: flag excessive delalloc rt extents as corruption Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 317/547] xfs: validate rc_domain in xchk_rtrefcount_mergeable Greg Kroah-Hartman
` (239 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit c8226f3d1a7eafe472addc232689e9c9a0c36a1c upstream.
LOLLM complains that we don't double-check dl->aborted one last time to
before committing repairs to the filesystem. This is important because
the live update handler could have set ->aborted if it encountered a
runtime error.
Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dirtree_repair.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -427,6 +427,11 @@ again:
error = -ESTALE;
goto out_trans_cancel;
}
+ if (dl->aborted) {
+ mutex_unlock(&dl->lock);
+ error = -EIO;
+ goto out_trans_cancel;
+ }
xrep_dirpath_set_outcome(dl, path, XREP_DIRPATH_DELETING);
mutex_unlock(&dl->lock);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 317/547] xfs: validate rc_domain in xchk_rtrefcount_mergeable
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 316/547] xfs: dont fix the directory tree if live update fails Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 318/547] xfs: dont proceed with xattr repair if the live update fails Greg Kroah-Hartman
` (238 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Sandeen, Darrick J. Wong,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <sandeen@redhat.com>
commit f04361fb8694bff98ec61e2e2030a1993426fdca upstream.
xchk_refcount_mergeable validates that the domains match, but this
was omitted from the realtime version of the check; fix it.
Fixes: c27929670de144 ("xfs: scrub the realtime refcount btree")
Cc: stable@vger.kernel.org # v6.14
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/rtrefcount.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/xfs/scrub/rtrefcount.c
+++ b/fs/xfs/scrub/rtrefcount.c
@@ -379,6 +379,8 @@ xchk_rtrefcount_mergeable(
if (r1->rc_blockcount == 0)
return false;
+ if (r1->rc_domain != r2->rc_domain)
+ return false;
if (r1->rc_startblock + r1->rc_blockcount != r2->rc_startblock)
return false;
if (r1->rc_refcount != r2->rc_refcount)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 318/547] xfs: dont proceed with xattr repair if the live update fails
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 317/547] xfs: validate rc_domain in xchk_rtrefcount_mergeable Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 319/547] xfs: fix skipped inode mask handling in iscan Greg Kroah-Hartman
` (237 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 833f98b3be45bc7c6ce4c87bdc4892f546ab72ee upstream.
LOLLM observes that we ought to make one last check for failed live
updates before replacing the xattr structure. Let's be cautious here.
Cc: stable@vger.kernel.org # v6.10
Fixes: e5d7ce0364d8ee ("xfs: replay unlocked parent pointer updates that accrue during xattr repair")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/attr_repair.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1477,6 +1477,9 @@ xrep_xattr_rebuild_tree(
if (error)
return error;
+ if (rx->live_update_aborted)
+ return -EIO;
+
/*
* Exchange the blocks mapped by the tempfile's attr fork with the file
* being repaired. The old attr blocks will then be attached to the
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 319/547] xfs: fix skipped inode mask handling in iscan
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 318/547] xfs: dont proceed with xattr repair if the live update fails Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 320/547] xfs: dont repair fs summary counters with garbage Greg Kroah-Hartman
` (236 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 63341d4af16fe850716b454fcd18990590d07d97 upstream.
xfs_highbit64() returns -1 if none of the bits in its argument are set.
In this particular callsite, a totally zeroed mask means that no inodes
were skipped, so executing the if-body is incorrect. Fix that.
Cc: stable@vger.kernel.org # v6.9
Fixes: 82334a79c6eb1c ("xfs: iscan batching should handle unallocated inodes too")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/iscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/iscan.c
+++ b/fs/xfs/scrub/iscan.c
@@ -545,7 +545,7 @@ xchk_iscan_finish_batch(
mutex_lock(&iscan->lock);
- if (iscan->__batch_ino != NULLFSINO) {
+ if (iscan->__batch_ino != NULLFSINO && iscan->__skipped_inomask) {
highest_skipped = iscan->__batch_ino +
xfs_highbit64(iscan->__skipped_inomask);
iscan->__visited_ino = max(iscan->__visited_ino,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 320/547] xfs: dont repair fs summary counters with garbage
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 319/547] xfs: fix skipped inode mask handling in iscan Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 321/547] xfs: fix lost errno returned from xfarray_foliosort Greg Kroah-Hartman
` (235 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 22a8a7501c0146dba4ce99b8256975ffe945125d upstream.
LOLLM noticed that if we scan the filesystem and come up with totally
garbage numbers for the summary counters, we don't actually mark the
scan incomplete. Because we don't do this, repair can install the
garbage values into the filesystem, making things worse. Don't do that.
Cc: stable@vger.kernel.org # v6.9
Fixes: 4ed080cd7cb077 ("xfs: repair summary counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/fscounters.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -368,8 +368,10 @@ retry:
/* Bail out if the values we compute are totally nonsense. */
if (fsc->icount < fsc->icount_min || fsc->icount > fsc->icount_max ||
fsc->fdblocks > mp->m_sb.sb_dblocks ||
- fsc->ifree > fsc->icount_max)
+ fsc->ifree > fsc->icount_max) {
+ xchk_set_incomplete(sc);
return -EFSCORRUPTED;
+ }
/*
* If ifree > icount then we probably had some perturbation in the
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 321/547] xfs: fix lost errno returned from xfarray_foliosort
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 320/547] xfs: dont repair fs summary counters with garbage Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 322/547] xfs: allow softlimit with no hardlimit in quota scrub Greg Kroah-Hartman
` (234 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 8c4f172c246717b1420f138a159ed15c315a58bd upstream.
LOLLM noticed that we stop the sort early but don't actually pass along
the error code, which could enable repair code to continue running with
an unsorted array. Fix that.
Cc: stable@vger.kernel.org # v6.9
Fixes: ee13fc67205b98 ("xfs: convert xfarray_pagesort to deal with large folios")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/xfarray.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/xfarray.c
+++ b/fs/xfs/scrub/xfarray.c
@@ -943,8 +943,10 @@ xfarray_sort(
* problems, we're done.
*/
ret = xfarray_foliosort(si, lo, hi);
- if (ret < 0)
+ if (ret < 0) {
+ error = ret;
goto out_free;
+ }
if (ret == 1) {
si->stack_depth--;
continue;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 322/547] xfs: allow softlimit with no hardlimit in quota scrub
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 321/547] xfs: fix lost errno returned from xfarray_foliosort Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 323/547] xfs: assign an owner to scrub_stats_fops Greg Kroah-Hartman
` (233 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 342c2e00b3a99099a7088f7b8c8f075670c603a9 upstream.
LOLLM observes that the sysadmin can set a user's soft limit to a
nonzero value and the hard limit to zero, so those aren't corruptions.
Cc: stable@vger.kernel.org # v4.15
Fixes: c2fc338c87a31f ("xfs: scrub quota information")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/quota.c | 8 ++++----
fs/xfs/scrub/quota_repair.c | 6 +++---
2 files changed, 7 insertions(+), 7 deletions(-)
--- a/fs/xfs/scrub/quota.c
+++ b/fs/xfs/scrub/quota.c
@@ -182,21 +182,21 @@ xchk_quota_item(
* suspect, which is why we flag it for review.
*
* Complain about corruption if the soft limit is greater than
- * the hard limit.
+ * the hard limit and there's a hard limit set.
*/
if (dq->q_blk.hardlimit > mp->m_sb.sb_dblocks)
xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
- if (dq->q_blk.softlimit > dq->q_blk.hardlimit)
+ if (dq->q_blk.hardlimit && dq->q_blk.softlimit > dq->q_blk.hardlimit)
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
if (dq->q_ino.hardlimit > M_IGEO(mp)->maxicount)
xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
- if (dq->q_ino.softlimit > dq->q_ino.hardlimit)
+ if (dq->q_ino.hardlimit && dq->q_ino.softlimit > dq->q_ino.hardlimit)
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
if (dq->q_rtb.hardlimit > mp->m_sb.sb_rblocks)
xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
- if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
+ if (dq->q_rtb.hardlimit && dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
/* Check the resource counts. */
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -193,17 +193,17 @@ xrep_quota_item(
goto out_unlock_dquot;
/* Check the limits. */
- if (dq->q_blk.softlimit > dq->q_blk.hardlimit) {
+ if (dq->q_blk.hardlimit && dq->q_blk.softlimit > dq->q_blk.hardlimit) {
dq->q_blk.softlimit = dq->q_blk.hardlimit;
dirty = true;
}
- if (dq->q_ino.softlimit > dq->q_ino.hardlimit) {
+ if (dq->q_ino.hardlimit && dq->q_ino.softlimit > dq->q_ino.hardlimit) {
dq->q_ino.softlimit = dq->q_ino.hardlimit;
dirty = true;
}
- if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
+ if (dq->q_rtb.hardlimit && dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
dq->q_rtb.softlimit = dq->q_rtb.hardlimit;
dirty = true;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 323/547] xfs: assign an owner to scrub_stats_fops
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 322/547] xfs: allow softlimit with no hardlimit in quota scrub Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 324/547] xfs: bail out of directory tree repairs on error Greg Kroah-Hartman
` (232 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit fe67a493c7a76cf75556152af24285a114f69d34 upstream.
LOLLM complains that file_operations structs for debugfs files are
supposed to have an owner set so that the module can't get unloaded if
someone's sitting on a debugfs file long after unmount/rmmod. Fix that.
Cc: stable@vger.kernel.org # v6.6
Fixes: d7a74cad8f4513 ("xfs: track usage statistics of online fsck")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/stats.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/xfs/scrub/stats.c
+++ b/fs/xfs/scrub/stats.c
@@ -300,6 +300,7 @@ out:
}
static const struct file_operations scrub_stats_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = xchk_scrub_stats_read,
};
@@ -327,6 +328,7 @@ xchk_clear_scrub_stats_write(
}
static const struct file_operations clear_scrub_stats_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.write = xchk_clear_scrub_stats_write,
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 324/547] xfs: bail out of directory tree repairs on error
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 323/547] xfs: assign an owner to scrub_stats_fops Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 325/547] xfs: fix revalidation of xchk_dquot_iter cached mappings Greg Kroah-Hartman
` (231 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit d83ca4e7cc65dce6a02fd3427cefd174517657a3 upstream.
LOLLM complains that we ignore errors returned by
xrep_dirpath_retain_parent and can set the dotdot entry to random stack
garbage. Fix that by passing errors all the way out.
Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dirtree_repair.c | 57 ++++++++++++++++++++++++++----------------
1 file changed, 36 insertions(+), 21 deletions(-)
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -94,7 +94,7 @@ xrep_dirtree_delete_all_paths(
}
/* Since this is the surviving path, set the dotdot entry to this value. */
-STATIC void
+STATIC int
xrep_dirpath_retain_parent(
struct xchk_dirtree *dl,
struct xchk_dirpath *path)
@@ -104,18 +104,20 @@ xrep_dirpath_retain_parent(
error = xfarray_load(dl->path_steps, path->first_step, &step);
if (error)
- return;
+ return error;
dl->parent_ino = be64_to_cpu(step.pptr_rec.p_ino);
+ return 0;
}
/* Find the one surviving path so we know how to set dotdot. */
-STATIC void
+STATIC int
xrep_dirtree_find_surviving_path(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
{
struct xchk_dirpath *path;
+ int error;
bool foundit = false;
xchk_dirtree_for_each_path(dl, path) {
@@ -124,7 +126,10 @@ xrep_dirtree_find_surviving_path(
case XCHK_DIRPATH_LOOP:
case XCHK_DIRPATH_OK:
if (!foundit) {
- xrep_dirpath_retain_parent(dl, path);
+ error = xrep_dirpath_retain_parent(dl, path);
+ if (error)
+ return error;
+
foundit = true;
continue;
}
@@ -136,16 +141,19 @@ xrep_dirtree_find_surviving_path(
}
ASSERT(oc->suspect + oc->good == 1);
+
+ return 0;
}
/* Delete all paths except for the one good one. */
-STATIC void
+STATIC int
xrep_dirtree_keep_one_good_path(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
{
struct xchk_dirpath *path;
bool foundit = false;
+ int error;
xchk_dirtree_for_each_path(dl, path) {
switch (path->outcome) {
@@ -157,7 +165,10 @@ xrep_dirtree_keep_one_good_path(
break;
case XCHK_DIRPATH_OK:
if (!foundit) {
- xrep_dirpath_retain_parent(dl, path);
+ error = xrep_dirpath_retain_parent(dl, path);
+ if (error)
+ return error;
+
foundit = true;
continue;
}
@@ -172,23 +183,28 @@ xrep_dirtree_keep_one_good_path(
ASSERT(oc->suspect == 0);
ASSERT(oc->good < 2);
+ return 0;
}
/* Delete all paths except for one suspect one. */
-STATIC void
+STATIC int
xrep_dirtree_keep_one_suspect_path(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
{
struct xchk_dirpath *path;
bool foundit = false;
+ int error = 0;
xchk_dirtree_for_each_path(dl, path) {
switch (path->outcome) {
case XCHK_DIRPATH_CORRUPT:
case XCHK_DIRPATH_LOOP:
if (!foundit) {
- xrep_dirpath_retain_parent(dl, path);
+ error = xrep_dirpath_retain_parent(dl, path);
+ if (error)
+ return error;
+
foundit = true;
continue;
}
@@ -206,13 +222,14 @@ xrep_dirtree_keep_one_suspect_path(
ASSERT(oc->suspect == 1);
ASSERT(oc->good == 0);
+ return error;
}
/*
* Figure out what to do with the paths we tried to find. Returns -EDEADLOCK
* if the scan results have become stale.
*/
-STATIC void
+STATIC int
xrep_dirtree_decide_fate(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
@@ -222,36 +239,32 @@ xrep_dirtree_decide_fate(
/* Parentless directories should not have any paths at all. */
if (xchk_dirtree_parentless(dl)) {
xrep_dirtree_delete_all_paths(dl, oc);
- return;
+ return 0;
}
/* One path is exactly the number of paths we want. */
- if (oc->good + oc->suspect == 1) {
- xrep_dirtree_find_surviving_path(dl, oc);
- return;
- }
+ if (oc->good + oc->suspect == 1)
+ return xrep_dirtree_find_surviving_path(dl, oc);
/* Zero paths means we should reattach the subdir to the orphanage. */
if (oc->good + oc->suspect == 0) {
if (dl->sc->orphanage)
oc->needs_adoption = true;
- return;
+ return 0;
}
/*
* Otherwise, this subdirectory has too many parents. If there's at
* least one good path, keep it and delete the others.
*/
- if (oc->good > 0) {
- xrep_dirtree_keep_one_good_path(dl, oc);
- return;
- }
+ if (oc->good > 0)
+ return xrep_dirtree_keep_one_good_path(dl, oc);
/*
* There are no good paths and there are too many suspect paths.
* Keep the first suspect path and delete the rest.
*/
- xrep_dirtree_keep_one_suspect_path(dl, oc);
+ return xrep_dirtree_keep_one_suspect_path(dl, oc);
}
/*
@@ -824,7 +837,9 @@ xrep_dirtree(
* to walk again.
*/
if (!dl->stale) {
- xrep_dirtree_decide_fate(dl, &oc);
+ error = xrep_dirtree_decide_fate(dl, &oc);
+ if (error)
+ break;
trace_xrep_dirtree_decided_fate(dl, &oc);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 325/547] xfs: fix revalidation of xchk_dquot_iter cached mappings
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 324/547] xfs: bail out of directory tree repairs on error Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 326/547] xfs: abort dirtree repair if the live update hook dies Greg Kroah-Hartman
` (230 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 6c64d650460b455980a6023d43bc6c8859c1cfd2 upstream.
LOLLM noticed that the purpose of xchk_dquot_iter_revalidate_bmap is to
revalidate the quota file mapping after we've (presumably) done
something to the quota file contents. However, the "yes this is valid"
code isn't quite strong enough -- the mapping must cover at least the
block at fileoff, not just end after fileoff. Fix that.
Cc: stable@vger.kernel.org # v6.8
Fixes: 21d7500929c8a0 ("xfs: improve dquot iteration for scrub")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dqiterate.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/xfs/scrub/dqiterate.c
+++ b/fs/xfs/scrub/dqiterate.c
@@ -58,6 +58,7 @@ xchk_dquot_iter_revalidate_bmap(
* no need to reread the bmbt.
*/
if (cursor->bmap.br_startoff != NULLFILEOFF &&
+ cursor->bmap.br_startoff <= fileoff &&
cursor->if_seq == ifp->if_seq &&
cursor->bmap.br_startoff + cursor->bmap.br_blockcount > fileoff)
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 326/547] xfs: abort dirtree repair if the live update hook dies
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 325/547] xfs: fix revalidation of xchk_dquot_iter cached mappings Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 327/547] xfs: check fork type against dabtree block magic number Greg Kroah-Hartman
` (229 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 07732dea4f5d0410e1566b81a58a1154bf9dcb29 upstream.
LOLLM notices that if the live update hook for the directory tree repair
code hits an error, it will set dl->aborted and stops working. If the
repair code ever sees that condition, it ought to bail out immediately
instead of continuing with obsolete data.
Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dirtree_repair.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -831,6 +831,11 @@ xrep_dirtree(
*/
mutex_lock(&dl->lock);
do {
+ if (dl->aborted) {
+ error = -EIO;
+ break;
+ }
+
/*
* Decide what we're going to do, then do it. An -ESTALE
* return here means the scan results are invalid and we have
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 327/547] xfs: check fork type against dabtree block magic number
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 326/547] xfs: abort dirtree repair if the live update hook dies Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 328/547] xfs: mark overfull dabtree node blocks as corrupt Greg Kroah-Hartman
` (228 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 43030b72a11a532e7e3c21ac84a8625425b4201b upstream.
LOLLM complains that we fail to flag dabtree blocks that should never be
associated with the file fork -- data forks can't point to xattr leaves,
and attr forks can't point to dirent blocks. Add the missing checks.
Cc: stable@vger.kernel.org # v4.15
Fixes: 7c4a07a424c18d ("xfs: scrub directory/attribute btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dabtree.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -410,6 +410,10 @@ xchk_da_btree_block(
XFS_BLFT_ATTR_LEAF_BUF);
blk->magic = XFS_ATTR_LEAF_MAGIC;
blk->hashval = xfs_attr_leaf_lasthash(blk->bp, pmaxrecs);
+ if (dargs->whichfork != XFS_ATTR_FORK) {
+ xchk_da_set_corrupt(ds, level);
+ goto out_freebp;
+ }
if (ds->tree_level != 0)
xchk_da_set_corrupt(ds, level);
break;
@@ -419,6 +423,10 @@ xchk_da_btree_block(
XFS_BLFT_DIR_LEAFN_BUF);
blk->magic = XFS_DIR2_LEAFN_MAGIC;
blk->hashval = xfs_dir2_leaf_lasthash(ip, blk->bp, pmaxrecs);
+ if (dargs->whichfork != XFS_DATA_FORK) {
+ xchk_da_set_corrupt(ds, level);
+ goto out_freebp;
+ }
if (ds->tree_level != 0)
xchk_da_set_corrupt(ds, level);
break;
@@ -428,6 +436,10 @@ xchk_da_btree_block(
XFS_BLFT_DIR_LEAF1_BUF);
blk->magic = XFS_DIR2_LEAF1_MAGIC;
blk->hashval = xfs_dir2_leaf_lasthash(ip, blk->bp, pmaxrecs);
+ if (dargs->whichfork != XFS_DATA_FORK) {
+ xchk_da_set_corrupt(ds, level);
+ goto out_freebp;
+ }
if (ds->tree_level != 0)
xchk_da_set_corrupt(ds, level);
break;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 328/547] xfs: mark overfull dabtree node blocks as corrupt
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 327/547] xfs: check fork type against dabtree block magic number Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 329/547] xfs: jump out of xchk_bmap_check_rmap if fatal signals Greg Kroah-Hartman
` (227 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit f61c91a2e5994fa81141d6c06dadae1fed206018 upstream.
LOLLM observes that we need to range-check the dabtree node record count
before using it to index an array. Fix that.
Cc: stable@vger.kernel.org # v4.15
Fixes: 7c4a07a424c18d ("xfs: scrub directory/attribute btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dabtree.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -451,6 +451,10 @@ xchk_da_btree_block(
node = blk->bp->b_addr;
xfs_da3_node_hdr_from_disk(ip->i_mount, &nodehdr, node);
btree = nodehdr.btree;
+ if (nodehdr.count > dargs->geo->node_ents) {
+ xchk_da_set_corrupt(ds, level);
+ goto out_freebp;
+ }
*pmaxrecs = nodehdr.count;
blk->hashval = be32_to_cpu(btree[*pmaxrecs - 1].hashval);
if (level == 0) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 329/547] xfs: jump out of xchk_bmap_check_rmap if fatal signals
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 328/547] xfs: mark overfull dabtree node blocks as corrupt Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 330/547] xfs: cross-reference the primary superblock Greg Kroah-Hartman
` (226 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 49d300a51442bd64b627645b7b0b1cd66e492905 upstream.
LOLLM observes that we never check for fatal signals inside the loop
that checks file fork mappings against the rmapbt. This can lead to
lengthy delays in responding to a ^C, so add some bailout checks.
Cc: stable@vger.kernel.org # v4.17
Fixes: 5e777b62b0bcb6 ("xfs: bmap scrubber should do rmap xref with bmap for sparse files")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/bmap.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/xfs/scrub/bmap.c
+++ b/fs/xfs/scrub/bmap.c
@@ -626,6 +626,10 @@ xchk_bmap_check_rmap(
struct xfs_ifork *ifp;
struct xfs_scrub *sc = sbcri->sc;
bool have_map;
+ int error = 0;
+
+ if (xchk_should_terminate(sc, &error))
+ return error;
/* Is this even the right fork? */
if (rec->rm_owner != I_INO(sc->ip))
@@ -657,6 +661,9 @@ xchk_bmap_check_rmap(
*/
check_rec = *rec;
while (have_map) {
+ if (xchk_should_terminate(sc, &error))
+ return error;
+
if (irec.br_startoff != check_rec.rm_offset)
xchk_fblock_set_corrupt(sc, sbcri->whichfork,
check_rec.rm_offset);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 330/547] xfs: cross-reference the primary superblock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 329/547] xfs: jump out of xchk_bmap_check_rmap if fatal signals Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-05 15:38 ` Barry K. Nathan
2026-11-04 21:08 ` [PATCH 7.3 331/547] xfs: adjust checks for cross-AG reaping issues Greg Kroah-Hartman
` (225 subsequent siblings)
555 siblings, 1 reply; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 0c61016006ab08f8346f9e7b1e38559bd4ea499e upstream.
Make sure we cross-reference the primary superblock against the rest of
the AG 0 space metadata. Drop the unused @bp parameter of
xchk_superblock_xref to avoid complaints about uninitialized variables.
Cc: stable@vger.kernel.org # v4.16
Fixes: 52dc4b44af7419 ("xfs: cross-reference with the bnobt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
| 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/fs/xfs/scrub/agheader.c
+++ b/fs/xfs/scrub/agheader.c
@@ -35,8 +35,7 @@ xchk_setup_agheader(
/* Cross-reference with the other btrees. */
STATIC void
xchk_superblock_xref(
- struct xfs_scrub *sc,
- struct xfs_buf *bp)
+ struct xfs_scrub *sc)
{
struct xfs_mount *mp = sc->mp;
xfs_agnumber_t agno = sc->sm->sm_agno;
@@ -106,16 +105,12 @@ xchk_superblock(
struct xfs_dsb *sb;
struct xfs_perag *pag;
size_t sblen;
- xfs_agnumber_t agno;
+ xfs_agnumber_t agno = sc->sm->sm_agno;
uint32_t v2_ok;
__be32 features_mask;
int error;
__be16 vernum_mask;
- agno = sc->sm->sm_agno;
- if (agno == 0)
- return 0;
-
/*
* Grab an active reference to the perag structure. If we can't get
* it, we're racing with something that's tearing down the AG, so
@@ -125,6 +120,9 @@ xchk_superblock(
if (!pag)
return -ENOENT;
+ if (agno == 0)
+ goto out_xref;
+
error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp);
/*
* The superblock verifier can return several different error codes
@@ -430,7 +428,8 @@ xchk_superblock(
if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen))
xchk_block_set_corrupt(sc, bp);
- xchk_superblock_xref(sc, bp);
+out_xref:
+ xchk_superblock_xref(sc);
out_pag:
xfs_perag_put(pag);
return error;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 331/547] xfs: adjust checks for cross-AG reaping issues
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 330/547] xfs: cross-reference the primary superblock Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 332/547] xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks Greg Kroah-Hartman
` (224 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 4c6668ecebc61bb0a53d4c6e95509bc960cf6bbc upstream.
While analyzing the reaping code for the previous patch, I studied the
xfs_fsblock_t code to reconstruct how this code works. AGs have a
superblock at the start of each AG which means that regions in the
xfsb_bitmap (aka xfs_fsblock_t bitmap) cannot cross an AG boundary, so
we don't need a loop here like we do for xfs_rtblock_t bitmaps.
However, the checks here are not quite right -- there can be quite a lot
of reserved space in COW forks, which means that the bitmap extent
actually can exceed XFS_MAX_BMBT_EXTLEN. We also don't have an explicit
debugging check that we never cross AGs, so add that here.
Cc: stable@vger.kernel.org # v6.8
Fixes: 66da11280f7ecd ("xfs: reintroduce reaping of file metadata blocks to xrep_reap_extents")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/reap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -796,9 +796,9 @@ xreap_fsmeta_extent(
xfs_agblock_t agbno_next = agbno + len;
int error = 0;
- ASSERT(len <= XFS_MAX_BMBT_EXTLEN);
ASSERT(sc->ip != NULL);
ASSERT(!sc->sa.pag);
+ ASSERT(agno == XFS_FSB_TO_AGNO(sc->mp, fsbno + len - 1));
/*
* We're reaping blocks after repairing file metadata, which means that
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 332/547] xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 331/547] xfs: adjust checks for cross-AG reaping issues Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 333/547] xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null Greg Kroah-Hartman
` (223 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 436ae68743a6974021fefa21fd3093d9bf8e66e4 upstream.
LOLLM noticed that xrep_dinode_check_dfork doesn't require that the
inode has the METADATA flag set in flags2. Add that check.
Cc: stable@vger.kernel.org # v6.14
Fixes: 702c90f4516223 ("xfs: support file data forks containing metadata btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1014,6 +1014,11 @@ xrep_dinode_bad_metabt_fork(
if (whichfork != XFS_DATA_FORK)
return true;
+ if (!xfs_has_metadir(sc->mp))
+ return true;
+ if (!(dip->di_flags2 & cpu_to_be64(XFS_DIFLAG2_METADATA)))
+ return true;
+
switch (be16_to_cpu(dip->di_metatype)) {
case XFS_METAFILE_RTRMAP:
return xrep_dinode_bad_rtrmapbt_fork(sc, dip, dfork_size);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 333/547] xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 332/547] xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 334/547] netfilter: nft_payload: restrict checksum offsets to known values Greg Kroah-Hartman
` (222 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 6b8d60784b61a17bd591cb4c6e8aa9ed29c24f5c upstream.
LOLLM complains that xchk_stats_estimate_bufsize underestimates the
buffer size by 1 byte because scnprintf wants to store a null byte after
the newline in each line. Each call to scnprintf overwrites the null
left by the previous call, but we still need the null byte for the last
line in the file.
Cc: stable@vger.kernel.org # v6.6
Fixes: d7a74cad8f4513 ("xfs: track usage statistics of online fsck")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/stats.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/stats.c
+++ b/fs/xfs/scrub/stats.c
@@ -168,7 +168,8 @@ xchk_stats_estimate_bufsize(
ret += field_width + 1;
}
- return ret;
+ /* null byte for scnprintf */
+ return ret + 1;
}
/* Clear all counters. */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 334/547] netfilter: nft_payload: restrict checksum offsets to known values
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 333/547] xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 335/547] rtnetlink: wait for RCU readers in rtnl_link_unregister() Greg Kroah-Hartman
` (221 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit c2226f0c7fe90b67732e5ae36dc5c3cc01ddf888 ]
We need to prevent userspace from corrupting e.g. tcp->doff, because
many locations in conntrack and conntrack helpers rely on
nf_conntrack_in() having validated the packet headers.
nft_payload allows to alter headers later which invalidates this
assumption.
The 'Fixes' commit restricts writes to safe fields, but there is
another side channel: the checksum location.
Restrict this too. Reported via sashiko/gemini.
Fixes: 112e447d17f7 ("netfilter: validate L4 headers after userspace packet writes")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_payload.c | 40 ++++++++++++++++++++++++++++++-------
1 file changed, 33 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index e315d35f73d4a..5b76af68b7049 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -20,6 +20,7 @@
#include <linux/tcp.h>
#include <linux/udp.h>
#include <net/gre.h>
+#include <linux/icmp.h>
#include <linux/icmpv6.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
@@ -1008,11 +1009,14 @@ static bool nft_payload_validate_inet_csum_offset(const struct nft_ctx *ctx,
if (priv->csum_flags) /* makes no sense, asks for "re-update" of L4 checksum */
return false;
- /* no further check here; offset can't be negative so bogus
- * offsets can corrupt L4 or payload but not l3 headers.
- * We already allow arbitrary l4/inner payload writes.
- */
- return true;
+ /* Validate csum_offset is one of the supported transport header checksums */
+ if (priv->csum_offset == offsetof(struct tcphdr, check) ||
+ priv->csum_offset == offsetof(struct udphdr, check) ||
+ priv->csum_offset == offsetof(struct icmphdr, checksum) ||
+ priv->csum_offset == offsetof(struct icmp6hdr, icmp6_cksum))
+ return true;
+
+ return false;
case NFT_PAYLOAD_INNER_HEADER:
return true;
case NFT_PAYLOAD_TUN_HEADER:
@@ -1046,6 +1050,27 @@ static bool nft_payload_csum_nh_write_ok(const struct nft_payload_set *priv,
return false;
}
+static bool nft_payload_csum_th_write_ok(const struct nft_payload_set *priv,
+ const struct nft_pktinfo *pkt)
+{
+ if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
+ return false;
+
+ switch (pkt->tprot) {
+ case IPPROTO_TCP:
+ return priv->csum_offset == offsetof(struct tcphdr, check);
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ return priv->csum_offset == offsetof(struct udphdr, check);
+ case IPPROTO_ICMPV6:
+ return priv->csum_offset == offsetof(struct icmp6hdr, icmp6_cksum);
+ case IPPROTO_ICMP:
+ return priv->csum_offset == offsetof(struct icmphdr, checksum);
+ }
+
+ return false;
+}
+
static bool nft_payload_csum_write_ok(const struct nft_pktinfo *pkt,
const struct nft_payload_set *priv)
{
@@ -1055,9 +1080,10 @@ static bool nft_payload_csum_write_ok(const struct nft_pktinfo *pkt,
case NFT_PAYLOAD_NETWORK_HEADER:
return nft_payload_csum_nh_write_ok(priv, pkt);
case NFT_PAYLOAD_TRANSPORT_HEADER:
+ return nft_payload_csum_th_write_ok(priv, pkt);
case NFT_PAYLOAD_INNER_HEADER:
- /* neither offsets are validated, offsets cannot be
- * negative so real l3 headers cannot be mangled.
+ /* offset is not validated, offset cannot be
+ * negative so real l3/l4 headers cannot be mangled.
*/
return true;
case NFT_PAYLOAD_TUN_HEADER:
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 335/547] rtnetlink: wait for RCU readers in rtnl_link_unregister()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 334/547] netfilter: nft_payload: restrict checksum offsets to known values Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 336/547] xfs: reduce new btree slack factor if free space is negative Greg Kroah-Hartman
` (220 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Andrea Parri,
Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin, stable+noautosel
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 3b70edea393de445255da6c706eebb823117a955 ]
rtnl_link_ops_get() finds ops on link_ops under rcu_read_lock() and only
then takes ops->srcu. rtnl_link_unregister() unlinks ops, then calls
synchronize_srcu() and cleanup_srcu_struct() without first waiting for
RCU readers. A reader that found ops before list_del_rcu() and has not yet
taken ops->srcu is not waited for.
Such a reader then locks a cleaned-up srcu_struct and keeps using ops
after the module that owns it is gone. rtnl_newlink() and
rtnl_dump_ifinfo() both look up ops without RTNL, the latter for any
user that dumps links filtered by kind.
With delays added between the lookup and srcu_read_lock() in
rtnl_link_ops_get(), and before rtnl_link_ops_put() in
rtnl_dump_ifinfo(), running "ip link show type dummy" alongside
"rmmod dummy" on a KASAN kernel gives:
BUG: KASAN: vmalloc-out-of-bounds in __srcu_read_unlock+0x57/0x70
Read of size 8 at addr ffffffffc02ff318 by task ip/147
Call Trace:
__srcu_read_unlock+0x57/0x70
rtnl_dump_ifinfo.cold+0x30/0x3b
rtnl_dumpit+0x7a/0x1b0
netlink_dump+0x486/0x11b0
__netlink_dump_start+0x661/0x910
rtnetlink_rcv_msg+0x611/0x9e0
netlink_rcv_skb+0x126/0x380
netlink_unicast+0x605/0x830
netlink_sendmsg+0x6d0/0xbb0
__sys_sendto+0x335/0x3a0
Call synchronize_rcu() before synchronize_srcu(), as
rtnl_af_unregister() already does. This should be enough because
rtnl_link_ops_get() is the only RCU walker of link_ops, and it takes
ops->srcu before rcu_read_unlock(), so every reader that found ops is
covered by synchronize_srcu() once the RCU grace period ends. The extra
grace period only costs time at module unload.
Readers and the writer were serialized by RTNL until link_ops got its
own mutex, which is why the missing RCU wait did not matter before.
Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns)
Fixes: 6b57ff21a310 ("rtnetlink: Protect link_ops by mutex.")
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261001143040.28467-1-parri.andrea@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index be9d1625bac31..580101b5ab585 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -707,6 +707,10 @@ void rtnl_link_unregister(struct rtnl_link_ops *ops)
list_del_rcu(&ops->list);
mutex_unlock(&link_ops_mutex);
+ /* Wait for rtnl_link_ops_get() readers that found ops but have
+ * not yet taken ops->srcu.
+ */
+ synchronize_rcu();
synchronize_srcu(&ops->srcu);
cleanup_srcu_struct(&ops->srcu);
--
2.53.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 336/547] xfs: reduce new btree slack factor if free space is negative
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 335/547] rtnetlink: wait for RCU readers in rtnl_link_unregister() Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 337/547] xfs: reject absurdly large xattr value lengths in xchk_xattr_actor Greg Kroah-Hartman
` (219 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 80f13dc7225eec318da7499c7a562d7a34d25e6a upstream.
LOLLM points out that if the incore fdblocks counter is negative, the
assignment to uint64_t will mask this possibly low space situation and
we don't pack the btree blocks as tightly as we probably ought to. If
it's the case that there's some free space and fdblocks is too low due
to an error in the superblock field, then we can end up failing btree
rebuilds due to ENOSPC unnecessarily. This is a corner case, but let's
fix it anyway.
Cc: stable@vger.kernel.org # v6.8
Fixes: be408417630427 ("xfs: implement block reservation accounting for btrees we're staging")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/newbt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/newbt.c
+++ b/fs/xfs/scrub/newbt.c
@@ -71,7 +71,7 @@ xrep_newbt_estimate_slack(
free = sc->sa.pag->pagf_freeblks;
sz = xfs_ag_block_count(sc->mp, pag_agno(sc->sa.pag));
} else {
- free = xfs_sum_freecounter_raw(sc->mp, XC_FREE_BLOCKS);
+ free = xfs_sum_freecounter(sc->mp, XC_FREE_BLOCKS);
sz = sc->mp->m_sb.sb_dblocks;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 337/547] xfs: reject absurdly large xattr value lengths in xchk_xattr_actor
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 336/547] xfs: reduce new btree slack factor if free space is negative Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 338/547] xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value Greg Kroah-Hartman
` (218 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit fd012955641881169a9f01a00f656f6ca73842ec upstream.
LOLLM suggests that we shouldn't try to allocate absurdly large buffers
for xattr value checks because that will push reclaim very hard, never
succeed, and is pointless because nobody can create xattrs that large.
Since the xattr repair code ignores values larger than XATTR_SIZE_MAX,
we can flag the corruption and return early.
Cc: stable@vger.kernel.org # v5.3
Fixes: 6d6ccedd76823c ("xfs: only allocate memory for scrubbing attributes when we need it")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/attr.c | 6 ++++++
fs/xfs/scrub/parent_repair.c | 4 ++++
2 files changed, 10 insertions(+)
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -216,6 +216,12 @@ xchk_xattr_actor(
return -ECANCELED;
}
+ /* Don't even try to handle a bizarrely large xattr. */
+ if (valuelen > XATTR_SIZE_MAX) {
+ xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, args.blkno);
+ return -ECANCELED;
+ }
+
/*
* Try to allocate enough memory to extract the attr value. If that
* doesn't work, return -EDEADLOCK as a signal to try again with a
--- a/fs/xfs/scrub/parent_repair.c
+++ b/fs/xfs/scrub/parent_repair.c
@@ -910,6 +910,10 @@ xrep_parent_fetch_xattr_remote(
};
int error;
+ /* Don't even try to handle a bizarrely large xattr. */
+ if (valuelen > XATTR_SIZE_MAX)
+ return -EFSCORRUPTED;
+
/*
* If we need a larger value buffer, try to allocate one. If that
* fails, return with -EDEADLOCK to try harder.
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 338/547] xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 337/547] xfs: reject absurdly large xattr value lengths in xchk_xattr_actor Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 339/547] xfs: reject remote xattr entries with an out-of-range value length Greg Kroah-Hartman
` (217 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Darrick J. Wong,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 0643549ffecaeb716c0b75590a9b76dfa5eb35b3 upstream.
xfs_attr_copy_value() takes the value length as a signed int and, for a
remote xattr, is handed args->rmtvaluelen. That field is filled from the
on-disk __be32 xfs_attr_leaf_name_remote.valuelen in
xfs_attr3_leaf_getvalue(), so a crafted length such as 0x80000000 is
stored into the signed rmtvaluelen as a negative number.
The "buffer too small" guard in xfs_attr_copy_value() is a signed
comparison:
if (args->valuelen < valuelen)
return -ERANGE;
A negative valuelen therefore compares as smaller than the caller's
buffer size, skips the -ERANGE path, and is then used as a copy length,
leading to an out-of-bounds copy of a full remote block into a small
getxattr(2) buffer on a mounted crafted image.
Reject a value length that is negative or larger than the maximum xattr
size before it is used, so a bogus on-disk length can no longer slip
through the value copier.
Fixes: 9df243a1a9e6 ("xfs: consolidate attribute value copying")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_attr_leaf.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -643,6 +643,17 @@ xfs_attr_copy_value(
int valuelen)
{
/*
+ * A value length that is negative or larger than the maximum xattr
+ * size is on-disk corruption. The remote value length is an on-disk
+ * __be32 stored into the signed args->rmtvaluelen, so a crafted value
+ * such as 0x80000000 becomes negative and would slip past the
+ * "args->valuelen < valuelen" check below and be used as a copy
+ * length. Reject it before that can happen.
+ */
+ if (valuelen < 0 || valuelen > XFS_XATTR_SIZE_MAX)
+ return -EFSCORRUPTED;
+
+ /*
* Parent pointer lookups require the caller to specify the name and
* value, so don't copy anything.
*/
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 339/547] xfs: reject remote xattr entries with an out-of-range value length
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 338/547] xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 340/547] xfs: release ip after unlinked list store failure Greg Kroah-Hartman
` (216 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Darrick J. Wong,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 15ccd92a782a0253f4a17895f3d3f71e5c1d1973 upstream.
xfs_attr3_leaf_verify_entry() validates a remote attribute entry's name
but never bounds its on-disk value length (xfs_attr_leaf_name_remote.
valuelen, a __be32). A crafted leaf with valuelen = 0x80000000 passes
the verifier and the CRC.
That length is later assigned into the signed int args->rmtvaluelen
(xfs_attr3_leaf_getvalue), becoming negative, which slips past the signed
-ERANGE check in xfs_attr_copy_value(); a getxattr() with a small buffer
then memcpy()s a full remote block into the small kvalue buffer
(xfs_attr_rmtval_copyout) -- a heap out-of-bounds write with
attacker-controlled content, from an unprivileged getxattr(2) on a
mounted crafted image.
Reject remote entries whose value length exceeds XFS_XATTR_SIZE_MAX in
the leaf verifier, so the malicious block is rejected at read time.
Fixes: c84760659dcf ("xfs: check attribute leaf block structure")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_attr_leaf.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -353,6 +353,8 @@ xfs_attr3_leaf_verify_entry(
if (!(ent->flags & XFS_ATTR_INCOMPLETE) &&
rentry->valueblk == 0)
return __this_address;
+ if (be32_to_cpu(rentry->valuelen) > XFS_XATTR_SIZE_MAX)
+ return __this_address;
}
if (name_end > buf_end)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 340/547] xfs: release ip after unlinked list store failure
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 339/547] xfs: reject remote xattr entries with an out-of-range value length Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 341/547] xfs: rescan the AGs if incore delalloc counter is negative Greg Kroah-Hartman
` (215 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 9a263723d7c9ab0615bab3f5cc145d3d24454a5c upstream.
If, while processing an unlinked list we see an inode that has nonzero
link count, we fail to store the incore prev/next pointers, we should
release the incore inode instead of leaking it. This was in the llm
fixes branch but fell out for -rc7. Weird.
Cc: stable@vger.kernel.org # v7.2-rc7
Fixes: 0052633527158b ("xfs: don't ignore runtime errors in xrep_iunlink_reload_next")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
| 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -1081,12 +1081,9 @@ xrep_iunlink_reload_next(
if (VFS_I(ip)->i_nlink != 0) {
error = xrep_iunlink_store_next(ragi, agino, NULLAGINO);
if (error)
- return error;
+ goto rele;
error = xrep_iunlink_store_prev(ragi, agino, LINKED_AGINO);
- if (error)
- return error;
-
goto rele;
}
@@ -1100,7 +1097,7 @@ xrep_iunlink_reload_next(
*/
rele:
xchk_irele(sc, ip);
- return 0;
+ return error;
}
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 341/547] xfs: rescan the AGs if incore delalloc counter is negative
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 340/547] xfs: release ip after unlinked list store failure Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 342/547] xfs: update quota flags on secondary supers when metadir enabled Greg Kroah-Hartman
` (214 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 47b1e941bb55f735d82ba2649412260da78b98f8 upstream.
LOLLM complains that percpu_counter_sum can return a negative number but
we instead misinterpret that into a huge unsigned value and do bad
things to fdblocks. It shouldn't do that, so let's add a retry loop and
an attempt to freeze the filesystem to (hopefully) zero out the incore
delalloc counter. It probably won't work, but at least failing the
repair beats doing the wrong thing.
Cc: stable@vger.kernel.org # v5.2
Fixes: 75efa57d0bf5fc ("xfs: add online scrub for superblock counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/fscounters.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -297,7 +297,7 @@ xchk_fscount_aggregate_agcounts(
{
struct xfs_mount *mp = sc->mp;
struct xfs_perag *pag = NULL;
- uint64_t delayed;
+ int64_t delayed;
int tries = 8;
int error = 0;
@@ -359,6 +359,11 @@ retry:
* of the computation.
*/
delayed = percpu_counter_sum(&mp->m_delalloc_blks);
+ if (delayed < 0) {
+ ASSERT(delayed >= 0);
+ xchk_set_incomplete(sc);
+ return -EFSCORRUPTED;
+ }
fsc->fdblocks -= delayed;
trace_xchk_fscounters_calc(mp, fsc->icount, fsc->ifree, fsc->fdblocks,
@@ -412,6 +417,7 @@ xchk_fscount_count_frextents(
{
struct xfs_mount *mp = sc->mp;
struct xfs_rtgroup *rtg = NULL;
+ int64_t delayed;
int error;
fsc->frextents = 0;
@@ -437,7 +443,14 @@ xchk_fscount_count_frextents(
}
}
- fsc->frextents_delayed = percpu_counter_sum(&mp->m_delalloc_rtextents);
+ delayed = percpu_counter_sum(&mp->m_delalloc_rtextents);
+ if (delayed < 0) {
+ ASSERT(delayed >= 0);
+ xchk_set_incomplete(sc);
+ return -EFSCORRUPTED;
+ }
+ fsc->frextents_delayed = delayed;
+
return 0;
}
#else
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 342/547] xfs: update quota flags on secondary supers when metadir enabled
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 341/547] xfs: rescan the AGs if incore delalloc counter is negative Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 343/547] xfs: abort directory tree repair whenever dl->aborted is set Greg Kroah-Hartman
` (213 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 9d9ea6e6cbc4cb1a36fb79f873d97e1ac2fe1a64 upstream.
xfs/085 exposes an interesting bug when metadir is enabled, quotas are
enabled via mount option, and the primary superblock crc fails
validation:
Phase 1 - find and verify superblock...
bad primary superblock - bad CRC in superblock !!!
attempting to find secondary superblock...
.found candidate secondary superblock...
verified secondary superblock...
quota accounting and enforcement flags lost
<snip>
Phase 3 - for each AG...
- scan and clear agi unlinked lists...
- process known inodes and perform inode discovery...
- agno = 0
- agno = 1
- agno = 2
unexpected regular file inode 16908418 with metadata flag will zap
cleared inode 16908418
unexpected regular file inode 16908419 with metadata flag will zap
cleared inode 16908419
unexpected regular file inode 16908420 with metadata flag will zap
cleared inode 16908420
- agno = 3
- process newly discovered inodes...
Quota files have been created, but xfs_repair thinks that quotas aren't
enabled and trashes the quota files. Looking at the filesystem reveals
that the quota accounting flags were indeed persisted to the primary
superblock but not the secondary:
# xfs_db -c 'sb 0' -c 'print qflags' -c 'sb 1' -c 'print qflags' /dev/sdf
Metadata corruption detected at 0x561c68436080, inode 0x81 dinode
xfs_db: Failed to load metadir root directory, error 117
Metadata corruption detected at 0x561c683f7c80, xfs_agf block 0x1/0x200
xfs_db: cannot init perag data (117). Continuing anyway.
Metadata CRC error detected at 0x561c6844d1b5, xfs_sb block 0x0/0x200
qflags = 0x7cf
qflags = 0
On a metadir filesystem, quota state is supposed to persist across
mount cycles if the sysadmin doesn't provide any quota mount options.
Therefore, any time we update the quota flags on a metadir filesystem,
we should write the same change to the secondary supers so that
xfs_repair will find the quota data if it ever has to restore from a
secondary.
Cc: stable@vger.kernel.org # v6.13
Fixes: d5d9dd5b3026a8 ("xfs: persist quota flags with metadir")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_mount.c | 9 ++++++++-
fs/xfs/xfs_qm.c | 36 +++++++++++++++++++++++++++++++++++-
fs/xfs/xfs_quota.h | 9 +++++++++
3 files changed, 52 insertions(+), 2 deletions(-)
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -446,6 +446,8 @@ int
xfs_mount_reset_sbqflags(
struct xfs_mount *mp)
{
+ int error;
+
mp->m_qflags = 0;
/* It is OK to look at sb_qflags in the mount path without m_sb_lock. */
@@ -458,7 +460,12 @@ xfs_mount_reset_sbqflags(
if (!xfs_fs_writable(mp, SB_FREEZE_WRITE))
return 0;
- return xfs_sync_sb(mp, false);
+ error = xfs_sync_sb(mp, false);
+ if (error)
+ return error;
+
+ xfs_qm_update_secondary_sb(mp);
+ return 0;
}
static const char *const xfs_free_pool_name[] = {
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -694,6 +694,32 @@ xfs_qm_create_metadir_qinos(
}
/*
+ * For metadir filesystems, quota flag state persists across mounts, so update
+ * secondary superblocks in case xfs_repair ever has to recover the primary
+ * from a secondary. growfs also updates backup supers so lock against that.
+ * Note that the secondary backups are opportunistic, so we log but do not
+ * return write errors.
+ */
+void
+__xfs_qm_update_secondary_sb(
+ struct xfs_mount *mp,
+ const char *func)
+{
+ int error;
+
+ if (!xfs_has_metadir(mp))
+ return;
+
+ mutex_lock(&mp->m_growlock);
+ error = xfs_update_secondary_sbs(mp);
+ mutex_unlock(&mp->m_growlock);
+
+ if (error)
+ xfs_alert(mp, "%s: Secondary super update failed, err=%d!",
+ func, error);
+}
+
+/*
* Add QUOTABIT to sb_versionnum and initialize qflags in preparation for
* creating quota files on a metadir filesystem.
*/
@@ -718,7 +744,12 @@ xfs_qm_prep_metadir_sb(
spin_unlock(&mp->m_sb_lock);
xfs_log_sb(tp);
- return xfs_trans_commit(tp);
+ error = xfs_trans_commit(tp);
+ if (error)
+ return error;
+
+ xfs_qm_update_secondary_sb(mp);
+ return 0;
}
/*
@@ -1683,6 +1714,9 @@ xfs_qm_mount_quotas(
ASSERT(!(XFS_IS_QUOTA_ON(mp)));
xfs_alert(mp, "%s: Superblock update failed!",
__func__);
+ } else {
+ /* Primary update succeeded, try to write secondary */
+ xfs_qm_update_secondary_sb(mp);
}
}
--- a/fs/xfs/xfs_quota.h
+++ b/fs/xfs/xfs_quota.h
@@ -151,6 +151,8 @@ void xfs_dqtrx_hook_setup(struct xfs_dqt
xfs_trans_mod_dquot((tp), (dqp), (field), (delta))
# endif /* CONFIG_XFS_LIVE_HOOKS */
+void __xfs_qm_update_secondary_sb(struct xfs_mount *mp,
+ const char *func);
#else
static inline int
xfs_qm_vop_dqalloc(struct xfs_inode *ip, kuid_t kuid, kgid_t kgid,
@@ -216,8 +218,15 @@ static inline int xfs_quota_reserve_blkr
# define xfs_dqtrx_hook_disable() ((void)0)
# endif /* CONFIG_XFS_LIVE_HOOKS */
+static inline void __xfs_qm_update_secondary_sb(struct xfs_mount *mp,
+ const char *func)
+{
+}
#endif /* CONFIG_XFS_QUOTA */
+#define xfs_qm_update_secondary_sb(mp) \
+ __xfs_qm_update_secondary_sb((mp), __func__)
+
static inline void
xfs_quota_unreserve_blkres(struct xfs_inode *ip, uint64_t blocks)
{
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 343/547] xfs: abort directory tree repair whenever dl->aborted is set
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 342/547] xfs: update quota flags on secondary supers when metadir enabled Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 344/547] xfs: always forget cached ACLs if the attr fork swap succeeds Greg Kroah-Hartman
` (212 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 4582327e7068194d55941b49dd66be211b9e3f90 upstream.
LOLLM observed that if the live update hooks for the directory tree
repair code ever fail, they'll set dl->aborted, but then the main repair
code path won't check it to exit early. This can cause incorrect
repairs, so let's check for hook errors and abort the repair.
Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dirtree_repair.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -575,6 +575,8 @@ xrep_dirtree_delete_path(
if (!error && dl->stale)
error = -ESTALE;
+ if (!error && dl->aborted)
+ error = -EIO;
return error;
}
@@ -720,6 +722,11 @@ xrep_dirtree_adopt(
error = -ESTALE;
goto out_trans;
}
+ if (dl->aborted) {
+ mutex_unlock(&dl->lock);
+ error = -EIO;
+ goto out_trans;
+ }
error = xrep_dirtree_create_adoption_path(dl);
mutex_unlock(&dl->lock);
if (error)
@@ -780,6 +787,8 @@ xrep_dirtree_move_to_orphanage(
if (!error && dl->stale)
error = -ESTALE;
+ if (!error && dl->aborted)
+ error = -EIO;
return error;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 344/547] xfs: always forget cached ACLs if the attr fork swap succeeds
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 343/547] xfs: abort directory tree repair whenever dl->aborted is set Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 345/547] xfs: always report inode repair setup failures Greg Kroah-Hartman
` (211 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 41ee987f53785b9443388a756912b1a0fe3c9592 upstream.
LOLLM complains that xrep_xattr_rebuild_tree omits the xfs_forget_acl
call if the attr fork swap succeeds (and hence the acls might have
changed) but reaping the old attr fork fails. Fix it so that we always
purge the cached acls if the swap succeeds, even if subsequent steps do
not. This avoids some cache coherency problems with access controls.
Cc: stable@vger.kernel.org # v6.10
Fixes: e47dcf113ae348 ("xfs: repair extended attributes")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/attr_repair.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1491,7 +1491,7 @@ xrep_xattr_rebuild_tree(
error = xrep_xattr_reset_tempfile_fork(sc);
if (error)
- return error;
+ goto forget_acls;
/*
* Roll to get a transaction without any inodes joined to it. Then we
@@ -1500,7 +1500,7 @@ xrep_xattr_rebuild_tree(
*/
error = xfs_trans_roll(&sc->tp);
if (error)
- return error;
+ goto forget_acls;
xrep_tempfile_iunlock(sc);
xrep_tempfile_iounlock(sc);
@@ -1509,7 +1509,7 @@ forget_acls:
/* Invalidate cached ACLs now that we've reloaded all the xattrs. */
xfs_forget_acl(VFS_I(sc->ip), SGI_ACL_FILE);
xfs_forget_acl(VFS_I(sc->ip), SGI_ACL_DEFAULT);
- return 0;
+ return error;
}
/* Tear down all the incore scan stuff we created. */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 345/547] xfs: always report inode repair setup failures
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 344/547] xfs: always forget cached ACLs if the attr fork swap succeeds Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 346/547] xfs: always report scrub errors in tracepoints Greg Kroah-Hartman
` (210 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit ce9098338a7e1a77246684242d10779fc4d4a539 upstream.
LOLLM noticed that xchk_setup_inode silently discards errors being
returned by xrep_setup_inode. Fix that, and fix the stub macro so that
it actually "returns" a value.
Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode.c | 2 +-
fs/xfs/scrub/repair.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/inode.c
+++ b/fs/xfs/scrub/inode.c
@@ -212,7 +212,7 @@ xchk_setup_inode(
* make repairs to the ondisk inode buffer.
*/
if (xchk_could_repair(sc))
- xrep_setup_inode(sc, &imap);
+ return xrep_setup_inode(sc, &imap);
return 0;
out_cancel:
--- a/fs/xfs/scrub/repair.h
+++ b/fs/xfs/scrub/repair.h
@@ -239,7 +239,7 @@ xrep_setup_nothing(
#define xrep_setup_rtrmapbt xrep_setup_nothing
#define xrep_setup_rtrefcountbt xrep_setup_nothing
-#define xrep_setup_inode(sc, imap) ((void)0)
+#define xrep_setup_inode(sc, imap) (0)
static inline int xrep_setup_symlink(struct xfs_scrub *sc, unsigned int *x)
{
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 346/547] xfs: always report scrub errors in tracepoints
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 345/547] xfs: always report inode repair setup failures Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 347/547] xfs: always zero the whole shortform header when zeroing attr fork Greg Kroah-Hartman
` (209 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 1ccc8f553d885d49c1bfe141ea1f331511940b3a upstream.
LOLLM complains that the error processing functions in scrub will
sometimes zero out *error before recording a tracepoint. This makes
diagnosing problems harder, so let's fix that.
Cc: stable@vger.kernel.org # v4.15
Fixes: 4700d22980d459 ("xfs: create helpers to record and deal with scrub problems")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/btree.c | 8 +++++++-
fs/xfs/scrub/common.c | 7 +++++--
fs/xfs/scrub/dabtree.c | 6 +++++-
3 files changed, 17 insertions(+), 4 deletions(-)
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -46,8 +46,14 @@ __xchk_btree_process_error(
case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= errflag;
+ if (cur->bc_ops->type == XFS_BTREE_TYPE_INODE)
+ trace_xchk_ifork_btree_op_error(sc, cur, level,
+ *error, ret_ip);
+ else
+ trace_xchk_btree_op_error(sc, cur, level,
+ *error, ret_ip);
*error = 0;
- fallthrough;
+ break;
default:
if (cur->bc_ops->type == XFS_BTREE_TYPE_INODE)
trace_xchk_ifork_btree_op_error(sc, cur, level,
--- a/fs/xfs/scrub/common.c
+++ b/fs/xfs/scrub/common.c
@@ -107,8 +107,9 @@ __xchk_process_error(
case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= errflag;
+ trace_xchk_op_error(sc, agno, bno, *error, ret_ip);
*error = 0;
- fallthrough;
+ break;
default:
trace_xchk_op_error(sc, agno, bno, *error, ret_ip);
break;
@@ -183,8 +184,10 @@ __xchk_fblock_process_error(
case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= errflag;
+ trace_xchk_file_op_error(sc, whichfork, offset, *error,
+ ret_ip);
*error = 0;
- fallthrough;
+ break;
default:
trace_xchk_file_op_error(sc, whichfork, offset, *error,
ret_ip);
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -49,8 +49,12 @@ xchk_da_process_error(
case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+ trace_xchk_file_op_error(sc, ds->dargs.whichfork,
+ xfs_dir2_da_to_db(ds->dargs.geo,
+ ds->state->path.blk[level].blkno),
+ *error, __return_address);
*error = 0;
- fallthrough;
+ break;
default:
trace_xchk_file_op_error(sc, ds->dargs.whichfork,
xfs_dir2_da_to_db(ds->dargs.geo,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 347/547] xfs: always zero the whole shortform header when zeroing attr fork
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 346/547] xfs: always report scrub errors in tracepoints Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 348/547] xfs: bound da-node entry count against the correct geometry Greg Kroah-Hartman
` (208 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 52aa50cea408e27454d206cccecbe4f694a6c1e1 upstream.
LOLLM noticed that xrep_xattr_fork_remove can decide to reset the attr
fork contents to an empty shortform header, but then fails to zero the
padding byte in the header. Fix that.
Cc: stable@vger.kernel.org # v6.10
Fixes: e47dcf113ae348 ("xfs: repair extended attributes")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/attr_repair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -970,7 +970,7 @@ xrep_xattr_fork_remove(
ifp->if_format = XFS_DINODE_FMT_LOCAL;
hdr = xfs_idata_realloc(ip, (int)sizeof(*hdr) - ifp->if_bytes,
XFS_ATTR_FORK);
- hdr->count = 0;
+ memset(hdr, 0, sizeof(*hdr));
hdr->totsize = cpu_to_be16(sizeof(*hdr));
xfs_trans_log_inode(sc->tp, ip,
XFS_ILOG_CORE | XFS_ILOG_ADATA);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 348/547] xfs: bound da-node entry count against the correct geometry
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 347/547] xfs: always zero the whole shortform header when zeroing attr fork Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 349/547] xfs: bound inode fork length against the fork size during log recovery Greg Kroah-Hartman
` (207 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Darrick J. Wong,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 3df5e5aaa3bc0913236c48ab29b7df3a785aa29f upstream.
xfs_da3_node_verify() bounds the node entry count against the larger of
the directory and attribute geometries because, as a buffer verifier, it
cannot tell whether the block belongs to the directory or the attribute
tree. When the directory block size exceeds the fs block size (e.g.
mkfs.xfs -n size=64k -b size=4k), an attribute node buffer is a single fs
block that holds only m_attr_geo->node_ents entries, yet a crafted attr
node may claim a count up to m_dir_geo->node_ents and still pass the
verifier.
xfs_da3_node_lookup_int() then indexes btree[] up to that count during
its binary search -- an out-of-bounds read via getxattr/listxattr on a
mounted crafted image.
The buffer verifier is the wrong place to tighten this: it has no fork
context, and the transaction-less read path used by getxattr does not run
xfs_da3_node_set_type() either. xfs_da3_node_lookup_int(), on the other
hand, always runs on that path and holds args->geo, the geometry of the
fork actually being searched. Bound the entry count against
args->geo->node_ents there, before walking the entries.
Fixes: 7ab610f9e0f1 ("xfs: move node entry counts to xfs_da_geometry")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_da_btree.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -1787,6 +1787,20 @@ xfs_da3_node_lookup_int(
} else
expected_level--;
+ /*
+ * The node verifier cannot tell whether this block belongs to
+ * the directory or the attribute tree, so it only bounds the
+ * entry count against the larger of the two geometries. Here
+ * args->geo is the geometry of the fork we are actually
+ * searching, so reject a count that would walk btree[] off the
+ * end of this node buffer.
+ */
+ if (nodehdr.count > args->geo->node_ents) {
+ xfs_buf_mark_corrupt(blk->bp);
+ xfs_da_mark_sick(args);
+ return -EFSCORRUPTED;
+ }
+
max = nodehdr.count;
blk->hashval = be32_to_cpu(btree[max - 1].hashval);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 349/547] xfs: bound inode fork length against the fork size during log recovery
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 348/547] xfs: bound da-node entry count against the correct geometry Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 350/547] xfs: check for fragments when full-extent sharing matches Greg Kroah-Hartman
` (206 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Darrick J. Wong,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 9232301894a06e664d8de2da97175cf98419bd16 upstream.
xlog_recover_inode_commit_pass2() copies an inode log item's data/attr
fork region into the inode buffer using the on-log region length without
bounding it against the fork capacity, e.g.:
len = item->ri_buf[2].iov_len;
memcpy(XFS_DFORK_DPTR(dip), src, len);
The only guard is an ASSERT, which is a no-op on production kernels
(CONFIG_XFS_DEBUG off), and xfs_dinode_verify() runs only after the copy.
A crafted image with a dirty log can therefore drive a heap out-of-bounds
write at mount time. The XFS_ILOG_DBROOT sibling already passes
XFS_DFORK_DSIZE as a bound; the DDATA/DEXT and ADATA/AEXT memcpy paths
did not.
Bound each logged fork region against the destination fork size before
copying it, and reject the log item with -EFSCORRUPTED when it does not
fit. Because the recovered inode is only verified after the fork data has
been copied in, the checks are done up front, before any memcpy into the
on-disk inode.
Fixes: 658fa68b6f34 ("xfs: refactor log recovery inode item dispatch for pass2 commit functions")
Cc: stable@vger.kernel.org # v5.8
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_inode_item_recover.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
--- a/fs/xfs/xfs_inode_item_recover.c
+++ b/fs/xfs/xfs_inode_item_recover.c
@@ -507,6 +507,25 @@ xlog_recover_inode_commit_pass2(
ASSERT(!(fields & XFS_ILOG_DFORK) ||
(len == xlog_calc_iovec_len(in_f->ilf_dsize)));
+ /*
+ * The recovered inode is verified only after the fork data has been
+ * copied into it, so bound each logged fork region against the size of
+ * its fork now, before the memcpy below can overrun the on-disk inode.
+ * The DBROOT/ABROOT cases already bound their copies against the fork
+ * size.
+ */
+ if ((fields & (XFS_ILOG_DDATA | XFS_ILOG_DEXT)) &&
+ item->ri_buf[2].iov_len > XFS_DFORK_DSIZE(dip, mp)) {
+ error = -EFSCORRUPTED;
+ goto out_release;
+ }
+ if ((fields & (XFS_ILOG_ADATA | XFS_ILOG_AEXT)) &&
+ item->ri_buf[(fields & XFS_ILOG_DFORK) ? 3 : 2].iov_len >
+ XFS_DFORK_ASIZE(dip, mp)) {
+ error = -EFSCORRUPTED;
+ goto out_release;
+ }
+
switch (fields & XFS_ILOG_DFORK) {
case XFS_ILOG_DDATA:
case XFS_ILOG_DEXT:
@@ -546,7 +565,6 @@ xlog_recover_inode_commit_pass2(
case XFS_ILOG_ADATA:
case XFS_ILOG_AEXT:
dest = XFS_DFORK_APTR(dip);
- ASSERT(len <= XFS_DFORK_ASIZE(dip, mp));
memcpy(dest, src, len);
break;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 350/547] xfs: check for fragments when full-extent sharing matches
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 349/547] xfs: bound inode fork length against the fork size during log recovery Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 351/547] xfs: check for termination during rmap btree walk Greg Kroah-Hartman
` (205 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 95e213c1ddb40dfb0a8178ed35c9f29992a320e1 upstream.
LOLLM noticed that xchk_refcountbt_process_rmap_fragments returns early
if there are enough rmap records that overlap the space referenced by a
refcountbt record to match the refcount in that refcountbt record.
Unfortunately, it never checks the fragment list in this case, so it
won't find the discrepancy between the rmap and refcount btrees.
Cc: stable@vger.kernel.org # v4.16
Fixes: dbde19da963706 ("xfs: cross-reference the rmapbt data with the refcountbt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/refcount.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/refcount.c
+++ b/fs/xfs/scrub/refcount.c
@@ -173,8 +173,11 @@ xchk_refcountbt_process_rmap_fragments(
xfs_nlink_t target_nr;
target_nr = refchk->refcount - refchk->seen;
- if (target_nr == 0)
+ if (target_nr == 0) {
+ if (!list_empty(&refchk->fragments))
+ refchk->seen = 0;
return;
+ }
/*
* There are (refchk->rc.rc_refcount - refchk->nr refcount)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 351/547] xfs: check for termination during rmap btree walk
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 350/547] xfs: check for fragments when full-extent sharing matches Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 352/547] xfs: clarify various parts of the bitmap API Greg Kroah-Hartman
` (204 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 1fc241cdeab276dc6c3ec14840faa706ed7712ff upstream.
LOLLM complains that we should check for a fatal signal *every* time we
walk a record in the rmap btree as part of rebuilding the free space
btrees. Fix that, and improve responsiveness to ^C of xfs_scrub.
Cc: stable@vger.kernel.org # v6.8
Fixes: 4bdfd7d15747b1 ("xfs: repair free space btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/alloc_repair.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/alloc_repair.c
+++ b/fs/xfs/scrub/alloc_repair.c
@@ -227,7 +227,10 @@ xrep_abt_walk_rmap(
void *priv)
{
struct xrep_abt *ra = priv;
- int error;
+ int error = 0;
+
+ if (xchk_should_terminate(ra->sc, &error))
+ return error;
/* Record all the OWN_AG blocks... */
if (rec->rm_owner == XFS_RMAP_OWN_AG) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 352/547] xfs: clarify various parts of the bitmap API
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 351/547] xfs: check for termination during rmap btree walk Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 353/547] xfs: clear set[ug]id mode bits when zapping attr fork Greg Kroah-Hartman
` (203 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 00f32fdf54983371d39162efef7df693e2842ffb upstream.
LOLLM pointed out some underspecified parts of the xbitmap{32,64} API.
Specifically, the behavior of set/clear/test functions when the length
parameter is zero is not well defined, nor is what happens when someone
tries to disunion a bitmap with itself. None of these situations are
expected, but we'll define zero-length set and clear to be nops, and the
rest to be checked by assertions.
Cc: stable@vger.kernel.org # v6.8
Fixes: 6ece924b952262 ("xfs: create separate structures and code for u32 bitmaps")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/bitmap.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/fs/xfs/scrub/bitmap.c
+++ b/fs/xfs/scrub/bitmap.c
@@ -77,6 +77,9 @@ xbitmap64_clear(
struct xbitmap64_node *new_bn;
uint64_t last = start + len - 1;
+ if (!len)
+ return 0;
+
while ((bn = xbitmap64_tree_iter_first(&bitmap->xb_root, start, last))) {
if (bn->bn_start < start && bn->bn_last > last) {
uint64_t old_last = bn->bn_last;
@@ -127,6 +130,9 @@ xbitmap64_set(
uint64_t last = start + len - 1;
int error;
+ if (!len)
+ return 0;
+
/* Is this whole range already set? */
left = xbitmap64_tree_iter_first(&bitmap->xb_root, start, last);
if (left && left->bn_start <= start && left->bn_last >= last)
@@ -223,6 +229,8 @@ xbitmap64_disunion(
struct xbitmap64_node *bn;
int error;
+ ASSERT(bitmap != sub);
+
if (xbitmap64_empty(bitmap) || xbitmap64_empty(sub))
return 0;
@@ -287,6 +295,8 @@ xbitmap64_test(
struct xbitmap64_node *bn;
uint64_t last = start + *len - 1;
+ ASSERT(*len > 0);
+
bn = xbitmap64_tree_iter_first(&bitmap->xb_root, start, last);
if (!bn)
return false;
@@ -357,6 +367,9 @@ xbitmap32_clear(
struct xbitmap32_node *new_bn;
uint32_t last = start + len - 1;
+ if (!len)
+ return 0;
+
while ((bn = xbitmap32_tree_iter_first(&bitmap->xb_root, start, last))) {
if (bn->bn_start < start && bn->bn_last > last) {
uint32_t old_last = bn->bn_last;
@@ -407,6 +420,9 @@ xbitmap32_set(
uint32_t last = start + len - 1;
int error;
+ if (!len)
+ return 0;
+
/* Is this whole range already set? */
left = xbitmap32_tree_iter_first(&bitmap->xb_root, start, last);
if (left && left->bn_start <= start && left->bn_last >= last)
@@ -503,6 +519,8 @@ xbitmap32_disunion(
struct xbitmap32_node *bn;
int error;
+ ASSERT(bitmap != sub);
+
if (xbitmap32_empty(bitmap) || xbitmap32_empty(sub))
return 0;
@@ -567,6 +585,8 @@ xbitmap32_test(
struct xbitmap32_node *bn;
uint32_t last = start + *len - 1;
+ ASSERT(*len > 0);
+
bn = xbitmap32_tree_iter_first(&bitmap->xb_root, start, last);
if (!bn)
return false;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 353/547] xfs: clear set[ug]id mode bits when zapping attr fork
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 352/547] xfs: clarify various parts of the bitmap API Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 354/547] xfs: complain loudly when dirtree checker finds broken links Greg Kroah-Hartman
` (202 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit eb20a959760c21e3547cd811d0d9b0b29df98959 upstream.
LOLLM observes that zapping a file's attr fork could result in ACLs
being removed from the file. Because we have no idea what we're
deleting, we should clear the setuid and setgid bits in addition to the
access mode bits so that nobody can access the file.
Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1307,7 +1307,12 @@ xrep_dinode_zap_afork(
*/
if (dip->di_format != XFS_DINODE_FMT_BTREE)
dip->di_forkoff = 0;
- dip->di_mode = cpu_to_be16(mode & ~0777);
+
+ /*
+ * Zapping the attr fork could remove ACLs, so we clear suid/sgid and
+ * all access mode bits.
+ */
+ dip->di_mode = cpu_to_be16(mode & ~(S_ISUID | S_ISGID | 0777));
dip->di_uid = 0;
dip->di_gid = 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 354/547] xfs: complain loudly when dirtree checker finds broken links
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 353/547] xfs: clear set[ug]id mode bits when zapping attr fork Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 355/547] xfs: dont allow sm_agno for non-group metadir path checking Greg Kroah-Hartman
` (201 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit e09438cab72c2c6a32665829d4186155346bfee8 upstream.
LOLLM observed that the directory tree walk code bails out if it finds
broken parent pointers along the way. However, it flattens the return
code to zero, which means that we can end up in the repair code having
not completed the scan. We should never proceed with a repair in this
state, so let's mark the scrub incomplete and exit.
Cc: stable@vger.kernel.org # v6.10
Fixes: 928b721a11789a ("xfs: teach online scrub to find directory tree structure problems")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dirtree.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/dirtree.c
+++ b/fs/xfs/scrub/dirtree.c
@@ -860,7 +860,8 @@ xchk_dirtree_find_paths_to_root(
* A parent pointer of @sc->ip is bad, don't
* bother continuing.
*/
- break;
+ xchk_set_incomplete(sc);
+ return error;
}
if (error == -ESTALE) {
/* This had better be an invalidation. */
@@ -981,6 +982,7 @@ xchk_dirtree(
* parent pointers are corrupt; this scan cannot be completed
* without full information.
*/
+ xchk_set_incomplete(sc);
xchk_ip_xref_set_corrupt(sc, sc->ip);
error = 0;
goto out_scanlock;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 355/547] xfs: dont allow sm_agno for non-group metadir path checking
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 354/547] xfs: complain loudly when dirtree checker finds broken links Greg Kroah-Hartman
@ 2026-11-04 21:08 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 356/547] xfs: dont clear COWEXTSIZE on directories on reflink filesystems Greg Kroah-Hartman
` (200 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 20c5a56bc4f2329872d21561e4a2d4b8576004c9 upstream.
LOLLM noticed that the metadata directory tree path checker accepts
non-zero values in the sm_agno field for non-group metadata. Make that
case return -EINVAL.
Cc: stable@vger.kernel.org # v6.13
Fixes: a74923333d9c3b ("xfs: scrub metadir paths for rtgroup metadata")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/metapath.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/xfs/scrub/metapath.c
+++ b/fs/xfs/scrub/metapath.c
@@ -129,6 +129,8 @@ static int
xchk_setup_metapath_rtdir(
struct xfs_scrub *sc)
{
+ if (sc->sm->sm_agno)
+ return -EINVAL;
if (!sc->mp->m_rtdirip)
return -ENOENT;
@@ -176,6 +178,8 @@ xchk_setup_metapath_quotadir(
{
struct xfs_quotainfo *qi = sc->mp->m_quotainfo;
+ if (sc->sm->sm_agno)
+ return -EINVAL;
if (!qi || !qi->qi_dirip)
return -ENOENT;
@@ -192,6 +196,8 @@ xchk_setup_metapath_dqinode(
struct xfs_quotainfo *qi = sc->mp->m_quotainfo;
struct xfs_inode *ip = NULL;
+ if (sc->sm->sm_agno)
+ return -EINVAL;
if (!qi)
return -ENOENT;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 356/547] xfs: dont clear COWEXTSIZE on directories on reflink filesystems
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-11-04 21:08 ` [PATCH 7.3 355/547] xfs: dont allow sm_agno for non-group metadir path checking Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 357/547] xfs: dont overrun incore inode when cleaning attr forks Greg Kroah-Hartman
` (199 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 3978b1f3109dfd5c648442bb040f9abd58608226 upstream.
LOLLM noticed that xrep_dinode_flags clears the COWEXTSIZE flag
unnecessarily on directories on reflink filesystems. Directories just
pass the hint along to new children, so it's valid to leave the flag
set.
Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -563,6 +563,8 @@ xrep_dinode_flags(
*/
if (xfs_has_reflink(mp) && S_ISREG(mode))
flags2 |= XFS_DIFLAG2_REFLINK;
+ else if (xfs_has_reflink(mp) && S_ISDIR(mode))
+ flags2 &= ~XFS_DIFLAG2_REFLINK;
else
flags2 &= ~(XFS_DIFLAG2_REFLINK | XFS_DIFLAG2_COWEXTSIZE);
if (!xfs_has_bigtime(mp))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 357/547] xfs: dont overrun incore inode when cleaning attr forks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 356/547] xfs: dont clear COWEXTSIZE on directories on reflink filesystems Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 358/547] xfs: dont queue rmap update twice when reaping a fork Greg Kroah-Hartman
` (198 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit c28b4b48deac17749ed1ebe4289a4ba73541ddc6 upstream.
LOLLM noticed that xrep_dinode_check_afork doesn't check for a
di_forkoff value that is so large that the attr fork would begin after
the end of the inode space. This causes afork_{ptr,size} to be
nonsense. What we really ought to do here is zap the attr fork.
Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1243,6 +1243,8 @@ xrep_dinode_check_afork(
if (XFS_DFORK_BOFF(dip) == 0)
return dip->di_aformat != XFS_DINODE_FMT_EXTENTS ||
xfs_dfork_attr_extents(dip) != 0;
+ if (XFS_DFORK_BOFF(dip) >= XFS_LITINO(sc->mp))
+ return true;
afork_size = XFS_DFORK_SIZE(dip, sc->mp, XFS_ATTR_FORK);
afork_ptr = XFS_DFORK_PTR(dip, XFS_ATTR_FORK);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 358/547] xfs: dont queue rmap update twice when reaping a fork
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 357/547] xfs: dont overrun incore inode when cleaning attr forks Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 359/547] xfs: dont rescan ifree and icount when frozen Greg Kroah-Hartman
` (197 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 219ff8a734d8438e24eb346a847c9b1ad9b7ab5d upstream.
LOLLM noticed that xrep_reap_bmapi_iter calls xfs_bmap_unmap_extent and
xfs_rmap_unmap_extent to remove a mapping from a file fork and its
reverse mapping. However, xfs_bmap_del_extent_real also queues a
deferred rmap removal log item, which means that we incorrectly queue
two rmap removal operations. Fix that by removing the extra call and
updating the comment to mention this subtlety that I forgot, having
written the code. :P
Cc: stable@vger.kernel.org # v6.10
Fixes: 5befb047b9f4de ("xfs: add the ability to reap entire inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/reap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -1480,12 +1480,12 @@ xrep_reap_bmapi_iter(
/*
* t0: Schedule removal of the mapping from the fork. We use
* deferred log intents in this function to control the exact
- * sequence of metadata updates.
+ * sequence of metadata updates. The BUI queues a RUI to
+ * remove the reverse mapping.
*/
xfs_bmap_unmap_extent(sc->tp, rs->ip, rs->whichfork, imap);
xfs_trans_mod_dquot_byino(sc->tp, rs->ip, XFS_TRANS_DQ_BCOUNT,
-(int64_t)imap->br_blockcount);
- xfs_rmap_unmap_extent(sc->tp, rs->ip, rs->whichfork, imap);
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 359/547] xfs: dont rescan ifree and icount when frozen
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 358/547] xfs: dont queue rmap update twice when reaping a fork Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 360/547] xfs: dont scan across metadata/regular directory trees for dirents Greg Kroah-Hartman
` (196 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 18028768415e3c05ab7edb22d740e2f4dc52836a upstream.
LOLLM points out that it's pointless to rescan the AGs if we've already
frozen the filesystem because there won't be any more perturbations.
Fix this to mark the scan incomplete and exit.
Cc: stable@vger.kernel.org # v5.2
Fixes: 75efa57d0bf5fc ("xfs: add online scrub for superblock counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/fscounters.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -384,6 +384,11 @@ retry:
* to maintain ifree <= icount before giving up.
*/
if (fsc->ifree > fsc->icount) {
+ if (fsc->frozen) {
+ xchk_set_incomplete(sc);
+ return -EFSCORRUPTED;
+ }
+
if (tries--)
goto retry;
return -EDEADLOCK;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 360/547] xfs: dont scan across metadata/regular directory trees for dirents
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 359/547] xfs: dont rescan ifree and icount when frozen Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 361/547] xfs: dont set a metadata directorys parent to sb_rootino Greg Kroah-Hartman
` (195 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 03ce4ca43c00394364493865f417d646e252bac2 upstream.
LOLLM points out that the directory repair code should never scan files
in the regular directory tree when fixing a metadata directory and
vice-versa. Amend the scan predicate to check this condition.
Cc: stable@vger.kernel.org # v6.13
Fixes: 4f3d4dd1b04b2b ("xfs: define the on-disk format for the metadir feature")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dir_repair.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -1189,7 +1189,9 @@ xrep_dir_want_scan(
struct xrep_dir *rd,
const struct xfs_inode *ip)
{
- return ip != rd->sc->ip && !xrep_is_tempfile(ip);
+ return ip != rd->sc->ip &&
+ xfs_is_metadir_inode(ip) == xfs_is_metadir_inode(rd->sc->ip) &&
+ !xrep_is_tempfile(ip);
}
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 361/547] xfs: dont set a metadata directorys parent to sb_rootino
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 360/547] xfs: dont scan across metadata/regular directory trees for dirents Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 362/547] xfs: dont subtract excess usage twice when computing agf_btreeblks Greg Kroah-Hartman
` (194 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit c9f98b0f4f70c8cfd617dc2886bf2fc0a36ab9da upstream.
LOLLM complains that it's weird to set a metadata directory's parent
inumber to the regular directory tree root. Fix this even if nobody's
ever going to notice this because metadata path lookups don't access
dotdot.
Cc: stable@vger.kernel.org # v6.13
Fixes: 4f3d4dd1b04b2b ("xfs: define the on-disk format for the metadir feature")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dir_repair.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -1674,7 +1674,10 @@ xrep_dir_swap(
ASSERT(sc->ilock_flags & XFS_ILOCK_EXCL);
if (rd->pscan.parent_ino == NULLFSINO) {
rd->needs_adoption = true;
- rd->pscan.parent_ino = rd->sc->mp->m_sb.sb_rootino;
+ if (xfs_is_metadir_inode(rd->sc->ip))
+ rd->pscan.parent_ino = rd->sc->mp->m_sb.sb_metadirino;
+ else
+ rd->pscan.parent_ino = rd->sc->mp->m_sb.sb_rootino;
}
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 362/547] xfs: dont subtract excess usage twice when computing agf_btreeblks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 361/547] xfs: dont set a metadata directorys parent to sb_rootino Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 363/547] xfs: dont try to repair rtsummary if the summary file isnt computed Greg Kroah-Hartman
` (193 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 4439b626fb5104204952aa2f169451688fb6be26 upstream.
LOLLM noticed that the free space btree repair code calculates
agf_btreeblks from the number of blocks we wrote to rebuild the free
space btrees (minus the roots). That's correct. However, it observes
that we subtract the "excess" reservation, which is not correct. Fix
this accounting problem.
Cc: stable@vger.kernel.org # v6.8
Fixes: 4bdfd7d15747b1 ("xfs: repair free space btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/alloc_repair.c | 6 +-----
fs/xfs/scrub/newbt.c | 13 -------------
fs/xfs/scrub/newbt.h | 1 -
3 files changed, 1 insertion(+), 19 deletions(-)
--- a/fs/xfs/scrub/alloc_repair.c
+++ b/fs/xfs/scrub/alloc_repair.c
@@ -663,15 +663,11 @@ xrep_abt_reset_counters(
/*
* Compute the contribution to agf_btreeblks for the new free space
- * btrees. This is the computed btree size minus anything we didn't
- * use.
+ * btrees. This is the computed btree size minus the root block.
*/
freesp_btreeblks += ra->new_bnobt.bload.nr_blocks - 1;
freesp_btreeblks += ra->new_cntbt.bload.nr_blocks - 1;
- freesp_btreeblks -= xrep_newbt_unused_blocks(&ra->new_bnobt);
- freesp_btreeblks -= xrep_newbt_unused_blocks(&ra->new_cntbt);
-
/*
* The AGF header contains extra information related to the free space
* btrees, so we must update those fields here.
--- a/fs/xfs/scrub/newbt.c
+++ b/fs/xfs/scrub/newbt.c
@@ -598,16 +598,3 @@ xrep_newbt_claim_block(
/* Relog all the EFIs. */
return xrep_defer_finish(xnr->sc);
}
-
-/* How many reserved blocks are unused? */
-unsigned int
-xrep_newbt_unused_blocks(
- struct xrep_newbt *xnr)
-{
- struct xrep_newbt_resv *resv;
- unsigned int unused = 0;
-
- list_for_each_entry(resv, &xnr->resv_list, list)
- unused += resv->len - resv->used;
- return unused;
-}
--- a/fs/xfs/scrub/newbt.h
+++ b/fs/xfs/scrub/newbt.h
@@ -71,6 +71,5 @@ void xrep_newbt_cancel(struct xrep_newbt
int xrep_newbt_commit(struct xrep_newbt *xnr);
int xrep_newbt_claim_block(struct xfs_btree_cur *cur, struct xrep_newbt *xnr,
union xfs_btree_ptr *ptr);
-unsigned int xrep_newbt_unused_blocks(struct xrep_newbt *xnr);
#endif /* __XFS_SCRUB_NEWBT_H__ */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 363/547] xfs: dont try to repair rtsummary if the summary file isnt computed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 362/547] xfs: dont subtract excess usage twice when computing agf_btreeblks Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 364/547] xfs: dont try to scrub self-referential dirent in metapath checker Greg Kroah-Hartman
` (192 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 6e82b7641889ad0198f3bf17a5e4c6fe7aab0850 upstream.
LOLLM observed that we can erroneously try to repair the rtsummary file
if we've not yet computed its contents. That results in a corrupt
summary file, so let's add a flag to track whether or not the incore
data is complete.
Cc: stable@vger.kernel.org # v6.10
Fixes: abf039e2e4afde ("xfs: online repair of realtime summaries")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/rtsummary.c | 9 ++++++++-
fs/xfs/scrub/rtsummary.h | 1 +
fs/xfs/scrub/rtsummary_repair.c | 2 +-
3 files changed, 10 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/rtsummary.c
+++ b/fs/xfs/scrub/rtsummary.c
@@ -212,13 +212,20 @@ xchk_rtsum_compute(
{
struct xfs_mount *mp = sc->mp;
struct xfs_rtgroup *rtg = sc->sr.rtg;
+ struct xchk_rtsummary *rts = sc->buf;
+ int error;
/* If the bitmap size doesn't match the computed size, bail. */
if (XFS_FSB_TO_B(mp, xfs_rtbitmap_blockcount(mp)) !=
rtg_bitmap(rtg)->i_disk_size)
return -EFSCORRUPTED;
- return xfs_rtalloc_query_all(rtg, sc->tp, xchk_rtsum_record_free, sc);
+ error = xfs_rtalloc_query_all(rtg, sc->tp, xchk_rtsum_record_free, sc);
+ if (error)
+ return error;
+
+ rts->summary_computed = true;
+ return 0;
}
/* Compare the rtsummary file against the one we computed. */
--- a/fs/xfs/scrub/rtsummary.h
+++ b/fs/xfs/scrub/rtsummary.h
@@ -17,6 +17,7 @@ struct xchk_rtsummary {
xfs_filblks_t rsumblocks;
unsigned int rsumlevels;
unsigned int resblks;
+ bool summary_computed;
/* suminfo position of xfile as we write buffers to disk. */
xfs_rtsumoff_t prep_wordoff;
--- a/fs/xfs/scrub/rtsummary_repair.c
+++ b/fs/xfs/scrub/rtsummary_repair.c
@@ -122,7 +122,7 @@ xrep_rtsummary(
return -EOPNOTSUPP;
/* Walk away if we disagree on the size of the rt bitmap. */
- if (rts->rbmblocks != mp->m_sb.sb_rbmblocks)
+ if (rts->rbmblocks != mp->m_sb.sb_rbmblocks || !rts->summary_computed)
return 0;
/* Make sure any problems with the fork are fixed. */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 364/547] xfs: dont try to scrub self-referential dirent in metapath checker
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 363/547] xfs: dont try to repair rtsummary if the summary file isnt computed Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 365/547] xfs: fix correction of unwritten extents in quota file data fork Greg Kroah-Hartman
` (191 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 1e7337a3ecebab1bb2ba02187d88b94e5146e4f0 upstream.
LOLLM observes that the _ilock_both helper will loop forever trying to
double-lock the same inode if mpath->dp == sc->ip. Callers are not
supposed to call us with parent == child because that makes no sense.
Trigger an assertion, mark the scan incomplete, and return IO error
so that this fails noisily.
Cc: stable@vger.kernel.org # v6.13
Fixes: b3c03efa5972f0 ("xfs: check metadata directory file path connectivity")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/metapath.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/xfs/scrub/metapath.c
+++ b/fs/xfs/scrub/metapath.c
@@ -325,6 +325,13 @@ xchk_metapath(
return 0;
}
+ /* Callers should not set the parent to the child. */
+ if (mpath->dp == sc->ip) {
+ ASSERT(mpath->dp != sc->ip);
+ xchk_set_incomplete(sc);
+ return -EIO;
+ }
+
xchk_trans_alloc_empty(sc);
error = xchk_metapath_ilock_both(mpath);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 365/547] xfs: fix correction of unwritten extents in quota file data fork
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 364/547] xfs: dont try to scrub self-referential dirent in metapath checker Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 366/547] xfs: fix data fork block count check in xrep_inode_blockcounts Greg Kroah-Hartman
` (190 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 6f2792720673f569fa3e1f68181b9d6fd26802b5 upstream.
LOLLM noticed a couple of problems with the code that fixes unwritten
mappings in the quota file's data fork: first, we should zero the ondisk
contents as part of converting them to "unwritten" just in case we crash
shortly after the conversion. Second, and more importantly, it noticed
that we fail to resynchronize the iext tree cursor after modifying the
iext tree. If the tree shape changes, we could be in a world of hurt.
Third, we should force a quotacheck if we reset an ondisk dquot. Fix
all issues.
Cc: stable@vger.kernel.org # v6.8
Fixes: a5b91555403e3a ("xfs: repair quotas")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/quota_repair.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -416,7 +416,9 @@ xrep_quota_data_fork(
/* Check for data fork problems that apply only to quota files. */
max_dqid_off = XFS_DQ_ID_MAX / qi->qi_dqperchunk;
ifp = xfs_ifork_ptr(sc->ip, XFS_DATA_FORK);
- for_each_xfs_iext(ifp, &icur, &irec) {
+ xfs_iext_first(ifp, &icur);
+
+ while (xfs_iext_get_extent(ifp, &icur, &irec)) {
if (isnullstartblock(irec.br_startblock)) {
error = -EFSCORRUPTED;
goto out;
@@ -440,16 +442,35 @@ xrep_quota_data_fork(
error = xfs_bmapi_write(sc->tp, sc->ip,
irec.br_startoff, irec.br_blockcount,
- XFS_BMAPI_CONVERT, 0, &nrec, &nmap);
+ XFS_BMAPI_CONVERT | XFS_BMAPI_ZERO, 0,
+ &nrec, &nmap);
if (error)
goto out;
ASSERT(nrec.br_startoff == irec.br_startoff);
ASSERT(nrec.br_blockcount == irec.br_blockcount);
+ /*
+ * We just zeroed the ondisk dquot, so counts could be
+ * wrong. Schedule a quotacheck to fix that.
+ */
+ xrep_force_quotacheck(sc, dqtype);
error = xfs_defer_finish(&sc->tp);
if (error)
goto out;
+
+ /*
+ * Set cursor to the next block past the extent we just
+ * converted because bmapi write could have merged
+ * records.
+ */
+ if (!xfs_iext_lookup_extent(sc->ip, ifp,
+ irec.br_startoff + irec.br_blockcount,
+ &icur, &irec))
+ break;
+ continue;
}
+
+ xfs_iext_next(ifp, &icur);
}
if (!joined) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 366/547] xfs: fix data fork block count check in xrep_inode_blockcounts
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 365/547] xfs: fix correction of unwritten extents in quota file data fork Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 367/547] xfs: init inode number for tracepoint Greg Kroah-Hartman
` (189 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 147f9f8300cb284923e08bb8a7b32ba9681c45ed upstream.
LOLLM notices that for non-reflink realtime files, the @count output of
xchk_inode_count_blocks includes both the file blocks on the realtime
volume and the bmap btree blocks on the data volume. Therefore, we must
compare this value to rblocks + dblocks to avoid unnecessary failure.
Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1724,7 +1724,7 @@ xrep_inode_blockcounts(
*/
;
} else if (XFS_IS_REALTIME_INODE(sc->ip)) {
- if (count >= sc->mp->m_sb.sb_rblocks)
+ if (count >= sc->mp->m_sb.sb_rblocks + sc->mp->m_sb.sb_dblocks)
return -EFSCORRUPTED;
} else {
if (count >= sc->mp->m_sb.sb_dblocks)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 367/547] xfs: init inode number for tracepoint
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 366/547] xfs: fix data fork block count check in xrep_inode_blockcounts Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 368/547] xfs: never reset the default quota timer Greg Kroah-Hartman
` (188 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit e98643f794d0d7a7fde8b29276d74e09fa0d5d19 upstream.
LOLLM complains that if the xchk_dir_lookup call fails, it won't set ino
to anything. ino is then passed into the tracepoint function, which
means that it reports random stack garbage. Set it to NULLFSINO instead
so that the circumstance is more obvious.
Cc: stable@vger.kernel.org # v6.13
Fixes: 0d2c636e489c11 ("xfs: repair metadata directory file path connectivity")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/metapath.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/metapath.c
+++ b/fs/xfs/scrub/metapath.c
@@ -522,7 +522,7 @@ xrep_metapath_try_link(
xfs_ino_t *alleged_child)
{
struct xfs_scrub *sc = mpath->sc;
- xfs_ino_t ino;
+ xfs_ino_t ino = NULLFSINO;
int error;
/* Allocate transaction, lock inodes, join to transaction. */
@@ -621,7 +621,7 @@ xrep_metapath_try_unlink(
{
struct xfs_scrub *sc = mpath->sc;
struct xfs_inode *ip = NULL;
- xfs_ino_t ino;
+ xfs_ino_t ino = NULLFSINO;
int error;
ASSERT(*alleged_child != I_INO(sc->ip));
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 368/547] xfs: never reset the default quota timer
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 367/547] xfs: init inode number for tracepoint Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 369/547] xfs: only written file data blocks can be shared Greg Kroah-Hartman
` (187 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit ddf4fe30c3fd7d37cf9bad3887ddb69984954cf4 upstream.
LOLLM notices that xrep_quota_fix_timer doesn't check the dquot id,
which means that it can inadvertently reset the default quota timer when
we really meant to ensure that a (non-root) quota overage timeout has a
sane timestamp. Fix that.
Cc: stable@vger.kernel.org # v6.8
Fixes: a5b91555403e3a ("xfs: repair quotas")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/quota_repair.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -272,6 +272,9 @@ xrep_quota_fix_timer(
time64_t new_timer;
uint32_t t;
+ /* never reset the default quota timer */
+ if (ddq->d_id == 0)
+ return;
if (!soft || count <= soft || *timer != 0)
return;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 369/547] xfs: only written file data blocks can be shared
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 368/547] xfs: never reset the default quota timer Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 370/547] xfs: opportunistically skip btree block checks Greg Kroah-Hartman
` (186 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 634b63baf05062988456a0bd5df2696c14ea2949 upstream.
LOLLM noticed that xchk_refcountbt_rmap_check (and its rt equivalent)
will count any rmap owner towards the shared count. However, the only
blocks that can be shared between xfs files are written file data
blocks; and the only blocks that can have single-refcount entries are
COW staging extents. Fix the checking code.
Cc: stable@vger.kernel.org # v4.16
Fixes: dbde19da963706 ("xfs: cross-reference the rmapbt data with the refcountbt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/refcount.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/fs/xfs/scrub/refcount.c
+++ b/fs/xfs/scrub/refcount.c
@@ -129,6 +129,18 @@ xchk_refcountbt_rmap_check(
return 0;
}
+ /*
+ * The refcount btree should only have records for written file data
+ * blocks or for COW staging blocks.
+ */
+ if ((XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) &&
+ rec->rm_owner != XFS_RMAP_OWN_COW) ||
+ (rec->rm_flags & (XFS_RMAP_ATTR_FORK | XFS_RMAP_BMBT_BLOCK |
+ XFS_RMAP_UNWRITTEN))) {
+ xchk_btree_xref_set_corrupt(refchk->sc, cur, 0);
+ return 0;
+ }
+
if (rec->rm_startblock <= refchk->bno && rm_last >= rc_last) {
/*
* The rmap overlaps the refcount record, so we can confirm
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 370/547] xfs: opportunistically skip btree block checks
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 369/547] xfs: only written file data blocks can be shared Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 371/547] xfs: propagate errors while checking null siblings Greg Kroah-Hartman
` (185 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 4ce244b234c251963fca6dff9de6edf26a209d08 upstream.
LOLLM notices that both callers of xchk_btree_get_block will return
early if *pblock is NULL after a successful return. However,
xchk_btree_get_block itself can return 0 after flagging a corruption.
There's no point in continuing after we've found a corruption, so null
the pointer out.
Cc: stable@vger.kernel.org # v4.15
Fixes: cc3e0948d2686f ("xfs: scrub the shape of a metadata btree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/btree.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -608,6 +608,14 @@ xchk_btree_get_block(
xfs_btree_get_block(bs->cur, level, pbp);
if (__xfs_btree_check_block(bs->cur, *pblock, level, *pbp)) {
xchk_btree_set_corrupt(bs->sc, bs->cur, level);
+ /*
+ * The btree block fails basic checks, so we know it's corrupt.
+ * There's no need to continue looking for corruptions, so we
+ * null out pblock. If *pbp is non-null then it's also
+ * attached to the transaction so we won't leak it despite the
+ * 0 return code.
+ */
+ *pblock = NULL;
return 0;
}
if (*pbp)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 371/547] xfs: propagate errors while checking null siblings
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 370/547] xfs: opportunistically skip btree block checks Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 372/547] xfs: range-check bc_levels array access in scrub tracepoints Greg Kroah-Hartman
` (184 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit e5bde75a816b3549942f4b09a8bf09006b7ea9de upstream.
LOLLM observes that if xfs_da3_path_shift returns an error here, scrub
doesn't handle it the way that it handles most runtime errors. Instead,
it drops the error and keeps going, even though that's not how that's
supposed to work. Fix that by calling xchk_da_process_error to set
corruption flags and then jump out of the flow of execution.
Cc: stable@vger.kernel.org # v4.15
Fixes: 7c4a07a424c18d ("xfs: scrub directory/attribute btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/dabtree.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -257,9 +257,10 @@ xchk_da_btree_block_check_sibling(
if (sibling == 0) {
error = xfs_da3_path_shift(ds->state, altpath, direction,
false, &retval);
- if (error == 0 && retval == 0)
+ if (!xchk_da_process_error(ds, level, &error))
+ goto out;
+ if (retval == 0)
xchk_da_set_corrupt(ds, level);
- error = 0;
goto out;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 372/547] xfs: range-check bc_levels array access in scrub tracepoints
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 371/547] xfs: propagate errors while checking null siblings Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 373/547] xfs: reattach dquots after changing inode ids Greg Kroah-Hartman
` (183 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 73b7276b8a4b5eb272f3c3b36ea3042e786f4741 upstream.
LOLLM noticed xchk_btree()'s odd habit of passing cur->bc_nlevels to
xchk_btree_ptr_ok when we're checking the pointer to the root block at
the start of the btree scan. This enables us to skip checking the
pointer for an inode btree's root (since it doesn't have one) but
doesn't handle per-AG btrees quite correctly. There isn't a problem for
__xfs_btree_check_ptr itself, but the corruption tracepoint naively
walks off the end of bc_level[]. Fix that by adding a helper to do an
implicit range check.
Cc: stable@vger.kernel.org # v5.16
Fixes: 6ca444cfd66354 ("xfs: prepare xfs_btree_cur for dynamic cursor heights")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/trace.c | 13 +++++++++++++
fs/xfs/scrub/trace.h | 10 +++++-----
2 files changed, 18 insertions(+), 5 deletions(-)
--- a/fs/xfs/scrub/trace.c
+++ b/fs/xfs/scrub/trace.c
@@ -42,6 +42,9 @@ xchk_btree_cur_fsbno(
struct xfs_btree_cur *cur,
int level)
{
+ if (level < 0)
+ return NULLFSBLOCK;
+
if (level < cur->bc_nlevels && cur->bc_levels[level].bp)
return XFS_DADDR_TO_FSB(cur->bc_mp,
xfs_buf_daddr(cur->bc_levels[level].bp));
@@ -53,6 +56,16 @@ xchk_btree_cur_fsbno(
return NULLFSBLOCK;
}
+static inline int
+xchk_btree_cur_ptr(
+ const struct xfs_btree_cur *cur,
+ int level)
+{
+ if (level >= 0 && level < cur->bc_nlevels)
+ return cur->bc_levels[level].ptr;
+ return -1;
+}
+
/*
* We include this last to have the helpers above available for the trace
* event implementations.
--- a/fs/xfs/scrub/trace.h
+++ b/fs/xfs/scrub/trace.h
@@ -577,7 +577,7 @@ TRACE_EVENT(xchk_btree_op_error,
__entry->level = level;
__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
- __entry->ptr = cur->bc_levels[level].ptr;
+ __entry->ptr = xchk_btree_cur_ptr(cur, level);
__entry->error = error;
__entry->ret_ip = ret_ip;
),
@@ -618,7 +618,7 @@ TRACE_EVENT(xchk_ifork_btree_op_error,
__entry->type = sc->sm->sm_type;
__assign_str(name);
__entry->level = level;
- __entry->ptr = cur->bc_levels[level].ptr;
+ __entry->ptr = xchk_btree_cur_ptr(cur, level);
__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
__entry->error = error;
@@ -660,7 +660,7 @@ TRACE_EVENT(xchk_btree_error,
__entry->level = level;
__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
- __entry->ptr = cur->bc_levels[level].ptr;
+ __entry->ptr = xchk_btree_cur_ptr(cur, level);
__entry->ret_ip = ret_ip;
),
TP_printk("dev %d:%d type %s %sbt level %d ptr %d agno 0x%x agbno 0x%x ret_ip %pS",
@@ -700,7 +700,7 @@ TRACE_EVENT(xchk_ifork_btree_error,
__entry->level = level;
__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
- __entry->ptr = cur->bc_levels[level].ptr;
+ __entry->ptr = xchk_btree_cur_ptr(cur, level);
__entry->ret_ip = ret_ip;
),
TP_printk("dev %d:%d ino 0x%llx fork %s type %s %sbt level %d ptr %d agno 0x%x agbno 0x%x ret_ip %pS",
@@ -740,7 +740,7 @@ DECLARE_EVENT_CLASS(xchk_sbtree_class,
__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
__entry->level = level;
__entry->nlevels = cur->bc_nlevels;
- __entry->ptr = cur->bc_levels[level].ptr;
+ __entry->ptr = xchk_btree_cur_ptr(cur, level);
),
TP_printk("dev %d:%d type %s %sbt agno 0x%x agbno 0x%x level %d nlevels %d ptr %d",
MAJOR(__entry->dev), MINOR(__entry->dev),
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 373/547] xfs: reattach dquots after changing inode ids
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 372/547] xfs: range-check bc_levels array access in scrub tracepoints Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 374/547] x86/bugs: Adapt SRSO mitigation to Zen6 Greg Kroah-Hartman
` (182 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 2f528e4a8f89daa6d0cc64b044f6f94c018fe9ae upstream.
LOLLM noticed that xrep_inode_ids can change the user, group, or project
id of any given file. When this happens, we need to detach any existing
incore dquot and attach the correct ones.
Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/inode_repair.c | 133 +++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 132 insertions(+), 1 deletion(-)
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -41,6 +41,8 @@
#include "xfs_rtgroup.h"
#include "xfs_rtrmap_btree.h"
#include "xfs_rtrefcount_btree.h"
+#include "xfs_dquot_item.h"
+#include "xfs_dquot.h"
#include "scrub/xfs_scrub.h"
#include "scrub/scrub.h"
#include "scrub/common.h"
@@ -1766,6 +1768,20 @@ xrep_inode_ids(
trace_xrep_inode_ids(sc);
+ /*
+ * We changed one of the file IDs, so we must detach the dquots to
+ * prevent further changes from being accounted to them, and try to
+ * attach the dquot for the new id to absorb any other block usage
+ * changes. We can't do that right now because the existing dquots
+ * might be attached to the scrub transaction and we're in the middle
+ * of fixing the inode, so we'll switch the incore dquot pointers
+ * later.
+ *
+ * Schedule a quotacheck so the accounting discrepancies will get fixed
+ * eventually. We'll have to repeat this later when we do the actual
+ * switch.
+ */
+
if (!uid_valid(VFS_I(sc->ip)->i_uid)) {
i_uid_write(VFS_I(sc->ip), 0);
dirty = true;
@@ -2075,6 +2091,113 @@ xrep_inode_unlinked(
return 0;
}
+#ifdef CONFIG_XFS_QUOTA
+static inline bool
+xrep_inode_need_reset_dquots(
+ struct xfs_scrub *sc)
+{
+ struct xfs_mount *mp = sc->mp;
+ struct xfs_inode *ip = sc->ip;
+
+ if (!XFS_IS_QUOTA_ON(mp))
+ return false;
+ if (xfs_is_quota_inode(&mp->m_sb, I_INO(ip)))
+ return false;
+ if (xfs_is_metadir_inode(ip))
+ return false;
+
+ if (XFS_IS_UQUOTA_ON(sc->mp) &&
+ (!ip->i_udquot || ip->i_udquot->q_id != i_uid_read(VFS_I(ip))))
+ return true;
+ if (XFS_IS_GQUOTA_ON(sc->mp) &&
+ (!ip->i_gdquot || ip->i_gdquot->q_id != i_gid_read(VFS_I(ip))))
+ return true;
+ if (XFS_IS_PQUOTA_ON(sc->mp) &&
+ (!ip->i_pdquot || ip->i_pdquot->q_id != ip->i_projid))
+ return true;
+
+ return false;
+}
+
+/* Switch dquot, return dqtype if we need quotacheck */
+static xfs_dqtype_t
+xrep_inode_switch_dquot(
+ struct xfs_scrub *sc,
+ xfs_dqtype_t type,
+ struct xfs_dquot **dqp)
+{
+ xfs_dqtype_t ret = 0;
+ xfs_dqid_t id = xfs_qm_id_for_quotatype(sc->ip, type);
+
+ if (*dqp != NULL && (*dqp)->q_id != id) {
+ xfs_qm_dqrele(*dqp);
+ *dqp = NULL;
+ }
+
+ if (!*dqp) {
+ xfs_qm_dqget_inode(sc->ip, type, true, dqp);
+ ret = type;
+ }
+ return ret;
+}
+
+static int
+xrep_inode_reset_dquots(
+ struct xfs_scrub *sc)
+{
+ xfs_dqtype_t need = 0;
+ int error;
+
+ /*
+ * If we changed the file IDs, then we need to drop the transaction so
+ * that we can detach the dquots and attach new ones.
+ *
+ * Commit the scrub transaction so that there are no dangling
+ * references to any dquots that might get detached, and retain the
+ * ILOCK, as required by the dqattach code.
+ *
+ * Note that dqattach can cycle the ILOCK when creating a new dquot, so
+ * this must be the very last thing that the repair function does.
+ */
+ error = xrep_trans_commit(sc);
+ if (error)
+ return error;
+
+ if (XFS_IS_UQUOTA_ON(sc->mp))
+ need |= xrep_inode_switch_dquot(sc, XFS_DQTYPE_USER,
+ &sc->ip->i_udquot);
+ if (XFS_IS_GQUOTA_ON(sc->mp))
+ need |= xrep_inode_switch_dquot(sc, XFS_DQTYPE_GROUP,
+ &sc->ip->i_gdquot);
+ if (XFS_IS_PQUOTA_ON(sc->mp))
+ need |= xrep_inode_switch_dquot(sc, XFS_DQTYPE_PROJ,
+ &sc->ip->i_pdquot);
+
+ xchk_iunlock(sc, XFS_ILOCK_EXCL);
+
+ /*
+ * Now that we've updated the dquots, force quotacheck once again.
+ * In theory we could be racing against a concurrent quotacheck.
+ * Note that we can't hold the ILOCK when allocating a transaction.
+ */
+ error = xchk_trans_alloc(sc, 0);
+ if (error)
+ return error;
+
+ if (need & XFS_DQTYPE_USER)
+ xrep_force_quotacheck(sc, XFS_DQTYPE_USER);
+ if (need & XFS_DQTYPE_GROUP)
+ xrep_force_quotacheck(sc, XFS_DQTYPE_GROUP);
+ if (need & XFS_DQTYPE_PROJ)
+ xrep_force_quotacheck(sc, XFS_DQTYPE_PROJ);
+
+ return 0;
+}
+#else
+# define xrep_inode_need_reset_dquots(sc) (false)
+# define xrep_inode_reset_dquots(sc) (0)
+#endif
+
/* Repair an inode's fields. */
int
xrep_inode(
@@ -2129,5 +2252,13 @@ xrep_inode(
if (error)
return error;
- return xrep_defer_finish(sc);
+ error = xrep_defer_finish(sc);
+ if (error)
+ return error;
+
+ /* Must come last */
+ if (xrep_inode_need_reset_dquots(sc))
+ return xrep_inode_reset_dquots(sc);
+
+ return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 374/547] x86/bugs: Adapt SRSO mitigation to Zen6
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 373/547] xfs: reattach dquots after changing inode ids Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 375/547] smb: server: size directory name conversion buffer correctly Greg Kroah-Hartman
` (181 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <bp@alien8.de>
commit ae1d2082d93bc04604dc08e9b7f9cdba5e0c28e6 upstream.
Zen6 has BTB protection which isolates the different contexts
(user/kernel, guest/host) from one another. This makes the SafeRET
mitigation there unnecessary leaving the user/user and guest/guest
attack vectors open, whose protection is handled by the Spectre v2
mitigation setting to do IBPB on a context switch.
Detect that setting and report it with a new mitigation string.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260822013231.1109255-1-bp@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/kernel/cpu/bugs.c | 18 ++++++++++++++++--
arch/x86/kernel/cpu/scattered.c | 1 +
3 files changed, 18 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -430,6 +430,7 @@
#define X86_FEATURE_SUCCOR (17*32+ 1) /* "succor" Uncorrectable error containment and recovery */
#define X86_FEATURE_CPPC_PERF_PRIO (17*32+ 2) /* CPPC Floor Perf support */
#define X86_FEATURE_SMCA (17*32+ 3) /* "smca" Scalable MCA */
+#define X86_FEATURE_BTB_CTX_ISOLATION (17*32+ 4) /* AMD: Branch predictions contexts isolated */
/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
#define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* "avx512_4vnniw" AVX-512 Neural Network Instructions */
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1175,6 +1175,7 @@ enum srso_mitigation {
SRSO_MITIGATION_IBPB,
SRSO_MITIGATION_IBPB_ON_VMEXIT,
SRSO_MITIGATION_BP_SPEC_REDUCE,
+ SRSO_MITIGATION_USER_IBPB,
};
static enum srso_mitigation srso_mitigation __ro_after_init = SRSO_MITIGATION_AUTO;
@@ -2908,7 +2909,8 @@ static const char * const srso_strings[]
[SRSO_MITIGATION_SAFE_RET] = "Mitigation: Safe RET",
[SRSO_MITIGATION_IBPB] = "Mitigation: IBPB",
[SRSO_MITIGATION_IBPB_ON_VMEXIT] = "Mitigation: IBPB on VMEXIT only",
- [SRSO_MITIGATION_BP_SPEC_REDUCE] = "Mitigation: Reduced Speculation"
+ [SRSO_MITIGATION_BP_SPEC_REDUCE] = "Mitigation: Reduced Speculation",
+ [SRSO_MITIGATION_USER_IBPB] = "Mitigation: IBPB on context switch",
};
static int __init srso_parse_cmdline(char *str)
@@ -2948,7 +2950,9 @@ static void __init srso_select_mitigatio
* required. Otherwise the 'microcode' mitigation is sufficient
* to protect the user->user and guest->guest vectors.
*/
- if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) ||
+ if ((cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) &&
+ !boot_cpu_has(X86_FEATURE_BTB_CTX_ISOLATION))
+ ||
(cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL) &&
!boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO))) {
srso_mitigation = SRSO_MITIGATION_SAFE_RET;
@@ -3024,6 +3028,16 @@ static void __init srso_update_mitigatio
boot_cpu_has(X86_FEATURE_IBPB_BRTYPE))
srso_mitigation = SRSO_MITIGATION_IBPB;
+ /*
+ * See if IBPB on context switch is the only thing needed to address
+ * GUEST/GUEST and USER/USER vectors.
+ */
+ if (srso_mitigation == SRSO_MITIGATION_MICROCODE &&
+ boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO) &&
+ boot_cpu_has(X86_FEATURE_BTB_CTX_ISOLATION) &&
+ spectre_v2_user_ibpb != SPECTRE_V2_USER_NONE)
+ srso_mitigation = SRSO_MITIGATION_USER_IBPB;
+
pr_info("%s\n", srso_strings[srso_mitigation]);
}
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -64,6 +64,7 @@ static const struct cpuid_bit cpuid_bits
{ X86_FEATURE_AMD_WORKLOAD_CLASS, CPUID_EAX, 22, 0x80000021, 0 },
{ X86_FEATURE_TSA_SQ_NO, CPUID_ECX, 1, 0x80000021, 0 },
{ X86_FEATURE_TSA_L1_NO, CPUID_ECX, 2, 0x80000021, 0 },
+ { X86_FEATURE_BTB_CTX_ISOLATION, CPUID_ECX, 8, 0x80000021, 0 },
{ X86_FEATURE_PERFMON_V2, CPUID_EAX, 0, 0x80000022, 0 },
{ X86_FEATURE_AMD_LBR_V2, CPUID_EAX, 1, 0x80000022, 0 },
{ X86_FEATURE_AMD_LBR_PMC_FREEZE, CPUID_EAX, 2, 0x80000022, 0 },
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 375/547] smb: server: size directory name conversion buffer correctly
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 374/547] x86/bugs: Adapt SRSO mitigation to Zen6 Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 376/547] smb: smbdirect: fix buffer length underflow in RDMA transfers Greg Kroah-Hartman
` (180 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, VeroFess, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: VeroFess <coderzeng@hotmail.com>
commit f1f37834eaba5904103af1f18afe3510c7e9dc71 upstream.
A 2048-byte ASCII directory name needs 4098 bytes when converted to
UTF-16, including the terminator. ksmbd_convert_dir_info_name() caps
its allocation at PATH_MAX and writes past the end of that buffer.
Allocate space for one UTF-16 code unit per input byte plus the
terminator. Use kmalloc_array() to check the size calculation.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: gpt 6 sol with daybreak blue
Signed-off-by: VeroFess <coderzeng@hotmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/misc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/smb/server/misc.c
+++ b/fs/smb/server/misc.c
@@ -296,12 +296,13 @@ char *ksmbd_convert_dir_info_name(struct
int *conv_len)
{
char *conv;
- int sz = min(4 * d_info->name_len, PATH_MAX);
- if (!sz)
+ if (d_info->name_len <= 0)
return NULL;
- conv = kmalloc(sz, KSMBD_DEFAULT_GFP);
+ /* One UTF-16 code unit per input byte, plus the terminating NUL. */
+ conv = kmalloc_array((size_t)d_info->name_len + 1,
+ sizeof(__le16), KSMBD_DEFAULT_GFP);
if (!conv)
return NULL;
@@ -310,7 +311,6 @@ char *ksmbd_convert_dir_info_name(struct
d_info->name_len, local_nls, 0);
*conv_len *= 2;
- /* We allocate buffer twice bigger than needed. */
conv[*conv_len] = 0x00;
conv[*conv_len + 1] = 0x00;
return conv;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 376/547] smb: smbdirect: fix buffer length underflow in RDMA transfers
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 375/547] smb: server: size directory name conversion buffer correctly Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 377/547] smb: client: bound POSIX lock data area by response length Greg Kroah-Hartman
` (179 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Metzmacher, Namjae Jeon,
zdi-disclosures
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
commit 7193241a49c958782ba4b8df06da3734d1e317d2 upstream.
When a remote buffer descriptor is larger than the remaining local
buffer, smbdirect_connection_rdma_xmit() clamps its length and sets
buf_len to zero. The common accounting code then subtracts the clamped
length from buf_len, causing it to underflow. If another descriptor
follows, the loop processes it with a wrapped remaining length and
includes memory beyond the local buffer in the RDMA transfer.
A client can trigger an out-of-bounds kernel write with an SMB WRITE
request, or an out-of-bounds kernel read with an SMB READ request, by
supplying multiple RDMA buffer descriptors with an oversized descriptor
before the last one.
Remove the premature assignment to buf_len. Subtracting the clamped length
already consumes the remaining buffer, so the next iteration stops and
only descriptors within the local buffer are used to build work requests.
Fixes: e628bf939aaf ("ksmbd: reduce descriptor size if remaining bytes is less than request size")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-33549
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/smbdirect/rw.c | 1 -
1 file changed, 1 deletion(-)
--- a/fs/smb/smbdirect/rw.c
+++ b/fs/smb/smbdirect/rw.c
@@ -143,7 +143,6 @@ int smbdirect_connection_rdma_xmit(struc
if (desc_buf_len > buf_len) {
desc_buf_len = buf_len;
desc[i].length = cpu_to_le32(desc_buf_len);
- buf_len = 0;
}
credits_needed += smbdirect_connection_calc_rw_credits(sc,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 377/547] smb: client: bound POSIX lock data area by response length
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 376/547] smb: smbdirect: fix buffer length underflow in RDMA transfers Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 378/547] smb: client: dont resurrect an exiting tcon from cached dir workers Greg Kroah-Hartman
` (178 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Namjae Jeon,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
commit 8fc9af68c57156ff64769f30e831553cd03b3000 upstream.
CIFSSMBPosixLock() receives a TRANS2 response whose server-provided
DataOffset and DataCount are not required by validate_t2() to describe an
interval inside the response. A server can therefore make the client read a
cifs_posix_lock beyond the response buffer and return those kernel bytes
through F_GETLK.
Use smbCalcSize() to obtain the full response length after any multipart
TRANS2 reassembly, then reject data areas that extend past it before
dereferencing them.
Fixes: fc94cdb94462 ("[CIFS] Fix new POSIX Locking for setting lock_type correctly on unlock")
Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 8 ++++++++
fs/smb/client/trace.h | 1 +
2 files changed, 9 insertions(+)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -2380,6 +2380,7 @@ CIFSSMBPosixLock(const unsigned int xid,
cifs_dbg(FYI, "Send error in Posix Lock = %d\n", rc);
} else if (pLockData) {
/* lock structure can be returned on get */
+ unsigned int rsp_len;
__u16 data_offset;
__u16 data_count;
rc = validate_t2((struct smb_t2_rsp *)pSMBr);
@@ -2391,11 +2392,18 @@ CIFSSMBPosixLock(const unsigned int xid,
}
data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
data_count = le16_to_cpu(pSMBr->t2.DataCount);
+ rsp_len = smbCalcSize(&pSMBr->hdr);
if (data_count < sizeof(struct cifs_posix_lock)) {
rc = smb_EIO2(smb_eio_trace_lock_data_too_small,
data_count, sizeof(struct cifs_posix_lock));
goto plk_err_exit;
}
+ if (data_offset > rsp_len ||
+ data_count > rsp_len - data_offset) {
+ rc = smb_EIO2(smb_eio_trace_lock_data_area,
+ data_offset, data_count);
+ goto plk_err_exit;
+ }
parm_data = (struct cifs_posix_lock *)
((char *)&pSMBr->hdr.Protocol + data_offset);
if (parm_data->lock_type == cpu_to_le16(CIFS_UNLCK))
--- a/fs/smb/client/trace.h
+++ b/fs/smb/client/trace.h
@@ -42,6 +42,7 @@
EM(smb_eio_trace_ioctl_no_rsp, "ioctl_no_rsp") \
EM(smb_eio_trace_ioctl_out_off, "ioctl_out_off") \
EM(smb_eio_trace_lock_bcc_too_small, "lock_bcc_too_small") \
+ EM(smb_eio_trace_lock_data_area, "lock_data_area") \
EM(smb_eio_trace_lock_data_too_small, "lock_data_too_small") \
EM(smb_eio_trace_malformed_ksid_key, "malformed_ksid_key") \
EM(smb_eio_trace_malformed_sid_key, "malformed_sid_key") \
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 378/547] smb: client: dont resurrect an exiting tcon from cached dir workers
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 377/547] smb: client: bound POSIX lock data area by response length Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 379/547] smb: client: fix buffer overflow in SMB2_tcon() Greg Kroah-Hartman
` (177 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Paulo Alcantara,
David Howells, Ronnie Sahlberg, Shyam Prasad N, Tom Talpey,
Bharath SM
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
commit d58e7b40908a8a57755811d5b37af1df3380278f upstream.
cfids_laundromat_worker() bumps tcon->tc_count for every expired open
cfid and queues cached_dir_offload_close() without checking whether the
tcon is already being torn down. Racing with the final cifs_put_tcon(),
the tcon comes back from zero and gets torn down twice:
T1 T2
cifs_put_tcon()
--tc_count == 0, TID_EXITING
tconInfoFree()
free_cached_dirs()
cancel_delayed_work_sync() cfids_laundromat_worker()
++tc_count == 1
queue_work(serverclose_wq)
kfree(tcon->origin_fullpath)
kfree(tcon)
cached_dir_offload_close()
close_cached_dir() [UAF]
cifs_put_tcon()
tconInfoFree() [double free]
cached_dir_lease_break() also bumps tc_count without tc_lock, racing with
the laundromat's locked update.
Take the tcon reference through a helper that refuses once the tcon is
TID_EXITING or its refcount has dropped to zero. Queued put_work and
close_work then always hold a tcon reference, so tconInfoFree() can't
run before they finish and free_cached_dirs() doesn't need to flush any
workqueue. If the laundromat can't get a reference, put the cfid back on
the dying list for free_cached_dirs() to free; its handle goes away with
the tree connection.
The lease break path finds the tcon on ses->tcon_list under
cifs_tcp_ses_lock, so it can't see TID_EXITING, but it now takes tc_lock.
Fixes: 3fa640d035e5 ("smb: During unmount, ensure all cached dir instances drop their dentry")
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cached_dir.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
--- a/fs/smb/client/cached_dir.c
+++ b/fs/smb/client/cached_dir.c
@@ -649,6 +649,17 @@ void invalidate_all_cached_dirs(struct c
flush_delayed_work(&cfids->laundromat_work);
}
+static bool cached_dir_get_tcon(struct cifs_tcon *tcon,
+ enum smb3_tcon_ref_trace trace)
+{
+ guard(spinlock)(&tcon->tc_lock);
+ if (tcon->status == TID_EXITING || tcon->tc_count <= 0)
+ return false;
+ ++tcon->tc_count;
+ trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, trace);
+ return true;
+}
+
static void
cached_dir_offload_close(struct work_struct *work)
{
@@ -693,6 +704,9 @@ bool cached_dir_lease_break(struct cifs_
!memcmp(lease_key,
cfid->fid.lease_key,
SMB2_LEASE_KEY_SIZE)) {
+ if (!cached_dir_get_tcon(tcon,
+ netfs_trace_tcon_ref_get_cached_lease_break))
+ break;
cfid->has_lease = false;
cfid->time = 0;
/*
@@ -703,9 +717,6 @@ bool cached_dir_lease_break(struct cifs_
cfid->on_list = false;
cfids->num_entries--;
- ++tcon->tc_count;
- trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
- netfs_trace_tcon_ref_get_cached_lease_break);
queue_work(cfid_put_wq, &cfid->put_work);
spin_unlock(&cfids->cfid_list_lock);
return true;
@@ -813,12 +824,13 @@ static void cfids_laundromat_worker(stru
cfid->dentry = NULL;
if (cfid->is_open) {
- spin_lock(&cfid->tcon->tc_lock);
- ++cfid->tcon->tc_count;
- trace_smb3_tcon_ref(cfid->tcon->debug_id, cfid->tcon->tc_count,
- netfs_trace_tcon_ref_get_cached_laundromat);
- spin_unlock(&cfid->tcon->tc_lock);
- queue_work(serverclose_wq, &cfid->close_work);
+ if (cached_dir_get_tcon(cfid->tcon,
+ netfs_trace_tcon_ref_get_cached_laundromat)) {
+ queue_work(serverclose_wq, &cfid->close_work);
+ continue;
+ }
+ scoped_guard(spinlock, &cfids->cfid_list_lock)
+ list_add_tail(&cfid->entry, &cfids->dying);
} else
/*
* Drop the ref-count from above, either the lease-ref (if there
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 379/547] smb: client: fix buffer overflow in SMB2_tcon()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 378/547] smb: client: dont resurrect an exiting tcon from cached dir workers Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 380/547] smb: client: fix fiemap wild read on empty truncated response Greg Kroah-Hartman
` (176 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Liu, Paulo Alcantara, Luxiao Xu,
Ren Wei
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luxiao Xu <rakukuip@gmail.com>
commit 73cc469b0ff7551f8537ea919709973e6dc4f514 upstream.
In SMB2_tcon(), unc_path is allocated with a fixed buffer size of
MAX_SHARENAME_LENGTH * 2 bytes (672 bytes). However, the user-controlled
UNC path (tree) length is passed to cifs_strtoUTF16(), which assumes the
destination buffer is large enough and writes strlen(tree) + 1 UTF-16 code
units.
Commit 62a1a439e0fd ("cifs: clean up handling of unc= option") removed the
length check on UNC mount options, allowing mount paths to exceed
MAX_SHARENAME_LENGTH while retaining the fixed-size buffer allocation in
SMB2_tcon(). Consequently, an oversized UNC string causes cifs_strtoUTF16()
to write past the end of the heap object, resulting in a slab-out-of-bounds
write. Furthermore, if a tree exceeds MAX_TREE_SIZE characters, strscpy()
truncates it in cifs_tcon::tree_name, causing subsequent reconnects or
failovers to fail.
Fix this by first verifying that the length of tree does not exceed
MAX_TREE_SIZE, returning -EINVAL if it does. Then, dynamically allocate
unc_path based on the length of tree so that it safely accommodates all
UTF-16 code units for paths within MAX_TREE_SIZE.
Fixes: 62a1a439e0fd ("cifs: clean up handling of unc= option")
Cc: stable@vger.kernel.org
Reported-by: Xin Liu <bird@lzu.edu.cn>
Closes: https://bugtracker.nebusec.ai/f/3292
Assisted-by: LLM
Suggested-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
[pc: remove unused MAX_SHARENAME_LENGTH]
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2118,8 +2118,6 @@ static inline void cifs_stats_fail_inc(s
cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
}
-#define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
-
/* These are similar values to what Windows uses */
static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
{
@@ -2150,7 +2148,15 @@ SMB2_tcon(const unsigned int xid, struct
if (!server || !tree)
return smb_EIO(smb_eio_trace_null_pointers);
- unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
+ total_len = strlen(tree);
+ if (total_len > MAX_TREE_SIZE) {
+ cifs_server_dbg(VFS | ONCE,
+ "%s: tree name exceeded %u characters\n",
+ __func__, MAX_TREE_SIZE);
+ return -EINVAL;
+ }
+
+ unc_path = kmalloc((total_len + 1) * sizeof(*unc_path), GFP_KERNEL);
if (unc_path == NULL)
return -ENOMEM;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 380/547] smb: client: fix fiemap wild read on empty truncated response
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 379/547] smb: client: fix buffer overflow in SMB2_tcon() Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 381/547] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2 Greg Kroah-Hartman
` (175 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
commit f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc upstream.
smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob
and loops for the next chunk. If the server reports
STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns
-E2BIG with out_data == NULL and out_data_len == 0, and the existing
length checks accept the empty result. The loop then evaluates
next = out_data[num - 1].file_offset + ...
with num == 0, reading 16 bytes before NULL.
Reject a truncated range blob that contains no range, so the resume
offset is never computed from an empty response. Also require the last
range in a truncated blob to advance the resume offset without
overflowing, and to stay within the requested range; a malicious or
broken server could otherwise make no progress or underflow len and loop
forever. Free the previous response buffer before retrying.
Reproduced on 6.6.87.2 with a malicious SMB2 server that answers
FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and
OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in
cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged
on mainline.
Fixes: 2f3ebaba13ce ("cifs: add fiemap support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2ops.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4360,6 +4360,15 @@ static int smb3_fiemap(struct cifs_tcon
goto out;
}
+ /*
+ * A truncated range blob must contain at least one range, otherwise
+ * there is no offset to resume from and out_data is NULL.
+ */
+ if (!last_blob && out_data_len == 0) {
+ rc = -EINVAL;
+ goto out;
+ }
+
num = out_data_len / sizeof(struct file_allocated_range_buffer);
for (i = 0; i < num; i++) {
flags = 0;
@@ -4380,10 +4389,25 @@ static int smb3_fiemap(struct cifs_tcon
}
if (!last_blob) {
- next = le64_to_cpu(out_data[num - 1].file_offset) +
- le64_to_cpu(out_data[num - 1].length);
- len = len - (next - start);
+ u64 last_start, last_len;
+
+ last_start = le64_to_cpu(out_data[num - 1].file_offset);
+ last_len = le64_to_cpu(out_data[num - 1].length);
+
+ if (check_add_overflow(last_start, last_len, &next) ||
+ next <= start) {
+ rc = -EINVAL;
+ goto out;
+ }
+ if (next - start >= len) {
+ rc = 0;
+ goto out;
+ }
+
+ len -= next - start;
start = next;
+ kfree(out_data);
+ out_data = NULL;
goto again;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 381/547] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 380/547] smb: client: fix fiemap wild read on empty truncated response Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 382/547] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan Greg Kroah-Hartman
` (174 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
commit f8171804a39ee89a11cd462f67862899de9c6b10 upstream.
cifs_fill_dirent() reads the fixed part of a directory entry and the
name length it holds, or for SMB_FIND_FILE_UNIX scans the name for its
terminating NUL, without knowing where the response ends.
cifs_save_resume_key() calls it for the entry at the LastNameOffset the
server chose, after every FindNext and after the FindFirst of a search
rewind, and records the name it returns as the resume name of the
search without bounding it; the next CIFSFindNext() copies up to
PATH_MAX - 1 bytes from that name into its request and sends them to
the server. cifs_filldir() bounds
the name against the end of the response since
commit f8cf09a53a0d ("smb: client: bound dirent name against end of
SMB response in cifs_filldir"), but only after cifs_fill_dirent() has
read the entry, and nxt_dir_entry() checks the entries it walks only
against sizeof(FILE_DIRECTORY_INFO), for every level but
SMB_FIND_FILE_INFO_STANDARD, and never sees the first entry of a
response.
Bounding where last_entry starts, as the preceding patch does, does
not bound the read. A last entry that starts within the final bytes of
the response still has its fixed part read past the end of the
received data, and the name length it declares, a __le32 for every
level but SMB_FIND_FILE_INFO_STANDARD and SMB_FIND_FILE_UNIX, is
recorded without being checked against anything. CIFSFindNext()
rejects only a length of PATH_MAX or more, then copies the name, up to
4095 bytes, into its request and sends it, and as the report below
shows that copy can run past the end of the cifs_request allocation
that holds the response. For SMB_FIND_FILE_UNIX the name is in
addition scanned for its terminating NUL over up to PATH_MAX + 1
UTF-16 units, or PATH_MAX bytes, before any check. The FindNext that
carries the name is only sent by the SMB1 dialect, which is not
negotiated by default; reaching it requires an explicit vers=1.0
mount.
With KASAN enabled, a response whose last entry declares a name
longer than the bytes that follow it gives:
==================================================================
BUG: KASAN: slab-out-of-bounds in CIFSFindNext+0x8ca/0x14c0
Read of size 4080 at addr ffff88807c823f98 by task ls/83
CPU: 0 UID: 0 PID: 83 Comm: ls Not tainted 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
Call Trace:
<TASK>
kasan_report+0xdf/0x1a0
kasan_check_range+0x10f/0x1e0
__asan_memcpy+0x23/0x60
CIFSFindNext+0x8ca/0x14c0
cifs_readdir+0xf51/0x29c0
iterate_dir+0x1c0/0x570
__x64_sys_getdents64+0x133/0x270
do_syscall_64+0x109/0x5d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 83 on cpu 1 at 13.497119s:
cifs_buf_get+0x36/0x90
smb_init+0x4f/0x110
CIFSFindNext+0xf7/0x14c0
cifs_readdir+0xf51/0x29c0
The buggy address belongs to the object at ffff88807c820000
which belongs to the cache cifs_request of size 16588
The buggy address is located 16280 bytes inside of
allocated 16588-byte region [ffff88807c820000, ffff88807c8240cc)
==================================================================
The read is the memcpy() that copies the recorded name into the next
request, so those bytes go to the server.
Pass the end of the response to cifs_fill_dirent() and have it reject
an entry whose fixed part does not fit or whose name extends past the
end, before either is used, so that both callers are covered;
cifs_save_resume_key() computes the end the same way cifs_readdir()
does. The name bound compares the bytes left between the name and the
end with the name length rather than adding the length to the name
pointer, since the length is a 32-bit value taken from the entry and
the sum could wrap on 32-bit systems. cifs_fill_dirent() is also used
on the SMB2 readdir path; there smb2_parse_query_directory() has
already checked every entry against the end of the response, so a
valid SMB2 response is not rejected by the new checks. The check
cifs_filldir() applies after the parse is left in place. The NUL scan
for SMB_FIND_FILE_UNIX names is capped by a separate patch.
An entry and its name lie inside the data area of the response, so a
server that points LastNameOffset at the entry is not affected. One
that points it at the file name, as MS-CIFS 2.2.6.2.2 describes, has
its last entry rejected here; the listing is unaffected, because
cifs_readdir() records the resume name from an entry it emitted, and
before this series such a response could instead end the listing early,
since a name length read from the wrong place is usually PATH_MAX or
more, which CIFSFindNext() rejects with -EINVAL.
On trees before v6.19 the type for the level 0x105 fixed part is
spelled SEARCH_ID_FULL_DIR_INFO; adjust when backporting.
Fixes: 0752f1522a91 ("[CIFS] make sure we have the right resume info before calling CIFSFindNext")
Cc: stable@vger.kernel.org # 6.1.x: f8cf09a53a0d: smb: client: bound dirent name against end of SMB response in cifs_filldir
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/readdir.c | 39 ++++++++++++++++++++++++++++++++++++---
1 file changed, 36 insertions(+), 3 deletions(-)
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -586,30 +586,46 @@ static void cifs_fill_dirent_std(struct
}
static int cifs_fill_dirent(struct cifs_dirent *de, const void *info,
- u16 level, bool is_unicode)
+ const char *end, u16 level, bool is_unicode)
{
+ size_t len = end > (const char *)info ? end - (const char *)info : 0;
+
memset(de, 0, sizeof(*de));
switch (level) {
case SMB_FIND_FILE_POSIX_INFO:
+ if (len < sizeof(struct smb2_posix_info))
+ goto too_short;
cifs_fill_dirent_posix(de, info);
break;
case SMB_FIND_FILE_UNIX:
+ if (len < offsetof(FILE_UNIX_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_unix(de, info, is_unicode);
break;
case SMB_FIND_FILE_DIRECTORY_INFO:
+ if (len < offsetof(FILE_DIRECTORY_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_dir(de, info);
break;
case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
+ if (len < offsetof(FILE_FULL_DIRECTORY_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_full(de, info);
break;
case SMB_FIND_FILE_ID_FULL_DIR_INFO:
+ if (len < offsetof(FILE_ID_FULL_DIR_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_search(de, info);
break;
case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
+ if (len < offsetof(FILE_BOTH_DIRECTORY_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_both(de, info);
break;
case SMB_FIND_FILE_INFO_STANDARD:
+ if (len < offsetof(FIND_FILE_STANDARD_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_std(de, info);
break;
default:
@@ -617,7 +633,19 @@ static int cifs_fill_dirent(struct cifs_
return -EINVAL;
}
+ if (de->name &&
+ (end < de->name || (size_t)(end - de->name) < de->namelen)) {
+ cifs_dbg(VFS, "%s: search entry name extends past end of SMB\n",
+ __func__);
+ return -EINVAL;
+ }
+
return 0;
+
+too_short:
+ cifs_dbg(VFS, "%s: search entry extends past end of SMB\n",
+ __func__);
+ return -EINVAL;
}
#define UNICODE_DOT cpu_to_le16(0x2e)
@@ -672,10 +700,14 @@ static int is_dir_changed(struct file *f
static int cifs_save_resume_key(const char *current_entry,
struct cifsFileInfo *file_info)
{
+ struct TCP_Server_Info *server = tlink_tcon(file_info->tlink)->ses->server;
+ char *buf = file_info->srch_inf.ntwrk_buf_start;
+ const char *end = buf + server->ops->calc_smb_size(buf);
struct cifs_dirent de;
int rc;
- rc = cifs_fill_dirent(&de, current_entry, file_info->srch_inf.info_level,
+ rc = cifs_fill_dirent(&de, current_entry, end,
+ file_info->srch_inf.info_level,
file_info->srch_inf.unicode);
if (!rc) {
file_info->srch_inf.presume_name = de.name;
@@ -977,7 +1009,8 @@ static int cifs_filldir(char *find_entry
struct qstr name;
int rc = 0;
- rc = cifs_fill_dirent(&de, find_entry, file_info->srch_inf.info_level,
+ rc = cifs_fill_dirent(&de, find_entry, end_of_smb,
+ file_info->srch_inf.info_level,
file_info->srch_inf.unicode);
if (rc)
return rc;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 382/547] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 381/547] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2 Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 383/547] smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl() Greg Kroah-Hartman
` (173 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
commit fa0c2f082946917c3f07d2475c8ce73a8c96d0e2 upstream.
cifs_fill_dirent_unix() finds the length of an SMB_FIND_FILE_UNIX
entry name by scanning for its terminating NUL, over up to PATH_MAX + 1
UTF-16 units in cifs_unicode_bytelen() or PATH_MAX bytes in strnlen().
Neither scan knows where the response ends. cifs_fill_dirent() only
requires the fixed part of the entry to fit, so the name can start
exactly at the end of the received data, and a name that holds no
terminator is then scanned for 8194 bytes, or 4096 bytes without
unicode, past the end of the received data. SendReceive() copies at
most 16468 bytes into the 16588-byte cifs_request allocation, so for a
response of that length up to 8074 of the bytes scanned lie past the
end of the allocation. Before the preceding patches bounded where the
entry starts, the entry itself could start up to 820 bytes past the
end of the allocation at the default CIFSMaxBufSize, and its name 928
bytes past it, so all 8194 scanned bytes would lie outside.
cifs_fill_dirent() rejects the name afterwards because it extends past
the end of the response, so nothing of what was read is used, but the
out-of-bounds read itself remains.
SMB_FIND_FILE_UNIX is only used with SMB1 servers that offer the Unix
extensions; SMB1 is not negotiated by default and requires an explicit
vers=1.0 mount.
Before the preceding patches, an entry placed past the buffer left the
scan out of bounds from its first read. They bound where the entry
starts, but nothing bounds the scan, so a name that holds no
terminator still runs off the end of the allocation. Reproduced on
the unpatched tree with KASAN enabled, for an entry that starts
inside the response, which is the case the preceding patches leave
open:
==================================================================
BUG: KASAN: slab-out-of-bounds in cifs_save_resume_key.isra.0+0x75c/0x7f0
Read of size 2 at addr ffff88807ee640cc by task ls/84
CPU: 0 UID: 0 PID: 84 Comm: ls Not tainted 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
Call Trace:
<TASK>
kasan_report+0xdf/0x1a0
cifs_save_resume_key.isra.0+0x75c/0x7f0
cifs_readdir+0x1ed6/0x29c0
iterate_dir+0x1c0/0x570
__x64_sys_getdents64+0x133/0x270
do_syscall_64+0x109/0x5d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 84 on cpu 1 at 15.751078s:
cifs_buf_get+0x36/0x90
smb_init+0x4f/0x110
CIFSFindNext+0xf7/0x14c0
cifs_readdir+0xf51/0x29c0
The buggy address belongs to the object at ffff88807ee60000
which belongs to the cache cifs_request of size 16588
The buggy address is located 0 bytes to the right of
allocated 16588-byte region [ffff88807ee60000, ffff88807ee640cc)
==================================================================
The two bytes read there are one UTF-16 unit of the scan, at the first
byte past the end of the object. The scan carries on from there,
reported again 2, 4 and 6 bytes to the right.
Pass the number of bytes that follow the fixed part of the entry to
cifs_fill_dirent_unix() and stop both scans there. A scan that reaches
the end of the response without finding a terminator now fails: it
returns a name that ends exactly at the end of the response and would
otherwise pass the bound, so cifs_fill_dirent() requires the position
of the terminator of an SMB_FIND_FILE_UNIX name to lie inside the
response as well. Accepting such a name truncated at the end of the
response would turn a malformed entry into a directory entry, or a
resume name, that no server sent. A name longer than the PATH_MAX cap
of the scans is still truncated there, as before, when the response
extends past the cap. The message cifs_unicode_bytelen() logs when it
finds no terminator now covers both limits.
This patch depends on "smb: client: fix OOB read of the resume name
sent in TRANS2_FIND_NEXT2", which adds the end argument of
cifs_fill_dirent() and the length it derives from it; the backport
note in that patch applies to this one as well.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/readdir.c | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -456,17 +456,20 @@ initiate_cifs_search(const unsigned int
}
/* return length of unicode string in bytes */
-static int cifs_unicode_bytelen(const char *str)
+static size_t cifs_unicode_bytelen(const char *str, size_t maxlen)
{
- int len;
const __le16 *ustr = (const __le16 *)str;
+ size_t len;
- for (len = 0; len <= PATH_MAX; len++) {
+ maxlen = umin(PATH_MAX + 1, maxlen / sizeof(__le16));
+ for (len = 0; len < maxlen; len++) {
if (ustr[len] == 0)
- return len << 1;
+ return len * sizeof(__le16);
}
- cifs_dbg(FYI, "Unicode string longer than PATH_MAX found\n");
- return len << 1;
+ len *= sizeof(__le16);
+ cifs_dbg(FYI, "%s: Unicode string not terminated within %zu bytes\n",
+ __func__, len);
+ return len;
}
static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level)
@@ -532,13 +535,13 @@ static void cifs_fill_dirent_posix(struc
}
static void cifs_fill_dirent_unix(struct cifs_dirent *de,
- const FILE_UNIX_INFO *info, bool is_unicode)
+ const FILE_UNIX_INFO *info, bool is_unicode, size_t maxlen)
{
de->name = &info->FileName[0];
if (is_unicode)
- de->namelen = cifs_unicode_bytelen(de->name);
+ de->namelen = cifs_unicode_bytelen(de->name, maxlen);
else
- de->namelen = strnlen(de->name, PATH_MAX);
+ de->namelen = strnlen(de->name, min_t(size_t, maxlen, PATH_MAX));
de->resume_key = info->ResumeKey;
de->ino = le64_to_cpu(info->basic.UniqueId);
}
@@ -589,6 +592,7 @@ static int cifs_fill_dirent(struct cifs_
const char *end, u16 level, bool is_unicode)
{
size_t len = end > (const char *)info ? end - (const char *)info : 0;
+ size_t nul_len = 0;
memset(de, 0, sizeof(*de));
@@ -601,7 +605,9 @@ static int cifs_fill_dirent(struct cifs_
case SMB_FIND_FILE_UNIX:
if (len < offsetof(FILE_UNIX_INFO, FileName))
goto too_short;
- cifs_fill_dirent_unix(de, info, is_unicode);
+ cifs_fill_dirent_unix(de, info, is_unicode,
+ len - offsetof(FILE_UNIX_INFO, FileName));
+ nul_len = is_unicode ? sizeof(__le16) : sizeof(__u8);
break;
case SMB_FIND_FILE_DIRECTORY_INFO:
if (len < offsetof(FILE_DIRECTORY_INFO, FileName))
@@ -634,7 +640,8 @@ static int cifs_fill_dirent(struct cifs_
}
if (de->name &&
- (end < de->name || (size_t)(end - de->name) < de->namelen)) {
+ (end < de->name ||
+ (size_t)(end - de->name) < de->namelen + nul_len)) {
cifs_dbg(VFS, "%s: search entry name extends past end of SMB\n",
__func__);
return -EINVAL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 383/547] smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 382/547] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 384/547] smb: client: reclaim credits for decrypted reads with no matching mid Greg Kroah-Hartman
` (172 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dominik Maier, Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Maier <dmnk@google.com>
commit a377a3645c7d0246af0bc4ef24db94bb2670bdde upstream.
In id_mode_to_cifs_acl(), while the chown branch reserves
sizeof(struct smb_ntsd) + 2 * sizeof(struct smb_sid) (plus
sizeof(struct smb_acl) and the worst-case ACE space after
commit 0ee150794c75 ("smb: client: fix heap overflow in DACL owner/group
rewrite")), the chmod branch only adds 2 * sizeof(struct smb_ace) or
5 * sizeof(struct smb_ace) to secdesclen (or 1 * sizeof(struct smb_ace)
on posix).
However, the chmod branch also invokes build_sec_desc() ->
copy_sec_desc(), which unconditionally writes the Owner SID at
pnntsd + sidsoffset and the Group SID at
pnntsd + sidsoffset + sizeof(struct smb_sid) (2 * 68 = 136 bytes total),
and set_chmod_dacl() always writes a struct smb_acl header (8 bytes)
even when the source descriptor has dacloffset == 0. When a security
descriptor has compact or overlapping Owner/Group SIDs (or
dacloffset == 0), calling chmod() under-allocates pnntsd and writes past
the end of the slab buffer.
Reserve sizeof(struct smb_acl) + 2 * sizeof(struct smb_sid) (plus
sizeof(struct smb_ntsd) on the posix path) in the chmod branch of
id_mode_to_cifs_acl().
Fixes: 7ee0b4c635c0 ("cifs: fix hardcoded default security descriptor length")
Fixes: f5065508897a ("cifs: Retain old ACEs when converting between mode bits and ACL.")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsacl.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/fs/smb/client/cifsacl.c
+++ b/fs/smb/client/cifsacl.c
@@ -1826,12 +1826,15 @@ id_mode_to_cifs_acl(struct inode *inode,
/* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */
if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */
+ nsecdesclen = sizeof(struct smb_acl) +
+ 2 * sizeof(struct smb_sid);
if (posix)
- nsecdesclen = 1 * sizeof(struct smb_ace);
+ nsecdesclen += sizeof(struct smb_ntsd) +
+ sizeof(struct smb_ace);
else if (mode_from_sid)
- nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace));
+ nsecdesclen += secdesclen + 2 * sizeof(struct smb_ace);
else /* cifsacl */
- nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace));
+ nsecdesclen += secdesclen + 5 * sizeof(struct smb_ace);
} else { /* chown */
/* When ownership changes, changes new owner sid length could be different */
nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 384/547] smb: client: reclaim credits for decrypted reads with no matching mid
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 383/547] smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl() Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 385/547] smb: client: reject FIND data areas that run past the received response Greg Kroah-Hartman
` (171 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara, David Howells,
Namjae Jeon, Ronnie Sahlberg, Shyam Prasad N, Tom Talpey,
Bharath SM
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
commit 78f73985846465a25a7bd1d89904053661f3ca92 upstream.
When a decrypted SMB2 READ response carries a MessageId that matches no
outstanding request, both the inline receive_encrypted_read() and the
offloaded smb2_decrypt_offload() paths drop the frame without accounting
the credits the server granted in it. The plaintext unknown-frame path in
cifs_demultiplex_thread() already reclaims them with
smb2_add_credits_from_hdr(), so encrypted reads leak credits that the
plaintext path would not.
This also happens for legitimate frames - e.g. a reply that arrives after
the client has timed out and dropped the mid - so over a long-lived
connection the client's credit count drifts down and can eventually starve
it of the ability to issue requests. The frame is AEAD-authenticated, so
the granted credits in the decrypted header come from the real server and
are safe to apply.
Reclaim the credits from the decrypted header before dropping the frame,
and export smb2_add_credits_from_hdr() so the SMB2 receive paths can use it.
Fixes: c42a6abe3012 ("CIFS: Add capability to decrypt big read responses")
Fixes: 35cf94a39728 ("smb3: allow parallelizing decryption of reads")
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsproto.h | 1 +
fs/smb/client/connect.c | 3 +--
fs/smb/client/smb2ops.c | 6 ++++--
3 files changed, 6 insertions(+), 4 deletions(-)
--- a/fs/smb/client/cifsproto.h
+++ b/fs/smb/client/cifsproto.h
@@ -131,6 +131,7 @@ void cifs_signal_cifsd_for_reconnect(str
void cifs_mark_tcp_ses_conns_for_reconnect(struct TCP_Server_Info *server,
bool mark_smb_session);
int cifs_reconnect(struct TCP_Server_Info *server, bool mark_smb_session);
+void smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server);
bool backup_cred(struct cifs_sb_info *cifs_sb);
bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file,
bool from_readdir);
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1238,8 +1238,7 @@ cifs_handle_standard(struct TCP_Server_I
return 0;
}
-static void
-smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
+void smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
{
struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;
int scredits, in_flight;
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5288,9 +5288,10 @@ static void smb2_decrypt_offload(struct
dw->server->lstrp = jiffies;
mid = smb2_find_dequeue_mid(dw->server, dw->buf);
- if (mid == NULL)
+ if (mid == NULL) {
cifs_dbg(FYI, "mid not found\n");
- else {
+ smb2_add_credits_from_hdr(dw->buf, dw->server);
+ } else {
mid->decrypted = true;
rc = handle_read_data(dw->server, mid, dw->buf,
dw->server->vals->read_rsp_size,
@@ -5421,6 +5422,7 @@ receive_encrypted_read(struct TCP_Server
*mid = smb2_find_mid(server, buf);
if (*mid == NULL) {
cifs_dbg(FYI, "mid not found\n");
+ smb2_add_credits_from_hdr(buf, server);
rc = -1;
} else {
cifs_dbg(FYI, "mid found\n");
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 385/547] smb: client: reject FIND data areas that run past the received response
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 384/547] smb: client: reclaim credits for decrypted reads with no matching mid Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 386/547] smb: client: reject short or out-of-range FIND response parameters Greg Kroah-Hartman
` (170 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
commit 29bd6773187cb5c1bbbdf90d677c6add7d58af26 upstream.
CIFSFindFirst() and CIFSFindNext() take the directory entries of a
TRANS2_FIND_FIRST2 or TRANS2_FIND_NEXT2 response from DataOffset for
DataCount bytes. validate_t2() bounds DataOffset at 1024 and
ParameterCount + DataCount by the byte count, and nothing compares
DataOffset + DataCount with the number of bytes SendReceive() copied
into the buffer.
smb_init() places the request and the response in the same
cifs_request allocation and cifs_buf_get() clears only the start of
it, so a short response whose data area extends past its end has
srch_entries_start point at bytes of the request that was just sent,
or at whatever the allocation held before, and those bytes are parsed
as directory entries. cifs_readdir() and find_cifs_entry() walk the
entries with nxt_dir_entry(), which checks every entry but the first
of a response against the end of the SMB; cifs_query_path_info() and
cifs_backup_query_path_info() read the first entry with no check at
all. Those reads stay inside the allocation, but what they return is
not part of the response. The last entry, which LastNameOffset locates
relative to the data area, is bounded against the received response
by an earlier patch of this series, as is every entry that
cifs_fill_dirent() parses; the walk itself and the two query functions
are not.
SMB1 is not negotiated by default; reaching this code requires an
explicit vers=1.0 mount.
Reject a response whose data area extends past the received length,
with the -EINVAL that validate_t2() returns for the other malformed
transaction responses. cifs_query_path_info() and
cifs_backup_query_path_info() still read a whole entry from a data
area that may be smaller than one; that is not changed here.
A conforming server is not affected. The data block of a transaction
response is part of the SMB, so DataOffset + DataCount cannot exceed
the smbCalcSize() bytes that SendReceive() copies; coalesce_t2()
appends each secondary response to the data area and adds its length
to both DataCount and the byte count, which keeps that relation.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 31 +++++++++++++++++++++++++------
1 file changed, 25 insertions(+), 6 deletions(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -4418,8 +4418,9 @@ CIFSFindFirst(const unsigned int xid, st
/* level 257 SMB_ */
TRANSACTION2_FFIRST_REQ *pSMB = NULL;
TRANSACTION2_FFIRST_RSP *pSMBr = NULL;
- T2_FFIRST_RSP_PARMS *parms;
+ unsigned int data_off, data_count;
struct nls_table *nls_codepage;
+ T2_FFIRST_RSP_PARMS *parms;
unsigned int in_len, lnoff;
__u16 params, byte_count;
int bytes_returned = 0;
@@ -4538,11 +4539,19 @@ findFirstRetry:
return rc;
}
+ data_off = le16_to_cpu(pSMBr->t2.DataOffset);
+ data_count = le16_to_cpu(pSMBr->t2.DataCount);
+ if (data_off + data_count > (unsigned int)bytes_returned) {
+ cifs_dbg(VFS, "%s: data area offset %u count %u past response length %d\n",
+ __func__, data_off, data_count, bytes_returned);
+ cifs_buf_release(pSMB);
+ return -EINVAL;
+ }
+
psrch_inf->unicode = !!(pSMBr->hdr.Flags2 & SMBFLG2_UNICODE);
psrch_inf->ntwrk_buf_start = (char *)pSMBr;
psrch_inf->smallBuf = false;
- psrch_inf->srch_entries_start = (char *)&pSMBr->hdr.Protocol +
- le16_to_cpu(pSMBr->t2.DataOffset);
+ psrch_inf->srch_entries_start = (char *)&pSMBr->hdr.Protocol + data_off;
parms = (T2_FFIRST_RSP_PARMS *)((char *)&pSMBr->hdr.Protocol +
le16_to_cpu(pSMBr->t2.ParameterOffset));
@@ -4575,8 +4584,9 @@ int CIFSFindNext(const unsigned int xid,
{
TRANSACTION2_FNEXT_REQ *pSMB = NULL;
TRANSACTION2_FNEXT_RSP *pSMBr = NULL;
- T2_FNEXT_RSP_PARMS *parms;
+ unsigned int data_off, data_count;
unsigned int name_len, in_len;
+ T2_FNEXT_RSP_PARMS *parms;
unsigned int lnoff;
__u16 params, byte_count;
char *response_data;
@@ -4660,13 +4670,22 @@ int CIFSFindNext(const unsigned int xid,
cifs_buf_release(pSMB);
return rc;
}
+
+ data_off = le16_to_cpu(pSMBr->t2.DataOffset);
+ data_count = le16_to_cpu(pSMBr->t2.DataCount);
+ if (data_off + data_count > (unsigned int)bytes_returned) {
+ cifs_dbg(VFS, "%s: data area offset %u count %u past response length %d\n",
+ __func__, data_off, data_count, bytes_returned);
+ cifs_buf_release(pSMB);
+ return -EINVAL;
+ }
+
/* BB fixme add lock for file (srch_info) struct here */
psrch_inf->unicode = !!(pSMBr->hdr.Flags2 & SMBFLG2_UNICODE);
response_data = (char *)&pSMBr->hdr.Protocol +
le16_to_cpu(pSMBr->t2.ParameterOffset);
parms = (T2_FNEXT_RSP_PARMS *)response_data;
- response_data = (char *)&pSMBr->hdr.Protocol +
- le16_to_cpu(pSMBr->t2.DataOffset);
+ response_data = (char *)&pSMBr->hdr.Protocol + data_off;
if (psrch_inf->smallBuf)
cifs_small_buf_release(psrch_inf->ntwrk_buf_start);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 386/547] smb: client: reject short or out-of-range FIND response parameters
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 385/547] smb: client: reject FIND data areas that run past the received response Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 387/547] smb: client: reject short SESSION_SETUP responses Greg Kroah-Hartman
` (169 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
commit 531aa4239b0d80d7146b102b98f7aa7da989ccdd upstream.
CIFSFindFirst() and CIFSFindNext() read the SearchHandle, SearchCount,
EndofSearch and LastNameOffset of a TRANS2_FIND_FIRST2 or
TRANS2_FIND_NEXT2 response at ParameterOffset. validate_t2() bounds
the offset at 1024 and ParameterCount below 512, and nothing compares
them with the number of bytes SendReceive() copied into the buffer or
with the size of the response parameters. smb_init() places the
request and the response in the same cifs_request allocation and
cifs_buf_get() clears only the start of it, so a short response with a
ParameterOffset past its end has the search handle, the entry count,
the end-of-search flag and the last-entry offset read out of the
request that was just sent, or out of whatever the allocation held
before, and a ParameterCount smaller than the parameters has them read
past the end of the parameter block. The reads stay inside the
allocation, but what they return is not part of the response, and
CIFSFindFirst() then hands back a search handle the server never sent.
That handle is sent back to the server in the next FIND_NEXT2 or
FIND_CLOSE2, so two bytes of the buffer leak at an offset the server
picks.
SMB1 is not negotiated by default; reaching this code requires an
explicit vers=1.0 mount.
Reject a response whose parameter area is smaller than the response
parameters or extends past the received length, returning smb_EIO2()
with a new smb_eio_traces value for each of the two responses, like
the other response checks this file gained since v6.19. Backports to
trees before v6.19 need smb_EIO2() replaced with -EINVAL and the
trace.h hunk dropped.
A conforming server is not affected. The parameter block of a
transaction response is part of the SMB, so ParameterOffset +
ParameterCount cannot exceed the smbCalcSize() bytes that
SendReceive() copies, and the response parameters are 10 bytes for
FIND_FIRST2 and 8 bytes for FIND_NEXT2, which is what
T2_FFIRST_RSP_PARMS and T2_FNEXT_RSP_PARMS hold.
This patch depends on "smb: client: reject FIND data areas that run
past the received response", whose declarations it extends.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # 6.19.x
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 34 ++++++++++++++++++++++++++++------
fs/smb/client/trace.h | 2 ++
2 files changed, 30 insertions(+), 6 deletions(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -4416,9 +4416,9 @@ CIFSFindFirst(const unsigned int xid, st
struct cifs_search_info *psrch_inf, bool msearch)
{
/* level 257 SMB_ */
+ unsigned int parm_off, parm_count, data_off, data_count;
TRANSACTION2_FFIRST_REQ *pSMB = NULL;
TRANSACTION2_FFIRST_RSP *pSMBr = NULL;
- unsigned int data_off, data_count;
struct nls_table *nls_codepage;
T2_FFIRST_RSP_PARMS *parms;
unsigned int in_len, lnoff;
@@ -4539,6 +4539,18 @@ findFirstRetry:
return rc;
}
+ parm_off = le16_to_cpu(pSMBr->t2.ParameterOffset);
+ parm_count = le16_to_cpu(pSMBr->t2.ParameterCount);
+ if (parm_count < sizeof(*parms) ||
+ parm_off + parm_count > (unsigned int)bytes_returned) {
+ cifs_dbg(FYI, "%s: bad parameter area offset %u count %u for response of %d\n",
+ __func__, parm_off, parm_count, bytes_returned);
+ rc = smb_EIO2(smb_eio_trace_ffirst_param_area,
+ parm_off, parm_count);
+ cifs_buf_release(pSMB);
+ return rc;
+ }
+
data_off = le16_to_cpu(pSMBr->t2.DataOffset);
data_count = le16_to_cpu(pSMBr->t2.DataCount);
if (data_off + data_count > (unsigned int)bytes_returned) {
@@ -4553,8 +4565,7 @@ findFirstRetry:
psrch_inf->smallBuf = false;
psrch_inf->srch_entries_start = (char *)&pSMBr->hdr.Protocol + data_off;
- parms = (T2_FFIRST_RSP_PARMS *)((char *)&pSMBr->hdr.Protocol +
- le16_to_cpu(pSMBr->t2.ParameterOffset));
+ parms = (T2_FFIRST_RSP_PARMS *)((char *)&pSMBr->hdr.Protocol + parm_off);
psrch_inf->endOfSearch = !!parms->EndofSearch;
psrch_inf->entries_in_buffer = le16_to_cpu(parms->SearchCount);
@@ -4582,9 +4593,9 @@ int CIFSFindNext(const unsigned int xid,
__u16 searchHandle, __u16 search_flags,
struct cifs_search_info *psrch_inf)
{
+ unsigned int parm_off, parm_count, data_off, data_count;
TRANSACTION2_FNEXT_REQ *pSMB = NULL;
TRANSACTION2_FNEXT_RSP *pSMBr = NULL;
- unsigned int data_off, data_count;
unsigned int name_len, in_len;
T2_FNEXT_RSP_PARMS *parms;
unsigned int lnoff;
@@ -4671,6 +4682,18 @@ int CIFSFindNext(const unsigned int xid,
return rc;
}
+ parm_off = le16_to_cpu(pSMBr->t2.ParameterOffset);
+ parm_count = le16_to_cpu(pSMBr->t2.ParameterCount);
+ if (parm_count < sizeof(*parms) ||
+ parm_off + parm_count > (unsigned int)bytes_returned) {
+ cifs_dbg(FYI, "%s: bad parameter area offset %u count %u for response of %d\n",
+ __func__, parm_off, parm_count, bytes_returned);
+ rc = smb_EIO2(smb_eio_trace_fnext_param_area,
+ parm_off, parm_count);
+ cifs_buf_release(pSMB);
+ return rc;
+ }
+
data_off = le16_to_cpu(pSMBr->t2.DataOffset);
data_count = le16_to_cpu(pSMBr->t2.DataCount);
if (data_off + data_count > (unsigned int)bytes_returned) {
@@ -4682,8 +4705,7 @@ int CIFSFindNext(const unsigned int xid,
/* BB fixme add lock for file (srch_info) struct here */
psrch_inf->unicode = !!(pSMBr->hdr.Flags2 & SMBFLG2_UNICODE);
- response_data = (char *)&pSMBr->hdr.Protocol +
- le16_to_cpu(pSMBr->t2.ParameterOffset);
+ response_data = (char *)&pSMBr->hdr.Protocol + parm_off;
parms = (T2_FNEXT_RSP_PARMS *)response_data;
response_data = (char *)&pSMBr->hdr.Protocol + data_off;
--- a/fs/smb/client/trace.h
+++ b/fs/smb/client/trace.h
@@ -30,6 +30,8 @@
EM(smb_eio_trace_ea_next_offset, "ea_next_offset") \
EM(smb_eio_trace_ea_overrun, "ea_overrun") \
EM(smb_eio_trace_extract_will_pin, "extract_will_pin") \
+ EM(smb_eio_trace_ffirst_param_area, "ffirst_param_area") \
+ EM(smb_eio_trace_fnext_param_area, "fnext_param_area") \
EM(smb_eio_trace_forced_shutdown, "forced_shutdown") \
EM(smb_eio_trace_getacl_bcc_too_small, "getacl_bcc_too_small") \
EM(smb_eio_trace_getcifsacl_param_count, "getcifsacl_param_count") \
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 387/547] smb: client: reject short SESSION_SETUP responses
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 386/547] smb: client: reject short or out-of-range FIND response parameters Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 388/547] smb: client: require stable pages for SMB compression Greg Kroah-Hartman
` (168 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
commit 4d8930afa3446041358a7db33e7b23a0bb9459b5 upstream.
smb2_check_message() accepts frames shorter than struct smb2_pdu when
the SMB2 status is non-zero, before the minimum-PDU check added by
b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP
response is therefore accepted even though it cannot contain the
SecurityBufferOffset and SecurityBufferLength fields.
The parser then reads those fields from stale bytes left in the reused
receive buffer by an earlier frame. With a long stale
SecurityBufferLength, decode_ntlmssp_challenge() copies up to about
64 KB from beyond the receive object and sends the data back to the
server in the NTLMv2 AUTHENTICATE target info.
Reject short MPR SESSION_SETUP responses before the short-error path,
and validate SecurityBufferOffset + SecurityBufferLength against the
received response length before decoding the challenge.
The ordering bypass is not new: the short-error early return predates
b4694f269e66d, and the unvalidated SecurityBufferLength read predates
the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable
trees are affected. Reproduced on 6.6.87.2; the path is unchanged on
mainline.
Fixes: 5478f9ba9a34 ("CIFS: Add session setup/logoff capability for SMB2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2misc.c | 16 ++++++++++++++++
fs/smb/client/smb2pdu.c | 10 ++++++++--
2 files changed, 24 insertions(+), 2 deletions(-)
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -225,6 +225,22 @@ smb2_check_message(char *buf, unsigned i
return 1;
}
+ /*
+ * A SESSION_SETUP response that asks for more processing carries a
+ * security blob and is parsed as a normal reply. Do not let the
+ * short-error path below accept a frame that cannot hold the fixed
+ * response fields; the minimum-PDU check later is unreachable once
+ * the early return has accepted the frame.
+ */
+ if (command == SMB2_SESSION_SETUP_HE &&
+ shdr->Status == STATUS_MORE_PROCESSING_REQUIRED &&
+ len < smb2_min_pdu_len[command]) {
+ cifs_server_dbg(VFS,
+ "%s: session setup response too short: %u < %zu\n",
+ __func__, len, smb2_min_pdu_len[command]);
+ return 1;
+ }
+
if (len < pdu_size) {
if ((len >= hdr_size)
&& (shdr->Status != 0)) {
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -1860,14 +1860,20 @@ SMB2_sess_auth_rawntlmssp_negotiate(stru
goto out;
u16 boff = le16_to_cpu(rsp->SecurityBufferOffset);
+ u16 blen = le16_to_cpu(rsp->SecurityBufferLength);
if (offsetof(struct smb2_sess_setup_rsp, Buffer) != boff) {
cifs_dbg(VFS, "Invalid security buffer offset %d\n", boff);
rc = smb_EIO1(smb_eio_trace_sess_buf_off, boff);
goto out;
}
- rc = decode_ntlmssp_challenge(rsp->Buffer,
- le16_to_cpu(rsp->SecurityBufferLength), ses);
+ if ((u32)boff + blen > sess_data->iov[0].iov_len) {
+ cifs_dbg(VFS, "%s: invalid security buffer length: %u\n",
+ __func__, blen);
+ rc = -EINVAL;
+ goto out;
+ }
+ rc = decode_ntlmssp_challenge(rsp->Buffer, blen, ses);
if (rc)
goto out;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 388/547] smb: client: require stable pages for SMB compression
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 387/547] smb: client: reject short SESSION_SETUP responses Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 389/547] smb: client: validate NT transaction response layout and offsets Greg Kroah-Hartman
` (167 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Paulo Alcantara,
Namjae Jeon, Ronnie Sahlberg, Shyam Prasad N, Tom Talpey,
Bharath SM
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
commit 8667061cf99394526dd9c0ea2662e6bbc7ae7848 upstream.
Like signing, SMB compression builds the write payload from the pagecache
folios: should_compress() lets a write request through and smb_compress()
compresses those folios on the way to the socket. If a buffered write
mutates a folio while a write subrequest is still in flight, the compressed
bytes no longer correspond to a consistent view of the data, and the server
silently stores corrupted contents - worse than the signed case, which at
least fails loudly with STATUS_ACCESS_DENIED.
Mark the mapping for stable writes when a write may be compressed, i.e. the
same condition should_compress() tests (compression negotiated and the share
allows compressed data), so netfs_perform_write() waits for writeback to
complete before modifying an in-flight folio.
Fixes: f046d71e84e1 ("smb: client: insert compression check/call on write requests")
Suggested-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/inode.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -88,7 +88,9 @@ static void cifs_set_ops(struct inode *i
else
inode->i_data.a_ops = &cifs_addr_ops;
mapping_set_large_folios(inode->i_mapping);
- if (tcon->ses->server->sign)
+ if (tcon->ses->server->sign ||
+ (tcon->ses->server->compression.enabled &&
+ (tcon->share_flags & SMB2_SHAREFLAG_COMPRESS_DATA)))
mapping_set_stable_writes(inode->i_mapping);
break;
case S_IFDIR:
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 389/547] smb: client: validate NT transaction response layout and offsets
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 388/547] smb: client: require stable pages for SMB compression Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 390/547] smb: client: validate SMB1 EA list bounds before parsing Greg Kroah-Hartman
` (166 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Namjae Jeon,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
commit 83d0d5e0ca22233c75daf139ec0063b9d2ff1ac7 upstream.
validate_ntransact() assumes that the response uses the fixed 18-word NT
transaction layout. A different WordCount makes get_bcc() locate the byte
count at a different offset from pSMBr->ByteCount, allowing the subsequent
bounds checks to use inconsistent response boundaries.
The function also turns the 32-bit ParameterOffset and DataOffset fields
into pointers before checking their bounds. On a 32-bit client, a large
offset can wrap the pointer below end_of_smb and pass the one-sided pointer
comparison. The caller then dereferences the parameter pointer or copies
from the data pointer.
Require the expected WordCount before reading the byte count. Check each
offset and count against the received SMB length as integers before forming
either pointer. Use subtraction after validating the offset so that the
range checks cannot overflow.
Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Fixes: 0a4b92c05ed0 ("[CIFS] Add worker function for Get ACL cifs style")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 32 +++++++++++++++++++-------------
1 file changed, 19 insertions(+), 13 deletions(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -3799,9 +3799,10 @@ static int
validate_ntransact(char *buf, char **ppparm, char **ppdata,
__u32 *pparmlen, __u32 *pdatalen)
{
- char *end_of_smb;
__u32 data_count, data_offset, parm_count, parm_offset;
struct smb_com_ntransact_rsp *pSMBr;
+ size_t buflen;
+ char *end_buf;
u16 bcc;
*pdatalen = 0;
@@ -3812,37 +3813,42 @@ validate_ntransact(char *buf, char **ppp
pSMBr = (struct smb_com_ntransact_rsp *)buf;
+ if (pSMBr->hdr.WordCount != 18) {
+ cifs_dbg(FYI, "invalid NT transaction WordCount %u\n",
+ pSMBr->hdr.WordCount);
+ return -EINVAL;
+ }
+
bcc = get_bcc(&pSMBr->hdr);
- end_of_smb = 2 /* sizeof byte count */ + bcc +
- (char *)&pSMBr->ByteCount;
+ end_buf = 2 /* sizeof byte count */ + bcc + (char *)&pSMBr->ByteCount;
+ buflen = end_buf - buf;
data_offset = le32_to_cpu(pSMBr->DataOffset);
data_count = le32_to_cpu(pSMBr->DataCount);
parm_offset = le32_to_cpu(pSMBr->ParameterOffset);
parm_count = le32_to_cpu(pSMBr->ParameterCount);
- *ppparm = (char *)&pSMBr->hdr.Protocol + parm_offset;
- *ppdata = (char *)&pSMBr->hdr.Protocol + data_offset;
-
/* should we also check that parm and data areas do not overlap? */
- if (*ppparm > end_of_smb) {
+ if (parm_offset > buflen) {
cifs_dbg(FYI, "parms start after end of smb\n");
return -EINVAL;
- } else if (parm_count + *ppparm > end_of_smb) {
+ } else if (parm_count > buflen - parm_offset) {
cifs_dbg(FYI, "parm end after end of smb\n");
return -EINVAL;
- } else if (*ppdata > end_of_smb) {
+ } else if (data_offset > buflen) {
cifs_dbg(FYI, "data starts after end of smb\n");
return -EINVAL;
- } else if (data_count + *ppdata > end_of_smb) {
- cifs_dbg(FYI, "data %p + count %d (%p) past smb end %p start %p\n",
- *ppdata, data_count, (data_count + *ppdata),
- end_of_smb, pSMBr);
+ } else if (data_count > buflen - data_offset) {
+ cifs_dbg(FYI, "data offset %u + count %u past smb length %zu\n",
+ data_offset, data_count, buflen);
return -EINVAL;
} else if (parm_count + data_count > bcc) {
cifs_dbg(FYI, "parm count and data count larger than SMB\n");
return -EINVAL;
}
+
+ *ppparm = buf + parm_offset;
+ *ppdata = buf + data_offset;
*pdatalen = data_count;
*pparmlen = parm_count;
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 390/547] smb: client: validate SMB1 EA list bounds before parsing
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 389/547] smb: client: validate NT transaction response layout and offsets Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 391/547] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
` (165 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
commit ddc7a7e1eeb116ccaf010a6f1fb6ab927f3f888d upstream.
CIFSSMBQAllEAs() checks the server-provided EA list length by adding it
to the response pointer. On 32-bit systems, a positive length can wrap
the pointer and pass the comparison. The parser then walks outside the
received response while reading the next FEA header.
A response with a list length of 0x40000000 reproduces this as a native
i386 page fault and kernel panic from listxattr() against an SMB1
server.
Check that the EA list starts within the SMB byte area before reading
its header. Keep its length unsigned and compare it with the bytes left
in the response without pointer addition.
SMB1 is not negotiated by default and requires an explicit vers=1.0
mount.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -6231,9 +6231,11 @@ CIFSSMBQAllEAs(const unsigned int xid, s
int rc = 0;
int bytes_returned;
int list_len;
+ u32 ea_list_len;
struct fealist *ea_response_data;
struct fea *temp_fea;
char *temp_ptr;
+ char *byte_area;
char *end_of_smb;
__u16 params, byte_count, data_offset;
unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0;
@@ -6312,9 +6314,19 @@ QAllEAsRetry:
ea_response_data = (struct fealist *)
(((char *) &pSMBr->hdr.Protocol) + data_offset);
- list_len = le32_to_cpu(ea_response_data->list_len);
- cifs_dbg(FYI, "ea length %d\n", list_len);
- if (list_len <= 8) {
+ byte_area = pByteArea(&pSMBr->hdr);
+ end_of_smb = byte_area + get_bcc(&pSMBr->hdr);
+ if ((char *)ea_response_data < byte_area ||
+ (char *)ea_response_data >
+ end_of_smb - sizeof(ea_response_data->list_len)) {
+ rc = smb_EIO2(smb_eio_trace_qalleas_overlong,
+ data_offset, get_bcc(&pSMBr->hdr));
+ goto QAllEAsOut;
+ }
+
+ ea_list_len = le32_to_cpu(ea_response_data->list_len);
+ cifs_dbg(FYI, "%s: ea length: %u\n", __func__, ea_list_len);
+ if (ea_list_len <= 8) {
cifs_dbg(FYI, "empty EA list returned from server\n");
/* didn't find the named attribute */
if (ea_name)
@@ -6323,14 +6335,14 @@ QAllEAsRetry:
}
/* make sure list_len doesn't go past end of SMB */
- end_of_smb = (char *)pByteArea(&pSMBr->hdr) + get_bcc(&pSMBr->hdr);
- if ((char *)ea_response_data + list_len > end_of_smb) {
+ if (ea_list_len > end_of_smb - (char *)ea_response_data) {
cifs_dbg(FYI, "EA list appears to go beyond SMB\n");
rc = smb_EIO2(smb_eio_trace_qalleas_overlong,
- (unsigned long)ea_response_data + list_len - (unsigned long)pSMBr,
- (unsigned long)end_of_smb - (unsigned long)pSMBr);
+ ea_list_len,
+ end_of_smb - (char *)ea_response_data);
goto QAllEAsOut;
}
+ list_len = ea_list_len;
/* account for ea list len */
list_len -= 4;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 391/547] smb: client: validate the data area in SMB2_read()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 390/547] smb: client: validate SMB1 EA list bounds before parsing Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 392/547] xfs: map pNFS layouts to the end of the extent again Greg Kroah-Hartman
` (164 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon,
Paulo Alcantara
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
commit 2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1 upstream.
SMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from
(char *)rsp + rsp->DataOffset without checking that the range lies
within the response actually received. A READ response with
DataOffset == 0 makes smb2_get_data_area_len() zero the data length, so
smb2_check_message() accepts a frame as short as the fixed response,
while SMB2_read() still uses the server-supplied DataLength, capped only
by CIFS_MAX_MSGSIZE and the caller's length.
A malicious server can answer the synchronous read used by the
mfsymlinks (or SFU) symlink parser with an 81-byte READ response
carrying DataOffset 0 and DataLength 1067, making the client copy 1067
bytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to
16 KiB in the general case).
Clamp a zero (or header-overlapping) DataOffset to read_rsp_size, as
handle_read_data() does for the asynchronous path, and reject the
response unless DataOffset + DataLength fits within rsp_iov.iov_len.
The SMB1 helper was fixed the same way in 5be5bdda5863.
Fixes: d8e050398d23 ("CIFS: Add readpage support for SMB2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -4962,6 +4962,7 @@ SMB2_read(const unsigned int xid, struct
struct kvec iov[1];
struct kvec rsp_iov;
unsigned int total_len;
+ u16 data_offset;
int flags = CIFS_LOG_ERROR;
struct cifs_ses *ses = io_parms->tcon->ses;
@@ -5021,8 +5022,29 @@ SMB2_read(const unsigned int xid, struct
*nbytes = 0;
}
+ data_offset = rsp->DataOffset;
+ if (data_offset < io_parms->server->vals->read_rsp_size) {
+ /*
+ * win2k8 sometimes sends an offset of 0 when the read is beyond
+ * the EOF. Treat it as if the data starts just after the header,
+ * as handle_read_data() does.
+ */
+ cifs_dbg(FYI, "data offset %u inside read response header\n",
+ data_offset);
+ data_offset = io_parms->server->vals->read_rsp_size;
+ }
+
+ /* The data area must lie within the response actually received */
+ if (*nbytes && (size_t)data_offset + *nbytes > rsp_iov.iov_len) {
+ cifs_dbg(FYI, "bad data offset %u length %u for response of %zu\n",
+ data_offset, *nbytes, rsp_iov.iov_len);
+ rc = smb_EIO2(smb_eio_trace_read_bad_offset,
+ data_offset, *nbytes);
+ *nbytes = 0;
+ }
+
if (*buf) {
- memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes);
+ memcpy(*buf, (char *)rsp + data_offset, *nbytes);
free_rsp_buf(resp_buftype, rsp_iov.iov_base);
} else if (resp_buftype != CIFS_NO_BUFFER) {
*buf = rsp_iov.iov_base;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 392/547] xfs: map pNFS layouts to the end of the extent again
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 391/547] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 393/547] kernfs: dont lose IN_DELETE_SELF when decoding a file handle Greg Kroah-Hartman
` (163 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Chinner, Daejun Park,
Darrick J. Wong, Carlos Maiolino
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
commit e3c682dd11303a95ff82ea63b9172dce788578d4 upstream.
Since commit 36ca6f11424a ("xfs: fix overlapping extents returned for
pNFS LAYOUTGET"), xfs_fs_map_blocks() maps only the range that nfsd asks
for. For O_DIRECT, the Linux block layout client asks for the range of
the I/O at hand, so it now needs a LAYOUTGET for every O_DIRECT read or
write to a part of a file it has no layout for yet, where the first
LAYOUTGET used to return the whole extent. Each LAYOUTGET is a round
trip, and xfs_fs_map_blocks() takes the iolock exclusively and writes
back and invalidates the page cache of the file for it.
On three QEMU VMs (an NVMe/TCP target, the server with nfsd and XFS, and
a client) running the same kernel without KASAN or lock debugging, a
client doing O_DIRECT I/O over the block layout of NFSv4.2 for 30
seconds to a 1 GiB file of one written extent, in order unless noted and
with an fsync every 16 MiB written, gets this many I/Os done (and
LAYOUTGETs counted at the server), one run each:
unpatched ENTIRE, no trim this patch
4 KiB reads 41207 (41207) 334931 (1) 343749 (1)
4 KiB random 36670 (34148) 259527 (1) 263829 (15)
4 KiB overwrite 38556 (38556) 325533 (1) 307105 (1)
64 KiB reads 70241 (16384) 80829 (1) 91196 (1)
1 MiB reads 6857 (1024) 6759 (1) 6706 (1)
"ENTIRE, no trim" is a test kernel that maps with XFS_BMAPI_ENTIRE and
does not trim. The random reads need a LAYOUTGET each time they go
before the lowest offset read so far, as the part of the extent before
the offset asked for is not mapped. 1 MiB overwrites and writes to an
unwritten extent also go from 1024 LAYOUTGETs to 1, with no clear change
in I/Os done. Appending to a new file needs a LAYOUTGET per 1 MiB
appended either way, as XFS allocates only the range asked for on a
filesystem without a stripe unit or an extent size hint.
The overlap fixed by that commit comes from XFS_BMAPI_ENTIRE reaching
back. nfsd4_block_proc_layoutget() calls ->map_blocks once per extent
of a LAYOUTGET, each time for the range left after the previous extent.
An allocation in one call can merge the extent that the next call starts
in with the extents before it, and the whole extent then starts before
the offset of that call and overlaps extents already in the layout. The
Linux client rejects such a layout (verify_extent() returns -EIO), and
the I/O that needed it fails.
In the thread of that commit, Christoph Hellwig asked for
XFS_BMAPI_ENTIRE to be dropped to stop the overlap, Darrick J. Wong
agreed, and it was said that the flag makes no difference on the first
call, which is for the whole range the client asked for. The difference
is past that range: the Linux client asks for the range of each O_DIRECT
I/O and uses the rest of a longer layout for the I/Os that follow, which
RFC 8881 allows (Table 22 sets only a minimum length). A client could
ask for more for a read layout, but for a write layout
xfs_fs_map_blocks() allocates any hole in the range asked for.
Dave Chinner suggested keeping the flag for the first call and trimming
the mappings of the calls that follow. ->map_blocks cannot tell the
first call from the others, and Christoph preferred to keep such a
choice out of that interface, so trim every mapping to start at the
offset asked for instead. No mapping can then overlap the one before
it, since each call starts where the previous extent ended. Unlike
Dave's suggestion, the first mapping loses the part of the extent before
the offset, and the last mapping keeps the part past the end of the
range, which the loop in nfsd4_block_proc_layoutget() already handles.
Trimming in that loop instead would keep his suggestion exactly, but
would change nfsd as well, while trimming in XFS keeps every mapping it
returns free of overlap whatever the caller does.
Unlike before that commit, don't let the mapping reach past EOF beyond
the range asked for. On an inode without XFS_DIFLAG_PREALLOC or
XFS_DIFLAG_APPEND, xfs_free_eofblocks() can free blocks past EOF, such
as speculative preallocation, without breaking the layout, so a client
that did not ask for them should not get them. What a client gets for a
range past EOF that it asks for does not change.
The aio group, the fsx tests and generic/013 (fsstress) of fstests over
the block layout, and the fsx tests and generic/013 over the SCSI
layout, give the same results with and without this patch. generic/091
and 263 fail with the ENTIRE, no trim kernel and pass with this patch,
and so does the pynfs test BLOCK5, which checks a write layout over a
hole between two allocated blocks against three rules of RFC 5663
section 2.3.1.
Fixes: 36ca6f11424a ("xfs: fix overlapping extents returned for pNFS LAYOUTGET")
Cc: stable@vger.kernel.org
Suggested-by: Dave Chinner <dgc@kernel.org>
Link: https://lore.kernel.org/r/ageSguSyf2kBY33a@dread
Link: https://lore.kernel.org/r/agwDhixPAAA0-cTa@infradead.org
Link: https://lore.kernel.org/r/agqfBPRWXQDR2ImG@infradead.org
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_pnfs.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index f8535ecde21a..ab385617003a 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -183,13 +183,28 @@ xfs_fs_map_blocks(
offset_fsb = XFS_B_TO_FSBT(mp, offset);
lock_flags = xfs_ilock_data_map_shared(ip);
- /* request mappings for the specified range only */
+ /*
+ * Map to the end of the extent that covers the start of the range,
+ * so that a client doing I/O in pieces gets a layout it can use for
+ * the pieces that follow. Never map anything before the start of
+ * the range: nfsd calls in here once per extent of a LAYOUTGET, for
+ * the range that is left after the previous extent, and the mapping
+ * can change in between, so a mapping that reaches back can overlap
+ * one already in the layout. Don't extend the mapping past EOF
+ * beyond the range either: xfs_free_eofblocks() can free blocks past
+ * EOF without breaking the layout.
+ */
error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb,
- &imap, &nimaps, 0);
+ &imap, &nimaps, XFS_BMAPI_ENTIRE);
if (error) {
xfs_iunlock(ip, lock_flags);
goto out_unlock;
}
+ if (nimaps)
+ xfs_trim_extent(&imap, offset_fsb,
+ max_t(xfs_fileoff_t, end_fsb,
+ XFS_B_TO_FSB(mp, XFS_ISIZE(ip))) -
+ offset_fsb);
seq = xfs_iomap_inode_sequence(ip, 0);
ASSERT(!nimaps || imap.br_startblock != DELAYSTARTBLOCK);
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 393/547] kernfs: dont lose IN_DELETE_SELF when decoding a file handle
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 392/547] xfs: map pNFS layouts to the end of the extent again Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 394/547] pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate Greg Kroah-Hartman
` (162 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tejun Heo, Shakeel Butt,
Christian Brauner (Amutable)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shakeel Butt <shakeel.butt@linux.dev>
commit dc1a0cc95737344b1a6aa42075e573e9625c6b9a upstream.
__kernfs_remove() clears i_nlink on a node's inodes and finds them with
ilookup(). A decode that has pinned the node but not yet hashed its
inode is invisible to that pass:
CPU0 CPU1
open_by_handle_at()
kernfs_find_and_get_node_by_id()
pins the node, still active
rmdir()
marks the subtree removing
ilookup() finds no inode
kernfs_get_inode()
hashes an inode with i_nlink 1
Nothing fixes it later: kernfs_refresh_inode() never touches i_nlink for
a file and skips it for a directory being removed. The inode keeps the
1 it was born with, and dentry_unlink_inode() sends IN_DELETE_SELF only
at 0, so a watcher never learns the node went away.
The other callers of kernfs_get_inode() are safe: those in fs/kernfs
hold kernfs_rwsem, and cgroup_may_write() is covered by cgroup_mutex,
which cgroup_destroy_locked() holds across kernfs_remove().
__kernfs_fh_to_dentry() has held nothing since exportfs support was
added.
Take kernfs_rwsem for reading, as ->get_parent already does, and cover
the lookup as well as kernfs_get_inode(). __kernfs_remove() deactivates
the whole subtree under the write lock, so under the read lock either
the lookup refuses the node, or the inode is hashed before the ilookup()
pass runs. The same holds for ->fh_to_parent, since a node cannot be
active while an ancestor is being removed.
Reproduced with a 300ms delay between the lookup and kernfs_get_inode(),
decoding a handle for a file in a cgroup directory while another task
rmdir()s it: st_nlink is 1 without this patch and 0 with it.
->get_parent still has a window of its own. It takes the same lock but
has no active check, so reconnect_path() can build an inode for an
ancestor that is already gone. That needs the active test rather than a
lock, and changes what ->get_parent returns, so it is left to the series
that reworks these paths.
Fixes: eea5d2bb34ba ("kernfs: Send IN_DELETE_SELF and IN_IGNORED")
Cc: stable@vger.kernel.org
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Link: https://patch.msgid.link/20260905191613.3143937-4-shakeel.butt@linux.dev
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/kernfs/mount.c | 32 +++++++++++++++++++++-----------
1 file changed, 21 insertions(+), 11 deletions(-)
--- a/fs/kernfs/mount.c
+++ b/fs/kernfs/mount.c
@@ -124,22 +124,32 @@ static struct dentry *__kernfs_fh_to_den
return NULL;
}
- kn = kernfs_find_and_get_node_by_id(info->root, id);
- if (!kn)
- return ERR_PTR(-ESTALE);
+ /*
+ * Hold kernfs_rwsem across the lookup as well as kernfs_get_inode().
+ * __kernfs_remove() deactivates the subtree and clears i_nlink on its
+ * inodes under the write lock, so under the read lock either
+ * kernfs_find_and_get_node_by_id() refuses the node, or the inode is
+ * in the inode hash before the ilookup() pass goes looking for it.
+ */
+ scoped_guard(rwsem_read, &info->root->kernfs_rwsem) {
+ kn = kernfs_find_and_get_node_by_id(info->root, id);
+ if (!kn)
+ return ERR_PTR(-ESTALE);
+
+ if (get_parent) {
+ struct kernfs_node *parent;
- if (get_parent) {
- struct kernfs_node *parent;
+ parent = kernfs_get_parent(kn);
+ kernfs_put(kn);
+ kn = parent;
+ if (!kn)
+ return ERR_PTR(-ESTALE);
+ }
- parent = kernfs_get_parent(kn);
+ inode = kernfs_get_inode(sb, kn);
kernfs_put(kn);
- kn = parent;
- if (!kn)
- return ERR_PTR(-ESTALE);
}
- inode = kernfs_get_inode(sb, kn);
- kernfs_put(kn);
return d_obtain_alias(inode);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 394/547] pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 393/547] kernfs: dont lose IN_DELETE_SELF when decoding a file handle Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 395/547] pnfs/blocklayout: Complete a device upcall only on its own reply Greg Kroah-Hartman
` (161 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit a0cb76dc3b2919af8257fc08b4f9a79a35442483 upstream.
decode_devicenotify_args() gated the trailing ndc_immediate on
cbd_layout_type rather than cbd_notify_type, so the flag was never
consumed and a multi-item cnda_changes<> misaligned after the first
entry.
Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/callback_xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -312,7 +312,7 @@ __be32 decode_devicenotify_args(struct s
memcpy(dev->cbd_dev_id.data, p, NFS4_DEVICEID4_SIZE);
p += XDR_QUADLEN(NFS4_DEVICEID4_SIZE);
- if (dev->cbd_layout_type == NOTIFY_DEVICEID4_CHANGE) {
+ if (dev->cbd_notify_type == NOTIFY_DEVICEID4_CHANGE) {
p = xdr_inline_decode(xdr, sizeof(uint32_t));
if (unlikely(p == NULL)) {
status = htonl(NFS4ERR_BADXDR);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 395/547] pnfs/blocklayout: Complete a device upcall only on its own reply
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 394/547] pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 396/547] pnfs/blocklayout: Complete a device upcall when the pipe is closed Greg Kroah-Hartman
` (160 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit acfbea6c5e27c68d6b6d12849eb2b7f8466ccf06 upstream.
bl_pipe_downcall() wakes bl_resolve_deviceid() on any write of the
right size, without checking that blkmapd has read the upcall being
replied to. A write that arrives first returns the waiter while its
struct rpc_pipe_msg is still queued on the pipe, which then holds a
list_head into a dead stack frame. Reaching the pipe takes root, so
the trigger is a broken or hostile blkmapd.
The wait has two further defects. bl_resolve_deviceid() sets
TASK_UNINTERRUPTIBLE only after rpc_queue_upcall() has made the
message visible, so a reply that lands in between wakes a running
task and the schedule() that follows sleeps forever holding
bl_mutex. And nn->bl_mount_reply is never reset, so when the pipe
purges an unread upcall the waiter takes the previous reply as its
own.
Move the message into struct nfs_net, where bl_mutex already limits
the pipe to one upcall per net namespace. Accept a reply only while
blkmapd has read the whole message and no earlier reply has been
taken, and reject any other write with -EINVAL. Wait for that reply
on a completion so it cannot slip past the sleep, and check
msg->errno before trusting it.
Fixes: fe0a9b740881 ("pnfsblock: add device operations")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-5-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/blocklayout/blocklayout.h | 5 ---
fs/nfs/blocklayout/rpc_pipefs.c | 58 ++++++++++++++++++++++++---------------
fs/nfs/netns.h | 5 ++-
3 files changed, 41 insertions(+), 27 deletions(-)
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -161,11 +161,6 @@ BLK_LSEG2EXT(struct pnfs_layout_segment
return BLK_LO2EXT(lseg->pls_layout);
}
-struct bl_pipe_msg {
- struct rpc_pipe_msg msg;
- wait_queue_head_t *bl_wq;
-};
-
struct bl_msg_hdr {
u8 type;
u16 totallen; /* length of entire message, including hdr itself */
--- a/fs/nfs/blocklayout/rpc_pipefs.c
+++ b/fs/nfs/blocklayout/rpc_pipefs.c
@@ -55,17 +55,15 @@ bl_resolve_deviceid(struct nfs_server *s
struct net *net = server->nfs_client->cl_net;
struct nfs_net *nn = net_generic(net, nfs_net_id);
struct bl_dev_msg *reply = &nn->bl_mount_reply;
- struct bl_pipe_msg bl_pipe_msg;
- struct rpc_pipe_msg *msg = &bl_pipe_msg.msg;
+ struct rpc_pipe_msg *msg = &nn->bl_pipe_msg;
+ struct rpc_pipe *pipe = nn->bl_device_pipe;
struct bl_msg_hdr *bl_msg;
- DECLARE_WAITQUEUE(wq, current);
dev_t dev = 0;
int rc;
dprintk("%s CREATING PIPEFS MESSAGE\n", __func__);
mutex_lock(&nn->bl_mutex);
- bl_pipe_msg.bl_wq = &nn->bl_wq;
b->simple.len += 4; /* single volume */
if (b->simple.len > PAGE_SIZE)
@@ -83,17 +81,15 @@ bl_resolve_deviceid(struct nfs_server *s
nfs4_encode_simple(msg->data + sizeof(*bl_msg), b);
dprintk("%s CALLING USERSPACE DAEMON\n", __func__);
- add_wait_queue(&nn->bl_wq, &wq);
- rc = rpc_queue_upcall(nn->bl_device_pipe, msg);
- if (rc < 0) {
- remove_wait_queue(&nn->bl_wq, &wq);
+ reinit_completion(&nn->bl_done);
+ rc = rpc_queue_upcall(pipe, msg);
+ if (rc < 0)
goto out_free_data;
- }
- set_current_state(TASK_UNINTERRUPTIBLE);
- schedule();
- remove_wait_queue(&nn->bl_wq, &wq);
+ wait_for_completion(&nn->bl_done);
+ if (msg->errno < 0)
+ goto out_free_data;
if (reply->status != BL_DEVICE_REQUEST_PROC) {
printk(KERN_WARNING "%s failed to decode device: %d\n",
__func__, reply->status);
@@ -113,26 +109,46 @@ static ssize_t bl_pipe_downcall(struct f
{
struct nfs_net *nn = net_generic(file_inode(filp)->i_sb->s_fs_info,
nfs_net_id);
+ struct rpc_pipe *pipe = nn->bl_device_pipe;
+ struct bl_dev_msg reply;
+ bool accepted;
- if (mlen != sizeof (struct bl_dev_msg))
+ if (mlen != sizeof(reply))
return -EINVAL;
-
- if (copy_from_user(&nn->bl_mount_reply, src, mlen) != 0)
+ if (copy_from_user(&reply, src, mlen) != 0)
return -EFAULT;
- wake_up(&nn->bl_wq);
-
+ /*
+ * Accept a reply only after blkmapd has read the whole upcall.
+ * Completion retires the message, here and in
+ * bl_pipe_destroy_msg(), so a later reply finds nothing in
+ * flight.
+ */
+ spin_lock(&pipe->lock);
+ accepted = rpc_msg_is_inflight(&nn->bl_pipe_msg);
+ if (accepted) {
+ nn->bl_pipe_msg.copied = 0;
+ nn->bl_mount_reply = reply;
+ complete(&nn->bl_done);
+ }
+ spin_unlock(&pipe->lock);
+ if (!accepted)
+ return -EINVAL;
return mlen;
}
static void bl_pipe_destroy_msg(struct rpc_pipe_msg *msg)
{
- struct bl_pipe_msg *bl_pipe_msg =
- container_of(msg, struct bl_pipe_msg, msg);
+ struct nfs_net *nn = container_of(msg, struct nfs_net, bl_pipe_msg);
+ struct rpc_pipe *pipe = nn->bl_device_pipe;
if (msg->errno >= 0)
return;
- wake_up(bl_pipe_msg->bl_wq);
+
+ spin_lock(&pipe->lock);
+ msg->copied = 0;
+ spin_unlock(&pipe->lock);
+ complete(&nn->bl_done);
}
static const struct rpc_pipe_ops bl_upcall_ops = {
@@ -221,7 +237,7 @@ static int nfs4blocklayout_net_init(stru
int err;
mutex_init(&nn->bl_mutex);
- init_waitqueue_head(&nn->bl_wq);
+ init_completion(&nn->bl_done);
nn->bl_device_pipe = rpc_mkpipe_data(&bl_upcall_ops, 0);
if (IS_ERR(nn->bl_device_pipe))
return PTR_ERR(nn->bl_device_pipe);
--- a/fs/nfs/netns.h
+++ b/fs/nfs/netns.h
@@ -10,6 +10,8 @@
#include <net/net_namespace.h>
#include <net/netns/generic.h>
#include <linux/sunrpc/stats.h>
+#include <linux/sunrpc/rpc_pipe_fs.h>
+#include <linux/completion.h>
struct bl_dev_msg {
int32_t status;
@@ -21,8 +23,9 @@ struct nfs_netns_client;
struct nfs_net {
struct cache_detail *nfs_dns_resolve;
struct rpc_pipe *bl_device_pipe;
+ struct rpc_pipe_msg bl_pipe_msg;
struct bl_dev_msg bl_mount_reply;
- wait_queue_head_t bl_wq;
+ struct completion bl_done;
struct mutex bl_mutex;
struct list_head nfs_client_list;
struct list_head nfs_volume_list;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 396/547] pnfs/blocklayout: Complete a device upcall when the pipe is closed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 395/547] pnfs/blocklayout: Complete a device upcall only on its own reply Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 397/547] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating Greg Kroah-Hartman
` (159 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 2a25cc8e984610828a526086313b8a7aeefe507d upstream.
Once blkmapd has read a whole upcall, rpc_pipe_read() unlinks the
message from every pipe list, so the purges in rpc_pipe_release()
and rpc_close_pipes() no longer reach it. bl_upcall_ops supplies no
.release_pipe callback, and bl_pipe_destroy_msg() returns without
completing the upcall because a downcall is expected to follow. A
daemon that exits between the read and the write therefore strands
its waiter: bl_resolve_deviceid() sleeps in wait_for_completion()
and never returns, and it holds nn->bl_mutex across that wait, so
every later device resolution in the net namespace blocks behind
it.
Add a .release_pipe that completes an upcall blkmapd has consumed
and left unanswered. Completing an upcall retires it, so a message
the framework has already purged is no longer in flight and is not
completed a second time here.
Fixes: fe0a9b740881 ("pnfsblock: add device operations")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-8-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/blocklayout/rpc_pipefs.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/fs/nfs/blocklayout/rpc_pipefs.c
+++ b/fs/nfs/blocklayout/rpc_pipefs.c
@@ -151,10 +151,31 @@ static void bl_pipe_destroy_msg(struct r
complete(&nn->bl_done);
}
+/*
+ * An upcall blkmapd has consumed is off every pipe list, so the
+ * purges in rpc_pipe_release() and rpc_close_pipes() cannot reach it.
+ * No downcall can arrive once the pipe is closed; release its waiter
+ * here.
+ */
+static void bl_release_pipe(struct inode *inode)
+{
+ struct nfs_net *nn = net_generic(inode->i_sb->s_fs_info, nfs_net_id);
+ struct rpc_pipe *pipe = nn->bl_device_pipe;
+
+ spin_lock(&pipe->lock);
+ if (rpc_msg_is_inflight(&nn->bl_pipe_msg)) {
+ nn->bl_pipe_msg.copied = 0;
+ nn->bl_pipe_msg.errno = -EPIPE;
+ complete(&nn->bl_done);
+ }
+ spin_unlock(&pipe->lock);
+}
+
static const struct rpc_pipe_ops bl_upcall_ops = {
.upcall = rpc_pipe_generic_upcall,
.downcall = bl_pipe_downcall,
.destroy_msg = bl_pipe_destroy_msg,
+ .release_pipe = bl_release_pipe,
};
static int nfs4blocklayout_register_sb(struct super_block *sb,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 397/547] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 396/547] pnfs/blocklayout: Complete a device upcall when the pipe is closed Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 398/547] NFSv4/pnfs: Free the netid when draining a data-server address list Greg Kroah-Hartman
` (158 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 32f0967ea296d447925465c98e7eec71d4e2f755 upstream.
decode_devicenotify_args() hands the server's notification count
straight to kmalloc_objs() as the array length, without checking it
against the message that carried it. Bound it the way nfs4xdr.c bounds
an attribute length, against xdr_stream_remaining().
Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/callback_xdr.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -271,6 +271,13 @@ __be32 decode_devicenotify_args(struct s
if (n == 0)
goto out;
+ /* sanity check the count against the remaining stream */
+ if (n > xdr_stream_remaining(xdr) /
+ ((4 * sizeof(uint32_t)) + NFS4_DEVICEID4_SIZE)) {
+ status = htonl(NFS4ERR_BADXDR);
+ goto out;
+ }
+
args->devs = kmalloc_objs(*args->devs, n);
if (!args->devs) {
status = htonl(NFS4ERR_DELAY);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 398/547] NFSv4/pnfs: Free the netid when draining a data-server address list
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 397/547] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 399/547] NFSv4: Fix a regression in the handling of CB_RECALL_ANY Greg Kroah-Hartman
` (157 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit a7c8e96d1b9fa327cbdea514d047c8295b28d49a upstream.
nfs4_pnfs_ds_addr_free() releases all three of an address entry's
allocations, but the four sites that drain a decoded list before it
reaches a data server open-code the loop and free only da_remotestr and
the entry, leaking da_netid. Both layout drivers drain that list when
nfs4_pnfs_ds_add() returned a data server already in the cache, and
again on their error exits.
Lift the drain into nfs4_pnfs_ds_addr_list_free() so an address list has
one owner. A striping mount reaches the cached case on nearly every
GETDEVICEINFO, since many deviceIDs name the same data servers.
Fixes: 4be78d26810b ("NFSv4/pNFS: Store the transport type in struct nfs4_pnfs_ds_addr")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/filelayout/filelayoutdev.c | 17 ++---------------
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 17 ++---------------
fs/nfs/pnfs.h | 1 +
fs/nfs/pnfs_nfs.c | 21 +++++++++++++--------
4 files changed, 18 insertions(+), 38 deletions(-)
--- a/fs/nfs/filelayout/filelayoutdev.c
+++ b/fs/nfs/filelayout/filelayoutdev.c
@@ -177,27 +177,14 @@ nfs4_fl_alloc_deviceid_node(struct nfs_s
trace_fl_getdevinfo(server, &pdev->dev_id, dsaddr->ds_list[i]->ds_remotestr);
/* If DS was already in cache, free ds addrs */
- while (!list_empty(&dsaddrs)) {
- da = list_first_entry(&dsaddrs,
- struct nfs4_pnfs_ds_addr,
- da_node);
- list_del_init(&da->da_node);
- kfree(da->da_remotestr);
- kfree(da);
- }
+ nfs4_pnfs_ds_addr_list_free(&dsaddrs);
}
folio_put(scratch);
return dsaddr;
out_err_drain_dsaddrs:
- while (!list_empty(&dsaddrs)) {
- da = list_first_entry(&dsaddrs, struct nfs4_pnfs_ds_addr,
- da_node);
- list_del_init(&da->da_node);
- kfree(da->da_remotestr);
- kfree(da);
- }
+ nfs4_pnfs_ds_addr_list_free(&dsaddrs);
out_err_free_deviceid:
nfs4_fl_free_deviceid(dsaddr);
/* stripe_indicies was part of dsaddr */
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -159,26 +159,13 @@ nfs4_ff_alloc_deviceid_node(struct nfs_s
goto out_err_drain_dsaddrs;
/* If DS was already in cache, free ds addrs */
- while (!list_empty(&dsaddrs)) {
- da = list_first_entry(&dsaddrs,
- struct nfs4_pnfs_ds_addr,
- da_node);
- list_del_init(&da->da_node);
- kfree(da->da_remotestr);
- kfree(da);
- }
+ nfs4_pnfs_ds_addr_list_free(&dsaddrs);
folio_put(scratch);
return new_ds;
out_err_drain_dsaddrs:
- while (!list_empty(&dsaddrs)) {
- da = list_first_entry(&dsaddrs, struct nfs4_pnfs_ds_addr,
- da_node);
- list_del_init(&da->da_node);
- kfree(da->da_remotestr);
- kfree(da);
- }
+ nfs4_pnfs_ds_addr_list_free(&dsaddrs);
kfree(ds_versions);
out_scratch:
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -427,6 +427,7 @@ int nfs4_pnfs_ds_connect(struct nfs_serv
struct nfs4_pnfs_ds_addr *nfs4_decode_mp_ds_addr(struct net *net,
struct xdr_stream *xdr,
gfp_t gfp_flags);
+void nfs4_pnfs_ds_addr_list_free(struct list_head *dsaddrs);
void pnfs_layout_mark_request_commit(struct nfs_page *req,
struct pnfs_layout_segment *lseg,
struct nfs_commit_info *cinfo,
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -633,23 +633,28 @@ static void nfs4_pnfs_ds_addr_free(struc
kfree(da);
}
-static void destroy_ds(struct nfs4_pnfs_ds *ds)
+void nfs4_pnfs_ds_addr_list_free(struct list_head *dsaddrs)
{
struct nfs4_pnfs_ds_addr *da;
+ while (!list_empty(dsaddrs)) {
+ da = list_first_entry(dsaddrs, struct nfs4_pnfs_ds_addr,
+ da_node);
+ list_del_init(&da->da_node);
+ nfs4_pnfs_ds_addr_free(da);
+ }
+}
+EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_addr_list_free);
+
+static void destroy_ds(struct nfs4_pnfs_ds *ds)
+{
dprintk("--> %s\n", __func__);
ifdebug(FACILITY)
print_ds(ds);
nfs_put_client(ds->ds_clp);
- while (!list_empty(&ds->ds_addrs)) {
- da = list_first_entry(&ds->ds_addrs,
- struct nfs4_pnfs_ds_addr,
- da_node);
- list_del_init(&da->da_node);
- nfs4_pnfs_ds_addr_free(da);
- }
+ nfs4_pnfs_ds_addr_list_free(&ds->ds_addrs);
kfree(ds->ds_remotestr);
kfree(ds);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 399/547] NFSv4: Fix a regression in the handling of CB_RECALL_ANY
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 398/547] NFSv4/pnfs: Free the netid when draining a data-server address list Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 400/547] NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET Greg Kroah-Hartman
` (156 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Trond Myklebust
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
commit 25dde935988bc0cc2991cedbea90a2ce65066d54 upstream.
When the flag NFS_DELEGATION_RETURN was replaced by the
server->delegations_return list, the test in
nfs_mark_return_if_closed_delegation() was replaced by one that stops
all further marking of delegations for return when closed as soon as the
server->delegations_return list is non-empty, breaking CB_RECALL_ANY
behaviour.
While the intention at the time was probably to check if
delegation->entry was non-empty in order to emulate the effect of the
NFS_DELEGATION_RETURN test, that is no longer an option, since
delegation->entry is also used for the LRU list.
By just removing the offending check altogether, the patch can end up
moving delegations from the server->delegations_delayed list
prematurely, triggering an early retry. However that should be mostly
harmless behaviour.
Fixes: 0ebe655bd033 ("NFS: add a separate delegation return list")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/delegation.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -934,8 +934,7 @@ nfs_mark_return_if_closed_delegation(str
{
struct inode *inode;
- if (!list_empty_careful(&server->delegations_return) ||
- test_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags))
+ if (test_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags))
return;
spin_lock(&delegation->lock);
inode = delegation->inode;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 400/547] NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 399/547] NFSv4: Fix a regression in the handling of CB_RECALL_ANY Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 401/547] NFSv4/filelayout: Anchor page coalescing on pattern_offset Greg Kroah-Hartman
` (155 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Jeff Layton,
Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 28c950413605fb5b6cb3863c5e3274ea69701097 upstream.
If the layout for the requested range is larger than the size the
client advertised in loga_maxcount, RFC 8881 Section 18.43.3 has the
metadata server return NFS4ERR_TOOSMALL. The client caps
loga_maxcount at a single page, so a flexfiles server that stripes a
layout segment across several dozen data servers produces this error
today.
The client has no handling for it: nfs4_stat_to_errno() maps the
error to -ETOOSMALL during decode, which nothing in the layoutget
path recognizes and nfs_error_is_fatal() does not consider fatal, so
pnfs_update_layout() clears the layout fail bit and returns no
segment. The I/O falls back to the MDS, but because no fail bit was
set, every subsequent pageio attempt sends another LAYOUTGET that is
doomed to the same NFS4ERR_TOOSMALL. Files whose layouts do not fit
the reply buffer never use pNFS and pay an extra round trip on every
pageio.
Map -ETOOSMALL to -EMSGSIZE in the layoutget exception handler and
have pnfs_update_layout() treat it like NFS4ERR_LAYOUTUNAVAILABLE:
mark the layout mode as failed and fall back to I/O through the MDS.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 8 ++++++++
fs/nfs/pnfs.c | 2 ++
2 files changed, 10 insertions(+)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -9681,6 +9681,14 @@ nfs4_layoutget_handle_exception(struct r
status = -EOVERFLOW;
goto out;
/*
+ * NFS4ERR_TOOSMALL means the layout for the requested range
+ * exceeds what the client advertised in loga_maxcount (see
+ * RFC8881 section 18.43.3).
+ */
+ case -ETOOSMALL:
+ status = -EMSGSIZE;
+ goto out;
+ /*
* NFS4ERR_LAYOUTTRYLATER is a conflict with another client
* (or clients) writing to the same RAID stripe except when
* the minlength argument is 0 (see RFC5661 section 18.43.3).
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2331,6 +2331,8 @@ lookup_again:
break;
case -ENODATA:
/* The server returned NFS4ERR_LAYOUTUNAVAILABLE */
+ case -EMSGSIZE:
+ /* The layout exceeded loga_maxcount (NFS4ERR_TOOSMALL) */
pnfs_layout_set_fail_bit(
lo, pnfs_iomode_to_fail_bit(iomode));
lseg = NULL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 401/547] NFSv4/filelayout: Anchor page coalescing on pattern_offset
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 400/547] NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 402/547] NFSv4/flexfiles: fail I/O to the data server once a lock is lost Greg Kroah-Hartman
` (154 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 7f2d221b01f356b6bb3bb6efef998f8b28339824 upstream.
filelayout_pg_test() bounds page coalescing to a single stripe unit
using an offset relative to pls_range.offset, but the data server is
selected by nfs4_fl_calc_j_index() using an offset relative to
pattern_offset. When a segment's pattern_offset and range offset are
not congruent modulo the stripe unit, the coalescing window is shifted
off the DS-selection grid, so a coalesced I/O can straddle a stripe
boundary and send the bytes past it to the wrong data server.
Anchor coalescing on pattern_offset to match nfs4_fl_calc_j_index().
Stripe-congruent segments, including the common whole-file pattern_offset
0 case, are unchanged.
Fixes: c6194271f94b ("pnfs: filelayout: support non page aligned layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/filelayout/filelayout.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -796,7 +796,7 @@ filelayout_pg_test(struct nfs_pageio_des
unsigned int size;
u64 p_stripe, r_stripe;
u32 stripe_offset;
- u64 segment_offset = pgio->pg_lseg->pls_range.offset;
+ u64 pattern_offset = FILELAYOUT_LSEG(pgio->pg_lseg)->pattern_offset;
u32 stripe_unit = FILELAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
/* calls nfs_generic_pg_test */
@@ -808,8 +808,8 @@ filelayout_pg_test(struct nfs_pageio_des
/* see if req and prev are in the same stripe */
if (prev) {
- p_stripe = (u64)req_offset(prev) - segment_offset;
- r_stripe = (u64)req_offset(req) - segment_offset;
+ p_stripe = (u64)req_offset(prev) - pattern_offset;
+ r_stripe = (u64)req_offset(req) - pattern_offset;
do_div(p_stripe, stripe_unit);
do_div(r_stripe, stripe_unit);
@@ -818,7 +818,7 @@ filelayout_pg_test(struct nfs_pageio_des
}
/* calculate remaining bytes in the current stripe */
- div_u64_rem((u64)req_offset(req) - segment_offset,
+ div_u64_rem((u64)req_offset(req) - pattern_offset,
stripe_unit,
&stripe_offset);
WARN_ON_ONCE(stripe_offset > stripe_unit);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 402/547] NFSv4/flexfiles: fail I/O to the data server once a lock is lost
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 401/547] NFSv4/filelayout: Anchor page coalescing on pattern_offset Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 403/547] NFSv4/flexfiles: Use the full 64-bit offset for read DS selection Greg Kroah-Hartman
` (153 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arun Potharaju, Benjamin Coddington,
Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <bcodding@hammerspace.com>
commit 7fa2ad367abe6d3155daefb57331e7fce1a17afd upstream.
When a client loses a byte-range lock, because its lease expired and it
may not recover the lock (nfs.recover_lost_locks=0) or because reclaim
failed, it marks the lock state NFS_LOCK_LOST and fails further I/O by
that lock owner. Otherwise an application that believes it holds a
lock over a range is never told that the lock is gone, and can
overwrite data that another client has since written under its own
lock on that range.
The NFSv4 READ/WRITE and file layout I/O paths apply this in
rpc_call_prepare, where nfs4_set_rw_stateid() returns -EIO for a lost
lock. The flexfiles data server I/O path does not: the NFSv3 data
server path never checked, and the check on the NFSv4 path was removed
when the data server stateid began to be taken from the layout.
Fail read and write RPCs to the data server in rpc_call_prepare when the
lock is lost. The data server path has no use for the stateid that
nfs4_set_rw_stateid() selects, and selecting it looks up a delegation
or open stateid on every I/O.
Instead add nfs4_lock_context_lost(), which only tests NFS_LOCK_LOST,
and check it alongside the open state. Its lookup,
__nfs4_lookup_lock_state(), is split out of __nfs4_find_lock_state()
and takes no reference: a lock state is only unlinked from
state->lock_states under state->state_lock, so one found while holding
that lock cannot be freed before it is released. Use it in
nfs4_copy_lock_stateid() as well, which only reads the lock state under
that lock. That drops a reference get and put from stateid selection
for all NFSv4 I/O without changing the stateid selected.
Terminating the RPC in rpc_call_prepare is not enough on its own. The
done callback reads the -EIO as a data server connection error, forgets
the device ID, and resets the I/O to pNFS (or, for an NFSv4 data
server, possibly to the MDS). After a reset to pNFS a new LAYOUTGET is
granted and rpc_call_prepare fails the I/O again, without end. The
existing NFS_CONTEXT_BAD check does not loop, since the open state is
then invalid and pnfs_update_layout() fails the reset I/O, but it still
forgets the device ID.
So when an RPC that was never sent fails and the open context is bad,
the open state is invalid, or the lock is lost, complete it with -EIO
without error handling. An RPC that was sent and failed is handled as
before, so a real data server error is still reported to the MDS.
Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Fixes: bb21ce0ad227 ("flexfiles: use per-mirror specified stateid for IO")
Cc: stable@vger.kernel.org
Tested-by: Arun Potharaju <arun.potharaju@hammerspace.com>
Assisted-by: LLM
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 25 +++++++++++++++++++--
fs/nfs/nfs4_fs.h | 2 +
fs/nfs/nfs4state.c | 38 +++++++++++++++++++++++++++++----
3 files changed, 59 insertions(+), 6 deletions(-)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1597,6 +1597,15 @@ out:
dprintk("%s: err %d op %d status %u\n", __func__, err, opnum, status);
}
+static bool ff_layout_io_state_lost(const struct nfs_pgio_header *hdr)
+{
+ struct nfs_open_context *ctx = hdr->args.context;
+
+ return test_bit(NFS_CONTEXT_BAD, &ctx->flags) ||
+ !nfs4_valid_open_stateid(ctx->state) ||
+ nfs4_lock_context_lost(ctx->state, hdr->args.lock_context);
+}
+
/* NFS_PROTO call done callback routines */
static int ff_layout_read_done_cb(struct rpc_task *task,
struct nfs_pgio_header *hdr)
@@ -1608,6 +1617,12 @@ static int ff_layout_read_done_cb(struct
hdr->args.offset);
int err;
+ if (task->tk_status < 0 && !RPC_WAS_SENT(task) &&
+ ff_layout_io_state_lost(hdr)) {
+ task->tk_status = -EIO;
+ return 0;
+ }
+
if (task->tk_status < 0) {
ff_layout_io_track_ds_error(hdr->lseg,
hdr->pgio_mirror_idx, dss_id,
@@ -1724,7 +1739,7 @@ static void ff_layout_read_record_layout
static int ff_layout_read_prepare_common(struct rpc_task *task,
struct nfs_pgio_header *hdr)
{
- if (unlikely(test_bit(NFS_CONTEXT_BAD, &hdr->args.context->flags))) {
+ if (unlikely(ff_layout_io_state_lost(hdr))) {
rpc_exit(task, -EIO);
return -EIO;
}
@@ -1813,6 +1828,12 @@ static int ff_layout_write_done_cb(struc
loff_t end_offs = 0;
int err;
+ if (task->tk_status < 0 && !RPC_WAS_SENT(task) &&
+ ff_layout_io_state_lost(hdr)) {
+ task->tk_status = -EIO;
+ return 0;
+ }
+
if (task->tk_status < 0) {
ff_layout_io_track_ds_error(hdr->lseg,
hdr->pgio_mirror_idx, dss_id,
@@ -1950,7 +1971,7 @@ static void ff_layout_write_record_layou
static int ff_layout_write_prepare_common(struct rpc_task *task,
struct nfs_pgio_header *hdr)
{
- if (unlikely(test_bit(NFS_CONTEXT_BAD, &hdr->args.context->flags))) {
+ if (unlikely(ff_layout_io_state_lost(hdr))) {
rpc_exit(task, -EIO);
return -EIO;
}
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -526,6 +526,8 @@ extern int nfs4_select_rw_stateid(struct
const struct cred **);
extern bool nfs4_copy_open_stateid(nfs4_stateid *dst,
struct nfs4_state *state);
+extern bool nfs4_lock_context_lost(struct nfs4_state *state,
+ const struct nfs_lock_context *l_ctx);
extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_t gfp_mask);
extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -812,10 +812,13 @@ void nfs4_close_sync(struct nfs4_state *
* be made. Failing that, a "consistent" choice is preferable. The
* consistent choice we make is to prefer the first owner, that of a
* Posix lock.
+ *
+ * Called with state->state_lock held. No reference is taken: a lock
+ * state is freed only after it is unlinked under state->state_lock.
*/
static struct nfs4_lock_state *
-__nfs4_find_lock_state(struct nfs4_state *state,
- fl_owner_t owner, fl_owner_t owner2)
+__nfs4_lookup_lock_state(struct nfs4_state *state,
+ fl_owner_t owner, fl_owner_t owner2)
{
struct nfs4_lock_state *pos, *ret = NULL;
list_for_each_entry(pos, &state->lock_states, ls_locks) {
@@ -826,6 +829,16 @@ __nfs4_find_lock_state(struct nfs4_state
if (pos->ls_owner == owner2)
ret = pos;
}
+ return ret;
+}
+
+static struct nfs4_lock_state *
+__nfs4_find_lock_state(struct nfs4_state *state,
+ fl_owner_t owner, fl_owner_t owner2)
+{
+ struct nfs4_lock_state *ret;
+
+ ret = __nfs4_lookup_lock_state(state, owner, owner2);
if (ret)
refcount_inc(&ret->ls_count);
return ret;
@@ -968,7 +981,7 @@ static int nfs4_copy_lock_stateid(nfs4_s
fl_flock_owner = l_ctx->open_context->flock_owner;
spin_lock(&state->state_lock);
- lsp = __nfs4_find_lock_state(state, owner, fl_flock_owner);
+ lsp = __nfs4_lookup_lock_state(state, owner, fl_flock_owner);
if (lsp && test_bit(NFS_LOCK_LOST, &lsp->ls_flags))
ret = -EIO;
else if (lsp != NULL && test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) != 0) {
@@ -976,11 +989,28 @@ static int nfs4_copy_lock_stateid(nfs4_s
ret = 0;
}
spin_unlock(&state->state_lock);
- nfs4_put_lock_state(lsp);
out:
return ret;
}
+bool nfs4_lock_context_lost(struct nfs4_state *state,
+ const struct nfs_lock_context *l_ctx)
+{
+ struct nfs4_lock_state *lsp;
+ bool ret;
+
+ if (!test_bit(LK_STATE_IN_USE, &state->flags))
+ return false;
+
+ spin_lock(&state->state_lock);
+ lsp = __nfs4_lookup_lock_state(state, l_ctx->lockowner,
+ l_ctx->open_context->flock_owner);
+ ret = lsp && test_bit(NFS_LOCK_LOST, &lsp->ls_flags);
+ spin_unlock(&state->state_lock);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(nfs4_lock_context_lost);
+
bool nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
{
bool ret;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 403/547] NFSv4/flexfiles: Use the full 64-bit offset for read DS selection
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 402/547] NFSv4/flexfiles: fail I/O to the data server once a lock is lost Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 404/547] NFSv4/flexfiles: Use the full 64-bit stripe_unit Greg Kroah-Hartman
` (152 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 448591e1f82902e5714bd436d6367adc7fbaea90 upstream.
The read data-server selection helpers declare their offset parameter
as u32, truncating the file offset before nfs4_ff_layout_calc_dss_id()
computes the stripe index. The write path already passes the full
offset; make the read path match.
Fixes: 4934ccbeaed3 ("NFSv4/flexfiles: Read path updates for striped layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -878,7 +878,7 @@ ff_layout_mark_ds_reachable(struct pnfs_
static struct nfs4_pnfs_ds *
ff_layout_choose_ds_for_read(struct pnfs_layout_segment *lseg,
u32 start_idx, u32 *best_idx,
- u32 offset, u32 *dss_id,
+ u64 offset, u32 *dss_id,
bool check_device)
{
struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
@@ -914,7 +914,7 @@ ff_layout_choose_ds_for_read(struct pnfs
static struct nfs4_pnfs_ds *
ff_layout_choose_any_ds_for_read(struct pnfs_layout_segment *lseg,
u32 start_idx, u32 *best_idx,
- u32 offset, u32 *dss_id)
+ u64 offset, u32 *dss_id)
{
return ff_layout_choose_ds_for_read(lseg, start_idx, best_idx,
offset, dss_id, false);
@@ -923,7 +923,7 @@ ff_layout_choose_any_ds_for_read(struct
static struct nfs4_pnfs_ds *
ff_layout_choose_valid_ds_for_read(struct pnfs_layout_segment *lseg,
u32 start_idx, u32 *best_idx,
- u32 offset, u32 *dss_id)
+ u64 offset, u32 *dss_id)
{
return ff_layout_choose_ds_for_read(lseg, start_idx, best_idx,
offset, dss_id, true);
@@ -932,7 +932,7 @@ ff_layout_choose_valid_ds_for_read(struc
static struct nfs4_pnfs_ds *
ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
u32 start_idx, u32 *best_idx,
- u32 offset, u32 *dss_id)
+ u64 offset, u32 *dss_id)
{
struct nfs4_pnfs_ds *ds;
@@ -947,7 +947,7 @@ ff_layout_choose_best_ds_for_read(struct
static struct nfs4_pnfs_ds *
ff_layout_get_ds_for_read(struct nfs_pageio_descriptor *pgio,
u32 *best_idx,
- u32 offset,
+ u64 offset,
u32 *dss_id)
{
struct pnfs_layout_segment *lseg = pgio->pg_lseg;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 404/547] NFSv4/flexfiles: Use the full 64-bit stripe_unit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 403/547] NFSv4/flexfiles: Use the full 64-bit offset for read DS selection Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 405/547] NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset Greg Kroah-Hartman
` (151 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 0cc1191538b1523dfe944eedc799fdd146c05fbf upstream.
ff_layout_alloc_lseg() decodes stripe_unit as the 64-bit value the
protocol defines and struct nfs4_ff_layout_segment stores it as one, but
both consumers narrow it back to 32 bits: nfs4_ff_layout_calc_dss_id()
divides with do_div(), which casts the divisor, and ff_layout_pg_test()
copies it into a u32 first. A stripe_unit that does not fit is silently
truncated, so the client stripes on a unit the server did not specify --
or divides by zero, if the low 32 bits happen to be clear.
Divide by the full value, with div64_u64() and div64_u64_rem().
Fixes: 20b1d75fb840 ("NFSv4/flexfiles: Add support for striped layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 12 ++++++------
fs/nfs/flexfilelayout/flexfilelayout.h | 2 +-
2 files changed, 7 insertions(+), 7 deletions(-)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -995,9 +995,9 @@ ff_layout_pg_test(struct nfs_pageio_desc
{
unsigned int size;
u64 p_stripe, r_stripe;
- u32 stripe_offset;
+ u64 stripe_offset;
u64 segment_offset = pgio->pg_lseg->pls_range.offset;
- u32 stripe_unit = FF_LAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
+ u64 stripe_unit = FF_LAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
/* calls nfs_generic_pg_test */
size = pnfs_generic_pg_test(pgio, prev, req);
@@ -1010,21 +1010,21 @@ ff_layout_pg_test(struct nfs_pageio_desc
if (prev) {
p_stripe = (u64)req_offset(prev) - segment_offset;
r_stripe = (u64)req_offset(req) - segment_offset;
- do_div(p_stripe, stripe_unit);
- do_div(r_stripe, stripe_unit);
+ p_stripe = div64_u64(p_stripe, stripe_unit);
+ r_stripe = div64_u64(r_stripe, stripe_unit);
if (p_stripe != r_stripe)
return 0;
}
/* calculate remaining bytes in the current stripe */
- div_u64_rem((u64)req_offset(req) - segment_offset,
+ div64_u64_rem((u64)req_offset(req) - segment_offset,
stripe_unit,
&stripe_offset);
WARN_ON_ONCE(stripe_offset > stripe_unit);
if (stripe_offset >= stripe_unit)
return 0;
- return min(stripe_unit - (unsigned int)stripe_offset, size);
+ return min_t(u64, stripe_unit - stripe_offset, size);
}
static void
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -220,7 +220,7 @@ nfs4_ff_layout_calc_dss_id(const u64 str
if (dss_count == 1 || stripe_unit == 0)
return 0;
- do_div(tmp, stripe_unit);
+ tmp = div64_u64(tmp, stripe_unit);
return do_div(tmp, dss_count);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 405/547] NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 404/547] NFSv4/flexfiles: Use the full 64-bit stripe_unit Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 406/547] NFS: Fix stale negative cache on failed nfs_mkdir() Greg Kroah-Hartman
` (150 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit a84c62c4f03706b2c2f01dcc5fe614a4233ee75d upstream.
ff_layout_pg_test() was copied from the files layout, which partitions
data servers relative to pattern_offset and bounds coalescing with a
segment-relative offset. Flexfiles has no pattern_offset:
nfs4_ff_layout_calc_dss_id() partitions on the absolute file offset
(RFC 8435 Section 6). So when a layout segment's offset is not
stripe-unit-aligned, the segment-relative coalescing window is shifted
off the absolute stripe grid and a coalesced I/O can straddle a stripe
boundary, sending the bytes past it to the wrong data server.
Bound coalescing on the absolute offset to match calc_dss_id(). Aligned
segments, including all whole-file layouts, are unchanged.
Fixes: 4934ccbeaed3 ("NFSv4/flexfiles: Read path updates for striped layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -996,7 +996,6 @@ ff_layout_pg_test(struct nfs_pageio_desc
unsigned int size;
u64 p_stripe, r_stripe;
u64 stripe_offset;
- u64 segment_offset = pgio->pg_lseg->pls_range.offset;
u64 stripe_unit = FF_LAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
/* calls nfs_generic_pg_test */
@@ -1008,8 +1007,8 @@ ff_layout_pg_test(struct nfs_pageio_desc
/* see if req and prev are in the same stripe */
if (prev) {
- p_stripe = (u64)req_offset(prev) - segment_offset;
- r_stripe = (u64)req_offset(req) - segment_offset;
+ p_stripe = (u64)req_offset(prev);
+ r_stripe = (u64)req_offset(req);
p_stripe = div64_u64(p_stripe, stripe_unit);
r_stripe = div64_u64(r_stripe, stripe_unit);
@@ -1018,7 +1017,7 @@ ff_layout_pg_test(struct nfs_pageio_desc
}
/* calculate remaining bytes in the current stripe */
- div64_u64_rem((u64)req_offset(req) - segment_offset,
+ div64_u64_rem((u64)req_offset(req),
stripe_unit,
&stripe_offset);
WARN_ON_ONCE(stripe_offset > stripe_unit);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 406/547] NFS: Fix stale negative cache on failed nfs_mkdir()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 405/547] NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 407/547] NFS/localio: detect a short read or write before the iterator has moved Greg Kroah-Hartman
` (149 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jimmy Zuber, NeilBrown,
Trond Myklebust
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Zuber <jamz@amazon.com>
commit 211cda4fdf33011cee39f8970c4625b207142d6b upstream.
Since commit 8376583b84a1 ("nfs: change mkdir inode_operation to return
alternate dentry if needed"), nfs_mkdir() no longer drops the dentry on
RPC failure. A negative cache value can then result in spurious ENOENT
results for further operations within that directory, such as open or
stat.
We observed this breaking some applications where an EEXIST on mkdir
caused the application to assume the directory to exist, only to fail
operations within that directory due to the retained negative cache
entry. The other create paths, nfs_create() and nfs_mknod(), still drop
the dentry on failure. This patch restores the previous behavior.
Fixes: 8376583b84a1 ("nfs: change mkdir inode_operation to return alternate dentry if needed")
Cc: stable@vger.kernel.org # v6.15+
Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/dir.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2490,6 +2490,8 @@ struct dentry *nfs_mkdir(struct mnt_idma
trace_nfs_mkdir_enter(dir, dentry);
ret = NFS_PROTO(dir)->mkdir(dir, dentry, &attr);
trace_nfs_mkdir_exit(dir, dentry, PTR_ERR_OR_ZERO(ret));
+ if (IS_ERR(ret))
+ d_drop(dentry);
return ret;
}
EXPORT_SYMBOL_GPL(nfs_mkdir);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 407/547] NFS/localio: detect a short read or write before the iterator has moved
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 406/547] NFS: Fix stale negative cache on failed nfs_mkdir() Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 408/547] NFS/localio: fix nfs_local_dio_misaligned tracepoint Greg Kroah-Hartman
` (148 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit db3ca539c1142d2c5380c5dbd3154ab7bb1c7d77 upstream.
nfs_local_call_read() and nfs_local_call_write() issue a misaligned
DIO as up to three segments and must stop at the first short one, or
the next segment lands at the wrong file offset. They test for that
by comparing the bytes transferred against iov_iter_count() of the
segment, read after read_iter() or write_iter() has advanced the
iterator, when the count is the residual rather than the request:
before the call: count == expected
after the call: count == expected - status
The test is therefore status < expected - status, and it fires only
when less than half of the segment was transferred. A short I/O that
covers between 50% and 99% of a segment slips through: the loop moves
on with ki_pos advanced by the short amount, the next segment is
issued at the wrong offset, and the header's byte count is
over-reported to the caller. A write that slips through also never
sets NFS_CONTEXT_WRITE_SYNC, which is what makes the writes that
follow a short one synchronous.
Take the segment's count before issuing it and compare against that.
This is the same defect that commit 250ec14932d5 ("nfsd: fix
partial-write detection in nfsd_direct_write") fixed in NFSD's version
of this loop.
Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE")
Fixes: d0497dd27452 ("nfs/localio: backfill missing partial read support for misaligned DIO")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/localio.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -674,6 +674,8 @@ static void nfs_local_call_read(struct w
n_iters = atomic_read(&iocb->n_iters);
for (int i = 0; i < n_iters ; i++) {
+ size_t expected;
+
if (iocb->iter_is_dio_aligned[i]) {
iocb->kiocb.ki_flags |= IOCB_DIRECT;
/* Only use AIO completion if DIO-aligned segment is last */
@@ -684,6 +686,8 @@ static void nfs_local_call_read(struct w
} else
iocb->kiocb.ki_flags &= ~IOCB_DIRECT;
+ /* read_iter() advances the iterator: measure it beforehand */
+ expected = iov_iter_count(&iocb->iters[i]);
scoped_with_creds(filp->f_cred)
status = filp->f_op->read_iter(&iocb->kiocb, &iocb->iters[i]);
@@ -691,7 +695,7 @@ static void nfs_local_call_read(struct w
continue;
/* Break on completion, errors, or short reads */
if (nfs_local_pgio_done(iocb, status) || status < 0 ||
- (size_t)status < iov_iter_count(&iocb->iters[i])) {
+ (size_t)status < expected) {
nfs_local_read_iocb_done(iocb);
break;
}
@@ -890,7 +894,7 @@ static void nfs_local_call_write(struct
file_start_write(filp);
n_iters = atomic_read(&iocb->n_iters);
for (int i = 0; i < n_iters ; i++) {
- size_t icount;
+ size_t expected;
if (iocb->iter_is_dio_aligned[i]) {
iocb->kiocb.ki_flags |= IOCB_DIRECT;
@@ -902,16 +906,17 @@ static void nfs_local_call_write(struct
} else
iocb->kiocb.ki_flags &= ~IOCB_DIRECT;
+ /* write_iter() advances the iterator: measure it beforehand */
+ expected = iov_iter_count(&iocb->iters[i]);
scoped_with_creds(filp->f_cred)
status = filp->f_op->write_iter(&iocb->kiocb, &iocb->iters[i]);
if (status == -EIOCBQUEUED)
continue;
/* Break on completion, errors, or short writes */
- icount = iov_iter_count(&iocb->iters[i]);
if (nfs_local_pgio_done(iocb, status) || status < 0 ||
- (size_t)status < icount) {
- if ((size_t)status < icount) {
+ (size_t)status < expected) {
+ if ((size_t)status < expected) {
struct nfs_lock_context *ctx =
iocb->hdr->req->wb_lock_context;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 408/547] NFS/localio: fix nfs_local_dio_misaligned tracepoint
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 407/547] NFS/localio: detect a short read or write before the iterator has moved Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 409/547] NFS/localio: report the stability a DIO WRITE actually has Greg Kroah-Hartman
` (147 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit 1ea352a0db8bcb6ff6820e9a8715aac0aa3c761f upstream.
The intended focus of nfs_local_iters_setup_dio()'s call to
trace_nfs_local_dio_misaligned() is on the middle segment being
misaligned, yet the @offset passed in was local_dio->start_len.
It would appear this was a cut-n-paste bug from the preceding
nfs_local_iter_setup() call that passes local_dio->start_len.
Fix this by passing the @offset as local_dio->middle_offset and
calculate the start segment's offset rather than assume.
Example traces, before this fix:
python3-32744 [006] .l... 132946.352360:
nfs_local_dio_write: fileid=00:33:1286 fhandle=0xf1f7c10b
offset=1048759 count=1048576 mem_align=4 offset_align=512
start=1048759+329 middle=1049088+1048064 end=2097152+183
python3-32744 [006] .l... 132946.352360:
nfs_local_dio_misaligned: fileid=00:33:1286 fhandle=0xf1f7c10b
offset=329 count=1048064 mem_align=4 offset_align=512
start=329+329 middle=1049088+1048064 end=2097152+183
After this fix:
python3-32744 [006] .l... 132946.352360:
nfs_local_dio_write: fileid=00:33:1286 fhandle=0xf1f7c10b
offset=1048759 count=1048576 mem_align=4 offset_align=512
start=1048759+329 middle=1049088+1048064 end=2097152+183
python3-32744 [006] .l... 132946.352360:
nfs_local_dio_misaligned: fileid=00:33:1286 fhandle=0xf1f7c10b
offset=1049088 count=1048064 mem_align=4 offset_align=512
start=1048759+329 middle=1049088+1048064 end=2097152+183
Fixes: 6a218b9c3183e ("nfs/localio: do not issue misaligned DIO out-of-order")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/localio.c | 2 +-
fs/nfs/nfstrace.h | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -446,7 +446,7 @@ nfs_local_iters_setup_dio(struct nfs_loc
if (unlikely(!iocb->iter_is_dio_aligned[n_iters])) {
trace_nfs_local_dio_misaligned(iocb->hdr->inode,
- local_dio->start_len, local_dio->middle_len, local_dio);
+ local_dio->middle_offset, local_dio->middle_len, local_dio);
return 0; /* no DIO-aligned IO possible */
}
iocb->end_iter_index = n_iters;
--- a/fs/nfs/nfstrace.h
+++ b/fs/nfs/nfstrace.h
@@ -1772,7 +1772,10 @@ DECLARE_EVENT_CLASS(nfs_local_dio_class,
__entry->count = count;
__entry->mem_align = local_dio->mem_align;
__entry->offset_align = local_dio->offset_align;
- __entry->start = offset;
+ if (local_dio->start_len)
+ __entry->start = local_dio->middle_offset - local_dio->start_len;
+ else
+ __entry->start = 0;
__entry->start_len = local_dio->start_len;
__entry->middle = local_dio->middle_offset;
__entry->middle_len = local_dio->middle_len;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 409/547] NFS/localio: report the stability a DIO WRITE actually has
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 408/547] NFS/localio: fix nfs_local_dio_misaligned tracepoint Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 410/547] NFSD: cap the number of listeners accepted in listener_set Greg Kroah-Hartman
` (146 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit 077d39c1ac8c9b2e2fad8e66a2ba6250ced1a860 upstream.
Since commit d32ddfeb5593 ("nfs/localio: Ensure DIO WRITE's IO on
stable storage upon completion") a DIO WRITE issued through LOCALIO
is persisted before it completes: nfs_local_iters_init() sets
IOCB_DSYNC|IOCB_SYNC on it despite whatever the caller asked for, so
that the buffered head and tail and the O_DIRECT middle of a
misaligned write cannot complete out of order. The reply still
reported the stability that was asked for, so an UNSTABLE write came
back UNSTABLE, the client kept its pages on the commit list, and the
COMMIT that followed ran an fsync for data that is already on stable
storage.
Report the stability the kiocb actually carries instead: FILE_SYNC
when IOCB_SYNC is set, DATA_SYNC when only IOCB_DSYNC is. A write
told FILE_SYNC has no reason to COMMIT and sends none. Buffered
writes, and any write that asked for at least what it got, are
unchanged.
Fixes: d32ddfeb5593 ("nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/localio.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -936,6 +936,7 @@ static void nfs_local_do_write(struct nf
const struct rpc_call_ops *call_ops)
{
struct nfs_pgio_header *hdr = iocb->hdr;
+ enum nfs3_stable_how committed = hdr->args.stable;
dprintk("%s: vfs_write count=%u pos=%llu %s\n",
__func__, hdr->args.count, hdr->args.offset,
@@ -954,9 +955,20 @@ static void nfs_local_do_write(struct nf
iocb->kiocb.ki_flags |= IOCB_DSYNC|IOCB_SYNC;
}
+ /*
+ * Report the stability the write will actually have. A DIO WRITE
+ * is persisted before it completes whatever was asked for, see
+ * nfs_local_iters_init(), and a caller told so has no reason to
+ * COMMIT data that is already on stable storage.
+ */
+ if (iocb->kiocb.ki_flags & IOCB_SYNC)
+ committed = NFS_FILE_SYNC;
+ else if (iocb->kiocb.ki_flags & IOCB_DSYNC)
+ committed = NFS_DATA_SYNC;
+
nfs_local_pgio_init(hdr, call_ops);
- nfs_set_local_verifier(hdr->inode, hdr->res.verf, hdr->args.stable);
+ nfs_set_local_verifier(hdr->inode, hdr->res.verf, committed);
INIT_WORK(&iocb->work, nfs_local_call_write);
if (nfs_local_defer_io())
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 410/547] NFSD: cap the number of listeners accepted in listener_set
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 409/547] NFS/localio: report the stability a DIO WRITE actually has Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 411/547] nfsd: clear XDR padding in GETXATTR replies Greg Kroah-Hartman
` (145 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 9a05e5ee0a98b9550521df86936b5f825bc07ec2 upstream.
nfsd_nl_listener_set_doit() matches each requested listener against the
existing set. The nested loop that does this is O(N * M), where N is the
requested count and M is the existing count. The loop runs under sv_lock
with bottom halves disabled. A userland request with a very large listener
list can therefore spin in atomic context for a long time.
Reject a request that carries more than NFSD_NL_LISTENER_MAX (1024)
entries. The check goes in nfsd_nl_validate_listeners(), before the code
takes any lock. The limit is far above any realistic configuration.
This patch does not cap M. Only the message size bounded N; real sockets
bound M. A listener_set result set is the requested set, so that path also
holds M at the cap, but __write_ports_addxprt() adds two listeners per call
and removes none, so repeated calls can push M past it. The worst case
under sv_lock is therefore 1024 * M, plus 1024 nla_parse_nested() calls.
Both interfaces require CAP_NET_ADMIN.
Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-1-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1973,21 +1973,22 @@ err_free_msg:
return err;
}
+/* Upper bound on the number of listeners a single request may carry. */
+#define NFSD_NL_LISTENER_MAX 1024
+
/**
* nfsd_nl_validate_listeners - sanity-check the listener list from userland
* @info: netlink metadata and command arguments
*
- * Walk every NFSD_A_SERVER_SOCK_ADDR attribute and confirm that each entry
- * is well-formed: it parses against the policy, carries both an address and
- * a transport name, and the address is long enough for its family. Doing
- * this up front lets the callers below assume every entry is valid and
- * guarantees we make no changes when the request is malformed.
+ * Walk every NFSD_A_SERVER_SOCK_ADDR attribute and confirm that the list is
+ * not oversized and that each entry is well-formed.
*
* Return: 0 if every entry is valid, or a negative errno otherwise.
*/
static int nfsd_nl_validate_listeners(struct genl_info *info)
{
const struct nlattr *attr;
+ unsigned int count = 0;
int rem;
nlmsg_for_each_attr_type(attr, NFSD_A_SERVER_SOCK_ADDR, info->nlhdr,
@@ -1996,6 +1997,11 @@ static int nfsd_nl_validate_listeners(st
struct sockaddr *sa;
int err;
+ if (++count > NFSD_NL_LISTENER_MAX) {
+ NL_SET_ERR_MSG(info->extack, "too many listeners");
+ return -E2BIG;
+ }
+
err = nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
nfsd_sock_nl_policy, info->extack);
if (err < 0)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 411/547] nfsd: clear XDR padding in GETXATTR replies
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 410/547] NFSD: cap the number of listeners accepted in listener_set Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 412/547] NFSD: copy SETXATTR data from all XDR buffer segments Greg Kroah-Hartman
` (144 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit daba58690339ae86f1ebeb5197aa1369fae37e57 upstream.
nfsd4_vbuf_to_stream() uses a raw memcpy() for the first fragment of an
attribute value. xdr_reserve_space() aligns the reservation but does not
initialize the extra bytes. If the complete value fits in that fragment,
the loop that clears padding for the final fragment is never entered.
A remote client reading an attribute whose length is not a multiple of
four can therefore receive one to three stale bytes from the response
page.
Encode the first fragment with xdr_encode_opaque_fixed(), matching the
final-fragment path and ensuring that any XDR padding is zeroed.
Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915160119.3105745-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6274,7 +6274,7 @@ nfsd4_vbuf_to_stream(struct xdr_stream *
if (!p)
return nfserr_resource;
- memcpy(p, buf, cplen);
+ xdr_encode_opaque_fixed(p, buf, cplen);
buf += cplen;
buflen -= cplen;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 412/547] NFSD: copy SETXATTR data from all XDR buffer segments
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 411/547] nfsd: clear XDR padding in GETXATTR replies Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 413/547] NFSD: Destroy a recalled delegation the client does not hold Greg Kroah-Hartman
` (143 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit b01319947c69b0e3ea0fcd4b675eb892f9cad8a0 upstream.
nfsd4_vbuf_from_vector() manually copies the head followed by whole
pages starting at offset zero. This assumes that all remaining data
starts at the beginning of the page array and that no data is stored
in the tail.
However, nfsd4_decode_setxattr() passes an xdr_buf returned by
xdr_stream_subsegment(). Such a sub-buffer can have a nonzero
page_base and can span its page and tail segments. Ignoring that
layout can copy the wrong bytes into the value passed to
vfs_setxattr().
Use read_bytes_from_xdr_buf(), which observes the complete xdr_buf
layout.
Fixes: c1346a1216ab ("NFSD: Replace the internals of the READ_BUF() macro")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915160022.3105295-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 19 +++----------------
1 file changed, 3 insertions(+), 16 deletions(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2320,10 +2320,8 @@ static __be32
nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr,
char **bufp, size_t buflen)
{
- struct page **pages = xdr->pages;
struct kvec *head = xdr->head;
- char *tmp, *dp;
- u32 len;
+ char *tmp;
if (buflen <= head->iov_len) {
/*
@@ -2338,19 +2336,8 @@ nfsd4_vbuf_from_vector(struct nfsd4_comp
if (tmp == NULL)
return nfserr_jukebox;
- dp = tmp;
- memcpy(dp, head->iov_base, head->iov_len);
- buflen -= head->iov_len;
- dp += head->iov_len;
-
- while (buflen > 0) {
- len = min_t(u32, buflen, PAGE_SIZE);
- memcpy(dp, page_address(*pages), len);
-
- buflen -= len;
- dp += len;
- pages++;
- }
+ if (read_bytes_from_xdr_buf(xdr, 0, tmp, buflen))
+ return nfserr_bad_xdr;
*bufp = tmp;
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 413/547] NFSD: Destroy a recalled delegation the client does not hold
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 412/547] NFSD: copy SETXATTR data from all XDR buffer segments Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 414/547] NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients Greg Kroah-Hartman
` (142 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit bbfa823f624d41e85ebca929ac77dc2182cadfed upstream.
A client that answers CB_RECALL with NFS4ERR_BADHANDLE or
NFS4ERR_BAD_STATEID has no record of the delegation, so the
FREE_STATEID that clears it from cl_revoked never arrives. Every later
SEQUENCE reply carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED, and the
client loops issuing TEST_STATEID.
Destroy such a delegation when it is reaped rather than revoking it
onto cl_revoked. RFC 8881 Section 20.2.4 completes the recall at the
reply when its status is neither NFS4_OK nor NFS4ERR_DELAY, so a
rejected recall leaves nothing to revoke. An administrative revoke
keeps that path, since NFS4ERR_ADMIN_REVOKED reports it. A destroyed
stateid returns NFS4ERR_BAD_STATEID instead of NFS4ERR_DELEG_REVOKED. A
client that rejects the recall but still holds the delegation gets no
notice that its state was revoked.
CB_RECALL can outrun the reply that granted the delegation, so honor
a rejection only once the client has seen that grant. Per RFC 8881
Section 2.10.6.3, retirement of the slot that carried the grant is that
proof; retry until then, and revoke when the retries lapse.
Fixes: 3bd64a5ba171 ("nfsd4: implement SEQ4_STATUS_RECALLABLE_STATE_REVOKED")
Cc: stable@vger.kernel.org # 6.14.x
Link: https://patch.msgid.link/20260802-nfsd-deleg-destroy-badhandle-v1-8-323aa7196055@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 200 +++++++++++++++++++++++++++++++++++++++++++---------
fs/nfsd/state.h | 13 +++
2 files changed, 179 insertions(+), 34 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -92,6 +92,8 @@ static void nfsd4_end_grace(struct nfsd_
static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps);
static void nfsd4_file_hash_remove(struct nfs4_file *fi);
static void deleg_reaper(struct nfsd_net *nn);
+static void nfsd4_drop_revoked_stid(struct nfs4_stid *s)
+ __releases(&s->sc_client->cl_lock);
static const struct lease_manager_operations nfsd_lease_mng_ops;
@@ -1279,6 +1281,9 @@ __alloc_init_deleg(struct nfs4_client *c
dp->dl_type = dl_type;
dp->dl_retries = 1;
dp->dl_recalled = false;
+ dp->dl_recall_rejected = false;
+ dp->dl_recall_grant.valid = false;
+ dp->dl_recall_grant.retired_at_send = false;
get_nfs4_file(fp);
dp->dl_stid.sc_file = fp;
nfsd4_init_cb(&dp->dl_recall, dp->dl_stid.sc_client,
@@ -1563,27 +1568,22 @@ static void destroy_delegation(struct nf
}
/**
- * revoke_delegation - perform nfs4 delegation structure cleanup
- * @dp: pointer to the delegation
+ * revoke_delegation - dispose of a delegation the server has revoked
+ * @dp: delegation to dispose of
+ *
+ * The caller holds a reference on @dp, which this function consumes.
+ * On NFSv4.1 and newer, @dp's sc_status must already carry
+ * SC_STATUS_REVOKED or SC_STATUS_ADMIN_REVOKED.
+ *
+ * @dp is parked on the client's cl_revoked list to await a FREE_STATEID.
+ * Where none can arrive, @dp is destroyed here instead: FREE_STATEID has
+ * already freed it, or the client rejected the recall with
+ * NFS4ERR_BADHANDLE or NFS4ERR_BAD_STATEID and holds no record of the
+ * delegation. NFS4ERR_ADMIN_REVOKED still prompts one, so an
+ * administrative revoke waits on cl_revoked.
*
- * This function assumes that it's called either from the administrative
- * interface (nfsd4_revoke_states()) that's revoking a specific delegation
- * stateid or it's called from a laundromat thread (nfsd4_landromat()) that
- * determined that this specific state has expired and needs to be revoked
- * (both mark state with the appropriate stid sc_status mode). It is also
- * assumed that a reference was taken on the @dp state. This function
- * consumes that reference.
- *
- * If this function finds that the @dp state is SC_STATUS_FREED it means
- * that a FREE_STATEID operation for this stateid has been processed and
- * we can proceed to removing it from recalled list. However, if @dp state
- * isn't marked SC_STATUS_FREED, it means we need place it on the cl_revoked
- * list and wait for the FREE_STATEID to arrive from the client. At the same
- * time, we need to mark it as SC_STATUS_FREEABLE to indicate to the
- * nfsd4_free_stateid() function that this stateid has already been added
- * to the cl_revoked list and that nfsd4_free_stateid() is now responsible
- * for removing it from the list. Inspection of where the delegation state
- * in the revocation process is protected by the clp->cl_lock.
+ * Context: Takes and releases the client's cl_lock; may sleep after
+ * dropping it.
*/
static void revoke_delegation(struct nfs4_delegation *dp)
{
@@ -1601,6 +1601,19 @@ static void revoke_delegation(struct nfs
list_del_init(&dp->dl_recall_lru);
goto out;
}
+ if (dp->dl_recall_rejected &&
+ !(dp->dl_stid.sc_status & SC_STATUS_ADMIN_REVOKED)) {
+ /*
+ * SC_STATUS_CLOSED, set under cl_lock, makes a racing
+ * FREE_STATEID bail out rather than drop this reference
+ * too. The put releases what cl_revoked would have held.
+ */
+ dp->dl_stid.sc_status |= SC_STATUS_CLOSED;
+ spin_unlock(&clp->cl_lock);
+ nfs4_put_stid(&dp->dl_stid);
+ destroy_unhashed_deleg(dp);
+ return;
+ }
list_add(&dp->dl_recall_lru, &clp->cl_revoked);
dp->dl_stid.sc_status |= SC_STATUS_FREEABLE;
out:
@@ -2895,11 +2908,18 @@ __destroy_client(struct nfs4_client *clp
list_del_init(&dp->dl_recall_lru);
destroy_unhashed_deleg(dp);
}
+ /*
+ * A CB_RECALL reply can release revoked delegations concurrently:
+ * nfsd4_shutdown_callback() has not run yet.
+ */
+ spin_lock(&clp->cl_lock);
while (!list_empty(&clp->cl_revoked)) {
dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
- list_del_init(&dp->dl_recall_lru);
- nfs4_put_stid(&dp->dl_stid);
+ /* this function drops ->cl_lock */
+ nfsd4_drop_revoked_stid(&dp->dl_stid);
+ spin_lock(&clp->cl_lock);
}
+ spin_unlock(&clp->cl_lock);
while (!list_empty(&clp->cl_openowners)) {
oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
nfs4_get_stateowner(&oo->oo_owner);
@@ -6069,6 +6089,60 @@ bool nfsd_wait_for_delegreturn(struct sv
return timeo > 0;
}
+static bool nfsd4_recall_grant_slot_retired(struct nfs4_delegation *dp)
+{
+ struct nfs4_client *clp = dp->dl_stid.sc_client;
+ struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
+ struct nfsd4_session *ses;
+ struct nfsd4_sessionid sid;
+ bool retired = false;
+ void *entry;
+
+ if (!dp->dl_recall_grant.valid)
+ return false;
+
+ /*
+ * gen_sessionid() composes a sessionid from the client's clientid
+ * and a sequence counter, so the sequence alone identifies the
+ * granting session.
+ */
+ sid.clientid = clp->cl_clientid;
+ sid.sequence = dp->dl_recall_grant.sessionid_seq;
+ sid.reserved = 0;
+
+ /*
+ * A missing session does not prove the client saw the grant: a
+ * DESTROY_SESSION unhashes its own session before the reply to
+ * that compound is encoded.
+ */
+ spin_lock(&nn->client_lock);
+ ses = __find_in_sessionid_hashtbl((struct nfs4_sessionid *)&sid,
+ clp->net);
+ entry = ses ? xa_load(&ses->se_slots, dp->dl_recall_grant.slotid) : NULL;
+ if (xa_is_value(entry)) {
+ /*
+ * A slot is freed only once the client has acknowledged
+ * the smaller slot table, which it cannot do while a
+ * request on that slot is outstanding.
+ */
+ retired = true;
+ } else if (entry) {
+ struct nfsd4_slot *slot = entry;
+
+ /*
+ * A reactivated slot was freed and rebuilt, so the same
+ * acknowledgment applies. The seqid test errs toward
+ * revoking: a rebuilt slot restarting at seqid 1 matches
+ * an old grant.
+ */
+ retired = (slot->sl_flags & NFSD4_SLOT_REUSED) ||
+ ((slot->sl_flags & NFSD4_SLOT_INITIALIZED) &&
+ slot->sl_seqid != dp->dl_recall_grant.seqid);
+ }
+ spin_unlock(&nn->client_lock);
+ return retired;
+}
+
static bool nfsd4_cb_recall_prepare(struct nfsd4_callback *cb)
{
struct nfs4_delegation *dp = cb_to_delegation(cb);
@@ -6090,9 +6164,37 @@ static bool nfsd4_cb_recall_prepare(stru
list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
}
spin_unlock(&nn->deleg_lock);
+
+ dp->dl_recall_grant.retired_at_send =
+ nfsd4_recall_grant_slot_retired(dp);
return true;
}
+/*
+ * cl_lock orders this against a laundromat reaping @dp: either
+ * revoke_delegation() observes dl_recall_rejected and destroys @dp, or
+ * it reached cl_revoked first and @dp is released here instead.
+ */
+static void nfsd4_deleg_recall_rejected(struct nfs4_delegation *dp)
+{
+ struct nfs4_client *clp = dp->dl_stid.sc_client;
+
+ spin_lock(&clp->cl_lock);
+ if (dp->dl_stid.sc_status & (SC_STATUS_CLOSED | SC_STATUS_FREED |
+ SC_STATUS_ADMIN_REVOKED)) {
+ spin_unlock(&clp->cl_lock);
+ return;
+ }
+ if (dp->dl_stid.sc_status & SC_STATUS_FREEABLE) {
+ dp->dl_stid.sc_status |= SC_STATUS_CLOSED;
+ /* this function drops ->cl_lock */
+ nfsd4_drop_revoked_stid(&dp->dl_stid);
+ return;
+ }
+ dp->dl_recall_rejected = true;
+ spin_unlock(&clp->cl_lock);
+}
+
static int nfsd4_cb_recall_done(struct nfsd4_callback *cb,
struct rpc_task *task)
{
@@ -6100,27 +6202,33 @@ static int nfsd4_cb_recall_done(struct n
trace_nfsd_cb_recall_done(&dp->dl_stid.sc_stateid, task);
- if (dp->dl_stid.sc_status)
- /* CLOSED or REVOKED */
- return 1;
-
switch (task->tk_status) {
case 0:
return 1;
case -NFS4ERR_DELAY:
+ if (dp->dl_stid.sc_status)
+ /* CLOSED or REVOKED */
+ return 1;
rpc_delay(task, 2 * HZ);
return 0;
case -EBADHANDLE:
case -NFS4ERR_BAD_STATEID:
/*
- * Race: client probably got cb_recall before open reply
- * granting delegation.
+ * Retirement of the granting slot proves the client saw
+ * the grant. Trust the rejection only if the slot had
+ * retired when this recall was sent.
*/
- if (dp->dl_retries--) {
+ if (dp->dl_recall_grant.retired_at_send) {
+ nfsd4_deleg_recall_rejected(dp);
+ return 1;
+ }
+ if (!dp->dl_stid.sc_status && dp->dl_retries--) {
+ dp->dl_recall_grant.retired_at_send =
+ nfsd4_recall_grant_slot_retired(dp);
rpc_delay(task, 2 * HZ);
return 0;
}
- fallthrough;
+ return 1;
default:
return 1;
}
@@ -6714,9 +6822,25 @@ static bool nfsd4_want_deleg_timestamps(
return open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_DELEG_TIMESTAMPS;
}
+static void
+nfs4_delegation_record_grant_slot(struct nfs4_delegation *dp,
+ const struct nfsd4_compound_state *cstate)
+{
+ const struct nfsd4_sessionid *sid;
+
+ if (!cstate->session)
+ return;
+ sid = (struct nfsd4_sessionid *)cstate->session->se_sessionid.data;
+ dp->dl_recall_grant.sessionid_seq = sid->sequence;
+ dp->dl_recall_grant.slotid = cstate->slot->sl_index;
+ dp->dl_recall_grant.seqid = cstate->slot->sl_seqid;
+ dp->dl_recall_grant.valid = true;
+}
+
static struct nfs4_delegation *
-nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
- struct svc_fh *parent)
+nfs4_set_delegation(struct nfsd4_open *open,
+ const struct nfsd4_compound_state *cstate,
+ struct nfs4_ol_stateid *stp, struct svc_fh *parent)
{
bool deleg_ts = nfsd4_want_deleg_timestamps(open);
struct nfs4_client *clp = stp->st_stid.sc_client;
@@ -6806,6 +6930,14 @@ nfs4_set_delegation(struct nfsd4_open *o
dp = alloc_init_deleg(clp, fp, odstate, dl_type);
if (!dp)
goto out_delegees;
+
+ /*
+ * Record the granting slot before kernel_setlease() makes @dp
+ * visible to lease breakers. A conflicting open can drive
+ * CB_RECALL to completion from that point on.
+ */
+ nfs4_delegation_record_grant_slot(dp, cstate);
+
if (stp->st_stid.sc_export)
dp->dl_stid.sc_export = exp_get(stp->st_stid.sc_export);
@@ -6970,6 +7102,7 @@ nfs4_open_delegation(struct svc_rqst *rq
struct nfs4_ol_stateid *stp, struct svc_fh *currentfh,
struct svc_fh *fh)
{
+ struct nfsd4_compoundres *resp = rqstp->rq_resp;
struct nfs4_openowner *oo = openowner(stp->st_stateowner);
bool deleg_ts = nfsd4_want_deleg_timestamps(open);
struct nfs4_client *clp = stp->st_stid.sc_client;
@@ -7006,7 +7139,7 @@ nfs4_open_delegation(struct svc_rqst *rq
default:
goto out_no_deleg;
}
- dp = nfs4_set_delegation(open, stp, parent);
+ dp = nfs4_set_delegation(open, &resp->cstate, stp, parent);
if (IS_ERR(dp))
goto out_no_deleg;
@@ -10300,6 +10433,7 @@ nfsd_get_dir_deleg(struct nfsd4_compound
dp = alloc_init_dir_deleg(clp, fp);
if (!dp)
goto out_delegees;
+ nfs4_delegation_record_grant_slot(dp, cstate);
if (cstate->current_fh.fh_export)
dp->dl_stid.sc_export =
exp_get(cstate->current_fh.fh_export);
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -270,7 +270,8 @@ struct nfsd4_cb_notify {
* If the server attempts to recall a delegation and the client doesn't do so
* before a timeout, the server may also revoke the delegation. In that case,
* the object will either be destroyed (v4.0) or moved to a per-client list of
- * revoked delegations (v4.1+).
+ * revoked delegations (v4.1+). A v4.1+ client that rejects the recall holds
+ * no record of the delegation, so the object is destroyed rather than listed.
*
* This object is a superset of the nfs4_stid.
*/
@@ -286,9 +287,19 @@ struct nfs4_delegation {
int dl_retries;
struct nfsd4_callback dl_recall;
bool dl_recalled;
+ bool dl_recall_rejected;
bool dl_written;
bool dl_setattr;
+ /* Forward-channel slot that carried the granting request */
+ struct {
+ u32 sessionid_seq;
+ u32 slotid;
+ u32 seqid;
+ bool valid;
+ bool retired_at_send;
+ } dl_recall_grant;
+
union {
/* for CB_GETATTR */
struct nfs4_cb_fattr dl_cb_fattr;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 414/547] NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 413/547] NFSD: Destroy a recalled delegation the client does not hold Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 415/547] NFSD: Dont complete a cld upcall the daemon has not read Greg Kroah-Hartman
` (141 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 95ff0c079b9cab91f2327beb4197a3bc48c71f55 upstream.
deleg_reaper() sends CB_RECALL_ANY to every ACTIVE client holding
delegations, but CB_RECALL_ANY is an NFSv4.1 operation. An NFSv4.0
client's callback service accepts only CB_GETATTR and CB_RECALL, so it
replies OP_ILLEGAL. The decoder maps the unexpected opnum to -EIO, and
nfsd4_cb_done() marks the client's callback channel down.
Nothing brings the channel back. nfsd4_run_cb_work() sets NFSD4_CB_UP
only for a minor version above zero, and the only nfsd4_probe_callback()
call site an NFSv4.0 client reaches is nfsd4_setclientid_confirm(). One
visit from the reaper therefore leaves the channel marked down until the
client re-establishes its clientid. RENEW then returns
NFS4ERR_CB_PATH_DOWN for as long as the client holds delegations.
nfsd4_cb_channel_good() stops returning true, so the client is granted
no further delegations.
Skip clients at minor version zero.
Fixes: 44df6f439a17 ("NFSD: add delegation reaper to react to low memory condition")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260817-recall-any-keep-count-v5-1-3b2cffce701e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7915,6 +7915,8 @@ deleg_reaper(struct nfsd_net *nn)
list_for_each_safe(pos, next, &nn->client_lru) {
clp = list_entry(pos, struct nfs4_client, cl_lru);
+ if (clp->cl_minorversion == 0)
+ continue;
if (clp->cl_state != NFSD4_ACTIVE)
continue;
if (list_empty(&clp->cl_delegations))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 415/547] NFSD: Dont complete a cld upcall the daemon has not read
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 414/547] NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients Greg Kroah-Hartman
@ 2026-11-04 21:09 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 416/547] nfsd: dont modify a session slot when replaying its cached reply Greg Kroah-Hartman
` (140 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Farhad Alemi, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 7f4bf851aca4e18940ebf2bddf4ba6783802ee81 upstream.
cld_pipe_downcall() matches a reply to its upcall on the xid alone.
A write that arrives before the daemon has read that upcall
completes __cld_pipe_upcall() while its struct rpc_pipe_msg is still
queued on the pipe. The waiter returns, its stack frame goes away,
and the pipe keeps a list_head that points into it. The next
rpc_queue_upcall() walks that pointer:
BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report
Read of size 8 at addr ffffc90007027950 by task syz.0.96/13066
__list_add_valid_or_report+0x6a/0x130
rpc_queue_upcall
cld_pipe_upcall
nfsd4_cld_grace_start
nfsd4_cld_tracking_init
The pipe is mode 0600 in rpc_pipefs, so the trigger is a broken or
hostile nfsdcld rather than an unprivileged task.
Record whether the daemon has consumed the whole message and
complete only when it has. cld_pipe_destroy_msg() runs on every path
by which the pipe releases a message, so it can maintain that flag
under cn_lock. nfsdcld sends its -EINPROGRESS downcalls only after
reading the upcall, so the new check does not break the GraceStart
record stream.
Fixes: f3f8014862d8 ("nfsd: add the infrastructure to handle the cld upcall")
Cc: stable@vger.kernel.org
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://lore.kernel.org/linux-nfs/CA+0ovCjVF58WLeen2ctdzHyWUASAAW3Y=Yjihyq0pFApYawtDg@mail.gmail.com/
Link: https://patch.msgid.link/20260901-alemi-v2-1-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4recover.c | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -647,6 +647,8 @@ struct cld_upcall {
struct list_head cu_list;
struct cld_net *cu_net;
struct completion cu_done;
+ /* daemon has read the whole upcall; protected by cn_lock */
+ bool cu_inflight;
union {
struct cld_msg_hdr cu_hdr;
struct cld_msg cu_msg;
@@ -807,6 +809,13 @@ cld_pipe_downcall(struct file *filp, con
spin_lock(&cn->cn_lock);
list_for_each_entry(tmp, &cn->cn_list, cu_list) {
if (get_unaligned(&tmp->cu_u.cu_hdr.cm_xid) == xid) {
+ /*
+ * Completing now would return the waiter
+ * while its message is still queued on the
+ * pipe.
+ */
+ if (!tmp->cu_inflight)
+ break;
cup = tmp;
if (status != -EINPROGRESS)
list_del_init(&cup->cu_list);
@@ -815,9 +824,9 @@ cld_pipe_downcall(struct file *filp, con
}
spin_unlock(&cn->cn_lock);
- /* couldn't find upcall? */
+ /* no upcall to complete? */
if (!cup) {
- dprintk("%s: couldn't find upcall -- xid=%u\n", __func__, xid);
+ dprintk("%s: no completable upcall -- xid=%u\n", __func__, xid);
return -EINVAL;
}
@@ -837,8 +846,16 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg
struct cld_msg *cmsg = msg->data;
struct cld_upcall *cup = container_of(cmsg, struct cld_upcall,
cu_u.cu_msg);
+ struct cld_net *cn = cup->cu_net;
+
+ /*
+ * errno >= 0 means the daemon read the whole message and a
+ * downcall will complete the upcall.
+ */
+ spin_lock(&cn->cn_lock);
+ cup->cu_inflight = msg->errno >= 0;
+ spin_unlock(&cn->cn_lock);
- /* errno >= 0 means we got a downcall */
if (msg->errno >= 0)
return;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 416/547] nfsd: dont modify a session slot when replaying its cached reply
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-11-04 21:09 ` [PATCH 7.3 415/547] NFSD: Dont complete a cld upcall the daemon has not read Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 417/547] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served Greg Kroah-Hartman
` (139 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ameer Hamza, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ameer Hamza <ameer.hamza@truenas.com>
commit 2987838317501ff67b672ac2a441fe34b7729f3d upstream.
nfsd4_sequence() claims a session slot by setting NFSD4_SLOT_INUSE
under nn->client_lock. A reply served from the slot's reply cache does
not claim it, and that distinction lived only in cstate->status, which
nfsd4_sequence() set to nfserr_replay_cache. Commit cc028a10a48c
("NFSD: Hoist status code encoding into XDR encoder functions") moved
nfsd4_proc_compound()'s cstate->status assignment below the out:
label, and the replay path's goto out was the one path that relied on
skipping it. The test in nfsd4_sequence_done() therefore no longer
identifies a replay, and every replay now stores its reply and clears
NFSD4_SLOT_INUSE as though it owned the slot.
NFSD4_SLOT_INUSE is the interlock: check_slot_seqid() rejects every
sequence id for a slot that is in use, before replay_matches_cache()
runs. A replay never sets it, so two replays can be in flight on the
same slot at once. One can read slot->sl_cred under nn->client_lock
while the other's completion frees and rebuilds it from the XDR
encoder without that lock. Two completions can also collide with each
other and release the same group_info twice. free_svc_cred() leaves
cr_uid, cr_gid and cr_flavor intact, so the reader passes every
earlier test in same_creds() and dereferences a NULL cr_group_info.
>From a 6.12.91 production server:
BUG: kernel NULL pointer dereference, address: 0000000000000004
CPU: 63 UID: 0 PID: 39015 Comm: nfsd
RIP: 0010:same_creds+0x38/0xa0 [nfsd]
RDX: 0000000000000000
Call Trace:
nfsd4_sequence+0x6a8/0x910 [nfsd]
nfsd4_proc_compound+0x345/0x670 [nfsd]
nfsd_dispatch+0x100/0x220 [nfsd]
svc_process_common+0x311/0x700 [sunrpc]
svc_process+0x131/0x1c0 [sunrpc]
svc_recv+0x7ef/0x9c0 [sunrpc]
nfsd+0xa3/0x100 [nfsd]
Kernel panic - not syncing: Fatal exception
Since v6.14 a live session's slot table can shrink, and the unowned
store becomes a use-after-free write. nfsd4_sequence() defers the
shrink while a slot is in use, but it tests NFSD4_SLOT_INUSE, which a
replay does not set, so free_session_slots() can kfree() the slot the
replay still holds in cstate->slot.
Record the claim in cstate->slot_owned when nfsd4_sequence() accepts a
request and test that in nfsd4_sequence_done(), so only the request
that claimed the slot updates its cached reply and clears
NFSD4_SLOT_INUSE. svc_generic_init_request() zeroes the compound
response before each request, so the flag starts clear.
Fixes: cc028a10a48c ("NFSD: Hoist status code encoding into XDR encoder functions")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260824173641.3274260-1-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 7 ++++++-
fs/nfsd/xdr4.h | 1 +
2 files changed, 7 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5144,6 +5144,7 @@ nfsd4_sequence(struct svc_rqst *rqstp, s
slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
cstate->slot = slot;
+ cstate->slot_owned = true;
cstate->session = session;
cstate->clp = clp;
@@ -5218,7 +5219,11 @@ nfsd4_sequence_done(struct nfsd4_compoun
struct nfsd4_compound_state *cs = &resp->cstate;
if (nfsd4_has_session(cs)) {
- if (cs->status != nfserr_replay_cache) {
+ /*
+ * Only the request that claimed the slot may update its
+ * cached reply and clear NFSD4_SLOT_INUSE.
+ */
+ if (cs->slot_owned) {
nfsd4_store_cache_entry(resp);
cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
}
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -188,6 +188,7 @@ struct nfsd4_compound_state {
struct nfsd4_slot *slot;
int data_offset;
bool spo_must_allowed;
+ bool slot_owned;
size_t iovlen;
u32 minorversion;
__be32 status;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 417/547] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 416/547] nfsd: dont modify a session slot when replaying its cached reply Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 418/547] NFSD: Fail a pool_threads read whose reply does not fit Greg Kroah-Hartman
` (138 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benji Wiebe, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 5d28b2c920d9d9d3c45b41769342ad785eb372a7 upstream.
The flexfiles layout driver hands out a deviceinfo that names this server
as an NFSv3 DS (flexfilelayout.c hardcodes da->version = 3). With v3
disabled, the client can't talk to the DS: it loops on v3 NULL calls that
the server answers with PROG_MISMATCH, and I/O hangs in D state.
Skip LAYOUT_FLEX_FILES in nfsd4_setup_layout_type() unless v3 is enabled.
Reported-by: Benji Wiebe <itsme@benjiwiebe.com>
Closes: https://lore.kernel.org/linux-nfs/c734eeb8-8486-4491-bb4d-b9656cbaffbe@app.fastmail.com/
Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260904-pnfs-ff-v1-1-5f502cf25401@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4layouts.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -127,10 +127,12 @@ nfsd4_set_deviceid(struct nfsd4_deviceid
void nfsd4_setup_layout_type(struct svc_export *exp)
{
+ struct nfsd_net *nn = net_generic(exp->cd->net, nfsd_net_id);
struct super_block *sb = exp->ex_path.mnt->mnt_sb;
expfs_block_layouts_t block_supported = exportfs_layouts_supported(sb);
- if (IS_ENABLED(CONFIG_NFSD_FLEXFILELAYOUT))
+ if (IS_ENABLED(CONFIG_NFSD_FLEXFILELAYOUT) &&
+ nfsd_vers(nn, 3, NFSD_TEST))
exp->ex_layout_types |= 1 << LAYOUT_FLEX_FILES;
if (IS_ENABLED(CONFIG_NFSD_BLOCKLAYOUT) &&
(block_supported & EXPFS_BLOCK_IN_BAND_ID))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 418/547] NFSD: Fail a pool_threads read whose reply does not fit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 417/547] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 419/547] nfsd: fetch direct I/O alignment for files handed to the filecache Greg Kroah-Hartman
` (137 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Laight, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit e27c63245903402ccfdb46c576462981a7e032e3 upstream.
The reply to a pool_threads read is the list of per-pool thread counts,
formatted into a buffer of SIMPLE_TRANSACTION_LIMIT bytes. snprintf()
truncates its last write and strlen() measures only what fit, so a reply
too long for that buffer ends mid-number with no terminating newline. A
pool running 4096 threads is reported as 40. Nothing marks the reply as
incomplete, so an administrator reads a plausible but wrong count.
Take snprintf()'s return value, which reports the truncation strlen()
cannot see, and fail the read with -ENAMETOOLONG when the list does
not fit. That is the errno svc_one_xprt_name() already returns for the
same condition.
Suggested-by: David Laight <david.laight.linux@gmail.com>
Fixes: eed2965af1ba ("[PATCH] knfsd: allow admin to set nthreads per node")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260812193349.13347-1-david.laight.linux@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -477,7 +477,7 @@ static ssize_t write_pool_threads(struct
char *mesg = buf;
int i;
int rv;
- int len;
+ size_t len;
int npools;
int *nthreads;
struct net *net = netns(file);
@@ -531,9 +531,13 @@ static ssize_t write_pool_threads(struct
mesg = buf;
size = SIMPLE_TRANSACTION_LIMIT;
- for (i = 0; i < npools && size > 0; i++) {
- snprintf(mesg, size, "%d%c", nthreads[i], (i == npools-1 ? '\n' : ' '));
- len = strlen(mesg);
+ for (i = 0; i < npools; i++) {
+ len = snprintf(mesg, size, "%d%c", nthreads[i],
+ (i == npools - 1 ? '\n' : ' '));
+ if (len >= size) {
+ rv = -ENAMETOOLONG;
+ goto out_free;
+ }
size -= len;
mesg += len;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 419/547] nfsd: fetch direct I/O alignment for files handed to the filecache
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 418/547] NFSD: Fail a pool_threads read whose reply does not fit Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 420/547] nfsd: Fix id-to-name cache entry leak in idtoname_parse() Greg Kroah-Hartman
` (136 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Flynn, Mike Snitzer,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Flynn <david.flynn@hammerspace.com>
commit ace72c3d263294df7111477caaeff37438aa10af upstream.
nfsd_file_do_acquire() fetches a file's direct I/O alignment
attributes (nf_dio_mem_align, nf_dio_offset_align and
nf_dio_read_offset_align) only on the branch where NFSD opens the
file itself. The other branch, taken when the caller supplies an
already-open struct file, stores that file in the nfsd_file and
leaves the three alignment fields zero.
NFSv4 OPEN with CREATE takes the supplied-file branch:
nfsd4_create_file() creates the file with dentry_create() and passes
the resulting struct file as open->op_filp, which nfs4_get_vfs_file()
hands to nfsd_file_acquire_opened(). The cached nfsd_file therefore
keeps zero alignment for its whole life, and
nfsd_write_dio_iters_init() refuses direct I/O for every WRITE to a
file the client has just created.
Observed on an export whose backing device reports a dio_mem_align of
4: all 16 of 16 1 MiB NFSv4.2 writes that followed an OPEN(CREATE)
took the buffered path, while 16 of 16 writes to the same file
reopened without CREATE went direct.
Hoist the nfsd_file_get_dio_attrs() call out of the open branch so
that it runs once, for both branches, whenever the acquire has
otherwise succeeded. A getattr failure now fails the acquire on the
supplied-file branch exactly as it already does on the open branch.
Fixes: d11f6cd1bb4a ("NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5.1
Signed-off-by: David Flynn <david.flynn@hammerspace.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Link: https://patch.msgid.link/20260908163448.30841-4-snitzer@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/filecache.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -1285,9 +1285,9 @@ open_file:
}
status = nfserrno(ret);
trace_nfsd_file_open(nf, status);
- if (status == nfs_ok)
- status = nfsd_file_get_dio_attrs(fhp, nf);
}
+ if (status == nfs_ok)
+ status = nfsd_file_get_dio_attrs(fhp, nf);
} else
status = nfserr_jukebox;
/*
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 420/547] nfsd: Fix id-to-name cache entry leak in idtoname_parse()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 419/547] nfsd: fetch direct I/O alignment for files handed to the filecache Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 421/547] NFSD: Fix out-of-bounds read in the rpc_status dump Greg Kroah-Hartman
` (135 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 8ca3b74c0c447af17d0e27e76658a3d4cae3c5ba upstream.
idtoname_lookup() returns the id-to-name cache entry with a new
reference. The name is parsed between the lookup and the update call,
and when the parsed name is malformed (negative length or longer than
IDMAP_NAMESZ), idtoname_parse() jumps to the error label without
dropping the reference returned by idtoname_lookup(), leaking the cache
entry.
Release the reference with cache_put() before taking the error exit.
Fixes: f9ecc921b5b5 ("[PATCH] knfsd: Use new cache code for name/id lookup caches")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260917163154.2162438-1-vulab@iscas.ac.cn
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4idmap.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -253,8 +253,10 @@ idtoname_parse(struct cache_detail *cd,
/* Name */
error = -EINVAL;
len = qword_get(&buf, buf1, PAGE_SIZE);
- if (len < 0 || len >= IDMAP_NAMESZ)
+ if (len < 0 || len >= IDMAP_NAMESZ) {
+ cache_put(&res->h, cd);
goto out;
+ }
if (len == 0)
set_bit(CACHE_NEGATIVE, &ent.h.flags);
else
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 421/547] NFSD: Fix out-of-bounds read in the rpc_status dump
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 420/547] nfsd: Fix id-to-name cache entry leak in idtoname_parse() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 422/547] nfsd: hold cl_lock in client_has_openowners() Greg Kroah-Hartman
` (134 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prabhakar Pujeri, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit cbea14890783fead76f878caf0775a62a42049bf upstream.
nfsd_nl_rpc_status_get_dumpit() loads args->opcnt and
args->ops separately, then walks ops[] before rechecking
rq_status_counter. A COMPOUND that completes between the two loads
runs nfsd4_release_compoundargs(), which zeroes opcnt and points ops
back at the eight-entry inline array. A dump that already sampled an
opcnt of 200 clamps it to the sixteen slots in rq_opnum, then indexes
iops[0..15]. iops is the last member of struct nfsd4_compoundargs and
rq_argp is allocated at exactly that size, so the walk runs off the
end of the allocation. The trailing recheck discards the sampled data,
but the read has already happened. NFSD_CMD_RPC_STATUS_GET carries
no GENL_ADMIN_PERM, so an unprivileged local user can repeat the dump
against a busy server until it lands in the window.
Sample opcnt and ops into locals, then finish the counter recheck
before dereferencing ops. An unchanged counter means both came from the
same COMPOUND, where opcnt cannot exceed what ops holds.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Reported-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
Closes: https://lore.kernel.org/linux-nfs/20260823113255.3417-1-prabhakar.pujeri@dell.com/
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260824-nfsd-posix-acl-ownership-v1-1-090fffc608ec@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1585,14 +1585,29 @@ int nfsd_nl_rpc_status_get_dumpit(struct
rqstp->rq_proc == NFSPROC4_COMPOUND) {
/* NFSv4 compound */
struct nfsd4_compoundargs *args;
+ struct nfsd4_op *ops;
+ u32 opcnt;
int j;
args = rqstp->rq_argp;
- genl_rqstp.rq_opcnt = min_t(u32, args->opcnt,
+ opcnt = READ_ONCE(args->opcnt);
+ ops = READ_ONCE(args->ops);
+
+ /*
+ * Finish the seqcount retry before
+ * dereferencing ops. An unchanged counter means
+ * opcnt and ops came from the same COMPOUND,
+ * where opcnt cannot exceed what ops holds.
+ */
+ smp_rmb();
+ if (READ_ONCE(rqstp->rq_status_counter) !=
+ status_counter)
+ continue;
+
+ genl_rqstp.rq_opcnt = min_t(u32, opcnt,
ARRAY_SIZE(genl_rqstp.rq_opnum));
for (j = 0; j < genl_rqstp.rq_opcnt; j++)
- genl_rqstp.rq_opnum[j] =
- args->ops[j].opnum;
+ genl_rqstp.rq_opnum[j] = ops[j].opnum;
}
#endif /* CONFIG_NFSD_V4 */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 422/547] nfsd: hold cl_lock in client_has_openowners()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 421/547] NFSD: Fix out-of-bounds read in the rpc_status dump Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 423/547] nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1 Greg Kroah-Hartman
` (133 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei (Microsoft),
AutonomousCodeSecurity, Cen Zhang (Microsoft Security FORGE Labs),
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>
commit 5336899b5491eaa2ac22c2925d87daab2b140eb3 upstream.
client_has_openowners() walks clp->cl_openowners and reads so_stateids
without clp->cl_lock. nfs4_put_stateowner() unhashes that openowner under
cl_lock and then frees it, so a concurrent EXCHANGE_ID with mismatched
creds can use-after-free the nfs4_openowner.
BUG: KASAN: slab-use-after-free in client_has_state+0x10a/0x140
fs/nfsd/nfs4state.c:3718 client_has_openowners()
nfsd4_exchange_id
nfsd4_proc_compound
nfsd_dispatch
svc_process
Take clp->cl_lock while client_has_openowners() walks the openowner
list.
Fixes: 4eaea1342507 ("nfsd: improve client_has_state to check for unused openowners")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Cc: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>
Link: https://patch.msgid.link/20260828041925.36758-1-blbllhy@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4242,12 +4242,18 @@ nfsd4_set_ex_flags(struct nfs4_client *n
static bool client_has_openowners(struct nfs4_client *clp)
{
struct nfs4_openowner *oo;
+ bool found = false;
+ spin_lock(&clp->cl_lock);
list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
- if (!list_empty(&oo->oo_owner.so_stateids))
- return true;
+ if (!list_empty(&oo->oo_owner.so_stateids)) {
+ found = true;
+ break;
+ }
}
- return false;
+ spin_unlock(&clp->cl_lock);
+
+ return found;
}
static bool client_has_state(struct nfs4_client *clp)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 423/547] nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 422/547] nfsd: hold cl_lock in client_has_openowners() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 424/547] NFSD: map fh_verify() status codes for NFS_ACLv3 replies Greg Kroah-Hartman
` (132 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, NeilBrown, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
commit ddfabbc7840891e09cd500ab97c9cd36b650ec24 upstream.
When a file is created with a v4.1 OPEN which requests
NFS4_CREATE_EXCLUSIVE4_1, the request can include attributes to be set.
However when the mtime/atime are set to hold the verifier, the other
ia_valid flags are cleared, so no attributes requested by the client are
used.
This code was originally written for NFSv3 where NFS3_CREATE_EXCLUSIVE
never includes attributes. When it was updated for v4.1, the fact that an
exclusive create CAN include attributes was not handled properly.
Fixes: ac6721a13e5b ("nfsd41: make sure nfs server process OPEN with EXCLUSIVE4_1 correctly")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260717093001.1972119-2-neilb@ownmail.net
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -394,8 +394,8 @@ nfsd4_create_file(struct svc_rqst *rqstp
if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
iap->ia_valid &= ~ATTR_SIZE;
if (nfsd4_create_is_exclusive(open->op_createmode)) {
- iap->ia_valid = ATTR_MTIME | ATTR_ATIME |
- ATTR_MTIME_SET|ATTR_ATIME_SET;
+ iap->ia_valid |= ATTR_MTIME | ATTR_ATIME |
+ ATTR_MTIME_SET|ATTR_ATIME_SET;
iap->ia_mtime.tv_sec = v_mtime;
iap->ia_atime.tv_sec = v_atime;
iap->ia_mtime.tv_nsec = 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 424/547] NFSD: map fh_verify() status codes for NFS_ACLv3 replies
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 423/547] nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1 Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 425/547] NFSD: Map flex file layout IDs through the requests user namespace Greg Kroah-Hartman
` (131 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit b1eb9f1aea88a0d7ec8116a70c33b7b31ad0a3eb upstream.
The NFS_ACLv3 protocol shares its status code space with NFSv3,
which has NFS3ERR_BADHANDLE but no NFSERR_NOFILEHANDLE. An
NFS_ACLv3 GETACL or SETACL request that carries an empty file
handle gets a reply with status 10020, a value the client cannot
interpret.
Commit 1459ad57673b ("nfsd: Move error code mapping to per-version
proc code.") made fh_verify() return nfserr_nofilehandle for an
empty handle regardless of protocol version. The NFSv3 procedures
gained nfsd3_map_status() in exchange, but the NFS_ACLv3 procedures
did not, so the unmapped status reaches the encoder.
Add the same mapping to the NFS_ACLv3 procedures.
Fixes: 1459ad57673b ("nfsd: Move error code mapping to per-version proc code.")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260916004240.141975-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs3acl.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -13,6 +13,19 @@
#include "xdr3.h"
#include "vfs.h"
+static __be32 nfsd3_map_status(__be32 status)
+{
+ switch (status) {
+ case nfserr_nofilehandle:
+ status = nfserr_badhandle;
+ break;
+ case nfserr_wrongsec:
+ status = nfserr_acces;
+ break;
+ }
+ return status;
+}
+
/*
* NULL call.
*/
@@ -71,6 +84,7 @@ static __be32 nfsd3_proc_getacl(struct s
/* resp->acl_{access,default} are released in nfs3svc_release_getacl. */
out:
+ resp->status = nfsd3_map_status(resp->status);
return rpc_success;
fail:
@@ -124,6 +138,7 @@ out_errno:
resp->status = nfserrno(error);
out:
/* argp->acl_{access,default} are released in nfs3svc_release_setacl. */
+ resp->status = nfsd3_map_status(resp->status);
return rpc_success;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 425/547] NFSD: Map flex file layout IDs through the requests user namespace
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 424/547] NFSD: map fh_verify() status codes for NFS_ACLv3 replies Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 426/547] nfsd: preflight SEQUENCE replies before accepting a slot Greg Kroah-Hartman
` (130 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit f913d5d2130a584d1a027ffe3dfd88b6be2e0540 upstream.
nfsd4_ff_proc_layoutget() and nfsd4_ff_encode_layoutget() translate
the file's owner and group with init_user_ns, but every other identity
nfsd places on the wire goes through nfsd_user_namespace(). When the
transport carries a credential from a non-initial user namespace, the
flex file layout reports host-global IDs. The client copies those IDs
into the AUTH_SYS credential it presents to the data server, and
svcauth_unix_accept() resolves that credential in the transport's
namespace, so data server I/O runs under an identity unrelated to the
file's owner.
Switching to the request's namespace introduces a second hazard.
from_kuid() returns (uid_t)-1 when the target namespace has no
mapping for the owner, and the IOMODE_READ arm adds one to that
result to derive an identity for which the data server denies
writes. The addition would wrap to zero, handing the client uid 0
instead of an identity distinct from the owner.
Translate both IDs in nfsd4_ff_proc_layoutget(), which has the
svc_rqst, and carry the wire values in struct pnfs_ff_layout.
from_kuid_munged() substitutes overflowuid for an unmapped owner and
thus never returns (uid_t)-1, so the increment cannot wrap to zero.
Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260720141442.783935-1-cel@kernel.org?part=3
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260720163724.810227-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/flexfilelayout.c | 20 ++++++++++++--------
fs/nfsd/flexfilelayoutxdr.c | 4 ++--
fs/nfsd/flexfilelayoutxdr.h | 5 +++--
3 files changed, 17 insertions(+), 12 deletions(-)
--- a/fs/nfsd/flexfilelayout.c
+++ b/fs/nfsd/flexfilelayout.c
@@ -14,6 +14,7 @@
#include <linux/sunrpc/addr.h>
#include "flexfilelayoutxdr.h"
+#include "auth.h"
#include "pnfs.h"
#include "vfs.h"
@@ -23,10 +24,10 @@ static __be32
nfsd4_ff_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
const struct svc_fh *fhp, struct nfsd4_layoutget *args)
{
+ struct user_namespace *userns = nfsd_user_namespace(rqstp);
struct nfsd4_layout_seg *seg = &args->lg_seg;
u32 device_generation = 0;
int error;
- uid_t u;
struct pnfs_ff_layout *fl;
@@ -49,13 +50,16 @@ nfsd4_ff_proc_layoutget(struct svc_rqst
fl->flags = FF_FLAGS_NO_LAYOUTCOMMIT | FF_FLAGS_NO_IO_THRU_MDS |
FF_FLAGS_NO_READ_IO;
- /* Do not allow a IOMODE_READ segment to have write pemissions */
- if (seg->iomode == IOMODE_READ) {
- u = from_kuid(&init_user_ns, inode->i_uid) + 1;
- fl->uid = make_kuid(&init_user_ns, u);
- } else
- fl->uid = inode->i_uid;
- fl->gid = inode->i_gid;
+ fl->uid = from_kuid_munged(userns, inode->i_uid);
+ fl->gid = from_kgid_munged(userns, inode->i_gid);
+
+ /*
+ * Do not allow an IOMODE_READ segment to have write permissions.
+ * The group is left intact so group-readable files stay readable;
+ * nfsd_setuser() squashes an unmapped uid to the export's anon ID.
+ */
+ if (seg->iomode == IOMODE_READ)
+ fl->uid++;
error = nfsd4_set_deviceid(&fl->deviceid, fhp, device_generation);
if (error)
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -32,8 +32,8 @@ nfsd4_ff_encode_layoutget(struct xdr_str
fh_len = 4 + xdr_align_size(fl->fh.size);
- uid.len = sprintf(uid.buf, "%u", from_kuid(&init_user_ns, fl->uid));
- gid.len = sprintf(gid.buf, "%u", from_kgid(&init_user_ns, fl->gid));
+ uid.len = sprintf(uid.buf, "%u", fl->uid);
+ gid.len = sprintf(gid.buf, "%u", fl->gid);
/* data server entry: deviceid + efficiency + stateid + fh list +
* user + group + flags + stats_collect_hint
--- a/fs/nfsd/flexfilelayoutxdr.h
+++ b/fs/nfsd/flexfilelayoutxdr.h
@@ -35,8 +35,9 @@ struct pnfs_ff_device_addr {
struct pnfs_ff_layout {
u32 flags;
u32 stats_collect_hint;
- kuid_t uid;
- kgid_t gid;
+ /* Values to encode; nfsd4_ff_proc_layoutget() has mapped these */
+ u32 uid;
+ u32 gid;
struct nfsd4_deviceid deviceid;
stateid_t stateid;
struct nfs_fh fh;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 426/547] nfsd: preflight SEQUENCE replies before accepting a slot
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 425/547] NFSD: Map flex file layout IDs through the requests user namespace Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 427/547] nfsd: propagate SETXATTR value decode errors Greg Kroah-Hartman
` (129 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Mayank Jangid (OpenSec Intelligence), Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 35ff1a7a7e3835c3e974bc5c45d335897564ceae upstream.
nfsd4_sequence() narrows the reply buffer to the session's cached
reply limit before it accepts the slot seqid. A client may negotiate
ca_maxresponsesize_cached down to NFSD_MIN_HDR_SEQ_SZ, and
nfsd4_alloc_slot() then gives every slot a zero-length sl_data[]. A
COMPOUND tag can fill that narrowed buffer until it holds the
SEQUENCE opcode but not the status word that follows.
nfsd4_encode_operation() returns without running
nfsd4_encode_sequence(), so cstate.data_offset stays zero. It leaves
op->status at nfs_ok as well, so the COMPOUND is treated as having
succeeded.
nfsd4_store_cache_entry() declines to cache a lone SEQUENCE that
returned an error. That test reads the status the operation
reported, so it passes here. The copy starts at offset zero and
takes the whole reply, RPC and COMPOUND headers included, into the
zero-length sl_data[]. The COMPOUND tag is copied along with it, so
the client picks most of the bytes written past the end of the slot:
BUG: KASAN: slab-out-of-bounds in read_bytes_from_xdr_buf+0x1bc/0x390
Write of size 80 at addr ffff888003a549cd by task kunit_try_catch/24
__asan_memcpy+0x38/0x60
read_bytes_from_xdr_buf+0x1bc/0x390
nfsd4_sequence_done+0x5b0/0x810
nfs4svc_encode_compoundres+0x1bf/0x240
Check that the fixed-size SEQUENCE result, plus room for a following
operation's error status, fits the negotiated limit before narrowing
the buffer and consuming the slot seqid. The slot and its reply
cache are left unchanged, as RFC 8881 Section 2.10.6.1.2 requires of
an error returned from SEQUENCE.
Fixes: 47ee52986472 ("nfsd4: adjust buflen to session channel limit")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Tested-by: Mayank Jangid (OpenSec Intelligence) <mayank.jangid.moon@gmail.com>
Link: https://patch.msgid.link/20260817-jean-v1-1-9e356596ab85@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5048,6 +5048,7 @@ __be32
nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
union nfsd4_op_u *u)
{
+ struct nfsd4_compoundargs *args = rqstp->rq_argp;
struct nfsd4_sequence *seq = &u->sequence;
struct nfsd4_compoundres *resp = rqstp->rq_resp;
struct xdr_stream *xdr = resp->xdr;
@@ -5057,6 +5058,7 @@ nfsd4_sequence(struct svc_rqst *rqstp, s
struct nfsd4_conn *conn;
__be32 status;
int buflen;
+ u32 maxlen, respsize;
struct net *net = SVC_NET(rqstp);
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
@@ -5134,7 +5136,22 @@ nfsd4_sequence(struct svc_rqst *rqstp, s
session->se_fchannel.maxresp_sz;
status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
nfserr_rep_too_big;
- if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
+ if (buflen < rqstp->rq_auth_slack)
+ goto out_put_session;
+ maxlen = buflen - rqstp->rq_auth_slack;
+
+ /*
+ * A SEQUENCE result too large for maxlen never reaches
+ * nfsd4_encode_sequence(), so cstate.data_offset stays zero and
+ * the reply cache overruns the slot.
+ */
+ respsize = nfsd4_max_reply(rqstp, &args->ops[0]);
+ if (!nfsd4_last_compound_op(rqstp))
+ respsize += COMPOUND_ERR_SLACK_SPACE;
+ if (xdr->buf->len + respsize > maxlen)
+ goto out_put_session;
+
+ if (xdr_restrict_buflen(xdr, maxlen))
goto out_put_session;
svc_reserve_auth(rqstp, buflen);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 427/547] nfsd: propagate SETXATTR value decode errors
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 426/547] nfsd: preflight SEQUENCE replies before accepting a slot Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 428/547] NFSD: Reject an oversized principal hash from nfsdcld Greg Kroah-Hartman
` (128 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit cfcfe0b38a66bbc4122c78a2b75e1b97b3534761 upstream.
nfsd4_decode_setxattr() stores the status returned while assembling a
non-empty attribute value, but then unconditionally returns nfs_ok. An
allocation failure can therefore leave a NULL value buffer paired with a
non-zero length and allow compound processing to continue.
Return the decoder status so that the operation stops on the original
error.
Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915125636.2849626-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2454,7 +2454,7 @@ nfsd4_decode_setxattr(struct nfsd4_compo
&setxattr->setxa_buf, size);
}
- return nfs_ok;
+ return status;
}
static __be32
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 428/547] NFSD: Reject an oversized principal hash from nfsdcld
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 427/547] nfsd: propagate SETXATTR value decode errors Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 429/547] NFSD: Resolve the recall-any mask names in the trace format Greg Kroah-Hartman
` (127 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit dbed9418c48906dae1a7bc328fb3bc0d0d0020c8 upstream.
__cld_pipe_inprogress_downcall() takes the principal hash length
from the daemon's GraceStart downcall without checking it against
the cc_princhash payload it describes, which holds at most
SHA256_DIGEST_SIZE bytes. The length is stored verbatim in the
reclaim record, and nfsd4_cld_check_v2() later hands it to memcmp()
against a digest array of SHA256_DIGEST_SIZE bytes on the stack. A
length up to U8_MAX reads past the end of that array, and the stray
bytes can only make the comparison fail, denying the client its
reclaim. The pipe is mode 0600 in rpc_pipefs, so the trigger is a
broken or hostile nfsdcld rather than an unprivileged task.
Reject a length larger than the wire field, as the existing check
on the client name length does.
Fixes: 6ee95d1c8991 ("nfsd: add support for upcall version 2")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-4-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4recover.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -728,6 +728,11 @@ __cld_pipe_inprogress_downcall(const str
name.len = namelen;
if (get_user(princhashlen, &ci->cc_princhash.cp_len))
return -EFAULT;
+ if (princhashlen > SHA256_DIGEST_SIZE) {
+ dprintk("%s: invalid princhashlen (%u)",
+ __func__, princhashlen);
+ return -EINVAL;
+ }
if (princhashlen > 0) {
princhashcopy = memdup_user(
&ci->cc_princhash.cp_data,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 429/547] NFSD: Resolve the recall-any mask names in the trace format
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 428/547] NFSD: Reject an oversized principal hash from nfsdcld Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 430/547] NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file Greg Kroah-Hartman
` (126 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Layton, Christoph Hellwig,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit c563a1f0679566d7d586802e5346591d0af8da78 upstream.
RCA4_TYPE_MASK_* are enum constants, so the preprocessor cannot fold
them into the print format that show_rca_mask() builds for the
nfsd_cb_recall_any event. Nothing declares an eval map for them
either, so trace_event_eval_update() has no substitution to apply at
module load, and the event's format file ships the enumerator names
verbatim. trace-cmd and perf cannot decode the bmval0 field.
Declare the eval maps for the nine mask bits show_rca_mask() decodes.
The format then carries the shift counts as integers, the same shape
the SUNRPC trace points already emit from their BIT() flag decoders.
Fixes: 638593be55c0 ("NFSD: add CB_RECALL_ANY tracepoints")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260818184151.31180-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/misc/nfs.h | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/include/trace/misc/nfs.h
+++ b/include/trace/misc/nfs.h
@@ -358,6 +358,16 @@ TRACE_DEFINE_ENUM(IOMODE_ANY);
{ IOMODE_RW, "RW" }, \
{ IOMODE_ANY, "ANY" })
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_RDATA_DLG);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_WDATA_DLG);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_DIR_DLG);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_FILE_LAYOUT);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_BLK_LAYOUT);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OBJ_LAYOUT_MIN);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OBJ_LAYOUT_MAX);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OTHER_LAYOUT_MIN);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OTHER_LAYOUT_MAX);
+
#define show_rca_mask(x) \
__print_flags(x, "|", \
{ BIT(RCA4_TYPE_MASK_RDATA_DLG), "RDATA_DLG" }, \
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 430/547] NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 429/547] NFSD: Resolve the recall-any mask names in the trace format Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 431/547] NFSD: Set nn->cld_net before registering the cld pipe Greg Kroah-Hartman
` (125 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jörg Sommer, NeilBrown,
Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 07649099cc8c449ea8d37d0e8d6b532fecb24bf8 upstream.
Commit 0ac903d1bfdc ("NFS: NFSERR_INVAL is not defined by NFSv2")
changed the status NFSD returns for an NFSv2 READ or WRITE of a
symlink or other non-regular file from NFSERR_INVAL to NFSERR_IO.
RFC 1094 defines neither an INVAL nor a SYMLINK status.
U-Boot's NFS client follows a symlink only when READ fails with
NFSERR_ISDIR or NFSERR_INVAL. Since that commit it cannot load a
boot image through a symlink exported by a Linux NFS server: the
load completes with zero bytes transferred.
Solaris returns NFSERR_ISDIR when the target of an NFSv2 READ or
WRITE is not a regular file. Return the same status from NFSD.
Other NFSv2 procedures continue to return NFSERR_IO.
Fixes: 0ac903d1bfdc ("NFS: NFSERR_INVAL is not defined by NFSv2")
Cc: stable@vger.kernel.org
Reported-by: Jörg Sommer <joerg@jo-so.de>
Closes: https://lore.kernel.org/linux-nfs/apE90ZRZB8IW_AiS@jo-so.de/
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260828231841.282003-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsproc.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -39,6 +39,21 @@ static __be32 nfsd_map_status(__be32 sta
return status;
}
+/*
+ * Because NFSv2 does not have an NFSERR_SYMLINK, Solaris returns
+ * NFSERR_ISDIR when the target of a READ or WRITE is any object
+ * that is not a regular file.
+ */
+static __be32 nfsd_map_io_status(__be32 status)
+{
+ switch (status) {
+ case nfserr_symlink:
+ case nfserr_wrong_type:
+ return nfserr_isdir;
+ }
+ return nfsd_map_status(status);
+}
+
static __be32
nfsd_proc_null(struct svc_rqst *rqstp)
{
@@ -237,7 +252,7 @@ nfsd_proc_read(struct svc_rqst *rqstp)
resp->status = fh_getattr(&resp->fh, &resp->stat);
else if (resp->status == nfserr_jukebox)
set_bit(RQ_DROPME, &rqstp->rq_flags);
- resp->status = nfsd_map_status(resp->status);
+ resp->status = nfsd_map_io_status(resp->status);
return rpc_success;
}
@@ -270,7 +285,7 @@ nfsd_proc_write(struct svc_rqst *rqstp)
resp->status = fh_getattr(&resp->fh, &resp->stat);
else if (resp->status == nfserr_jukebox)
set_bit(RQ_DROPME, &rqstp->rq_flags);
- resp->status = nfsd_map_status(resp->status);
+ resp->status = nfsd_map_io_status(resp->status);
return rpc_success;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 431/547] NFSD: Set nn->cld_net before registering the cld pipe
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 430/547] NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 432/547] NFSD: validate transport name in listener_set before serv creation Greg Kroah-Hartman
` (124 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 14996e662f3b734427e2d645cacffc27b779f7d1 upstream.
rpc_mkpipe_dentry() instantiates the pipe's dentry before it returns,
so the cld pipe can be opened as soon as nfsd4_cld_register_net() has
run. __nfsd4_init_cld_pipe() does not store the new cld_net in
nn->cld_net until after that call. cld_pipe_downcall() reaches the
cld_net only through that pointer and takes cn_lock without checking
it, so a write() that lands in the window oopses.
Store nn->cld_net once @cn is fully initialized and before the pipe is
registered, and clear it again when registration fails.
Fixes: f3f8014862d8 ("nfsd: add the infrastructure to handle the cld upcall")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-6-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4recover.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -937,18 +937,24 @@ __nfsd4_init_cld_pipe(struct net *net)
}
spin_lock_init(&cn->cn_lock);
INIT_LIST_HEAD(&cn->cn_list);
+#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
+ cn->cn_has_legacy = false;
+#endif
+
+ /*
+ * The pipe's methods reach @cn through nn->cld_net, so set
+ * it before the pipe can be opened.
+ */
+ nn->cld_net = cn;
ret = nfsd4_cld_register_net(net, cn->cn_pipe);
if (unlikely(ret))
goto err_destroy_data;
-#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
- cn->cn_has_legacy = false;
-#endif
- nn->cld_net = cn;
return 0;
err_destroy_data:
+ nn->cld_net = NULL;
rpc_destroy_pipe_data(cn->cn_pipe);
err:
kfree(cn);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 432/547] NFSD: validate transport name in listener_set before serv creation
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 431/547] NFSD: Set nn->cld_net before registering the cld pipe Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 433/547] nfsd: zero NFSv4 COMPOUND tag padding Greg Kroah-Hartman
` (123 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 421becdc5cf4d7d2fbda393e78ca76d25d277c0f upstream.
nfsd_nl_listener_set_doit() holds nfsd_mutex for the whole listener
teardown and rebuild. The code checks NFSD_A_SOCK_TRANSPORT_NAME for
presence only, and not for content. An arbitrary name therefore reaches
svc_xprt_create_from_sa(). There, a name that matches no registered class
calls request_module("svc%s", name). That call is a TASK_KILLABLE usermode
helper upcall, and it runs under nfsd_mutex.
Check the name against the classes that NFSD can create: tcp, udp and
rdma. The check goes in nfsd_nl_validate_listeners(), which runs before
the code takes nfsd_mutex. The rejection names the offending attribute
through extack, since -EPROTONOSUPPORT on its own does not say which
entry carried the bad name.
This narrows the upcall. It does not remove it. NFSD accepts "rdma"
without a condition, so on a kernel that does not build svcrdma the name
still reaches request_module("svcrdma") under nfsd_mutex. That is
necessary for the modular case, where the autoload is legitimate.
Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Link: https://syzkaller.appspot.com/bug?extid=c7eae0eb80858a2dba0f
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-2-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1992,6 +1992,23 @@ err_free_msg:
return err;
}
+/*
+ * Transport classes NFSD knows how to instantiate. Vetting the name here
+ * keeps a bogus string from reaching svc_xprt_create_from_sa(), where an
+ * unknown name triggers a request_module("svc%s", name) upcall under
+ * nfsd_mutex.
+ */
+static bool nfsd_nl_transport_supported(const char *name)
+{
+ static const char * const supported[] = { "tcp", "udp", "rdma" };
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(supported); i++)
+ if (!strcmp(name, supported[i]))
+ return true;
+ return false;
+}
+
/* Upper bound on the number of listeners a single request may carry. */
#define NFSD_NL_LISTENER_MAX 1024
@@ -2029,6 +2046,13 @@ static int nfsd_nl_validate_listeners(st
if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
return -EINVAL;
+ if (!nfsd_nl_transport_supported(nla_data(tb[NFSD_A_SOCK_TRANSPORT_NAME]))) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NFSD_A_SOCK_TRANSPORT_NAME],
+ "unsupported transport name");
+ return -EPROTONOSUPPORT;
+ }
+
sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(sa->sa_family))
return -EINVAL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 433/547] nfsd: zero NFSv4 COMPOUND tag padding
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 432/547] NFSD: validate transport name in listener_set before serv creation Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 434/547] SUNRPC: Copy the deferred RPC Call from the head buffer Greg Kroah-Hartman
` (122 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 3f1181cb09c85499286c7f462d93530b0ebcafcc upstream.
nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space
and skips directly to the aligned end of the field. xdr_reserve_space()
rounds the reservation up but does not initialize the padding bytes.
A remote client can choose a tag length that is not a multiple of four,
causing one to three stale bytes from the response page to be returned in
the COMPOUND reply.
Use xdr_encode_opaque_fixed() to copy the tag and clear its XDR padding.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915160049.3105481-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6788,8 +6788,7 @@ nfs4svc_encode_compoundres(struct svc_rq
*p++ = resp->cstate.status;
*p++ = htonl(resp->taglen);
- memcpy(p, resp->tag, resp->taglen);
- p += XDR_QUADLEN(resp->taglen);
+ p = xdr_encode_opaque_fixed(p, resp->tag, resp->taglen);
*p++ = htonl(resp->opcnt);
nfsd4_sequence_done(resp);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 434/547] SUNRPC: Copy the deferred RPC Call from the head buffer
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 433/547] nfsd: zero NFSv4 COMPOUND tag padding Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 435/547] SUNRPC: Do not credit control-record octets to the RPC stream Greg Kroah-Hartman
` (121 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kimi Security Team, Yilin Zhang,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 2192a56b0686599358909c3e12e9a366f5b5d452 upstream.
svc_defer() snapshots the RPC Call for replay once a pending cache
upcall resolves. It copies the Call starting (rq_arg.len -
head[0].iov_len) bytes before head[0].iov_base, a back-up that once
covered a transport header. No transport has had one since commit
983084b2672c ("SUNRPC: Remove svc_rqst::rq_xprt_hlen"), so the two
lengths are meant to be equal.
An RPCSEC_GSS Call breaks that assumption. Unwrapping the integrity
service truncates rq_arg.len by the length of the trailing checksum,
and unwrapping the privacy service leaves rq_arg.len short by an
amount the client sets with trailing bytes after the wrap token.
Neither adjusts head[0].iov_len. Both lengths are size_t, so the
subtraction underflows and the copy starts past head[0].iov_base.
Every deferred integrity Call replays a shifted snapshot.
A deferred replay skips GSS verification, so a shifted snapshot runs
as an authenticated Call. With the privacy service the offset is
client-chosen. A forged Call placed in that window, naming another
user's GSS context handle, runs under that identity.
Copy the Call from head[0].iov_base. Refuse to defer a Call whose
length runs past the head buffer, so the copy cannot read out of
bounds.
Fixes: 260c1d1298f6 ("svc: Add transport hdr size for defer/revisit")
Cc: stable@vger.kernel.org
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Reported-by: Yilin Zhang <yilinzhang@moonshot.ai>
Link: https://patch.msgid.link/20260902133101.48914-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc_xprt.c | 22 +++++++---------------
1 file changed, 7 insertions(+), 15 deletions(-)
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -1268,13 +1268,8 @@ static void svc_revisit(struct cache_def
}
/*
- * Save the request off for later processing. The request buffer looks
- * like this:
- *
- * <xprt-header><rpc-header><rpc-pagelist><rpc-tail>
- *
- * This code can only handle requests that consist of an xprt-header
- * and rpc-header.
+ * Save the request off for later processing. Only a Call that fits
+ * entirely in rq_arg.head[0] can be deferred.
*/
static struct cache_deferred_req *svc_defer(struct cache_req *req)
{
@@ -1287,8 +1282,11 @@ static struct cache_deferred_req *svc_de
dr = rqstp->rq_deferred;
rqstp->rq_deferred = NULL;
} else {
- size_t skip;
size_t size;
+
+ if (rqstp->rq_arg.len > rqstp->rq_arg.head[0].iov_len)
+ return NULL;
+
/* FIXME maybe discard if size too large */
size = sizeof(struct svc_deferred_req) + rqstp->rq_arg.len;
dr = kmalloc(size, GFP_KERNEL);
@@ -1302,9 +1300,7 @@ static struct cache_deferred_req *svc_de
dr->daddr = rqstp->rq_daddr;
dr->argslen = rqstp->rq_arg.len >> 2;
- /* back up head to the start of the buffer and copy */
- skip = rqstp->rq_arg.len - rqstp->rq_arg.head[0].iov_len;
- memcpy(dr->args, rqstp->rq_arg.head[0].iov_base - skip,
+ memcpy(dr->args, rqstp->rq_arg.head[0].iov_base,
dr->argslen << 2);
}
dr->xprt_ctxt = rqstp->rq_xprt_ctxt;
@@ -1327,17 +1323,13 @@ static noinline int svc_deferred_recv(st
trace_svc_defer_recv(dr);
- /* setup iov_base past transport header */
rqstp->rq_arg.head[0].iov_base = dr->args;
- /* The iov_len does not include the transport header bytes */
rqstp->rq_arg.head[0].iov_len = dr->argslen << 2;
rqstp->rq_arg.page_len = 0;
- /* The rq_arg.len includes the transport header bytes */
rqstp->rq_arg.len = dr->argslen << 2;
rqstp->rq_prot = dr->prot;
memcpy(&rqstp->rq_addr, &dr->addr, dr->addrlen);
rqstp->rq_addrlen = dr->addrlen;
- /* Save off transport header len in case we get deferred again */
rqstp->rq_daddr = dr->daddr;
rqstp->rq_xprt_ctxt = dr->xprt_ctxt;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 435/547] SUNRPC: Do not credit control-record octets to the RPC stream
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 434/547] SUNRPC: Copy the deferred RPC Call from the head buffer Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 436/547] SUNRPC: fix oversized GSS proxy token copy Greg Kroah-Hartman
` (120 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 129e7107b971009bc81643d23f3ab949f540d321 upstream.
svc_tcp_sock_recv_cmsg() receives up to two octets into a local
buffer, and returns that count for any record type other than
TLS_RECORD_TYPE_ALERT. Nothing reached the caller's buffer, but
svc_tcp_read_marker() adds the count to sk_tcplen and
svc_tcp_read_msg()'s caller adds it to sk_datalen. The RPC stream
advances over octets it never received. The fragment marker is
assembled from stale sk_marker octets. The message body comes from
pages nothing wrote.
A conforming client reaches this. RFC 8446 Section 4.6.3 lets either
peer send KeyUpdate once it has sent its Finished, and svcsock has no
rekey path. kTLS leaves the partially consumed record on ctx->rx_list,
so the body drains two octets per svc_tcp_recvfrom() call. Each pair
is credited the same way.
Return -EAGAIN for a record that is not an alert. That is what
svc_tcp_sock_process_cmsg()'s default arm returned before the receive
moved into a local buffer.
Fixes: bee47cb026e7 ("sunrpc: fix handling of server side tls alerts")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-1-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -289,8 +289,13 @@ svc_tcp_sock_recv_cmsg(struct socket *so
iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1,
alert_kvec.iov_len);
ret = sock_recvmsg(sock, &msg, MSG_DONTWAIT);
- if (ret > 0 &&
- tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) {
+ if (ret > 0) {
+ /* Returning the count would credit the RPC stream with
+ * octets that never reached the caller's buffer.
+ */
+ if (tls_get_record_type(sock->sk, &u.cmsg) !=
+ TLS_RECORD_TYPE_ALERT)
+ return -EAGAIN;
iov_iter_revert(&msg.msg_iter, ret);
ret = svc_tcp_sock_process_cmsg(sock, &msg, &u.cmsg, -EAGAIN);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 436/547] SUNRPC: fix oversized GSS proxy token copy
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 435/547] SUNRPC: Do not credit control-record octets to the RPC stream Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 437/547] sunrpc: honor the netlink unix_gid NEGATIVE flag Greg Kroah-Hartman
` (119 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 62319c2534b603b416fa2aa2f3ef18c311f75010 upstream.
gss_read_proxy_verf() allocates one page per token chunk, but it copies the
entire linear head of an RPC request into in_token->pages[0]. A UDP datagram
can leave more than PAGE_SIZE bytes in the linear head, so a large
RPCSEC_GSS INIT token overwrites following pages.
Copy the linear head in page-sized chunks before switching to the request
page array. The linear head itself can span multiple pages.
Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Assisted-by: Codex:gpt-5
Link: https://patch.msgid.link/20260910125120.3798995-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1085,10 +1085,11 @@ static int gss_read_proxy_verf(struct sv
}
length = min_t(unsigned int, inlen, (char *)xdr->end - (char *)xdr->p);
- if (length)
- memcpy(page_address(in_token->pages[0]), xdr->p, length);
+ for (to_offs = 0; to_offs < length; to_offs += PAGE_SIZE)
+ memcpy(page_address(in_token->pages[to_offs >> PAGE_SHIFT]),
+ (char *)xdr->p + to_offs,
+ min_t(unsigned int, length - to_offs, PAGE_SIZE));
inlen -= length;
-
to_offs = length;
from_offs = rqstp->rq_arg.page_base;
while (inlen) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 437/547] sunrpc: honor the netlink unix_gid NEGATIVE flag
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 436/547] SUNRPC: fix oversized GSS proxy token copy Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 438/547] SUNRPC: keep the first error in svc_register() Greg Kroah-Hartman
` (118 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ameer Hamza, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ameer Hamza <ameer.hamza@truenas.com>
commit 7bc856dfaa104bf2bc26abd40b53dbf857c2d5bc upstream.
The unix_gid netlink upcall protocol has an explicit
SUNRPC_A_UNIX_GID_NEGATIVE attribute for failed group lookups, and
mountd sends it, but sunrpc_nl_parse_one_unix_gid() only allocates
an empty group list for a flagged reply without propagating the
flag into the entry, so it installs a valid positive entry with
zero groups. Such an entry strips the uid of all supplementary
groups until it is refreshed or expires: the same defect the
previous patch fixes on the classic channel, on a transport that
can say "lookup failed" explicitly.
Set CACHE_NEGATIVE for flagged replies, as the netlink ip_map
path already does for its negative flag. An empty GIDS list
without the flag remains a positive entry.
Fixes: 0850e8603cd7 ("sunrpc: add netlink upcall for the auth.unix.gid cache")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Link: https://patch.msgid.link/20260814221953.108837-3-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcauth_unix.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -730,6 +730,8 @@ static int sunrpc_nl_parse_one_unix_gid(
boot.tv_sec;
if (tb[SUNRPC_A_UNIX_GID_NEGATIVE]) {
+ /* failed lookup: keep the credential's own groups */
+ set_bit(CACHE_NEGATIVE, &ug.h.flags);
ug.gi = groups_alloc(0);
if (!ug.gi)
return -ENOMEM;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 438/547] SUNRPC: keep the first error in svc_register()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 437/547] sunrpc: honor the netlink unix_gid NEGATIVE flag Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 439/547] sunrpc: pin gss module across auth_domain RCU free Greg Kroah-Hartman
` (117 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 9ed91d7c4698e611ea5bfca45076008def831fb3 upstream.
svc_register() assigns every pg_rpcbind_set() result to the same "error"
variable and returns the last one, so a later result erases an earlier
failure.
Keep the first error instead of the last.
Fixes: 642ee6b209c2 ("SUNRPC: Allow further customisation of RPC program registration")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-3-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1208,13 +1208,16 @@ int svc_register(const struct svc_serv *
struct svc_program *progp = &serv->sv_programs[p];
for (i = 0; i < progp->pg_nvers; i++) {
+ int ret;
- error = progp->pg_rpcbind_set(net, progp, i,
+ ret = progp->pg_rpcbind_set(net, progp, i,
family, proto, port);
- if (error < 0) {
+ if (ret < 0) {
printk(KERN_WARNING "svc: failed to register "
"%sv%u RPC service (errno %d).\n",
- progp->pg_name, i, -error);
+ progp->pg_name, i, -ret);
+ if (!error)
+ error = ret;
break;
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 439/547] sunrpc: pin gss module across auth_domain RCU free
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 438/547] SUNRPC: keep the first error in svc_register() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 440/547] SUNRPC: Reject a socket that already has an svc_sock attached Greg Kroah-Hartman
` (116 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit b64d21116374688c33302a6704387c27d1156d72 upstream.
A gss auth_domain stores a raw pointer to svcauthops_gss in
dom->flavour, and its release queues svcauth_gss_domain_release_rcu()
via call_rcu(). Both live in auth_rpcgss.ko text, and nothing pins the
module while a domain referencing it is reachable. rmmod auth_rpcgss
can therefore unmap that text while an NFSD export still holds a
reference to the domain.
The export cache is one such holder. When the export is finally
released, the domain reference drops from module text:
svc_export_put()
auth_domain_put(exp->ex_client)
auth_domain_release()
dom->flavour->domain_release(dom) /* into module text */
svcauth_gss_domain_release()
call_rcu(&dom->rcu_head,
svcauth_gss_domain_release_rcu)
Once auth_rpcgss is unloaded, the domain_release call lands in
unmapped memory. The rcu_barrier() in exit_rpcsec_gss() does not
help: it waits only for callbacks already queued, and this one is
not queued until the export goes away.
NFSD's NFSv4 objects import symbols from auth_rpcgss.ko, so only a
server built without CONFIG_NFSD_V4 can unload auth_rpcgss while
exports still name a gss domain.
Take a module reference in svcauth_gss_register_pseudoflavor() before
publishing the domain and drop it at the end of
svcauth_gss_domain_release_rcu(). The rcu_barrier() then holds the
module image until this callback has returned.
Fixes: 608a0ab2f54a ("SUNRPC: Add lockless lookup of the server's auth domain")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
[ cel: rewrote description ]
Link: https://patch.msgid.link/20260913160706.384180-1-cel@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -824,12 +824,18 @@ svcauth_gss_register_pseudoflavor(u32 ps
new->h.flavour = &svcauthops_gss;
new->pseudoflavor = pseudoflavor;
+ if (!try_module_get(svcauthops_gss.owner)) {
+ stat = -ENODEV;
+ goto out_free_name;
+ }
+
test = auth_domain_lookup(name, &new->h);
if (test != &new->h) {
pr_warn("svc: duplicate registration of gss pseudo flavour %s.\n",
name);
stat = -EADDRINUSE;
auth_domain_put(test);
+ module_put(svcauthops_gss.owner);
goto out_free_name;
}
return test;
@@ -2004,9 +2010,11 @@ svcauth_gss_domain_release_rcu(struct rc
{
struct auth_domain *dom = container_of(head, struct auth_domain, rcu_head);
struct gss_domain *gd = container_of(dom, struct gss_domain, h);
+ struct module *owner = dom->flavour->owner;
kfree(dom->name);
kfree(gd);
+ module_put(owner);
}
static void
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 440/547] SUNRPC: Reject a socket that already has an svc_sock attached
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 439/547] sunrpc: pin gss module across auth_domain RCU free Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 441/547] SUNRPC: Reject a TLS alert record that is not two octets Greg Kroah-Hartman
` (115 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+54cdc566f64abf51b7f1,
Jeff Layton, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 0995447b8059c4d23853cdcddbe789c4a2b6bb88 upstream.
Writing the same socket descriptor to /proc/fs/nfsd/portlist twice
attaches a second svc_sock to one socket. svc_setup_socket() saves
the socket's callbacks before installing its own, so the second
attach records svc_write_space() as the old write_space callback.
svc_udp_init() invokes that callback by way of svc_sock_setbufsize(),
and svc_write_space() then calls itself until the kernel stack is
exhausted:
BUG: TASK stack guard page was hit at ffffc900037d7ff8
svc_write_space+0x90/0x2b0 net/sunrpc/svcsock.c:429
svc_write_space+0xe6/0x2b0 net/sunrpc/svcsock.c:430
... 700 more ...
svc_sock_setbufsize+0x18d/0x220 net/sunrpc/svcsock.c:386
svc_udp_init net/sunrpc/svcsock.c:854 [inline]
svc_setup_socket+0xb2f/0x1090 net/sunrpc/svcsock.c:1498
svc_addsock+0x2fd/0x760 net/sunrpc/svcsock.c:1547
__write_ports_addfd fs/nfsd/nfsctl.c:742 [inline]
write_ports+0xa5b/0xcc0 fs/nfsd/nfsctl.c:861
nfsctl_transaction_write+0x106/0x1a0 fs/nfsd/nfsctl.c:112
svc_data_ready() and svc_tcp_state_change() chain through their saved
callbacks the same way, so a TCP descriptor added twice recurses on
the next incoming segment instead. Reaching any of this takes a
writer on portlist, and the nfsd filesystem sets no FS_USERNS_MOUNT,
so the reproducer needs CAP_SYS_ADMIN in the initial user namespace.
Reject a socket that already carries sk_user_data. svc_setup_socket()
overwrites that field unconditionally, so a socket some other
consumer has claimed is one NFSD would corrupt whether or not the
callbacks recurse.
Fixes: b41b66d63c73 ("[PATCH] knfsd: allow sockets to be passed to nfsd via 'portlist'")
Cc: stable@vger.kernel.org
Reported-by: syzbot+54cdc566f64abf51b7f1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=54cdc566f64abf51b7f1
Link: https://patch.msgid.link/20260815162844.8219-1-cel@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1546,6 +1546,9 @@ int svc_addsock(struct svc_serv *serv, s
err = -EISCONN;
if (so->state > SS_UNCONNECTED)
goto out;
+ err = -EBUSY;
+ if (so->sk->sk_user_data)
+ goto out;
err = -ENOENT;
if (!try_module_get(THIS_MODULE))
goto out;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 441/547] SUNRPC: Reject a TLS alert record that is not two octets
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 440/547] SUNRPC: Reject a socket that already has an svc_sock attached Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 442/547] SUNRPC: Resume receiving after a TLS control record Greg Kroah-Hartman
` (114 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit d16bebe45272ced4f962d27b9efd8b32a3876bd9 upstream.
tls_alert_recv() reads two octets from the kvec it is handed and does
not check the length (net/handshake/alert.c). svc_tcp_sock_recv_cmsg()
calls it for any positive receive, and the alert[] buffer it supplies
carries no initializer. A one-octet alert body leaves the description
read from uninitialized stack and reported through
trace_tls_alert_recv().
The peer controls that length. Neither tls_rx_msg_size() nor
tls_rx_one_record() enforces the two-octet Alert payload. A TLS 1.3
record carrying only the inner content-type octet decrypts to a
zero-length payload. RFC 8446 Section 5.1 requires a record with an
Alert type to carry exactly one message, so any other length is
malformed.
Require exactly two octets before parsing and return -EBADMSG
otherwise. That closes the transport rather than acting on a partly
uninitialized alert. Gate the path on a control message rather than a
positive count so that a zero-length record reaches the check.
Fixes: bee47cb026e7 ("sunrpc: fix handling of server side tls alerts")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-2-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -289,13 +289,23 @@ svc_tcp_sock_recv_cmsg(struct socket *so
iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1,
alert_kvec.iov_len);
ret = sock_recvmsg(sock, &msg, MSG_DONTWAIT);
- if (ret > 0) {
+ /* put_cmsg() shrinks msg_controllen, so a short one means
+ * kTLS filled in u.cmsg.
+ */
+ if (ret >= 0 && msg.msg_controllen < sizeof(u)) {
/* Returning the count would credit the RPC stream with
* octets that never reached the caller's buffer.
*/
if (tls_get_record_type(sock->sk, &u.cmsg) !=
TLS_RECORD_TYPE_ALERT)
return -EAGAIN;
+ /* An Alert record carries exactly one two-octet message
+ * (RFC 8446 Section 5.1). alert_kvec caps the receive at two,
+ * so a longer record produces the same count. MSG_EOR appears
+ * only once kTLS has drained the whole record.
+ */
+ if (ret != sizeof(alert) || !(msg.msg_flags & MSG_EOR))
+ return -EBADMSG;
iov_iter_revert(&msg.msg_iter, ret);
ret = svc_tcp_sock_process_cmsg(sock, &msg, &u.cmsg, -EAGAIN);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 442/547] SUNRPC: Resume receiving after a TLS control record
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 441/547] SUNRPC: Reject a TLS alert record that is not two octets Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 443/547] SUNRPC: trace an accepted transport before publishing it Greg Kroah-Hartman
` (113 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 8079c660b247f282340fbe7f55cf8a354009db9e upstream.
A TLS control record delivers no payload to the RPC layer.
svc_tcp_recvfrom() clears XPT_DATA before the receive, and
svc_tcp_sock_recv_cmsg() returns -EAGAIN for the record it consumed.
Nothing marks the transport ready again. kTLS raises data_ready for
arriving TCP segments, not for records it has already decrypted. An
RPC Call queued behind an alert or a KeyUpdate waits until the client
sends more. The client blocks until its RPC timeout expires.
The receive takes only the first two octets of the record. kTLS holds
the remainder on its receive list, where each later receive takes two
octets more.
Drain a record that is not an alert, then mark the transport ready
once a control record has been consumed.
Fixes: 5e052dda121e ("SUNRPC: Recognize control messages in server-side TCP socket code")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-4-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 52 insertions(+), 3 deletions(-)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -238,6 +238,39 @@ static int svc_one_sock_name(struct svc_
return len;
}
+/*
+ * kTLS delivers a record only up to the caller's buffer and keeps
+ * the remainder on its receive list, where no further data_ready
+ * announces it. Consume the whole record.
+ */
+static void
+svc_tcp_sock_drain_record(struct socket *sock)
+{
+ union {
+ struct cmsghdr cmsg;
+ u8 buf[CMSG_SPACE(sizeof(u8))];
+ } u;
+ u8 discard[64];
+ struct kvec discard_kvec = {
+ .iov_base = discard,
+ .iov_len = sizeof(discard),
+ };
+
+ for (;;) {
+ struct msghdr msg = {
+ .msg_control = &u,
+ .msg_controllen = sizeof(u),
+ };
+
+ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &discard_kvec, 1,
+ discard_kvec.iov_len);
+ if (sock_recvmsg(sock, &msg, MSG_DONTWAIT) <= 0)
+ break;
+ if (msg.msg_flags & MSG_EOR)
+ break;
+ }
+}
+
static int
svc_tcp_sock_process_cmsg(struct socket *sock, struct msghdr *msg,
struct cmsghdr *cmsg, int ret)
@@ -293,12 +326,20 @@ svc_tcp_sock_recv_cmsg(struct socket *so
* kTLS filled in u.cmsg.
*/
if (ret >= 0 && msg.msg_controllen < sizeof(u)) {
+ u8 content_type = tls_get_record_type(sock->sk, &u.cmsg);
+
/* Returning the count would credit the RPC stream with
* octets that never reached the caller's buffer.
*/
- if (tls_get_record_type(sock->sk, &u.cmsg) !=
- TLS_RECORD_TYPE_ALERT)
+ if (content_type != TLS_RECORD_TYPE_ALERT) {
+ /* An application data record carries RPC payload.
+ * Draining one breaks RPC fragment framing.
+ */
+ if (content_type != TLS_RECORD_TYPE_DATA &&
+ !(msg.msg_flags & MSG_EOR))
+ svc_tcp_sock_drain_record(sock);
return -EAGAIN;
+ }
/* An Alert record carries exactly one two-octet message
* (RFC 8446 Section 5.1). alert_kvec caps the receive at two,
* so a longer record produces the same count. MSG_EOR appears
@@ -321,8 +362,16 @@ svc_tcp_sock_recvmsg(struct svc_sock *sv
ret = sock_recvmsg(sock, msg, MSG_DONTWAIT);
if (msg->msg_flags & MSG_CTRUNC) {
msg->msg_flags &= ~(MSG_CTRUNC | MSG_EOR);
- if (ret == 0 || ret == -EIO)
+ if (ret == 0 || ret == -EIO) {
ret = svc_tcp_sock_recv_cmsg(sock, &msg->msg_flags);
+ /* A control record delivers nothing to the caller,
+ * and kTLS announces no data_ready for records it
+ * already holds. Mark the transport ready so that
+ * the records behind this one can be received.
+ */
+ if (ret == -EAGAIN)
+ set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+ }
}
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 443/547] SUNRPC: trace an accepted transport before publishing it
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 442/547] SUNRPC: Resume receiving after a TLS control record Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 444/547] sunrpc: treat empty auth.unix.gid replies as negative entries Greg Kroah-Hartman
` (112 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, VEGA, Zhiling Zou, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit 06f90cf104fc21ee01e7ef1eb80e092173089b9f upstream.
svc_handle_xprt() publishes a newly accepted transport before tracing
it. svc_add_new_temp_xprt() places the transport on sv_tempsocks and
clears XPT_BUSY, so another nfsd thread can dequeue it at once. If the
peer has already closed the connection, that thread runs
svc_delete_xprt(), which drops the list reference, the only reference
the new transport holds. trace_svc_xprt_accept() then reads the
transport's addresses and network namespace from freed memory.
Before publication the accepting thread owns the transport
exclusively: XPT_BUSY is still set from svc_xprt_init() and the
transport is on no list. Emit the tracepoint there.
Fixes: 11bbb0f76e99 ("SUNRPC: Trace a few more generic svc_xprt events")
Cc: stable@vger.kernel.org
Reported-by: VEGA <vega@nebusec.ai>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Link: https://patch.msgid.link/d15495bff2247e3f9d4f9ef36df8e246a3898380.1789220778.git.zhilinz@nebusec.ai
[ cel: trace before publication instead of taking an extra reference ]
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc_xprt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -852,8 +852,8 @@ static void svc_handle_xprt(struct svc_r
newxpt = xprt->xpt_ops->xpo_accept(xprt);
if (newxpt) {
newxpt->xpt_cred = get_cred(xprt->xpt_cred);
- svc_add_new_temp_xprt(serv, newxpt);
trace_svc_xprt_accept(newxpt, serv->sv_name);
+ svc_add_new_temp_xprt(serv, newxpt);
} else {
module_put(xprt->xpt_class->xcl_owner);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 444/547] sunrpc: treat empty auth.unix.gid replies as negative entries
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 443/547] SUNRPC: trace an accepted transport before publishing it Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 445/547] SUNRPC: Treat every TLS error alert as fatal Greg Kroah-Hartman
` (111 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ameer Hamza, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ameer Hamza <ameer.hamza@truenas.com>
commit a12cc0930235b86b934ade7c077a1935c2ac333d upstream.
When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
failure, e.g. while winbind or sssd is briefly unreachable), it
answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
installs that as a valid positive entry, and svcauth_unix_set_client()
then replaces the credential's group list with the empty one on
every request, RPCSEC_GSS included via svcauth_gss_set_client().
One failed lookup strips that uid of all supplementary groups on
every export for up to mountd's configured TTL (30 minutes by
default), long after the NSS backend has recovered.
mountd cannot send an empty list for a successful lookup, since
getgrouplist(3) always includes at least the user's primary group,
so a zero-group reply can only mean the lookup failed. Record it as
a negative entry: unix_gid_find() then returns -ENOENT and
svcauth_unix_set_client() keeps the groups the RPC credential
already carries. This is the fallback that
commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
gid list when using AUTH_UNIX authentication") promised when no
answer is available, and the same state try_to_negate_entry()
already creates when no listener holds the channel open.
Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid list when using AUTH_UNIX authentication")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Link: https://patch.msgid.link/20260814221953.108837-2-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcauth_unix.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -540,6 +540,13 @@ static int unix_gid_parse(struct cache_d
if (ugp) {
struct cache_head *ch;
ug.h.flags = 0;
+ /*
+ * mountd sends at least the user's primary group on
+ * success, so an empty list can only mean the lookup
+ * failed. Keep the credential's own groups instead.
+ */
+ if (gids == 0)
+ set_bit(CACHE_NEGATIVE, &ug.h.flags);
ug.h.expiry_time = expiry;
ch = sunrpc_cache_update(cd,
&ug.h, &ugp->h,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 445/547] SUNRPC: Treat every TLS error alert as fatal
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 444/547] sunrpc: treat empty auth.unix.gid replies as negative entries Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 446/547] rxrpc: Fix update of call->tx_pending without holding lock Greg Kroah-Hartman
` (110 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 2c0dfe9d6d81e4bc9201b11dab3876cbfd01884e upstream.
svc_tcp_sock_process_cmsg() decides whether an alert ends the session
by reading the alert's level octet. RFC 8446 Section 6 retired that
field. The severity is implicit in the description, and a receiver
treats every alert listed in Section 6.2 as an error alert
"regardless of the AlertLevel in the message". A peer that aborts
with unexpected_message but leaves the legacy octet set to warning
makes the server return -EAGAIN. svc_tcp_recvfrom() then leaves a
dead TLS session attached to an open transport. NFSD keeps polling
it.
Decide from the alert description instead. close_notify and
user_canceled are the closure alerts (RFC 8446 Section 6.1). Every
other description ends the session, including one this kernel does
not recognize.
Fixes: 39067dda1d86 ("SUNRPC: Use new helpers to handle TLS Alerts")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-3-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -290,8 +290,17 @@ svc_tcp_sock_process_cmsg(struct socket
break;
case TLS_RECORD_TYPE_ALERT:
tls_alert_recv(sock->sk, msg, &level, &description);
- ret = (level == TLS_ALERT_LEVEL_FATAL) ?
- -ENOTCONN : -EAGAIN;
+ /* RFC 8446 Section 6: every alert but a closure alert is
+ * an error alert.
+ */
+ switch (description) {
+ case TLS_ALERT_DESC_CLOSE_NOTIFY:
+ case TLS_ALERT_DESC_USER_CANCELED:
+ ret = -EAGAIN;
+ break;
+ default:
+ ret = -ENOTCONN;
+ }
break;
default:
/* discard this record type */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 446/547] rxrpc: Fix update of call->tx_pending without holding lock
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 445/547] SUNRPC: Treat every TLS error alert as fatal Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 447/547] rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data() Greg Kroah-Hartman
` (109 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Eric Dumazet, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-afs
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 7801c42c3bb737cfb06194a383873fcad8daacf5 upstream.
Currently, rxrpc_send_data() updates call->tx_pending just before it
returns - but it won't be holding the call->user_mutex when it does this if
a wait was interrupted by a signal. This would allow a parallel sendmsg()
to race.
Further, both the callers of rxrpc_send_data() call it with the lock held,
and then it returns an indication through the parameter list to say whether
it has dropped the lock or not - after which the callers both just drop the
lock if it's still held.
Fix this by:
(1) Moving the release of call->user_mutex down into rxrpc_send_data() and
get rid of the indicator parameter. This makes it easier to see where
the lock is held.
(2) After waiting, if the attempt to reacquire the mutex is interrupted,
just return directly there rather than going to out_unlock
(3) Restricting the txb variable to inside the buffering loop and leaving
->tx_pending set until we've queued the buffer.
Note that there's a slight change in behaviour in that wait_for_space
failure now doesn't check for completion because it doesn't hold the call
user_mutex. The caller, however, should re-issue the send and pick up any
error at a second attempt.
Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg")
Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-4-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rxrpc/sendmsg.c | 63 +++++++++++++++++++++++-----------------------------
1 file changed, 29 insertions(+), 34 deletions(-)
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -320,10 +320,9 @@ static int rxrpc_alloc_txqueue(struct so
static int rxrpc_send_data(struct rxrpc_sock *rx,
struct rxrpc_call *call,
struct msghdr *msg, size_t len,
- rxrpc_notify_end_tx_t notify_end_tx,
- bool *_dropped_lock)
+ rxrpc_notify_end_tx_t notify_end_tx)
+ __releases(&call->user_mutex)
{
- struct rxrpc_txbuf *txb;
struct sock *sk = &rx->sk;
enum rxrpc_call_state state;
long timeo;
@@ -334,30 +333,26 @@ static int rxrpc_send_data(struct rxrpc_
trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send,
call->cid, call->call_id, call->rx_consumed,
0, -EPROTO);
- return -EPROTO;
+ ret = -EPROTO;
+ goto out_unlock;
}
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
ret = rxrpc_wait_to_be_connected(call, &timeo);
if (ret < 0)
- return ret;
+ goto out_unlock;
if (call->conn->state == RXRPC_CONN_CLIENT_UNSECURED) {
ret = rxrpc_init_client_conn_security(call->conn);
if (ret < 0)
- return ret;
+ goto out_unlock;
}
/* this should be in poll */
sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
reload:
- txb = call->tx_pending;
- call->tx_pending = NULL;
- if (txb)
- rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
-
ret = -EPIPE;
if (sk->sk_shutdown & SEND_SHUTDOWN)
goto maybe_error;
@@ -386,6 +381,8 @@ reload:
}
do {
+ struct rxrpc_txbuf *txb = call->tx_pending;
+
if (!txb) {
size_t remain;
@@ -411,6 +408,9 @@ reload:
ret = -ENOMEM;
goto maybe_error;
}
+ call->tx_pending = txb;
+ } else {
+ rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
}
_debug("append");
@@ -445,9 +445,9 @@ reload:
ret = call->security->secure_packet(call, txb);
if (ret < 0)
- goto out;
+ goto out_unlock;
rxrpc_queue_packet(rx, call, txb, notify_end_tx);
- txb = NULL;
+ call->tx_pending = NULL;
}
} while (msg_data_left(msg) > 0);
@@ -456,45 +456,46 @@ success:
if (rxrpc_call_is_complete(call) &&
call->error < 0)
ret = call->error;
-out:
- call->tx_pending = txb;
+out_unlock:
+ mutex_unlock(&call->user_mutex);
_leave(" = %d", ret);
return ret;
call_terminated:
- rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted);
- _leave(" = %d", call->error);
- return call->error;
+ ret = call->error;
+ goto out_unlock;
maybe_error:
if (copied)
goto success;
- goto out;
+ goto out_unlock;
efault:
ret = -EFAULT;
- goto out;
+ goto out_unlock;
wait_for_space:
ret = -EAGAIN;
if (msg->msg_flags & MSG_DONTWAIT)
goto maybe_error;
mutex_unlock(&call->user_mutex);
- *_dropped_lock = true;
+
ret = rxrpc_wait_for_tx_window(rx, call, &timeo,
msg->msg_flags & MSG_WAITALL);
if (ret < 0)
- goto maybe_error;
+ goto out_nolock;
if (call->interruptibility == RXRPC_INTERRUPTIBLE) {
if (mutex_lock_interruptible(&call->user_mutex) < 0) {
ret = sock_intr_errno(timeo);
- goto maybe_error;
+ goto out_nolock;
}
} else {
mutex_lock(&call->user_mutex);
}
- *_dropped_lock = false;
goto reload;
+out_nolock:
+ _leave(" = %d [intr]", ret);
+ return copied ?: ret;
}
/*
@@ -660,7 +661,6 @@ rxrpc_new_client_call_for_sendmsg(struct
int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
{
struct rxrpc_call *call;
- bool dropped_lock = false;
int ret;
struct rxrpc_send_params p = {
@@ -769,16 +769,15 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *
ret = 0;
break;
case RXRPC_CMD_SEND_DATA:
- ret = rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock);
- break;
+ ret = rxrpc_send_data(rx, call, msg, len, NULL);
+ goto error_put;
default:
ret = -EINVAL;
break;
}
out_put_unlock:
- if (!dropped_lock)
- mutex_unlock(&call->user_mutex);
+ mutex_unlock(&call->user_mutex);
error_put:
rxrpc_put_call(call, rxrpc_call_put_sendmsg);
_leave(" = %d", ret);
@@ -808,7 +807,6 @@ int rxrpc_kernel_send_data(struct socket
struct msghdr *msg, size_t len,
rxrpc_notify_end_tx_t notify_end_tx)
{
- bool dropped_lock = false;
int ret;
_enter("{%d},", call->debug_id);
@@ -819,12 +817,9 @@ int rxrpc_kernel_send_data(struct socket
mutex_lock(&call->user_mutex);
ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len,
- notify_end_tx, &dropped_lock);
+ notify_end_tx);
if (ret == -ESHUTDOWN)
ret = call->error;
-
- if (!dropped_lock)
- mutex_unlock(&call->user_mutex);
_leave(" = %d", ret);
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 447/547] rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 446/547] rxrpc: Fix update of call->tx_pending without holding lock Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 448/547] afs: Fix afs to abort the rxrpc call on send error Greg Kroah-Hartman
` (108 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Laight, David Howells,
Marc Dionne, Eric Dumazet, David S. Miller, Jakub Kicinski,
Paolo Abeni, Simon Horman, linux-afs
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit af208f36ae22440cf6011a43cb3064fd525d85b4 upstream.
Fix rxrpc_kernel_send_data() to loop around if it detects a short send.
David Laight suggested doing it here rather than wrapping all the calls in
loops. Further, remove the len argument and use the iterator count instead
and return 0 on success, not the amount copied.
Note this is also a prerequisite for changing the way rxrpc_send_data()
works to return a short send rather than an error if some data was
buffered.
Fixes: 651350d10f93 ("[AF_RXRPC]: Add an interface to the AF_RXRPC module for the AFS filesystem to use")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-5-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/networking/rxrpc.rst | 8 +++++---
fs/afs/rxrpc.c | 32 +++++++++++++-------------------
include/net/af_rxrpc.h | 5 ++---
net/rxrpc/rxperf.c | 25 ++++++++++---------------
net/rxrpc/sendmsg.c | 27 +++++++++++++++++++--------
5 files changed, 49 insertions(+), 48 deletions(-)
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -870,7 +870,6 @@ The kernel interface functions are as fo
int rxrpc_kernel_send_data(struct socket *sock,
struct rxrpc_call *call,
struct msghdr *msg,
- size_t len,
rxrpc_notify_end_tx_t notify_end_rx);
This is used to supply either the request part of a client call or the
@@ -879,14 +878,17 @@ The kernel interface functions are as fo
exclusively to in-kernel virtual addresses. msg.msg_flags may be given
MSG_MORE if there will be subsequent data sends for this call.
- The msg must not specify a destination address, control data or any flags
- other than MSG_MORE. len is the total amount of data to transmit.
+ msg must not specify a destination address, control data or any flags
+ other than MSG_MORE or MSG_WAITALL.
notify_end_rx can be NULL or it can be used to specify a function to be
called when the call changes state to end the Tx phase. This function is
called with a spinlock held to prevent the last DATA packet from being
transmitted until the function returns.
+ It returns 0 if all the provided data has been buffered and a negative
+ error code on failure.
+
(#) Receive data from a call::
int rxrpc_kernel_recv_data(struct socket *sock,
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -412,8 +412,7 @@ void afs_make_call(struct afs_call *call
msg.msg_controllen = 0;
msg.msg_flags = MSG_WAITALL | (call->write_iter ? MSG_MORE : 0);
- ret = rxrpc_kernel_send_data(call->net->socket, rxcall,
- &msg, call->request_size,
+ ret = rxrpc_kernel_send_data(call->net->socket, rxcall, &msg,
afs_notify_end_request_tx);
if (ret < 0)
goto error_do_abort;
@@ -425,7 +424,6 @@ void afs_make_call(struct afs_call *call
ret = rxrpc_kernel_send_data(call->net->socket,
call->rxcall, &msg,
- iov_iter_count(&msg.msg_iter),
afs_notify_end_request_tx);
*call->write_iter = msg.msg_iter;
@@ -871,7 +869,7 @@ void afs_send_empty_reply(struct afs_cal
msg.msg_controllen = 0;
msg.msg_flags = 0;
- switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0,
+ switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
afs_notify_end_reply_tx)) {
case 0:
_leave(" [replied]");
@@ -897,7 +895,7 @@ void afs_send_simple_reply(struct afs_ca
struct afs_net *net = call->net;
struct msghdr msg;
struct kvec iov[1];
- int n;
+ int ret;
_enter("");
@@ -912,21 +910,17 @@ void afs_send_simple_reply(struct afs_ca
msg.msg_controllen = 0;
msg.msg_flags = 0;
- n = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, len,
- afs_notify_end_reply_tx);
- if (n >= 0) {
- /* Success */
- _leave(" [replied]");
- return;
- }
-
- if (n == -ENOMEM) {
- _debug("oom");
- rxrpc_kernel_abort_call(net->socket, call->rxcall,
- RXGEN_SS_MARSHAL, -ENOMEM,
- afs_abort_oom);
+ ret = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
+ afs_notify_end_reply_tx);
+ if (ret < 0) {
+ if (ret == -ENOMEM) {
+ _debug("oom");
+ rxrpc_kernel_abort_call(net->socket, call->rxcall,
+ RXGEN_SS_MARSHAL, -ENOMEM,
+ afs_abort_oom);
+ }
+ _leave(" [error]");
}
- _leave(" [error]");
}
/*
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -64,9 +64,8 @@ struct rxrpc_call *rxrpc_kernel_begin_ca
bool upgrade,
enum rxrpc_interruptibility interruptibility,
unsigned int debug_id);
-int rxrpc_kernel_send_data(struct socket *, struct rxrpc_call *,
- struct msghdr *, size_t,
- rxrpc_notify_end_tx_t);
+int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
+ struct msghdr *msg, rxrpc_notify_end_tx_t notify_end_tx);
int rxrpc_kernel_recv_data(struct socket *, struct rxrpc_call *,
struct iov_iter *, size_t *, bool, u32 *, u16 *);
bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *,
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -513,8 +513,8 @@ static int rxperf_process_call(struct rx
struct msghdr msg = {};
struct bio_vec bv;
struct kvec iov[1];
- ssize_t n;
size_t reply_len = call->reply_len, len;
+ int ret;
rxrpc_kernel_set_tx_length(rxperf_socket, call->rxcall,
reply_len + sizeof(rxperf_magic_cookie));
@@ -524,13 +524,11 @@ static int rxperf_process_call(struct rx
bvec_set_page(&bv, ZERO_PAGE(0), len, 0);
iov_iter_bvec(&msg.msg_iter, WRITE, &bv, 1, len);
msg.msg_flags = MSG_MORE;
- n = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg,
- len, rxperf_notify_end_reply_tx);
- if (n < 0)
- return n;
- if (n == 0)
- return -EIO;
- reply_len -= n;
+ ret = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg,
+ rxperf_notify_end_reply_tx);
+ if (ret < 0)
+ return ret;
+ reply_len -= len;
}
len = sizeof(rxperf_magic_cookie);
@@ -538,16 +536,13 @@ static int rxperf_process_call(struct rx
iov[0].iov_len = len;
iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, len);
msg.msg_flags = 0;
- n = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, len,
- rxperf_notify_end_reply_tx);
- if (n >= 0)
- return 0; /* Success */
-
- if (n == -ENOMEM)
+ ret = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg,
+ rxperf_notify_end_reply_tx);
+ if (ret == -ENOMEM)
rxrpc_kernel_abort_call(rxperf_socket, call->rxcall,
RXGEN_SS_MARSHAL, -ENOMEM,
rxperf_abort_oom);
- return n;
+ return ret;
}
/*
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -793,7 +793,6 @@ error_release_sock:
* @sock: The socket the call is on
* @call: The call to send data through
* @msg: The data to send
- * @len: The amount of data to send
* @notify_end_tx: Notification that the last packet is queued.
*
* Allow a kernel service to send data on a call. The call must be in an state
@@ -804,8 +803,7 @@ error_release_sock:
* Return: %0 if successful and a negative error code otherwise.
*/
int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
- struct msghdr *msg, size_t len,
- rxrpc_notify_end_tx_t notify_end_tx)
+ struct msghdr *msg, rxrpc_notify_end_tx_t notify_end_tx)
{
int ret;
@@ -814,12 +812,25 @@ int rxrpc_kernel_send_data(struct socket
ASSERTCMP(msg->msg_name, ==, NULL);
ASSERTCMP(msg->msg_control, ==, NULL);
- mutex_lock(&call->user_mutex);
+ for (;;) {
+ mutex_lock(&call->user_mutex);
+
+ ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg,
+ msg_data_left(msg), notify_end_tx);
+ if (ret == -ESHUTDOWN)
+ ret = call->error;
+ if (ret < 0)
+ break;
+ if (msg_data_left(msg) == 0) {
+ ret = 0;
+ break;
+ }
+ if (ret == 0) {
+ ret = -EIO;
+ break;
+ }
+ }
- ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len,
- notify_end_tx);
- if (ret == -ESHUTDOWN)
- ret = call->error;
_leave(" = %d", ret);
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 448/547] afs: Fix afs to abort the rxrpc call on send error
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 447/547] rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 449/547] rxrpc: Fix double IRQ enablement Greg Kroah-Hartman
` (107 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Eric Dumazet, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-afs
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 3e6af08a571fe2943a006acf3e890f36322602bc upstream.
Fix afs_send_empty_reply() and afs_send_simple_reply() to always try to
abort the rxrpc call rather than just aborting on -ENOMEM and otherwise
abandoning it. If the call is already complete due to network failure or a
received abort, this will do nothing.
Also make afs_make_call() always abort on send error; again, it does
nothing if the rxrpc call is already dead.
Fixes: 08e0e7c82eea ("[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_RXRPC.")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-6-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/rxrpc.c | 37 +++++++++++++------------------------
include/trace/events/rxrpc.h | 2 +-
2 files changed, 14 insertions(+), 25 deletions(-)
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -441,10 +441,8 @@ void afs_make_call(struct afs_call *call
return;
error_do_abort:
- if (ret != -ECONNABORTED)
- rxrpc_kernel_abort_call(call->net->socket, rxcall,
- RX_USER_ABORT, ret,
- afs_abort_send_data_error);
+ rxrpc_kernel_abort_call(call->net->socket, rxcall,
+ RX_USER_ABORT, ret, afs_abort_send_data_error);
if (call->async) {
afs_see_call(call, afs_call_trace_async_abort);
return;
@@ -857,6 +855,7 @@ void afs_send_empty_reply(struct afs_cal
{
struct afs_net *net = call->net;
struct msghdr msg;
+ int ret;
_enter("");
@@ -869,21 +868,13 @@ void afs_send_empty_reply(struct afs_cal
msg.msg_controllen = 0;
msg.msg_flags = 0;
- switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
- afs_notify_end_reply_tx)) {
- case 0:
- _leave(" [replied]");
- return;
-
- case -ENOMEM:
- _debug("oom");
+ ret = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
+ afs_notify_end_reply_tx);
+ if (ret < 0) {
rxrpc_kernel_abort_call(net->socket, call->rxcall,
- RXGEN_SS_MARSHAL, -ENOMEM,
- afs_abort_oom);
- fallthrough;
- default:
- _leave(" [error]");
- return;
+ RXGEN_SS_MARSHAL, ret,
+ afs_abort_send_error);
+ afs_set_call_complete(call, ret, RXGEN_SS_MARSHAL);
}
}
@@ -913,12 +904,10 @@ void afs_send_simple_reply(struct afs_ca
ret = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
afs_notify_end_reply_tx);
if (ret < 0) {
- if (ret == -ENOMEM) {
- _debug("oom");
- rxrpc_kernel_abort_call(net->socket, call->rxcall,
- RXGEN_SS_MARSHAL, -ENOMEM,
- afs_abort_oom);
- }
+ rxrpc_kernel_abort_call(net->socket, call->rxcall,
+ RXGEN_SS_MARSHAL, ret,
+ afs_abort_send_error);
+ afs_set_call_complete(call, ret, RXGEN_SS_MARSHAL);
_leave(" [error]");
}
}
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -20,10 +20,10 @@
/* AFS errors */ \
EM(afs_abort_general_error, "afs-error") \
EM(afs_abort_interrupted, "afs-intr") \
- EM(afs_abort_oom, "afs-oom") \
EM(afs_abort_op_not_supported, "afs-op-notsupp") \
EM(afs_abort_probeuuid_negative, "afs-probeuuid-neg") \
EM(afs_abort_send_data_error, "afs-send-data") \
+ EM(afs_abort_send_error, "afs-send-error") \
EM(afs_abort_unmarshal_error, "afs-unmarshal") \
EM(afs_abort_unsupported_sec_class, "afs-unsup-sec-class") \
/* rxperf errors */ \
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 449/547] rxrpc: Fix double IRQ enablement
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 448/547] afs: Fix afs to abort the rxrpc call on send error Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 450/547] rxrpc: Fix return in rxrpc_recvmsg_data() for service calls Greg Kroah-Hartman
` (106 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Eric Dumazet, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-afs, stable
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 41eb0af096ba8754e584d47e6de42f1e4980ceae upstream.
rxrpc_notify_socket() explicitly disables and then re-enables IRQs, but one
of its call chains (rxrpc_input_queue_data() -> rxrpc_end_rx_phase() ->
rxrpc_call_completed() -> rxrpc_set_call_completion()) has IRQs disabled
around it.
Fix this by making rxrpc_notify_socket() use irqsave spinlocks.
Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/O thread")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.979970-6-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20261006133011.531806-9-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rxrpc/recvmsg.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -24,6 +24,7 @@ void rxrpc_notify_socket(struct rxrpc_ca
{
struct rxrpc_sock *rx;
struct sock *sk;
+ unsigned long flags;
_enter("%d", call->debug_id);
@@ -38,16 +39,16 @@ void rxrpc_notify_socket(struct rxrpc_ca
sk = &rx->sk;
if (rx && sk->sk_state < RXRPC_CLOSE) {
if (call->notify_rx) {
- spin_lock_irq(&call->notify_lock);
+ spin_lock_irqsave(&call->notify_lock, flags);
call->notify_rx(sk, call, call->user_call_ID);
- spin_unlock_irq(&call->notify_lock);
+ spin_unlock_irqrestore(&call->notify_lock, flags);
} else {
- spin_lock_irq(&rx->recvmsg_lock);
+ spin_lock_irqsave(&rx->recvmsg_lock, flags);
if (list_empty(&call->recvmsg_link)) {
rxrpc_get_call(call, rxrpc_call_get_notify_socket);
list_add_tail(&call->recvmsg_link, &rx->recvmsg_q);
}
- spin_unlock_irq(&rx->recvmsg_lock);
+ spin_unlock_irqrestore(&rx->recvmsg_lock, flags);
if (!sock_flag(sk, SOCK_DEAD)) {
_debug("call %ps", sk->sk_data_ready);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 450/547] rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 449/547] rxrpc: Fix double IRQ enablement Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 451/547] x86/cpuid: Mark CPUID function 0x23 as being indexed Greg Kroah-Hartman
` (105 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Jeffrey Altman, Eric Dumazet, David S. Miller, Jakub Kicinski,
Paolo Abeni, Simon Horman, linux-afs
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 18a71e111c7505e16c2de91480561fc491f41341 upstream.
When rxrpc_recvmsg_data() gets called on a service call that has received
all of the request, RXRPC_CALL_RECVMSG_READ_ALL has been set, and this
causes rxrpc_recvmsg_data() to jump straight out, indicating the end of the
call (ie. rxrpc_kernel_recv_data() returns 1) without waiting for the call
to be processed or the reply to be transmitted.
rxperf_deliver_to_call() also has to be altered to call
rxrpc_kernel_recv_data() to collect the final ACK on a service call as does
afs_deliver_to_call().
Fixes: d001648ec7cf ("rxrpc: Don't expose skbs to in-kernel users [ver #2]")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260914151340.3227501-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-10-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/networking/rxrpc.rst | 13 +++++++++----
fs/afs/rxrpc.c | 4 ++--
net/rxrpc/recvmsg.c | 13 ++++++++++---
net/rxrpc/rxperf.c | 16 ++++++++++++++--
4 files changed, 35 insertions(+), 11 deletions(-)
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -909,10 +909,15 @@ The kernel interface functions are as fo
want_more should be true if further data will be required after this is
satisfied and false if this is the last item of the receive phase.
- There are three normal returns: 0 if the buffer was filled and want_more
- was true; 1 if the buffer was filled, the last DATA packet has been
- emptied and want_more was false; and -EAGAIN if the function needs to be
- called again.
+ For client calls, there are three normal returns: 0 if the buffer was
+ filled and want_more was true; 1 if the buffer was filled, the last DATA
+ packet has been emptied and want_more was false; and -EAGAIN if the
+ function needs to be called again.
+
+ For service calls, there are four normal returns: 0 and -EAGAIN are the
+ same as for client calls; 2 indicates that the last DATA packet of the
+ request has been received, want_more was false and the call is still in
+ progress; and 1 indicates that the call is now successfully complete.
If the last DATA packet is processed but the buffer contains less than
the amount requested, EBADMSG is returned. If want_more wasn't set, but
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -541,7 +541,7 @@ void afs_deliver_to_call(struct afs_call
&call->service_id);
trace_afs_receive_data(call, &call->def_iter, false, ret);
- if (ret == -EINPROGRESS || ret == -EAGAIN)
+ if (ret == -EAGAIN || ret == 2)
return;
if (ret < 0 || ret == 1) {
if (ret == 1)
@@ -934,7 +934,7 @@ int afs_extract_data(struct afs_call *ca
return ret;
state = READ_ONCE(call->state);
- if (ret == 1) {
+ if (ret == 1 || ret == 2) {
switch (state) {
case AFS_CALL_CL_AWAIT_REPLY:
afs_set_call_state(call, state, AFS_CALL_CL_PROC_REPLY);
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -638,9 +638,11 @@ wait_error:
* Note that we may return %-EAGAIN to drain empty packets at the end
* of the data, even if we've already copied over the requested data.
*
- * Return: %0 if got what was asked for and there's more available, %1
- * if we got what was asked for and we're at the end of the data and
- * %-EAGAIN if we need more data.
+ * Return: %0 if got what was asked for and there's more available, %1 if we
+ * got what was asked for and we're at the end of the call, %2 if a service
+ * call received all of the request but is still in progress and %-EAGAIN if we
+ * need more data. A variety of other errors can be returned if the call
+ * completed with failure.
*/
int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
struct iov_iter *iter, size_t *_len,
@@ -679,6 +681,11 @@ int rxrpc_kernel_recv_data(struct socket
read_phase_complete:
ret = 1;
+ if (rxrpc_is_service_call(call)) {
+ if (rxrpc_call_is_complete(call))
+ goto call_failed;
+ ret = 2;
+ }
out:
if (_service)
*_service = call->dest_srx.srx_service;
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -293,8 +293,20 @@ static void rxperf_deliver_to_call(struc
state == RXPERF_CALL_SV_AWAIT_ACK
) {
if (state == RXPERF_CALL_SV_AWAIT_ACK) {
- if (!rxrpc_kernel_check_life(rxperf_socket, call->rxcall))
+ size_t len = 0;
+ iov_iter_kvec(&call->iter, ITER_DEST, NULL, 0, 0);
+ ret = rxrpc_kernel_recv_data(rxperf_socket,
+ call->rxcall, &call->iter,
+ &len, false, &remote_abort,
+ &call->service_id);
+
+ if (ret == -EAGAIN || ret == 2)
+ return;
+ if (ret < 0 || ret == 1) {
+ if (ret == 1)
+ ret = 0;
goto call_complete;
+ }
return;
}
@@ -369,7 +381,7 @@ static int rxperf_extract_data(struct rx
if (ret == 0 || ret == -EAGAIN)
return ret;
- if (ret == 1) {
+ if (ret == 1 || ret == 2) {
switch (call->state) {
case RXPERF_CALL_SV_AWAIT_REQUEST:
rxperf_set_call_state(call, RXPERF_CALL_SV_REPLYING);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 451/547] x86/cpuid: Mark CPUID function 0x23 as being indexed
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 450/547] rxrpc: Fix return in rxrpc_recvmsg_data() for service calls Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 452/547] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr() Greg Kroah-Hartman
` (104 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rick Edgecombe, Sean Christopherson,
Borislav Petkov (AMD)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 108775fa28fe04a16f19a828a779689f3d0ea9f0 upstream.
Add function 0x23 to the set of CPUID functions that are indexed, as per
the SDM and the many sub-leafs defined in leaf_types.h.
Closes: https://lore.kernel.org/all/213d614fe73e183a230c8f4e0c8fa1cc3d45df39.camel@intel.com
Reported-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261022210134.612848-2-seanjc@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/cpuid/api.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/include/asm/cpuid/api.h
+++ b/arch/x86/include/asm/cpuid/api.h
@@ -181,6 +181,7 @@ static __always_inline bool cpuid_functi
case 0x1d:
case 0x1e:
case 0x1f:
+ case 0x23:
case 0x24:
case 0x8000001d:
return true;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 452/547] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 451/547] x86/cpuid: Mark CPUID function 0x23 as being indexed Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 453/547] ALSA: x86: hdmi: fix chmap array missing terminator entry Greg Kroah-Hartman
` (103 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Rapoport (Microsoft),
Dave Hansen, Juergen Gross, Lorenzo Stoakes (ARM), syzbot,
Atish Patra, Nikunj A Dadhania
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
commit ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482 upstream.
lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of
the walked page table levels so that verify_rwx() can detect mappings that
are both writable and executable.
The RW bits are folded into a bool with
rw &= pXd_flags(*pXd) & _PAGE_RW;
but _PAGE_RW is 0x2. So consider the accumulation line:
rw &= pXd_flags(*pXd) & _PAGE_RW;
where rw=0x1 and the right side evaluates down to 0x2. It'll end up doing:
rw = 0x1 & 0x2
and rw always ends up 0.
This way rw becomes false at the first level walked, regardless of the
actual permissions, and verify_rwx() treats every mapping as non-writable
and never reports a W^X violation.
Add double negation to the right side to normalize the _PAGE_RW flag to
0 or 1.
Assisted-by: Copilot:claude-opus-4.8
Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: syzbot@syzkaller.appspotmail.com
Tested-by: Atish Patra <atishp@meta.com>
Tested-by: Nikunj A Dadhania <nikunj@amd.com>
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260813-cpa-fixes-v2-5-39b4ff90f91d@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/pat/set_memory.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -754,7 +754,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t
*level = PG_LEVEL_512G;
*nx |= pgd_flags(*pgd) & _PAGE_NX;
- *rw &= pgd_flags(*pgd) & _PAGE_RW;
+ *rw &= !!(pgd_flags(*pgd) & _PAGE_RW);
p4d = p4d_offset(pgd, address);
if (p4d_none(*p4d))
@@ -765,7 +765,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t
*level = PG_LEVEL_1G;
*nx |= p4d_flags(*p4d) & _PAGE_NX;
- *rw &= p4d_flags(*p4d) & _PAGE_RW;
+ *rw &= !!(p4d_flags(*p4d) & _PAGE_RW);
pud = pud_offset(p4d, address);
if (pud_none(*pud))
@@ -776,7 +776,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t
*level = PG_LEVEL_2M;
*nx |= pud_flags(*pud) & _PAGE_NX;
- *rw &= pud_flags(*pud) & _PAGE_RW;
+ *rw &= !!(pud_flags(*pud) & _PAGE_RW);
pmd = pmd_offset(pud, address);
if (pmd_none(*pmd))
@@ -787,7 +787,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t
*level = PG_LEVEL_4K;
*nx |= pmd_flags(*pmd) & _PAGE_NX;
- *rw &= pmd_flags(*pmd) & _PAGE_RW;
+ *rw &= !!(pmd_flags(*pmd) & _PAGE_RW);
return pte_offset_kernel(pmd, address);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 453/547] ALSA: x86: hdmi: fix chmap array missing terminator entry
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 452/547] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 454/547] KVM: Only bind memslot to guest_memfd instance for CREATE operations Greg Kroah-Hartman
` (102 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
commit f5e1a9a3fddab8421416b68bb132ae9626d07156 upstream.
had_build_channel_allocation_map() allocates a single struct
snd_pcm_chmap_elem via kzalloc() and stores it as
intelhaddata->chmap->chmap. struct snd_pcm_chmap.chmap is expected to
be a zero-terminated array (see snd_pcm_std_chmaps[]), but
had_register_chmap_ctls() never overrides the TLV callback installed
by snd_pcm_add_chmap_ctls(), so the generic pcm_chmap_ctl_tlv() from
ALSA core is left in place.
pcm_chmap_ctl_tlv() is reachable by any local user via
SNDRV_CTL_IOCTL_TLV_READ on the "Playback Channel Map" control and
walks the array with "for (map = info->chmap; map->channels; map++)".
Since the driver's single element is never terminated, this walks
past the allocation. The same pointer is also freed on hot-unplug and
rebuilt on hot-plug under intelhaddata->mutex, while the TLV callback
runs under card->controls_rwsem without that mutex, so the walk can
also race a concurrent free of the array.
Fix this by allocating a second, zeroed element so the array is
properly terminated, and by dropping the inherited TLV callback
entirely at registration time, since the driver never implements one
of its own.
Fixes: 5dab11d89777 ("ALSA: x86: hdmi: Add audio support for BYT and CHT")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085411.13742-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/x86/intel_hdmi_audio.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/sound/x86/intel_hdmi_audio.c
+++ b/sound/x86/intel_hdmi_audio.c
@@ -475,7 +475,8 @@ static void had_build_channel_allocation
kfree(intelhaddata->chmap->chmap);
intelhaddata->chmap->chmap = NULL;
- chmap = kzalloc_obj(*chmap);
+ /* info->chmap must be zero-terminated; allocate a spare terminator entry */
+ chmap = kzalloc_objs(*chmap, 2);
if (!chmap)
return;
@@ -575,6 +576,12 @@ static int had_register_chmap_ctls(struc
intelhaddata->chmap->kctl->info = had_chmap_ctl_info;
intelhaddata->chmap->kctl->get = had_chmap_ctl_get;
intelhaddata->chmap->chmap = NULL;
+
+ /* drop the inherited TLV read: it walks chmap without our mutex */
+ intelhaddata->chmap->kctl->tlv.c = NULL;
+ intelhaddata->chmap->kctl->vd[0].access &=
+ ~(SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK);
+
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 454/547] KVM: Only bind memslot to guest_memfd instance for CREATE operations
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 453/547] ALSA: x86: hdmi: fix chmap array missing terminator entry Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 455/547] KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch Greg Kroah-Hartman
` (101 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 513333a5546017da2a4a6173bfb70372f83733b3 upstream.
For additional defense-in-depth, and to avoid having to handle impossible
unwind scenarios when binding to a memslot fails, bind a memslot to a gmem
instance only for CREATE operations, i.e. don't attempt to establish a
binding for MOVE and FLAGS_ONLY operations. And when FLAGS_ONLY operations
are eventually supported (this is currently all dead code), creating a new
binding would be incorrect; KVM instead needs to do a 1:1 replacement of
the existing binding, i.e. FLAGS_ONLY will need its own dedicated handling.
Update the relevant TODO to make a better guess as to what needs to be done
to support toggling dirty logging for guest_memfd memslots.
Because it's dead code, no functional change intended.
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Link: https://patch.msgid.link/20260922001332.1121266-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/kvm_main.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1758,10 +1758,10 @@ static void kvm_commit_memory_region(str
kvm_destroy_dirty_bitmap(old);
/*
- * Unbind the guest_memfd instance as needed; the @new slot has
- * already created its own binding. TODO: Drop the WARN when
- * dirty logging guest_memfd memslots is supported. Until then,
- * flags-only changes on guest_memfd slots should be impossible.
+ * TODO: Drop the WARN and do the unbind() call only for MOVE
+ * when dirty logging guest_memfd memslots is supported. Until
+ * then, flags-only changes on guest_memfd slots should also be
+ * impossible; unbind the old memslot for defense-in-depth.
*/
if (WARN_ON_ONCE(old->flags & KVM_MEM_GUEST_MEMFD))
kvm_gmem_unbind(old);
@@ -2121,7 +2121,7 @@ static int kvm_set_memory_region(struct
new->npages = npages;
new->flags = mem->flags;
new->userspace_addr = mem->userspace_addr;
- if (mem->flags & KVM_MEM_GUEST_MEMFD) {
+ if (change == KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD)) {
r = kvm_gmem_bind(kvm, new, mem->guest_memfd, mem->guest_memfd_offset);
if (r)
goto out;
@@ -2134,7 +2134,7 @@ static int kvm_set_memory_region(struct
return 0;
out_unbind:
- if (mem->flags & KVM_MEM_GUEST_MEMFD)
+ if (change == KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD))
kvm_gmem_unbind(new);
out:
kfree(new);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 455/547] KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 454/547] KVM: Only bind memslot to guest_memfd instance for CREATE operations Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 456/547] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0 Greg Kroah-Hartman
` (100 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Teodorescu, Yosry Ahmed,
Nikunj A Dadhania, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <yosry@kernel.org>
commit bf260dc9e7b8bfcd06c1a8e739797b1cf0917c72 upstream.
When the pCPU where the VMCB was most recently used is switched, reset
the ASID generation in both VMCBs, triggering new ASID allocation for
the immediate VMRUN as well as the next VMRUN on the other VMCB.
The ASID is shared between vmcb01 and vmcb02, and gets flushed on every
nested transition. However, since pCPU tracking is done per VMCB, it is
possible for one VMCB to allocate a new ASID when migrated to a new
pCPU, and then the other VMCB reuses that ASID on the old pCPU. This can
result in the same ASID being used by multiple vCPUs on the old pCPU.
Example scenario:
- vCPU runs on pCPU A, vmcb01 is active, asid=1.
- vCPU migrates to pCPU B, vmcb01 pCPU changes, new asid=2.
- Another vCPU runs on pCPU A and allocates asid=2 as well.
- vCPU migrates back to pCPU A, and then switches to vmcb02 before it
runs again with vmcb01.
- No pCPU switch is detected for vmcb02, so VMRUN is done with asid=2.
- Two vCPUs end up using asid=2 on the same pCPU.
Keep the VMCB dirtying to the active VMCB only. Clean bits are tracked
by a pCPU for each VMCB, so do not unnecessarily dirty a VMCB if its
pCPU does not change.
Additionally, initialize the tracked pCPU for vmcb02 to -1 on nested
enablement as hardening, so that a new ASID allocation is always
triggered when nested is disabled and re-enabled.
No performance regression was noticed when overcommitting L1 vCPUs in L0
(to force rescheduling), pinning L1 <-> L2 vCPUs, and running CPUID in a
tight loop bouncing between 2 vCPUs in L2.
An alternative (and perhaps more proper) fix would be tracking the ASID
per-VMCB instead (e.g. [1]). However, that's a more involved change, and
it would result in having different ASIDs for L1 and L2 without actually
properly maintaining them. It would probably work because all TLB
flushes target the current VMCB, and the other VMCB is always flushed on
nested transitions, but the code ends up in an arguably more fragile
state. Punt a proper clean fix to an incoming (and overdue) overhaul of
SVM's ASID usage [2].
[1] https://lore.kernel.org/lkml/20250205182402.2147495-2-yosry.ahmed@linux.dev
[2] https://lore.kernel.org/kvm/20260728003557.1136583-1-yosry@kernel.org
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Nikunj A Dadhania <nikunj@amd.com>
Link: https://patch.msgid.link/20260903223258.486034-1-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/nested.c | 1 +
arch/x86/kvm/svm/svm.c | 19 +++++++++++++++----
2 files changed, 16 insertions(+), 4 deletions(-)
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1494,6 +1494,7 @@ int svm_allocate_nested(struct vcpu_svm
if (!svm->nested.msrpm)
goto err_free_vmcb02;
+ svm->nested.vmcb02.cpu = -1;
svm->nested.initialized = true;
return 0;
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3759,14 +3759,25 @@ static int pre_svm_run(struct kvm_vcpu *
struct vcpu_svm *svm = to_svm(vcpu);
/*
- * If the previous vmrun of the vmcb occurred on a different physical
- * cpu, then mark the vmcb dirty and assign a new asid. Hardware's
- * vmcb clean bits are per logical CPU, as are KVM's asid assignments.
+ * If the previous VMRUN of the VMCB occurred on a different physical
+ * cpu, then mark the VMCB dirty as hardware's clean bits are per pCPU.
+ *
+ * Reset the ASID generation in both VMCBs. This will lead to assigning
+ * a new ASID now, and then again when switching to the other VMCB.
+ * However, this is needed as the ASID is shared between the VMCBs, and
+ * otherwise it would be possible to use an ASID allocated on one pCPU
+ * on another, for example:
+ * - vCPU migrates from pCPU A to pCPU B, allocates a new ASID.
+ * - vCPU migrates back to pCPU A, and then switches the VMCB.
+ * - The new VMCB does not detect a pCPU change and runs on pCPU A with
+ * the new ASID allocated on pCPU B, which is potentially used by
+ * another vCPU/VM.
*/
if (unlikely(svm->current_vmcb->cpu != vcpu->cpu)) {
- svm->current_vmcb->asid_generation = 0;
vmcb_mark_all_dirty(svm->vmcb);
svm->current_vmcb->cpu = vcpu->cpu;
+ svm->vmcb01.asid_generation = 0;
+ svm->nested.vmcb02.asid_generation = 0;
}
if (is_sev_guest(vcpu))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 456/547] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 455/547] KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 457/547] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state Greg Kroah-Hartman
` (99 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yosry Ahmed, Stefan Teodorescu,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 5dc500a354cc8e109df678076ae3488094649468 upstream.
Reject KVM_SET_NESTED_STATE if the incoming L1 host state has what is
effectively an impossible EFER combination of LMA=1 but LME=0, i.e. if the
state says long mode is active but not enabled. Unlike VMX, SVM doesn't
have an explicit consistent check for the illegal combination; presumably
hardware simply ignores EFER.LMA if EFER.LME=0.
Unfortunately, KVM doesn't ignore EFER.LMA in this case and consumes the
illegal state when constructing the shadow MMU for L2. E.g. if userspace
also clears CR4.PAE, then kvm_calc_cpu_role() will compute a role with 4 or
5 levels of paging, but shadow_mmu_init_context() will wire up the MMU to
use the paging32 template, which maxes out its levels at 2.
Note, the "real badness" is effectively the same as what happened with the
nVMX bug fixed by commit 112e66017bff ("KVM: nVMX: add missing consistency
checks for CR0 and CR4"). Unfortunately, the sanity check added by commit
72e2fb24a0b0 ("KVM: x86/mmu: Bug the VM if a vCPU ends up in long mode
without PAE enabled") doesn't work for this case, since L2 state is active
at the time of the page fault, but it's L1 that has the bad state.
Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
Cc: stable@vger.kernel.org
Cc: Yosry Ahmed <yosry@kernel.org>
Reported-by: Stefan Teodorescu <fane@google.com>
Link: https://patch.msgid.link/20260902232028.2767071-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/nested.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -2029,6 +2029,7 @@ static int svm_set_nested_state(struct k
if (!(save->cr0 & X86_CR0_PG) ||
!(save->cr0 & X86_CR0_PE) ||
(save->rflags & X86_EFLAGS_VM) ||
+ ((save->efer & EFER_LMA) && !(save->efer & EFER_LME)) ||
!nested_vmcb_check_save(vcpu, &save_cached, false))
goto out_free;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 457/547] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 456/547] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0 Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 458/547] KVM: Use goto to handle errors during memslot preparation Greg Kroah-Hartman
` (98 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yosry Ahmed, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 1c4c84a643b704e473cb171f7b61359ff29b12a4 upstream.
Force EFER.LMA=0 if EFER.LME=0 when preparing L2 state for VMRUN, i.e.
mimic real hardware's behavior of ignoring EFER.LMA if EFER.LME=0. VMRUN
unfortunately allows the nonsensical combination, i.e. doesn't fail, but
KVM itself has an invariant EFER.LMA can be set et if and only if EFER.LME
is set. Breaking that invariant can lead to a variety of issue,
particularly in MMU code that keys off EFER.LMA when determining whether to
emulate/virtualization 4/5-level paging versus PAE paging.
Cc: stable@vger.kernel.org
Cc: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260902232028.2767071-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/nested.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -789,6 +789,10 @@ static void nested_vmcb02_prepare_save(s
kvm_set_rflags(vcpu, save->rflags | X86_EFLAGS_FIXED);
+ /* SVM ignores EFER.LMA if EFER.LME=0 (instead of failing VMRUN). */
+ if (!(svm->nested.save.efer & EFER_LME))
+ svm->nested.save.efer &= ~EFER_LMA;
+
svm_set_efer(vcpu, svm->nested.save.efer);
svm_set_cr0(vcpu, svm->nested.save.cr0);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 458/547] KVM: Use goto to handle errors during memslot preparation
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 457/547] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 459/547] KVM: VMX: Disallow using to_vmx() in common VT code Greg Kroah-Hartman
` (97 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Ackerley Tng, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 23a205797cec86f391d0be886b9bc741e1262063 upstream.
Use a goto to unwind early memslot changes if preparing for a memslot
operation fails. This will allow moving the creation of guest_memfd
bindings into kvm_set_memslot() without needing to copy+paste the unwind
logic.
No functional change intended.
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Link: https://patch.msgid.link/20260922001332.1121266-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/kvm_main.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1947,21 +1947,8 @@ static int kvm_set_memslot(struct kvm *k
}
r = kvm_prepare_memory_region(kvm, old, new, change);
- if (r) {
- /*
- * For DELETE/MOVE, revert the above INVALID change. No
- * modifications required since the original slot was preserved
- * in the inactive slots. Changing the active memslots also
- * release slots_arch_lock.
- */
- if (change == KVM_MR_DELETE || change == KVM_MR_MOVE) {
- kvm_activate_memslot(kvm, invalid_slot, old);
- kfree(invalid_slot);
- } else {
- mutex_unlock(&kvm->slots_arch_lock);
- }
- return r;
- }
+ if (r)
+ goto err;
/*
* For DELETE and MOVE, the working slot is now active as the INVALID
@@ -1993,6 +1980,20 @@ static int kvm_set_memslot(struct kvm *k
kvm_commit_memory_region(kvm, old, new, change);
return 0;
+
+err:
+ /*
+ * For DELETE/MOVE, revert the above INVALID change. No modifications
+ * required since the original slot was preserved in the inactive slots.
+ * Changing the active memslots also release slots_arch_lock.
+ */
+ if (change == KVM_MR_DELETE || change == KVM_MR_MOVE) {
+ kvm_activate_memslot(kvm, invalid_slot, old);
+ kfree(invalid_slot);
+ } else {
+ mutex_unlock(&kvm->slots_arch_lock);
+ }
+ return r;
}
static bool kvm_check_memslot_overlap(struct kvm_memslots *slots, int id,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 459/547] KVM: VMX: Disallow using to_vmx() in common VT code
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 458/547] KVM: Use goto to handle errors during memslot preparation Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 460/547] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter Greg Kroah-Hartman
` (96 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Kai Huang, Binbin Wu,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit f305fd31f52a8d3ce4d2bf0c88c45bb7a373809c upstream.
Poison to_vmx() in main.c and posted_intr.c so that attempting to interpret
the vCPU as a VMX vCPU will fail at compile time, as opposed to failing at
runtime, or worse corrupting state without outright failing.
Note, to_tdx() is buried in tdx.c, i.e. isn't broadly reachable, and so
doesn't need the same treatment as to_vmx().
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Tested-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260904010353.3175819-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/main.c | 2 ++
arch/x86/kvm/vmx/posted_intr.c | 2 ++
2 files changed, 4 insertions(+)
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -10,6 +10,8 @@
#include "tdx.h"
#include "tdx_arch.h"
+#pragma GCC poison to_vmx
+
#ifdef CONFIG_KVM_INTEL_TDX
static_assert(offsetof(struct vcpu_vmx, vt) == offsetof(struct vcpu_tdx, vt));
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -14,6 +14,8 @@
#include "vmx.h"
#include "tdx.h"
+#pragma GCC poison to_vmx
+
/*
* Maintain a per-CPU list of vCPUs that need to be awakened by wakeup_handler()
* when a WAKEUP_VECTOR interrupted is posted. vCPUs are added to the list when
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 460/547] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 459/547] KVM: VMX: Disallow using to_vmx() in common VT code Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 461/547] KVM: VMX: Make handle_bus_lock_vmexit() a shared helper Greg Kroah-Hartman
` (95 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Yan Zhao, Binbin Wu,
Rick Edgecombe, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit d85f7dc8cf3c91a131946dae4c3aa8d9c97322d7 upstream.
Add EXIT_REASON_UNDEFINED to track KVM's magic "0xdead" value that's used
to stuff the exit reason on a failed VM-Enter so that the magic can be
reused by TDX, and to make it more obvious that it's an arbitrary, KVM-
defined value (though the whole "dead" thing makes it pretty darn obvious).
Opportunistically add a compile-time assert to ensure the KVM-defined exit
reason never collides with a "real" exit reason.
No functional change intended.
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Yan Zhao <yan.y.zhao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260921235656.1107929-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/vmx.h | 8 ++++++++
arch/x86/kvm/vmx/vmx.c | 4 +++-
2 files changed, 11 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -20,6 +20,14 @@
#include <asm/trapnr.h>
#include <asm/vmxfeatures.h>
+/*
+ * UNDEFINED is a KVM-defined value used to indicate that the basic exit reason
+ * is undefined/invalid, e.g. on VM-Fail or if TDX never attempted VM-Enter.
+ * The value itself is arbitrary, it just needs to not collide with a real exit
+ * reason.
+ */
+#define EXIT_REASON_UNDEFINED 0xdead
+
struct vmcs_hdr {
u32 revision_id:31;
u32 shadow_vmcs:1;
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6388,6 +6388,8 @@ static int (*kvm_vmx_exit_handlers[])(st
static const int kvm_vmx_max_exit_handlers =
ARRAY_SIZE(kvm_vmx_exit_handlers);
+static_assert(EXIT_REASON_UNDEFINED >= ARRAY_SIZE(kvm_vmx_exit_handlers));
+
void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code)
{
@@ -7474,7 +7476,7 @@ static noinstr void vmx_vcpu_enter_exit(
vmx_enable_fb_clear(vmx);
if (unlikely(vmx->fail)) {
- vmx->vt.exit_reason.full = 0xdead;
+ vmx->vt.exit_reason.full = EXIT_REASON_UNDEFINED;
goto out;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 461/547] KVM: VMX: Make handle_bus_lock_vmexit() a shared helper
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 460/547] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 462/547] KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected Greg Kroah-Hartman
` (94 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Nikolay Borisov,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit 326fa2c9b4d3e6cab58c139eb55aaabd7179192e upstream.
Move handle_bus_lock_vmexit() from vmx.c to main.c to make it a shared
helper so that TDX can use it for Bus Lock VM exit handling as well.
Rename it to add vt_ prefix to reflect that it is a helper for both VMX
and TDX.
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Link: https://patch.msgid.link/20260819094903.3060020-8-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/common.h | 1 +
arch/x86/kvm/vmx/main.c | 11 +++++++++++
arch/x86/kvm/vmx/vmx.c | 13 +------------
3 files changed, 13 insertions(+), 12 deletions(-)
--- a/arch/x86/kvm/vmx/common.h
+++ b/arch/x86/kvm/vmx/common.h
@@ -184,5 +184,6 @@ static inline void __vmx_deliver_posted_
}
noinstr void vmx_handle_nmi(struct kvm_vcpu *vcpu);
+int vt_handle_bus_lock_vmexit(struct kvm_vcpu *vcpu);
#endif /* __KVM_X86_VMX_COMMON_H */
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -878,6 +878,17 @@ static int vt_gmem_max_mapping_level(str
#define vt_op_tdx_only(name) NULL
#endif /* CONFIG_KVM_INTEL_TDX */
+int vt_handle_bus_lock_vmexit(struct kvm_vcpu *vcpu)
+{
+ /*
+ * Hardware may or may not set the BUS_LOCK_DETECTED flag on BUS_LOCK
+ * VM-Exits. Unconditionally set the flag here and leave the handling
+ * to .handle_exit() callback.
+ */
+ to_vt(vcpu)->exit_reason.bus_lock_detected = true;
+ return 1;
+}
+
#define VMX_REQUIRED_APICV_INHIBITS \
(BIT(APICV_INHIBIT_REASON_DISABLED) | \
BIT(APICV_INHIBIT_REASON_ABSENT) | \
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6267,17 +6267,6 @@ static int handle_encls(struct kvm_vcpu
}
#endif /* CONFIG_X86_SGX_KVM */
-static int handle_bus_lock_vmexit(struct kvm_vcpu *vcpu)
-{
- /*
- * Hardware may or may not set the BUS_LOCK_DETECTED flag on BUS_LOCK
- * VM-Exits. Unconditionally set the flag here and leave the handling to
- * vmx_handle_exit().
- */
- to_vt(vcpu)->exit_reason.bus_lock_detected = true;
- return 1;
-}
-
static int handle_notify(struct kvm_vcpu *vcpu)
{
unsigned long exit_qual = vmx_get_exit_qual(vcpu);
@@ -6377,7 +6366,7 @@ static int (*kvm_vmx_exit_handlers[])(st
[EXIT_REASON_VMFUNC] = handle_vmx_instruction,
[EXIT_REASON_PREEMPTION_TIMER] = handle_preemption_timer,
[EXIT_REASON_ENCLS] = handle_encls,
- [EXIT_REASON_BUS_LOCK] = handle_bus_lock_vmexit,
+ [EXIT_REASON_BUS_LOCK] = vt_handle_bus_lock_vmexit,
[EXIT_REASON_NOTIFY] = handle_notify,
[EXIT_REASON_SEAMCALL] = handle_tdx_instruction,
[EXIT_REASON_TDCALL] = handle_tdx_instruction,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 462/547] KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 461/547] KVM: VMX: Make handle_bus_lock_vmexit() a shared helper Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 463/547] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has Greg Kroah-Hartman
` (93 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Xiaoyao Li,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit cef48693da1e964e9f192bfc16cd0ed287c48337 upstream.
Preserve the negative return value from __vmx_handle_exit() when a bus
lock is detected, instead of always overwriting it with 0.
The purpose of bus_lock_detected handling is to force a userspace exit to
inform userspace that a bus lock happened. The negative return value can
achieve this purpose, and changing the negative value to 0 fails to return
an error to userspace. So, preserve the negative return value.
Fixes: fe6b6bc802b4 ("KVM: VMX: Enable bus lock VM exit")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260805034602.5B2BB1F000E9@smtp.kernel.org/
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-7-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/vmx.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6864,11 +6864,12 @@ int vmx_handle_exit(struct kvm_vcpu *vcp
* a bus lock in guest.
*/
if (vmx_get_exit_reason(vcpu).bus_lock_detected) {
- if (ret > 0)
+ if (ret > 0) {
vcpu->run->exit_reason = KVM_EXIT_X86_BUS_LOCK;
+ ret = 0;
+ }
vcpu->run->flags |= KVM_RUN_X86_BUS_LOCK;
- return 0;
}
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 463/547] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 462/547] KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 464/547] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0 Greg Kroah-Hartman
` (92 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 115f9405a2ed6d78ee7ad8436bdd638743f6d1d4 upstream.
Extend the "EFER.LMA && !CR4.PAE" check, which exists largely to guard
against KVM configuring a paging32 MMU with more than 2 levels of paging,
with a very explicit check for exactly that: that KVM isn't trying to walk
more levels of paging than the MMU template provides. I.e. harden KVM
against all bugs that would cause KVM to generates accesses beyond the
bounds of guest_walker's arrays, regardless of how KVM ended up with the
misconfigured MMU.
Note, don't use w->cpu_role.base.level directly as the paging64 template
only provides two levels of page tables for PAE paging on 32-bit hosts, and
handles the third level by manually emulating the PDPTR access.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260902232028.2767071-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/paging_tmpl.h | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -367,13 +367,14 @@ retry_walk:
pte_access = ~0;
/*
- * Queue a page fault for injection if this assertion fails, as callers
- * assume that walker.fault contains sane info on a walk failure. I.e.
- * avoid making the situation worse by inducing even worse badness
- * between when the assertion fails and when KVM kicks the vCPU out to
- * userspace (because the VM is bugged).
+ * Queue a page fault for injection if any of the below assertions fail,
+ * as callers assume that walker.fault contains sane info on a walk
+ * failure. I.e. avoid making the situation worse by inducing even
+ * worse badness between when the assertion fails and when KVM kicks
+ * the vCPU out to userspace (because the VM is bugged).
*/
- if (KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm))
+ if (KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm) ||
+ KVM_BUG_ON(walker->max_level > PT_MAX_FULL_LEVELS, vcpu->kvm))
goto error;
++walker->level;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 464/547] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 463/547] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 465/547] KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration Greg Kroah-Hartman
` (91 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 34dacbe7ae93f2d3c26cd0bf3e08200b1fa2c180 upstream.
Bug the VM if KVM attempts to construct a CPU role with the should-be-
impossible combination of long mode being active without PAE paging being
enabled. KVM's MMU construction assumes that EFER.LMA can be set if and
only CR4.PAE is set, and will create a completely invalid MMU if that
assumption fails. FNAME(walk_addr_generic) already has sanity checks to
try and mitigate the fallout, but attempt to catch such bugs earlier, as
this is (at least) the second time KVM has had bugs that escaped into
FNAME(walk_addr_generic), and it's entirely possible the bad state could
cause problems elsewhere.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260902232028.2767071-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -5916,6 +5916,9 @@ static union kvm_cpu_role kvm_calc_cpu_r
return role;
}
+ if (KVM_BUG_ON(____is_efer_lma(regs) && !____is_cr4_pae(regs), vcpu->kvm))
+ *(u64 *)®s->efer &= ~EFER_LMA;
+
role.base.efer_nx = ____is_efer_nx(regs);
role.base.cr0_wp = ____is_cr0_wp(regs);
role.base.cr4_smep = ____is_cr4_smep(regs);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 465/547] KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 464/547] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0 Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 466/547] KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt() Greg Kroah-Hartman
` (90 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, David Woodhouse,
Paul Durrant, Paolo Bonzini
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit eacdb76c5f04956035c5d7f7e1973028f30684a2 upstream.
Xen's map_guest_area() enforces that vcpu_info is aligned to
sizeof(xen_ulong_t). KVM has no such check, allowing a guest to
register vcpu_info at an arbitrary byte alignment.
Enforce unconditional 4-byte alignment regardless of the current
shinfo mode. This is sufficient because subsequent commits ensure
that all locked atomic operations on vcpu_info fields use at most
32-bit accesses. Return -ENXIO on failure, matching Xen's
map_guest_area() behaviour for unaligned requests.
Originally observed in review of an unrelated patch:
https://lore.kernel.org/all/20260604193554.1BA311F00893@smtp.kernel.org/
Cc: stable@vger.kernel.org
Fixes: 73e69a86347a ("KVM: x86/xen: register vcpu info")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260604193554.1BA311F00893@smtp.kernel.org
Assisted-by: Kiro:claude-opus-4.6-1m
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Link: https://patch.msgid.link/20260831213632.81023-7-dwmw2@infradead.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/xen.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -941,6 +941,10 @@ int kvm_xen_vcpu_set_attr(struct kvm_vcp
break;
}
+ r = -ENXIO;
+ if (!IS_ALIGNED(data->u.gpa, sizeof(u32)))
+ break;
+
r = kvm_gpc_activate(&vcpu->arch.xen.vcpu_info_cache,
data->u.gpa, sizeof(struct vcpu_info));
} else {
@@ -950,6 +954,10 @@ int kvm_xen_vcpu_set_attr(struct kvm_vcp
break;
}
+ r = -ENXIO;
+ if (!IS_ALIGNED(data->u.hva, sizeof(u32)))
+ break;
+
r = kvm_gpc_activate_hva(&vcpu->arch.xen.vcpu_info_cache,
data->u.hva, sizeof(struct vcpu_info));
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 466/547] KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 465/547] KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 467/547] KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted Greg Kroah-Hartman
` (89 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Woodhouse, Paul Durrant,
Paolo Bonzini
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit aa8ad943f242ef14d136c5440b1178de77466c9e upstream.
kvm_gpc_check() checks the cached memslot generation against the current
one, which dereferences kvm->memslots and therefore requires kvm->srcu to
be held. __kvm_xen_has_interrupt() does not take it.
Most callers do happen to hold kvm->srcu, but not all of them:
- kvm_emulate_halt() on the VM-Exit path, via kvm_vcpu_has_events() and
kvm_cpu_has_extint(). vcpu_enter_guest() drops the vCPU's SRCU lock
before entering the guest, so it is not held on the way back out.
- kvm_vcpu_block() -> kvm_vcpu_check_block() -> kvm_arch_vcpu_runnable(),
which is the case the existing comment in this function describes.
On a PROVE_RCU kernel the former produces:
WARNING: suspicious RCU usage
include/linux/kvm_host.h:1092 suspicious rcu_dereference_check() usage!
...
kvm_gpc_check+0x344/0x3e0 [kvm]
__kvm_xen_has_interrupt+0x83/0x310 [kvm]
kvm_cpu_has_extint+0x1ff/0x370 [kvm]
kvm_cpu_has_interrupt+0x16/0x100 [kvm]
kvm_vcpu_has_events+0x4ce/0x690 [kvm]
kvm_emulate_halt+0x52/0x1f0 [kvm]
vmx_vcpu_run+0x988/0x2630 [kvm_intel]
Use guard(srcu) so that the three existing early returns don't each need
an explicit unlock. SRCU read sections nest, so this is harmless on the
paths which already hold it, and srcu_read_lock() does not sleep, so it
is also safe in the atomic case which this function already handles.
Fixes: 7caf9571563e ("KVM: x86/xen: Use gfn_to_pfn_cache for vcpu_info")
Cc: stable@vger.kernel.org
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Assisted-by: Claude:claude-mythos-5
Reviewed-by: Paul Durrant <paul@xen.org>
Link: https://patch.msgid.link/20260831213632.81023-11-dwmw2@infradead.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/xen.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -728,6 +728,16 @@ int __kvm_xen_has_interrupt(struct kvm_v
BUILD_BUG_ON(sizeof(rc) !=
sizeof_field(struct compat_vcpu_info, evtchn_upcall_pending));
+ /*
+ * kvm_gpc_check() checks the memslot generation, so kvm->srcu must be
+ * held. Most callers hold it already, but this is also reached from
+ * kvm_emulate_halt() on the VM-Exit path and from kvm_vcpu_block(),
+ * where vcpu_enter_guest() has already dropped the vCPU's SRCU lock.
+ * Taking SRCU does not sleep, so it is safe even in the atomic case
+ * which is handled below.
+ */
+ guard(srcu)(&v->kvm->srcu);
+
read_lock_irqsave(&gpc->lock, flags);
while (!kvm_gpc_check(gpc, sizeof(struct vcpu_info))) {
read_unlock_irqrestore(&gpc->lock, flags);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 467/547] KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 466/547] KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 468/547] KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload Greg Kroah-Hartman
` (88 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qinguang Chen, Zhiping Du,
Keqiang Duan, Chao Gao, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keqiang Duan <duankeqiangcym@gmail.com>
commit 883719f57f5d3898637b130d6db4742471cad618 upstream.
Force a vCPU out of its hardware-tracked halted state when userspace puts
the vCPU into any state other than HALTED via KVM_SET_MP_STATE, i.e. clear
VMCS.GUEST_ACTIVITY_STATE if it says the vCPU is halted. Add an optional
kvm_x86_ops hook to do the clearing, as SVM has no equivalent VMCB field.
When HLT-exiting is disabled for a VM (KVM_CAP_X86_DISABLE_EXITS with
KVM_X86_DISABLE_EXITS_HLT, e.g. QEMU's "-overcommit cpu-pm=on"), a guest
HLT halts the physical CPU instead of exiting to KVM, and hardware saves
GUEST_ACTIVITY_STATE=HLT into the VMCS on the next VM-Exit. That field is
sticky: it survives VM-Exit/VM-Enter and is only cleared by vmx_clear_hlt()
on event injection, or by vmx_vcpu_reset() on INIT / vCPU creation.
Nothing clears it on a userspace-driven state change. KVM_SET_REGS only
writes the software register cache and KVM_SET_MP_STATE only writes
vcpu->arch.mp_state; kvm_vcpu_running() likewise consults software state
only. A VMM that emulates a machine reset therefore ends up with a vCPU
that KVM happily VM-Enters while hardware refuses to fetch instructions.
Reproduce with a Linux guest by triggering a panic/kdump on a non-boot
vCPU: nmi_shootdown_cpus() parks the other vCPUs -- including vCPU0 -- in
crash_nmi_callback(), which does local_irq_disable() followed by a bare
HLT. The capture kernel then resets the machine via port 0xCF9. QEMU
rewrites RIP to 0xfff0 and sets mp_state to RUNNABLE, but vCPU0's
GUEST_ACTIVITY_STATE is still HLT, so the BSP never executes the reset
vector, never sends SIPIs, and the entire VM hangs at "reboot: machine
restart" forever. Only destroying and recreating the VM recovers it.
Key off "not HALTED" rather than "is RUNNABLE" as HALTED is the only target
state for which retaining the hardware halted state is meaningful; every
other transition either can't be reached on VMX, e.g. AP_RESET_HOLD, or
goes through vmx_vcpu_reset(), which stuffs GUEST_ACTIVITY_ACTIVE anyways.
This also captures the intent more directly: KVM only ever drops the
hardware halted state, it never installs it.
Hook KVM_SET_MP_STATE rather than the VM-Enter path so that the clearing
is driven by an explicit userspace declaration, and so that no work is
added to vmx_vcpu_run(). Gate the call on kvm_hlt_in_guest() even though
vmx_clear_hlt() checks it as well, as the check is cheap and makes it
obvious in common code when the hardware state can exist at all.
Do nothing for TDX vCPUs as TDX doesn't support disabling HLT-exiting and
KVM cannot access a TD's VMCS, i.e. the VMCS used to run the vCPU can't
in HALTED state, and even if it were, KVM can't change it.
Fixes: caa057a2cad6 ("KVM: X86: Provide a capability to disable HLT intercepts")
Cc: stable@vger.kernel.org
Tested-by: Qinguang Chen <chenqinguang@kuaishou.com>
Signed-off-by: Zhiping Du <duzhiping@kuaishou.com>
Signed-off-by: Keqiang Duan <duankeqiangcym@gmail.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Link: https://patch.msgid.link/20260820123512.87236-1-duankeqiangcym@gmail.com
[sean: drop claim that spurious wakeups are ok, massage changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/kvm-x86-ops.h | 1 +
arch/x86/include/asm/kvm_host.h | 7 +++++++
arch/x86/kvm/vmx/main.c | 13 +++++++++++++
arch/x86/kvm/vmx/vmx.c | 2 +-
arch/x86/kvm/vmx/x86_ops.h | 1 +
arch/x86/kvm/x86.c | 13 +++++++++++++
6 files changed, 36 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/kvm-x86-ops.h
+++ b/arch/x86/include/asm/kvm-x86-ops.h
@@ -82,6 +82,7 @@ KVM_X86_OP(interrupt_allowed)
KVM_X86_OP(nmi_allowed)
KVM_X86_OP(get_nmi_mask)
KVM_X86_OP(set_nmi_mask)
+KVM_X86_OP_OPTIONAL(clear_hlt)
KVM_X86_OP(enable_nmi_window)
KVM_X86_OP(enable_irq_window)
KVM_X86_OP_OPTIONAL(update_cr8_intercept)
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1607,6 +1607,13 @@ struct kvm_x86_ops {
int (*nmi_allowed)(struct kvm_vcpu *vcpu, bool for_injection);
bool (*get_nmi_mask)(struct kvm_vcpu *vcpu);
void (*set_nmi_mask)(struct kvm_vcpu *vcpu, bool masked);
+ /*
+ * Force the vCPU out of any hardware-tracked halted/inactive state so
+ * that it will fetch and execute instructions on the next VM-Enter.
+ * Only needed by VMX, where VMCS.GUEST_ACTIVITY_STATE persists across
+ * VM-Exit/VM-Enter; SVM has no equivalent VMCB field.
+ */
+ void (*clear_hlt)(struct kvm_vcpu *vcpu);
/* Whether or not a virtual NMI is pending in hardware. */
bool (*is_vnmi_pending)(struct kvm_vcpu *vcpu);
/*
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -603,6 +603,18 @@ static void vt_set_nmi_mask(struct kvm_v
vmx_set_nmi_mask(vcpu, masked);
}
+static void vt_clear_hlt(struct kvm_vcpu *vcpu)
+{
+ /*
+ * TDX doesn't support disabling HLT-exiting, and KVM can't access a
+ * TD's VMCS, so there is never any hardware halted state to clear.
+ */
+ if (is_td_vcpu(vcpu))
+ return;
+
+ vmx_clear_hlt(vcpu);
+}
+
static void vt_enable_nmi_window(struct kvm_vcpu *vcpu)
{
/* Refer to the comments in tdx_inject_nmi(). */
@@ -977,6 +989,7 @@ struct kvm_x86_ops vt_x86_ops __initdata
.nmi_allowed = vt_op(nmi_allowed),
.get_nmi_mask = vt_op(get_nmi_mask),
.set_nmi_mask = vt_op(set_nmi_mask),
+ .clear_hlt = vt_op(clear_hlt),
.enable_nmi_window = vt_op(enable_nmi_window),
.enable_irq_window = vt_op(enable_irq_window),
.update_cr8_intercept = vt_op(update_cr8_intercept),
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1909,7 +1909,7 @@ int vmx_skip_emulated_instruction(struct
return skip_emulated_instruction(vcpu);
}
-static void vmx_clear_hlt(struct kvm_vcpu *vcpu)
+void vmx_clear_hlt(struct kvm_vcpu *vcpu)
{
/*
* Ensure that we clear the HLT state in the VMCS. We don't need to
--- a/arch/x86/kvm/vmx/x86_ops.h
+++ b/arch/x86/kvm/vmx/x86_ops.h
@@ -95,6 +95,7 @@ int vmx_interrupt_allowed(struct kvm_vcp
int vmx_nmi_allowed(struct kvm_vcpu *vcpu, bool for_injection);
bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
+void vmx_clear_hlt(struct kvm_vcpu *vcpu);
void vmx_enable_nmi_window(struct kvm_vcpu *vcpu);
void vmx_enable_irq_window(struct kvm_vcpu *vcpu);
void vmx_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr);
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9062,6 +9062,19 @@ int kvm_arch_vcpu_ioctl_set_mpstate(stru
}
kvm_set_mp_state(vcpu, mp_state->mp_state);
+
+ /*
+ * Force the vCPU out of any hardware-tracked halted state, e.g. VMX's
+ * GUEST_ACTIVITY_STATE=HLT, when userspace puts the vCPU into a state
+ * other than HALTED. The hardware state is sticky across VM-Exit and
+ * VM-Enter and is not touched by any other ioctl, so a vCPU that halted
+ * with HLT-exiting disabled stays wedged even after userspace rewrites
+ * its registers, e.g. when a VMM emulates a machine reset.
+ */
+ if (kvm_hlt_in_guest(vcpu->kvm) &&
+ mp_state->mp_state != KVM_MP_STATE_HALTED)
+ kvm_x86_call(clear_hlt)(vcpu);
+
kvm_make_request(KVM_REQ_EVENT, vcpu);
ret = 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 468/547] KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 467/547] KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 469/547] KVM: x86: Request event processing for exception VM-Exits Greg Kroah-Hartman
` (87 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 719a1d58bf43edd03b271df90b67c58c1e9a7da4 upstream.
Preserve Bus Lock Detect if it isn't present in the payload. Unlike RTM,
which is explicitly modified on every #DB, DR6.BLD is modified if and only
if the #DB is due to a (coincident) Bus Lock Detect.
Per Intel's SDM:
Other debug exceptions do not modify this bit.
And AMD's APM
All other #DB exceptions leave DR6[BLD] unmodified,
Restore the explicit RTM handling that was clobbered by commit
9a3ecd5e2aa1 ("KVM: X86: Rename DR6_INIT to DR6_ACTIVE_LOW"), as the
semantics of any given bit are feature specific, i.e. are obviously not
consistent for active-high versus active-low. In other words, while the
bug was technically introduced when support for Bus Lock Detect was added,
it's really that attempt to genericize handling of active-low bits that set
KVM up to fail.
Fixes: e8ea85fb280e ("KVM: X86: Add support for the emulation of DR6_BUS_LOCK bit")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260930193634.3415089-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 52 ++++++++++++++++++++++++++++++----------------------
1 file changed, 30 insertions(+), 22 deletions(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -399,30 +399,37 @@ void kvm_deliver_exception_payload(struc
switch (ex->vector) {
case DB_VECTOR:
/*
- * "Certain debug exceptions may clear bit 0-3. The
- * remaining contents of the DR6 register are never
- * cleared by the processor".
- */
- vcpu->arch.dr6 &= ~DR_TRAP_BITS;
- /*
- * In order to reflect the #DB exception payload in guest
- * dr6, three components need to be considered: active low
- * bit, FIXED_1 bits and active high bits (e.g. DR6_BD,
- * DR6_BS and DR6_BT)
- * DR6_ACTIVE_LOW contains the FIXED_1 and active low bits.
- * In the target guest dr6:
- * FIXED_1 bits should always be set.
- * Active low bits should be cleared if 1-setting in payload.
- * Active high bits should be set if 1-setting in payload.
+ * DR6 is a mess. Reserved/unused bits are fixed-to-1, and so
+ * to maintain backwards compatibility with existing software,
+ * features that use previously-reserved bits have active-low
+ * semantics, i.e. clear the bit when the feature is present in
+ * the payload.
+ *
+ * Further complicating matters, some DR6 bits are preserved by
+ * hardware, while others are explicitly modified on every #DB.
+ * The trap bits are always set based on the payload, as is the
+ * RTM flag (but it's active low). All other bits are modified
+ * if and only if a relevant debug exception occurs, e.g. BD,
+ * BS, and BT are never cleared by hardware, and BLD is never
+ * set by hardware (when supported, excepting RESET).
*
- * Note, the payload is compatible with the pending debug
- * exceptions/exit qualification under VMX, that active_low bits
- * are active high in payload.
- * So they need to be flipped for DR6.
+ * Lastly, the payload does NOT have active-low semantics, e.g.
+ * so that it's compatible VMX's pending debug exceptions and
+ * qualification fields, and to avoid bleeding the DR6 madness
+ * into other KVM code.
+ *
+ * To compute DR6:
+ *
+ * 1. "Reset" the bits that are modified on all #DBs
+ * 2. Clear active-low bits that are present in the payload.
+ * 3. Set active-high bits that are present in the payload.
+ * 4. Clear fixed-0 bits.
+ * 5. Set fixed-1 bits.
*/
- vcpu->arch.dr6 |= DR6_ACTIVE_LOW;
- vcpu->arch.dr6 |= ex->payload;
- vcpu->arch.dr6 ^= ex->payload & DR6_ACTIVE_LOW;
+ vcpu->arch.dr6 &= ~DR_TRAP_BITS;
+ vcpu->arch.dr6 |= DR6_RTM;
+ vcpu->arch.dr6 &= ~(ex->payload & DR6_ACTIVE_LOW);
+ vcpu->arch.dr6 |= (ex->payload & ~DR6_ACTIVE_LOW);
/*
* The #DB payload is defined as compatible with the 'pending
@@ -431,6 +438,7 @@ void kvm_deliver_exception_payload(struc
* breakpoint), it is reserved and must be zero in DR6.
*/
vcpu->arch.dr6 &= ~BIT(12);
+ vcpu->arch.dr6 |= DR6_FIXED_1;
break;
case PF_VECTOR:
vcpu->arch.cr2 = ex->payload;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 469/547] KVM: x86: Request event processing for exception VM-Exits
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 468/547] KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 470/547] KVM: x86: Take SRCU in kvm_zap_gfn_range() Greg Kroah-Hartman
` (86 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Loc Nguyen, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loc Nguyen <loc@ryzome.com>
commit 88b23a2e8286b7016c3b58dc10093cf28c22aa3d upstream.
Request event processing whenever kvm_queue_exception_vmexit() queues an
exception VM-Exit. Most callers reach the helper through
kvm_multiple_exception(), which already sets KVM_REQ_EVENT, but nested
asynchronous page faults call it directly.
Without another event request, vcpu_enter_guest() skips
kvm_check_and_inject_events() and re-enters L2. A subsequent VM-Exit can
clear the pending exception while reconstructing vectoring state, losing
the synthetic #PF VM-Exit. The APF reason remains PAGE_NOT_PRESENT and a
later regular #PF can consume the stale value.
Setting KVM_REQ_EVENT in the common helper ensures that L1 receives the
queued VM-Exit before KVM re-enters L2.
Fixes: 7709aba8f716 ("KVM: x86: Morph pending exceptions to pending VM-Exits at queue time")
Cc: stable@vger.kernel.org
Signed-off-by: Loc Nguyen <loc@ryzome.com>
Link: https://patch.msgid.link/20261002053723.3275202-2-loc@ryzome.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -456,6 +456,8 @@ static void kvm_queue_exception_vmexit(s
{
struct kvm_queued_exception *ex = &vcpu->arch.exception_vmexit;
+ kvm_make_request(KVM_REQ_EVENT, vcpu);
+
ex->vector = vector;
ex->injected = false;
ex->pending = true;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 470/547] KVM: x86: Take SRCU in kvm_zap_gfn_range()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 469/547] KVM: x86: Request event processing for exception VM-Exits Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 471/547] KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak Greg Kroah-Hartman
` (85 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Kai Huang,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
commit b59a87c1ba3c347e8aec5f932eb7abf13064fd62 upstream.
kvm_zap_gfn_range() walks memslots and rmaps and may drop mmu_lock to
reschedule. Callers that do not already hold kvm->srcu (or slots_lock)
can race with memslot deletion: synchronize_srcu_expedited() does not
wait, kvm_free_memslot() frees the old slot and its rmap, and the zap
resumes on freed memory.
The VFIO noncoherent-DMA path hits this by zapping the entire GPA
space without SRCU. KASAN reported:
BUG: KASAN: vmalloc-out-of-bounds in slot_rmap_walk_next+0x82/0x1c0
Read of size 8 at addr ffffc900005c1008
Call Trace:
slot_rmap_walk_next+0x82/0x1c0
__kvm_rmap_zap_gfn_range+0x17a/0x280
kvm_zap_gfn_range+0x2a6/0x6a0
kvm_vfio_set_attr+0x576/0x770
kvm_device_ioctl+0x1ff/0x3b0
Take SRCU inside kvm_zap_gfn_range() so every caller is covered.
Nesting with an existing kvm->srcu critical section is fine; the
helper uses a local index. Drop the now-redundant SRCU pair from
__kvm_set_or_clear_apicv_inhibit().
Fixes: 362ff6dca541 ("KVM: x86/mmu: Zap KVM TDP when noncoherent DMA assignment starts/stops")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260825183924.237727-1-nicoyip.dev@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 2 ++
arch/x86/kvm/x86.c | 2 --
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -7126,6 +7126,8 @@ void kvm_zap_gfn_range(struct kvm *kvm,
if (WARN_ON_ONCE(gfn_end <= gfn_start))
return;
+ guard(srcu)(&kvm->srcu);
+
write_lock(&kvm->mmu_lock);
kvm_mmu_invalidate_start(kvm);
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7935,10 +7935,8 @@ void __kvm_set_or_clear_apicv_inhibit(st
kvm->arch.apicv_inhibit_reasons = new;
if (new) {
unsigned long gfn = gpa_to_gfn(APIC_DEFAULT_PHYS_BASE);
- int idx = srcu_read_lock(&kvm->srcu);
kvm_zap_gfn_range(kvm, gfn, gfn+1);
- srcu_read_unlock(&kvm->srcu, idx);
}
} else {
kvm->arch.apicv_inhibit_reasons = new;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 471/547] KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 470/547] KVM: x86: Take SRCU in kvm_zap_gfn_range() Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 472/547] KVM: TDX: Check if there is valid exit infos based on vp_enter_ret Greg Kroah-Hartman
` (84 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Teodorescu, Vitaly Kuznetsov,
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 2616f497506a772db53e7bb1024cde50b4c165e0 upstream.
Ensure all reserved flags are zeroed when setting the msg_pending flag as
part of SynIC message delivery, as setting only msg_pending can leak seven
bits of kernel stack data to the guest. E.g. gcc typically uses a
bitwise-OR to set the msg_pending flag, without initializing the on-stack
variable.
Precisely zero the flags, e.g. as opposed to zeroing the entire structure,
to make it somewhat more obvious that the flags *need* to be zeroed. E.g.
it would be quite easy to misread the initial read of guest memory and
think that zeroing the entire structure is completely superfluous.
Fixes: 3a0e7731724f ("x86: kvm: hyperv: simplify SynIC message delivery")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://patch.msgid.link/20260826184449.814130-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/hyperv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -802,7 +802,9 @@ static int synic_deliver_msg(struct kvm_
if (no_retry)
return 0;
+ hv_hdr.message_flags.asu8 = 0;
hv_hdr.message_flags.msg_pending = 1;
+
r = kvm_vcpu_write_guest_page(vcpu, msg_page_gfn,
&hv_hdr.message_flags,
msg_off +
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 472/547] KVM: TDX: Check if there is valid exit infos based on vp_enter_ret
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 471/547] KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 473/547] KVM: TDX: Enable Notify VM exit Greg Kroah-Hartman
` (83 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Xiaoyao Li,
Binbin Wu
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit 0966c881ea13be5ec89820c185de4d55568e80ed upstream.
Check if there is valid exit info based on vp_enter_ret instead of relying
on the clobbered Exit Reason, in tdx_get_exit_info().
Current KVM uses "Exit Reason is not equal to the synthesized invalid
Exit Reason, -1u," as the condition to identify there is a real TD Exit
and valid exit infos. However, there is one issue with this approach:
KVM updates the Exit Reason to the synthesized invalid Exit Reason for
real EPT MISCONFIG as well. This is a false positive for real EPT
MISCONFIG, which has valid exit infos.
Though the issue can be addressed by changing the handling for real EPT
MISCONFIG to not update the Exit Reason to the synthesized one, relying
on the clobbered Exit Reason itself is brittle. Instead, check
vp_enter_ret directly to identify if it is a valid Exit Reason.
Fixes: da407fe45908 ("KVM: TDX: Handle EPT violation/misconfig exit")
Cc: stable@vger.kernel.org
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-3-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/tdx.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -921,21 +921,27 @@ static __always_inline u32 tdcall_to_vmx
return EXIT_REASON_TDCALL;
}
-static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
+static __always_inline bool tdx_is_exit_reason_valid(u64 vp_enter_ret)
{
- struct vcpu_tdx *tdx = to_tdx(vcpu);
- u32 exit_reason;
-
- switch (tdx->vp_enter_ret & TDX_SEAMCALL_STATUS_MASK) {
+ switch (vp_enter_ret & TDX_SEAMCALL_STATUS_MASK) {
case TDX_SUCCESS:
case TDX_NON_RECOVERABLE_VCPU:
case TDX_NON_RECOVERABLE_TD:
case TDX_NON_RECOVERABLE_TD_NON_ACCESSIBLE:
case TDX_NON_RECOVERABLE_TD_WRONG_APIC_MODE:
- break;
+ return true;
default:
- return -1u;
+ return false;
}
+}
+
+static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
+{
+ struct vcpu_tdx *tdx = to_tdx(vcpu);
+ u32 exit_reason;
+
+ if (!tdx_is_exit_reason_valid(tdx->vp_enter_ret))
+ return -1u;
exit_reason = tdx->vp_enter_ret;
@@ -2141,7 +2147,7 @@ void tdx_get_exit_info(struct kvm_vcpu *
struct vcpu_tdx *tdx = to_tdx(vcpu);
*reason = tdx->vt.exit_reason.full;
- if (*reason != -1u) {
+ if (tdx_is_exit_reason_valid(tdx->vp_enter_ret)) {
*info1 = vmx_get_exit_qual(vcpu);
*info2 = tdx->ext_exit_qualification;
*intr_info = vmx_get_intr_info(vcpu);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 473/547] KVM: TDX: Enable Notify VM exit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 472/547] KVM: TDX: Check if there is valid exit infos based on vp_enter_ret Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 474/547] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason Greg Kroah-Hartman
` (82 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Rick Edgecombe,
Binbin Wu, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit d93395058c1951bb657c8895dd1fc0f22263f1cc upstream.
Enable Notify VM exit functionality for TDX guests.
Notify VM exit is an existing feature supported by KVM. Userspace can
enable Notify VM exit through KVM_CAP_X86_NOTIFY_VMEXIT when it's
reported as supported. However, KVM reports the support of this CAP just
based on the hardware capability but doesn't differentiate between VMX
and TDX. This leads to the issue that userspace can enable this cap for
TDX guests without getting an error, but the feature is not actually
enabled because KVM doesn't call the TDX module API to program the
relevant TD VMCS fields.
Enable Notify VM exit for TDX guests by:
- Invoking TDX module API calls to set NOTIFY_VM_EXITING and Notify
Window in TD VMCS. It's done in tdx_vcpu_init() where other TD VMCS
bits are set. Since TDX vCPU cannot be reset, it only needs to be
configured once when initializing the TDX vCPU.
- Adding corresponding exit handler for TDX Notify VM Exit.
Notify VM exit can happen when executing the IRET instruction. If the
IRET unblocks the NMI blocking state, bit 12 of the exit qualification
is set. In this case, the VMM needs to restore the "blocked by NMI" state
when it decides to re-enter the guest. For TDX, KVM cannot manage the
GUEST_INTERRUPTIBILITY_INFO and it's TDX module's responsibility to
handle it. Extract the common part without NMI blocking handling into a
helper in common.h so that it can be shared between VMX and TDX.
Note, KVM uses "pre-production" terminology for the feature formally called
Notify VM-Exit. All public versions of the SDM refer to the feature as
Instruction Timeout. This will be remedied in the near future, for now,
use KVM's terminology for consistency.
Note, #2, there is no enumeration bit for Notify VM exit by TDX module
because all TDX modules support it, and allow to set the corresponding
TD VMCS fields as long as the hardware supports the feature.
Fixes: 161d34609f9b ("KVM: TDX: Make TDX VM type supported")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-2-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/common.h | 19 +++++++++++++++++++
arch/x86/kvm/vmx/tdx.c | 10 ++++++++++
arch/x86/kvm/vmx/vmx.c | 13 +------------
3 files changed, 30 insertions(+), 12 deletions(-)
--- a/arch/x86/kvm/vmx/common.h
+++ b/arch/x86/kvm/vmx/common.h
@@ -4,6 +4,7 @@
#include <linux/kvm_host.h>
#include <asm/posted_intr.h>
+#include <asm/vmx.h>
#include "mmu.h"
@@ -183,6 +184,24 @@ static inline void __vmx_deliver_posted_
kvm_vcpu_trigger_posted_interrupt(vcpu, POSTED_INTR_VECTOR);
}
+static inline int __vt_handle_notify(struct kvm_vcpu *vcpu,
+ unsigned long exit_qual)
+{
+ bool context_invalid = exit_qual & NOTIFY_VM_CONTEXT_INVALID;
+
+ ++vcpu->stat.notify_window_exits;
+
+ if (vcpu->kvm->arch.notify_vmexit_flags & KVM_X86_NOTIFY_VMEXIT_USER ||
+ context_invalid) {
+ vcpu->run->exit_reason = KVM_EXIT_NOTIFY;
+ vcpu->run->notify.flags = context_invalid ?
+ KVM_NOTIFY_CONTEXT_INVALID : 0;
+ return 0;
+ }
+
+ return 1;
+}
+
noinstr void vmx_handle_nmi(struct kvm_vcpu *vcpu);
int vt_handle_bus_lock_vmexit(struct kvm_vcpu *vcpu);
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -2132,6 +2132,9 @@ int tdx_handle_exit(struct kvm_vcpu *vcp
* - If it's not an MSMI, no need to do anything here.
*/
return 1;
+ case EXIT_REASON_NOTIFY:
+ /* NMI blocking state is handled by TDX module */
+ return __vt_handle_notify(vcpu, vmx_get_exit_qual(vcpu));
default:
break;
}
@@ -3155,6 +3158,13 @@ static int tdx_vcpu_init(struct kvm_vcpu
td_vmcs_write64(tdx, POSTED_INTR_DESC_ADDR, __pa(&tdx->vt.pi_desc));
td_vmcs_setbit32(tdx, PIN_BASED_VM_EXEC_CONTROL, PIN_BASED_POSTED_INTR);
+ if (kvm_notify_vmexit_enabled(vcpu->kvm)) {
+ td_vmcs_setbit32(tdx, SECONDARY_VM_EXEC_CONTROL,
+ SECONDARY_EXEC_NOTIFY_VM_EXITING);
+ td_vmcs_write32(tdx, NOTIFY_WINDOW,
+ vcpu->kvm->arch.notify_window);
+ }
+
tdx->state = VCPU_TD_STATE_INITIALIZED;
return 0;
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6270,9 +6270,6 @@ static int handle_encls(struct kvm_vcpu
static int handle_notify(struct kvm_vcpu *vcpu)
{
unsigned long exit_qual = vmx_get_exit_qual(vcpu);
- bool context_invalid = exit_qual & NOTIFY_VM_CONTEXT_INVALID;
-
- ++vcpu->stat.notify_window_exits;
/*
* Notify VM exit happened while executing iret from NMI,
@@ -6282,15 +6279,7 @@ static int handle_notify(struct kvm_vcpu
vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
GUEST_INTR_STATE_NMI);
- if (vcpu->kvm->arch.notify_vmexit_flags & KVM_X86_NOTIFY_VMEXIT_USER ||
- context_invalid) {
- vcpu->run->exit_reason = KVM_EXIT_NOTIFY;
- vcpu->run->notify.flags = context_invalid ?
- KVM_NOTIFY_CONTEXT_INVALID : 0;
- return 0;
- }
-
- return 1;
+ return __vt_handle_notify(vcpu, exit_qual);
}
static int vmx_get_msr_imm_reg(struct kvm_vcpu *vcpu)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 474/547] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 473/547] KVM: TDX: Enable Notify VM exit Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 475/547] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return Greg Kroah-Hartman
` (81 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Rick Edgecombe,
Binbin Wu, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit b43c520b198ab70868307a489ef2117ed6d6c4cc upstream.
Set bits 31:16 to 0 instead of all-1s when synthesizing an exit reason,
e.g. if the TDX Module never attempted VM-Enter, or when stuffing the exit
reason due to an unexpected "real" EPT Misconfig. Opportunistically use
VMX's KVM-defined EXIT_REASON_UNDEFINED (0xdead) instead of -1u.
KVM is going to support Bus Lock VM exit for TDX, after which bit 26 of
the Exit Reason becomes meaningful and indicates that a bus lock happened.
The existing synthesized Exit Reason, -1u, will cause a false positive in
that case. Change the synthesized Exit Reason from -1u to U16_MAX, so that
bits 31:16 are set to 0. This also avoids the potential issues when other
bits in 31:16 become valid in the future.
As a bonus, the check for synthesized Exit Reason in tdx_failed_vmentry()
becomes unnecessary. Just drop it.
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-4-xiaoyao.li@intel.com
[sean: use EXIT_REASON_UNDEFINED instead of another magic value]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/tdx.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -940,8 +940,13 @@ static __always_inline u32 tdx_to_vmx_ex
struct vcpu_tdx *tdx = to_tdx(vcpu);
u32 exit_reason;
+ /*
+ * Return the synthesized invalid Exit Reason, as the TDX module
+ * never attempted to run the vCPU, i.e. the Exit Reason is undefined,
+ * but this is NOT a failed VM-Enter.
+ */
if (!tdx_is_exit_reason_valid(tdx->vp_enter_ret))
- return -1u;
+ return EXIT_REASON_UNDEFINED;
exit_reason = tdx->vp_enter_ret;
@@ -956,7 +961,7 @@ static __always_inline u32 tdx_to_vmx_ex
* Defer KVM_BUG_ON() until tdx_handle_exit() because this is in
* non-instrumentable code with interrupts disabled.
*/
- return -1u;
+ return EXIT_REASON_UNDEFINED;
default:
break;
}
@@ -987,8 +992,7 @@ static noinstr void tdx_vcpu_enter_exit(
static bool tdx_failed_vmentry(struct kvm_vcpu *vcpu)
{
- return vmx_get_exit_reason(vcpu).failed_vmentry &&
- vmx_get_exit_reason(vcpu).full != -1u;
+ return vmx_get_exit_reason(vcpu).failed_vmentry;
}
static fastpath_t tdx_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 475/547] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 474/547] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason Greg Kroah-Hartman
@ 2026-11-04 21:10 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 476/547] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason() Greg Kroah-Hartman
` (80 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit e5f1d62c59aea4f270773de1bf6e8867f5b1124c upstream.
Forcefully update the exit_reason to KVM's "standard" EXIT_REASON_UNDEFINED
if tdx_vcpu_run() bails without trying to run the vCPU because KVM needs to
wait for an in-progress S-EPT zap to complete. This avoids handling the
previous exit multiple times due to a stale exit_reason.
Fixes: 4b2abc49712b ("KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-6-xiaoyao.li@intel.com
[sean: use EXIT_REASON_UNDEFINED, drop comment about bits 31:16]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/tdx.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1081,8 +1081,16 @@ fastpath_t tdx_vcpu_run(struct kvm_vcpu
* allowing vCPU entry to avoid contention with tdh_vp_enter() and
* TDCALLs.
*/
- if (unlikely(READ_ONCE(to_kvm_tdx(vcpu->kvm)->wait_for_sept_zap)))
+ if (unlikely(READ_ONCE(to_kvm_tdx(vcpu->kvm)->wait_for_sept_zap))) {
+ /*
+ * The vCPU never entered the guest, but this looks like a
+ * handled exit to the caller. Synthesize an invalid exit
+ * reason so the previous exit's stale value isn't consumed
+ * a second time.
+ */
+ vt->exit_reason.full = EXIT_REASON_UNDEFINED;
return EXIT_FASTPATH_EXIT_HANDLED;
+ }
trace_kvm_entry(vcpu, run_flags & KVM_RUN_FORCE_IMMEDIATE_EXIT);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 476/547] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-11-04 21:10 ` [PATCH 7.3 475/547] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 477/547] KVM: TDX: Enable Bus Lock VM exit Greg Kroah-Hartman
` (79 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit bc335ce04408750585b4b32f248c543c9493d545 upstream.
When handling the real Exit Reason, don't assume the upper 16 bits as
all-0 in tdx_to_vmx_exit_reason(), in preparation for enabling Bus Lock
VM exit.
When Bus Lock VM exit is enabled, the bit 26 of Exit Reason becomes
valid and it can be 1 with various exit reasons. Change the logic in
tdx_to_vmx_exit_reason() to check the 'basic' Exit Reason for correctness.
Also preserve bit[31:16] when changing the (basic) Exit Reason, to not
lose the information in bit[31:16].
Change the return type of tdx_to_vmx_exit_reason() to
"union vmx_exit_reason" for the convenience of manipulating the basic
field.
Fixes: c42856af8f70 ("KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL)")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-5-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/tdx.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -935,10 +935,10 @@ static __always_inline bool tdx_is_exit_
}
}
-static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
+static __always_inline union vmx_exit_reason tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
{
struct vcpu_tdx *tdx = to_tdx(vcpu);
- u32 exit_reason;
+ union vmx_exit_reason exit_reason;
/*
* Return the synthesized invalid Exit Reason, as the TDX module
@@ -946,22 +946,26 @@ static __always_inline u32 tdx_to_vmx_ex
* but this is NOT a failed VM-Enter.
*/
if (!tdx_is_exit_reason_valid(tdx->vp_enter_ret))
- return EXIT_REASON_UNDEFINED;
+ return (union vmx_exit_reason) {
+ .basic = EXIT_REASON_UNDEFINED,
+ };
- exit_reason = tdx->vp_enter_ret;
+ exit_reason.full = (u32)tdx->vp_enter_ret;
- switch (exit_reason) {
+ switch (exit_reason.basic) {
case EXIT_REASON_TDCALL:
if (tdvmcall_exit_type(vcpu))
- return EXIT_REASON_VMCALL;
-
- return tdcall_to_vmx_exit_reason(vcpu);
+ exit_reason.basic = EXIT_REASON_VMCALL;
+ else
+ exit_reason.basic = tdcall_to_vmx_exit_reason(vcpu);
+ break;
case EXIT_REASON_EPT_MISCONFIG:
/*
* Defer KVM_BUG_ON() until tdx_handle_exit() because this is in
* non-instrumentable code with interrupts disabled.
*/
- return EXIT_REASON_UNDEFINED;
+ exit_reason.basic = EXIT_REASON_UNDEFINED;
+ break;
default:
break;
}
@@ -978,7 +982,7 @@ static noinstr void tdx_vcpu_enter_exit(
tdx->vp_enter_ret = tdh_vp_enter(&tdx->vp, &tdx->vp_enter_args);
- vt->exit_reason.full = tdx_to_vmx_exit_reason(vcpu);
+ vt->exit_reason = tdx_to_vmx_exit_reason(vcpu);
vt->exit_qualification = tdx->vp_enter_args.rcx;
tdx->ext_exit_qualification = tdx->vp_enter_args.rdx;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 477/547] KVM: TDX: Enable Bus Lock VM exit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 476/547] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason() Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 478/547] KVM: guest_memfd: Split bind() into prepare()+commit() phases Greg Kroah-Hartman
` (78 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Nikolay Borisov,
Sean Christopherson, Chenyi Qiang
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
commit 63d196e2e20429de5ba501f1b6059d9b93140007 upstream.
Enable Bus Lock VM exit functionality for TDX guests.
Bus Lock VM exit is an existing feature supported by KVM. Userspace can
enable Bus Lock VM exit through KVM_BUS_LOCK_DETECTION_EXIT when it's
reported as supported. However, KVM reports the support of this CAP
just based on the hardware capability but doesn't differentiate between
VMX and TDX. This leads to the issue that userspace can enable this cap
for TDX guests without getting an error, but the feature is not actually
enabled because KVM doesn't call the TDX module API to program the
relevant TD VMCS fields.
Enable Bus Lock VM exit for TDX guests by programming the
BUS_LOCK_DETECTION control in the TD VMCS and by adding the exit handler.
Note, there is no enumeration bit for this feature by TDX module because
all TDX modules support it and allow to set the TD VMCS as long as the
hardware supports the feature.
Fixes: 161d34609f9b ("KVM: TDX: Make TDX VM type supported")
Cc: stable@vger.kernel.org
Originally-by: Chenyi Qiang <chenyi.qiang@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Link: https://patch.msgid.link/20260819094903.3060020-9-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/tdx.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -2050,7 +2050,7 @@ int tdx_complete_emulated_msr(struct kvm
}
-int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
+static int __tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
{
struct vcpu_tdx *tdx = to_tdx(vcpu);
u64 vp_enter_ret = tdx->vp_enter_ret;
@@ -2151,6 +2151,8 @@ int tdx_handle_exit(struct kvm_vcpu *vcp
case EXIT_REASON_NOTIFY:
/* NMI blocking state is handled by TDX module */
return __vt_handle_notify(vcpu, vmx_get_exit_qual(vcpu));
+ case EXIT_REASON_BUS_LOCK:
+ return vt_handle_bus_lock_vmexit(vcpu);
default:
break;
}
@@ -2160,6 +2162,22 @@ unhandled_exit:
return 0;
}
+int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
+{
+ int ret = __tdx_handle_exit(vcpu, fastpath);
+
+ /* Exit to user space when bus lock was detected */
+ if (vmx_get_exit_reason(vcpu).bus_lock_detected) {
+ if (ret > 0) {
+ vcpu->run->exit_reason = KVM_EXIT_X86_BUS_LOCK;
+ ret = 0;
+ }
+
+ vcpu->run->flags |= KVM_RUN_X86_BUS_LOCK;
+ }
+ return ret;
+}
+
void tdx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code)
{
@@ -3181,6 +3199,10 @@ static int tdx_vcpu_init(struct kvm_vcpu
vcpu->kvm->arch.notify_window);
}
+ if (vcpu->kvm->arch.bus_lock_detection_enabled)
+ td_vmcs_setbit32(tdx, SECONDARY_VM_EXEC_CONTROL,
+ SECONDARY_EXEC_BUS_LOCK_DETECTION);
+
tdx->state = VCPU_TD_STATE_INITIALIZED;
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 478/547] KVM: guest_memfd: Split bind() into prepare()+commit() phases
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 477/547] KVM: TDX: Enable Bus Lock VM exit Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 479/547] KVM: guest_memfd: take the invalidate lock when unbinding a dying file Greg Kroah-Hartman
` (77 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 83411f32b8ad96c6b05b1511d1a588daab44bd25 upstream.
Split binding a memslot to a guest_memfd instance into prepare() and
commit() phases so that KVM can separate preparing the memslot from binding
the memslot to the gmem instance, i.e. from committing the memslot. This
will allow waiting to commit the memslot+gmem binding until the memslot is
fully prepared, which is necessary as the memslot becomes reachable when
the binding is created.
As a bonus, drop the unwind-on-failure from the commit phase (other than
nullifying the bindings), as the only reason bind() did the full unwind is
because it technically didn't own the memslot, i.e. "needed" to leave
memslot in the same state it started in.
No functional change intended (the unwinding down on bind() failure was
effectively dead code since KVM simply deletes the memslot on failure,
i.e. there was nothing that could actually observe the unwind).
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Link: https://patch.msgid.link/20260922001332.1121266-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/guest_memfd.c | 68 ++++++++++++++++++++++++++++---------------------
virt/kvm/guest_memfd.h | 19 ++++++++++---
virt/kvm/kvm_main.c | 18 ++++++++++++
3 files changed, 70 insertions(+), 35 deletions(-)
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -603,15 +603,14 @@ int kvm_gmem_create(struct kvm *kvm, str
return __kvm_gmem_create(kvm, size, flags);
}
-int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
- unsigned int fd, uoff_t offset)
+int kvm_gmem_prepare_memory_region(struct kvm *kvm, struct kvm_memory_slot *slot,
+ unsigned int fd, uoff_t offset)
{
uoff_t size = slot->npages << PAGE_SHIFT;
- unsigned long start, end;
struct gmem_file *f;
struct inode *inode;
struct file *file;
- int r = -EINVAL;
+
BUILD_BUG_ON(sizeof(gpa_t) != sizeof(offset));
BUILD_BUG_ON(sizeof(gfn_t) != sizeof(slot->gmem.pgoff));
@@ -635,44 +634,55 @@ int kvm_gmem_bind(struct kvm *kvm, struc
if (!PAGE_ALIGNED(offset) || offset + size > i_size_read(inode))
goto err;
- filemap_invalidate_lock(inode->i_mapping);
-
- start = offset >> PAGE_SHIFT;
- end = start + slot->npages;
-
- if (!xa_empty(&f->bindings) &&
- xa_find(&f->bindings, &start, end - 1, XA_PRESENT)) {
- r = -EEXIST;
- filemap_invalidate_unlock(inode->i_mapping);
- goto err;
- }
-
/*
* memslots of flag KVM_MEM_GUEST_MEMFD are immutable to change, so
* kvm_gmem_bind() must occur on a new memslot. Because the memslot
* is not visible yet, kvm_gmem_get_pfn() is guaranteed to see the file.
*/
WRITE_ONCE(slot->gmem.file, file);
- slot->gmem.pgoff = start;
+ slot->gmem.pgoff = offset >> PAGE_SHIFT;
if (kvm_gmem_supports_mmap(inode))
slot->flags |= KVM_MEMSLOT_GMEM_ONLY;
- r = xa_err(xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL));
- if (r) {
- xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL);
- slot->gmem.file = NULL;
- slot->gmem.pgoff = 0;
- slot->flags &= ~KVM_MEMSLOT_GMEM_ONLY;
- }
- filemap_invalidate_unlock(inode->i_mapping);
-
/*
- * Drop the reference to the file, even on success. The file pins KVM,
- * not the other way 'round. Active bindings are invalidated if the
- * file is closed before memslots are destroyed.
+ * Gift the caller a reference to the file. The reference will be
+ * dropped after bindings are established, or if installing the new
+ * memslot ultimately fails.
*/
+ return 0;
+
err:
fput(file);
+ return -EINVAL;
+}
+
+int kvm_gmem_commit_memory_region(struct kvm *kvm, struct kvm_memory_slot *slot)
+{
+ struct gmem_file *f = slot->gmem.file->private_data;
+ struct inode *inode = file_inode(slot->gmem.file);
+ unsigned long start, end;
+ int r;
+
+ if (WARN_ON_ONCE(slot->gmem.file->f_op != &kvm_gmem_fops))
+ return -EIO;
+
+ filemap_invalidate_lock(inode->i_mapping);
+
+ start = slot->gmem.pgoff;
+ end = start + slot->npages;
+
+ if (!xa_empty(&f->bindings) &&
+ xa_find(&f->bindings, &start, end - 1, XA_PRESENT)) {
+ filemap_invalidate_unlock(inode->i_mapping);
+ return -EEXIST;
+ }
+
+ r = xa_err(xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL));
+ if (r)
+ xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL);
+
+ filemap_invalidate_unlock(inode->i_mapping);
+
return r;
}
--- a/virt/kvm/guest_memfd.h
+++ b/virt/kvm/guest_memfd.h
@@ -8,8 +8,9 @@
int kvm_gmem_init(struct module *module);
void kvm_gmem_exit(void);
int kvm_gmem_create(struct kvm *kvm, struct kvm_create_guest_memfd *args);
-int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
- unsigned int fd, uoff_t offset);
+int kvm_gmem_prepare_memory_region(struct kvm *kvm, struct kvm_memory_slot *slot,
+ unsigned int fd, uoff_t offset);
+int kvm_gmem_commit_memory_region(struct kvm *kvm, struct kvm_memory_slot *slot);
void kvm_gmem_unbind(struct kvm_memory_slot *slot);
#else
static inline int kvm_gmem_init(struct module *module)
@@ -17,9 +18,17 @@ static inline int kvm_gmem_init(struct m
return 0;
}
static inline void kvm_gmem_exit(void) {};
-static inline int kvm_gmem_bind(struct kvm *kvm,
- struct kvm_memory_slot *slot,
- unsigned int fd, uoff_t offset)
+
+static inline int kvm_gmem_prepare_memory_region(struct kvm *kvm,
+ struct kvm_memory_slot *slot,
+ unsigned int fd, uoff_t offset)
+{
+ WARN_ON_ONCE(1);
+ return -EIO;
+}
+
+static inline int kvm_gmem_commit_memory_region(struct kvm *kvm,
+ struct kvm_memory_slot *slot)
{
WARN_ON_ONCE(1);
return -EIO;
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2123,7 +2123,23 @@ static int kvm_set_memory_region(struct
new->flags = mem->flags;
new->userspace_addr = mem->userspace_addr;
if (change == KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD)) {
- r = kvm_gmem_bind(kvm, new, mem->guest_memfd, mem->guest_memfd_offset);
+ r = kvm_gmem_prepare_memory_region(kvm, new, mem->guest_memfd,
+ mem->guest_memfd_offset);
+ if (r)
+ goto out;
+
+ r = kvm_gmem_commit_memory_region(kvm, new);
+
+ /*
+ * Drop the reference to the file, even on success. The file
+ * pins KVM, not the other way 'round. Active bindings are
+ * invalidated if the file is closed before memslots are
+ * destroyed.
+ */
+#ifdef CONFIG_KVM_GUEST_MEMFD
+ fput(new->gmem.file);
+#endif
+
if (r)
goto out;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 479/547] KVM: guest_memfd: take the invalidate lock when unbinding a dying file
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 478/547] KVM: guest_memfd: Split bind() into prepare()+commit() phases Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 480/547] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready Greg Kroah-Hartman
` (76 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Sean Christopherson,
Shivank Garg, David Hildenbrand (Arm)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivank Garg <shivankg@amd.com>
commit 0ee2c883b62deb74d8c43007e8049dc006d3a2fb upstream.
kvm_gmem_unbind() takes mapping->invalidate_lock only if the
get_file_active() succeeds. When the guest_memfd file is dying, its
reference count is already zero so get_file_active fails and the binding
is removed without holding the invalidate lock.
kvm_gmem_invalidate_{start,end}() checks f->bindings independently to
decide whether to begin or end KVM MMU invalidation. So, the bindings
must therefore remain stable between the two calls. Otherwise, unbind
can remove a binding after start increments mmu_invalidate_in_progress,
but before end finds the binding and decrements it.
Example, unbind race with memory failure:
CPU 0: memory failure CPU 1: memslot delete
---------------------------------- ---------------------------
(guest_memfd file is dying)
kvm_gmem_error_folio()
kvm_gmem_invalidate_start()
finds binding
mmu_invalidate_in_progress++
kvm_gmem_unbind()
get_file_active() fails
removes binding
kvm_gmem_invalidate_end()
no binding found
counter stays elevated
mmu_invalidate_retry() then returns 1 forever, so guest page faults
retry without ever installing a mapping and the guest hangs.
Remove the distinction between live and dying files in the unbind path.
Always use slot->gmem.file and take the invalidate lock when it's non-NULL.
Normal unbind callers hold slots_lock, which prevents release from clearing
the pointer or freeing the file state until unbind completes. Final VM
teardown can only see a NULL pointer because guest_memfd pins the KVM until
release has cleared all bindings.
Fixes: ae431059e75d ("KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260728092027.225CF1F000E9@smtp.kernel.org
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Link: https://patch.msgid.link/20260901-gmem-unbind-fix-v2-1-12febe1d2216@amd.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/guest_memfd.c | 44 ++++++++++++++++++--------------------------
1 file changed, 18 insertions(+), 26 deletions(-)
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -686,48 +686,40 @@ int kvm_gmem_commit_memory_region(struct
return r;
}
-static void __kvm_gmem_unbind(struct kvm_memory_slot *slot, struct gmem_file *f)
+void kvm_gmem_unbind(struct kvm_memory_slot *slot)
{
+ struct file *file = slot->gmem.file;
unsigned long start = slot->gmem.pgoff;
unsigned long end = start + slot->npages;
-
- xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL);
+ struct gmem_file *f;
/*
- * synchronize_srcu(&kvm->srcu) ensured that kvm_gmem_get_pfn()
- * cannot see this memslot.
- */
- WRITE_ONCE(slot->gmem.file, NULL);
-}
-
-void kvm_gmem_unbind(struct kvm_memory_slot *slot)
-{
- /*
* Nothing to do if the underlying file was _already_ closed, as
* kvm_gmem_release() invalidates and nullifies all bindings.
*/
- if (!slot->gmem.file)
+ if (!file)
return;
- CLASS(gmem_get_file, file)(slot);
-
/*
* However, if the file is _being_ closed, then the bindings need to be
* removed as kvm_gmem_release() might not run until after the memslot
- * is freed. Note, modifying the bindings is safe even though the file
- * is dying as kvm_gmem_release() nullifies slot->gmem.file under
- * slots_lock, and only puts its reference to KVM after destroying all
- * bindings. I.e. reaching this point means kvm_gmem_release() hasn't
- * yet destroyed the bindings or freed the gmem_file, and can't do so
- * until the caller drops slots_lock.
+ * is freed. Modifying the bindings is safe even if the file is dying
+ * as kvm_gmem_release() nullifies slot->gmem.file under slots_lock,
+ * and only puts its reference to KVM after destroying all bindings.
+ * I.e. reaching this point means kvm_gmem_release() hasn't destroyed
+ * the bindings or freed the gmem_file and can't do so until the caller
+ * drops slots_lock, so there's no need to verify the file is live.
*/
- if (!file) {
- __kvm_gmem_unbind(slot, slot->gmem.file->private_data);
- return;
- }
+ f = file->private_data;
filemap_invalidate_lock(file->f_mapping);
- __kvm_gmem_unbind(slot, file->private_data);
+ xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL);
+
+ /*
+ * synchronize_srcu(&kvm->srcu) ensured that kvm_gmem_get_pfn()
+ * cannot see this memslot.
+ */
+ WRITE_ONCE(slot->gmem.file, NULL);
filemap_invalidate_unlock(file->f_mapping);
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 480/547] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 479/547] KVM: guest_memfd: take the invalidate lock when unbinding a dying file Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 481/547] KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users Greg Kroah-Hartman
` (75 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko Bot, Sean Christopherson
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 3fe5d2944e5ac3fc5073344b0982c73703332e18 upstream.
Wait to bind a memslot to a guest_memfd instance until *after* the memslot
is fully prepared, as creating the binding in guest_memfd will effectively
expose the memslot to readers. As pointed out by Sashiko, binding the
memslot before it's ready to be exposed to the rest of the world can break
various memslot assumption and rules. E.g. x86 could observe a NULL rmap
pointer if a PUNCH_HOLE hit the guest_memfd after the binding was created,
but before KVM made it through kvm_prepare_memory_region().
Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory")
Cc: stable@vger.kernel.org
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260826170551.BEF801F000E9@smtp.kernel.org
Link: https://patch.msgid.link/20260922001332.1121266-6-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/kvm_main.c | 36 +++++++++++++++++++-----------------
1 file changed, 19 insertions(+), 17 deletions(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1950,6 +1950,15 @@ static int kvm_set_memslot(struct kvm *k
if (r)
goto err;
+ if (change == KVM_MR_CREATE && (new->flags & KVM_MEM_GUEST_MEMFD)) {
+ r = kvm_gmem_commit_memory_region(kvm, new);
+ if (r) {
+ kvm_arch_free_memslot(kvm, new);
+ kvm_destroy_dirty_bitmap(new);
+ goto err;
+ }
+ }
+
/*
* For DELETE and MOVE, the working slot is now active as the INVALID
* version of the old slot. MOVE is particularly special as it reuses
@@ -2127,32 +2136,25 @@ static int kvm_set_memory_region(struct
mem->guest_memfd_offset);
if (r)
goto out;
+ }
- r = kvm_gmem_commit_memory_region(kvm, new);
+ r = kvm_set_memslot(kvm, old, new, change);
- /*
- * Drop the reference to the file, even on success. The file
- * pins KVM, not the other way 'round. Active bindings are
- * invalidated if the file is closed before memslots are
- * destroyed.
- */
+ /*
+ * Drop the reference to the gmem file, even on success. The file pins
+ * KVM, not the other way 'round. Active bindings are invalidated if
+ * the file is closed before memslots are destroyed.
+ */
#ifdef CONFIG_KVM_GUEST_MEMFD
- fput(new->gmem.file);
+ if (change == KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD))
+ fput(new->gmem.file);
#endif
- if (r)
- goto out;
- }
-
- r = kvm_set_memslot(kvm, old, new, change);
if (r)
- goto out_unbind;
+ goto out;
return 0;
-out_unbind:
- if (change == KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD))
- kvm_gmem_unbind(new);
out:
kfree(new);
return r;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 481/547] KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 480/547] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 482/547] KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form Greg Kroah-Hartman
` (74 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amit Machhiwal, Ritesh Harjani (IBM),
Madhavan Srinivasan
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Machhiwal <amachhiw@linux.ibm.com>
commit abbbe5ff83e7c9ed3a4d61b73011f1df7bf87907 upstream.
kvmppc_hv_find_lock_hpte() requires virtual-mode callers to run with
preemption disabled, because it can return with HPTE_V_HVLOCK still held
until the caller later unlocks the HPTE. Existing virtual-mode callers
in book3s_64_mmu_hv.c already follow that rule.
Two virtual-mode call paths do not:
1. kvmppc_handle_exit_hv() calls kvmppc_hpte_hv_fault() for hash-mode
data-side and instruction-side faults after guest exit, with
preemption already enabled. kvmppc_hpte_hv_fault() calls
kvmppc_hv_find_lock_hpte() directly.
2. kvmppc_pseries_do_hcall() executes virtual-mode handlers for HPT
hcalls via kvmppc_pseries_do_hpt_hcall() with preemption enabled.
The handlers for H_ENTER, H_REMOVE, H_READ, H_CLEAR_MOD, H_CLEAR_REF,
H_PROTECT, and H_BULK_REMOVE spin on try_lock_hpte() or lock_rmap(),
and H_ENTER also reaches kvmppc_do_h_enter(), which uses
arch_spin_lock() on kvm->mmu_lock. That raw lock choice is
intentional because kvmppc_do_h_enter() is also used by real-mode
callers, so the correct fix is to establish the proper preemption
context at the virtual-mode caller boundary.
If a vCPU thread is preempted while holding HPTE_V_HVLOCK, any other
thread on the same CPU trying to acquire the same bit-lock can spin
indefinitely. The same applies to lock_rmap() users and to the H_ENTER
path while holding the raw mmu_lock.
Fix this by adding preempt_disable()/preempt_enable() pairs around the
two kvmppc_hpte_hv_fault() call sites in kvmppc_handle_exit_hv(), and
around the kvmppc_pseries_do_hpt_hcall() invocation in
kvmppc_pseries_do_hcall(). Targeting only the HPT hcall helper avoids
wrapping non-HPT hcalls (such as H_RTAS, H_CONFER, H_REGISTER_VPA) that
perform page faults, blocking memory allocations, or context switches.
Fixes: 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for HPT hcalls and page faults")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260928122837.8782-3-amachhiw@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kvm/book3s_hv.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1212,9 +1212,11 @@ int kvmppc_pseries_do_hcall(struct kvm_v
case H_CLEAR_REF:
case H_PROTECT:
case H_BULK_REMOVE:
+ preempt_disable();
idx = srcu_read_lock(&kvm->srcu);
ret = kvmppc_pseries_do_hpt_hcall(vcpu, req);
srcu_read_unlock(&kvm->srcu, idx);
+ preempt_enable();
if (ret == H_TOO_HARD)
return RESUME_HOST;
break;
@@ -1834,8 +1836,10 @@ static int kvmppc_handle_exit_hv(struct
else
vsid = vcpu->arch.fault_gpa;
+ preempt_disable();
err = kvmppc_hpte_hv_fault(vcpu, vcpu->arch.fault_dar,
vsid, vcpu->arch.fault_dsisr, true);
+ preempt_enable();
if (err == 0) {
r = RESUME_GUEST;
} else if (err == -1 || err == -2) {
@@ -1881,8 +1885,10 @@ static int kvmppc_handle_exit_hv(struct
else
vsid = vcpu->arch.fault_gpa;
+ preempt_disable();
err = kvmppc_hpte_hv_fault(vcpu, vcpu->arch.fault_dar,
vsid, vcpu->arch.fault_dsisr, false);
+ preempt_enable();
if (err == 0) {
r = RESUME_GUEST;
} else if (err == -1) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 482/547] KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 481/547] KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 483/547] HID: usbhid: skip interrupt IN polling for devices with no input reports Greg Kroah-Hartman
` (73 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amit Machhiwal, Madhavan Srinivasan
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Machhiwal <amachhiw@linux.ibm.com>
commit 31895b0ff96778b524c74b43a108090581271603 upstream.
get_d_signext() has two compounding bugs since its introduction in 2010:
1. The extraction mask 0x8FF silently drops bits 8-10 of the 12-bit D
field (PPC ISA bits 21-23), corrupting any displacement that has any
of those bits set.
2. The sign-magnitude idiom "-(d & 0x7ff)" is wrong for two's-complement:
for D=0xFFC (encoding of -4) it returns -252 instead of -4.
Together these errors produce a wrong effective address for psq_l, psq_lu,
psq_st, and psq_stu whenever the displacement is negative or is a positive
value >= 0x100 with bits 8-10 set — essentially any real-world paired-
single stack-relative access.
The D field occupies the bottom 12 bits of the instruction word (confirmed
by the adjacent W and I extractions via inst_get_field(inst,16,16) and
inst_get_field(inst,17,19)). Replace the open-coded logic with the standard
sign_extend32(inst & 0xfff, 11), which correctly performs two's-complement
sign extension from 12 bits to 32 bits.
Fixes: 831317b605e7 ("KVM: PPC: Implement Paired Single emulation")
Cc: stable@vger.kernel.org
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260928122837.8782-4-amachhiw@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kvm/book3s_paired_singles.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/arch/powerpc/kvm/book3s_paired_singles.c
+++ b/arch/powerpc/kvm/book3s_paired_singles.c
@@ -479,12 +479,7 @@ static bool kvmppc_inst_is_paired_single
static int get_d_signext(u32 inst)
{
- int d = inst & 0x8ff;
-
- if (d & 0x800)
- return -(d & 0x7ff);
-
- return (d & 0x7ff);
+ return sign_extend32(inst & 0xfff, 11);
}
static int kvmppc_ps_three_in(struct kvm_vcpu *vcpu, bool rc,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 483/547] HID: usbhid: skip interrupt IN polling for devices with no input reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 482/547] KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 484/547] HID: zydacron: validate key report length Greg Kroah-Hartman
` (72 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kerim Kabirov, GameBurrow,
Ahmed Yaseen, Denis Benato, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Yaseen <yaseen@ghoul.dev>
commit 4563e596bd913fb2d5b10b2ef306c754cf97ced2 upstream.
usbhid starts polling a device's interrupt IN endpoint on open
(usbhid_open() -> hid_start_in()). If the report descriptor declares no
input reports there is nothing to read there, so the poll is useless,
and on some composite devices it is also harmful.
The ASUS ROG N-Key keyboards expose a second, input-less interface used
only for RGB control via feature reports. Opening its hidraw node (any
hidraw reader does, including SDL/Steam Input or a plain cat) starts the
pointless IN poll and keypress reports on the keyboard interface get
dropped for as long as the node stays open: a lost key-down drops a
letter, a lost key-up leaves the key stuck. usbmon shows the dropped
reports never reach the URB layer.
The useless poll itself is long-standing; commit 4ac74ea68f64 ("HID:
asus: early return for ROG devices") is what exposes it on these
devices by keeping the input-less interface alive instead of ejecting
it, so its hidraw node can be opened and the poll started.
Skip the poll in usbhid_open() when the device has no input reports.
Feature reports and hidraw output keep working over the control and OUT
endpoints, so the interface is otherwise unaffected.
Fixes: 4ac74ea68f64 ("HID: asus: early return for ROG devices")
Link: https://discuss.cachyos.org/t/keyboard-input-issues-on-asus-rog-strix-16-2025-with-cachyos-during-gaming/30823
Link: https://github.com/ublue-os/bazzite/issues/4590
Cc: stable@vger.kernel.org
Tested-by: Kerim Kabirov <the.privat33r+linux@pm.me>
Tested-by: GameBurrow <gameburrow@pm.me>
Signed-off-by: Ahmed Yaseen <yaseen@ghoul.dev>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hid-core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 96b0181cf819..d7cf2b56e117 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -688,7 +688,14 @@ static int usbhid_open(struct hid_device *hid)
set_bit(HID_OPENED, &usbhid->iofl);
- if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
+ /*
+ * ALWAYS_POLL devices are already polled from usbhid_start(), and a
+ * device with no input reports has nothing to send on the interrupt
+ * IN endpoint. In some cases polling is harmful: on the ASUS ROG
+ * N-Key keyboards it makes the sibling interface drop keypresses.
+ */
+ if ((hid->quirks & HID_QUIRK_ALWAYS_POLL) ||
+ list_empty(&hid->report_enum[HID_INPUT_REPORT].report_list)) {
res = 0;
goto Done;
}
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 484/547] HID: zydacron: validate key report length
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 483/547] HID: usbhid: skip interrupt IN polling for devices with no input reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 485/547] HID: amd_sfh: Remove unsupported motion-state field from accelerometer report Greg Kroah-Hartman
` (71 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 9932c9af185f8586e883d44ca562c12f4487c762 upstream.
The HID core invokes raw_event callbacks before validating the report
length. zc_raw_event() verifies the report ID in byte zero and then reads
the key code from byte one for report IDs 0x02 and 0x03 without checking
that the second byte is present.
A one-byte report reproduced the issue under KASAN:
BUG: KASAN: slab-out-of-bounds in zc_raw_event+0x54c/0x580
Read of size 1 by task hidtrigger/93
Call Trace:
zc_raw_event+0x54c/0x580
__hid_input_report+0x2ef/0x3a0
inject_store+0x479/0x490 [faketrans]
Require both the report ID and key code before processing the report.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: d0742abaa1c3 ("HID: add omitted hid-zydacron.c file")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-zydacron.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-zydacron.c
+++ b/drivers/hid/hid-zydacron.c
@@ -114,6 +114,9 @@ static int zc_raw_event(struct hid_devic
unsigned key;
unsigned short index;
+ if (size < 2)
+ return 0;
+
if (report->id == data[0] && (hdev->claimed & HID_CLAIMED_INPUT)) {
/* break keys */
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 485/547] HID: amd_sfh: Remove unsupported motion-state field from accelerometer report
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 484/547] HID: zydacron: validate key report length Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 486/547] HID: amd_sfh: Use report type from request node Greg Kroah-Hartman
` (70 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrej Scek, Basavaraj Natikar,
Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
commit 6ff86122906357687735dd379c6279e3b2fa26af upstream.
The accelerometer HID report descriptor declares a trailing motion-state
field (usage 0x0451), but the Sensor Fusion Hub never reports this data,
so each accelerometer input report is one byte shorter than the descriptor
advertises.
This was previously harmless because hid-core zero-padded short reports.
Since commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") such reports are rejected instead:
hid-sensor-hub 0020:1022:0001.0003: Event data for report 1 was too short (15 vs 14)
As a result the accelerometer input events are dropped and screen
auto-rotation stops working on AMD SFH systems.
Remove the motion-state field from the accelerometer report descriptor and
drop the unused in_accel_shake_detection member, so the descriptor matches
the report actually provided by the hardware.
Fixes: 1434f9fc0e47 ("SFH: Create HID report to Enable support of AMD sensor fusion Hub (SFH)")
Reported-by: Andrej Scek <scek.andrej@gmail.com>
Closes: https://lore.kernel.org/linux-input/CADrS85612m-Hh-G4BJmOhy-y6r3Ni3kD8_GM-2QRBeWWEEZWuA@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h | 2 --
drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h | 7 -------
2 files changed, 9 deletions(-)
--- a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h
+++ b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h
@@ -48,8 +48,6 @@ struct accel3_input_report {
int in_accel_x_value;
int in_accel_y_value;
int in_accel_z_value;
- /* include if required to support the "shake" event */
- u8 in_accel_shake_detection;
} __packed;
struct gyro_feature_report {
--- a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h
+++ b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h
@@ -169,13 +169,6 @@ static const u8 accel3_report_descriptor
0x95, 1, /* HID report count (1) */
0x55, 0x0E, /* HID unit exponent(0x0E) */
0X81, 0x02, /* HID Input (Data_Arr_Abs) */
-
-0x0A, 0x51, 0x04, /* HID usage sensor data motion state */
-0x15, 0, /* HID logical Min_8(0) False = Still*/
-0x25, 1, /* HID logical Min_8(1) True = In motion */
-0x75, 8, /* HID report size(8) */
-0x95, 1, /* HID report count (1) */
-0X81, 0x02, /* HID Input (Data_Arr_Abs) */
0xC0 /* HID end collection */
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 486/547] HID: amd_sfh: Use report type from request node
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 485/547] HID: amd_sfh: Remove unsupported motion-state field from accelerometer report Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 487/547] HID: asus: do not send keyboard init reports to touchpads Greg Kroah-Hartman
` (69 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Basavaraj Natikar, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
commit 85f1bea97f1909f81577cfcf3e4db9017e7f5337 upstream.
Use report type from request node while sending feature and input reports
to HID core. The cli_data report type array is never assigned and
feature reports are sent as input reports.
Fixes: 1434f9fc0e47 ("SFH: Create HID report to Enable support of AMD sensor fusion Hub (SFH)")
Closes: https://github.com/ublue-os/bazzite/issues/5796
Cc: stable@vger.kernel.org
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
@@ -95,7 +95,7 @@ void amd_sfh_work(struct work_struct *wo
cli_data->feature_report[current_index]);
if (report_size)
hid_input_report(cli_data->hid_sensor_hubs[current_index],
- cli_data->report_type[current_index],
+ node_type,
cli_data->feature_report[current_index], report_size, 0);
else
pr_err("AMDSFH: Invalid report size\n");
@@ -104,7 +104,7 @@ void amd_sfh_work(struct work_struct *wo
report_size = mp2_ops->get_in_rep(current_index, sensor_index, report_id, in_data);
if (report_size)
hid_input_report(cli_data->hid_sensor_hubs[current_index],
- cli_data->report_type[current_index],
+ node_type,
in_data->input_report[current_index], report_size, 0);
else
pr_err("AMDSFH: Invalid report size\n");
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 487/547] HID: asus: do not send keyboard init reports to touchpads
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 486/547] HID: amd_sfh: Use report type from request node Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 488/547] HID: core: Fix out-of-bounds left shift by 32 in s32ton() Greg Kroah-Hartman
` (68 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Panz Dev, Denis Benato, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panz Dev <panz.development@gmail.com>
commit 8099f9da59f1c338bf88e25b7aa2a7fdf840879c upstream.
Commit 0919db9f3583 ("HID: asus: always fully initialize devices") added a
loop during asus_probe() to send keyboard feature report initializations
(asus_kbd_init) to all ASUS HID devices.
On ASUS laptops with I2C/HID touchpads (such as the ASUS E200HA), sending
keyboard feature reports (FEATURE_KBD_REPORT_ID) to touchpad endpoints
sends invalid feature requests to touchpad hardware, corrupting probe
state and causing the touchpad to become unresponsive.
Wrap the asus_report_id_init loop in an `if (!drvdata->tp)` check so
keyboard feature initialization only runs for actual keyboards.
Tested on ASUS E200HA (where touchpad functionality is fully restored)
and ASUS VivoBook Flip 14 TP401MA (confirming zero regressions).
Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices")
Cc: stable@vger.kernel.org
Signed-off-by: Panz Dev <panz.development@gmail.com>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-asus.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index ec966fc0a411..bd46aba6622a 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -1493,12 +1493,14 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
return ret;
}
- for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
- if (asus_has_report_id(hdev, asus_report_id_init[r])) {
- ret = asus_kbd_init(hdev, asus_report_id_init[r]);
- if (ret < 0)
- hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
- asus_report_id_init[r], ret);
+ if (!drvdata->tp) {
+ for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
+ if (asus_has_report_id(hdev, asus_report_id_init[r])) {
+ ret = asus_kbd_init(hdev, asus_report_id_init[r]);
+ if (ret < 0)
+ hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
+ asus_report_id_init[r], ret);
+ }
}
}
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 488/547] HID: core: Fix out-of-bounds left shift by 32 in s32ton()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 487/547] HID: asus: do not send keyboard init reports to touchpads Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 489/547] HID: cougar: reject short special-key reports Greg Kroah-Hartman
` (67 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern,
syzbot+25a1d2907885b2182275, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 5fe63b415c636c7f4f6848a8e53bdd4bbf0c300d upstream.
Syzbot reported an out-of-bounds shift (32-bit integer shifted left by
32) in the s32ton() routine in the HID core. This routine converts a
signed 32-bit integer to a signed n-bit integer, and it caps the value
of n at 32. But when n == 32 there's no need to do anything; it can
simply return the input value. This will avoid calculating (1 << n)
when n is 32, which was the cause of the invalid shift.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift")
Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/
Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -71,8 +71,8 @@ static u32 s32ton(__s32 value, unsigned
if (!value || !n)
return 0;
- if (n > 32)
- n = 32;
+ if (n >= 32)
+ return (u32) value;
a = value >> (n - 1);
if (a && a != -1)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 489/547] HID: cougar: reject short special-key reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 488/547] HID: core: Fix out-of-bounds left shift by 32 in s32ton() Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 490/547] HID: cp2112: validate response report lengths Greg Kroah-Hartman
` (66 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit c6c0df8a4b73a0d563c5e64de640ef5ff525fc82 upstream.
The HID core invokes raw_event callbacks before validating the report
length. cougar_raw_event() reads the key code and action from offsets one
and two without checking that those bytes are present. A short report on
the special interface can therefore cause an out-of-bounds read.
Consume reports that do not contain the action field before accessing the
fixed offsets, consistent with the callback's handling of other reports on
the special interface.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: b8e759b8f6da ("HID: cougar: Add support for the Cougar 500k Gaming Keyboard")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-cougar.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-cougar.c
+++ b/drivers/hid/hid-cougar.c
@@ -270,6 +270,9 @@ static int cougar_raw_event(struct hid_d
if (!shared->enabled || !shared->input)
return -EPERM;
+ if (size <= COUGAR_FIELD_ACTION)
+ return -EPERM;
+
code = data[COUGAR_FIELD_CODE];
action = data[COUGAR_FIELD_ACTION];
for (i = 0; cougar_mapping[i][0]; i++) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 490/547] HID: cp2112: validate response report lengths
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 489/547] HID: cougar: reject short special-key reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 491/547] HID: elo: reject short touchscreen reports Greg Kroah-Hartman
` (65 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit fc54e71a063c0dcc4bceba6d0f71805a9b84082d upstream.
The HID core invokes raw_event callbacks before validating the report
length. cp2112_raw_event() reads every field of a transfer status response
without checking size. For a data response, it reads the length at offset
two and copies that many bytes from offset three, again without ensuring
that the input report contains them.
Require a complete transfer status structure. For data responses, first
require the header and then ensure the clamped payload length fits in the
received report before copying it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: e932d8178667 ("HID: add hid-cp2112 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-cp2112.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -1430,6 +1430,9 @@ static int cp2112_raw_event(struct hid_d
switch (data[0]) {
case CP2112_TRANSFER_STATUS_RESPONSE:
+ if (size < sizeof(*xfer))
+ return 0;
+
hid_dbg(hdev, "xfer status: %02x %02x %04x %04x\n",
xfer->status0, xfer->status1,
be16_to_cpu(xfer->retries), be16_to_cpu(xfer->length));
@@ -1463,11 +1466,16 @@ static int cp2112_raw_event(struct hid_d
atomic_set(&dev->xfer_avail, 1);
break;
case CP2112_DATA_READ_RESPONSE:
+ if (size < 3)
+ return 0;
+
hid_dbg(hdev, "read response: %02x %02x\n", data[1], data[2]);
dev->read_length = data[2];
if (dev->read_length > sizeof(dev->read_data))
dev->read_length = sizeof(dev->read_data);
+ if (dev->read_length > size - 3)
+ return 0;
memcpy(dev->read_data, &data[3], dev->read_length);
atomic_set(&dev->read_avail, 1);
@@ -1494,4 +1502,3 @@ module_hid_driver(cp2112_driver);
MODULE_DESCRIPTION("Silicon Labs HID USB to SMBus master bridge");
MODULE_AUTHOR("David Barksdale <dbarksdale@uplogix.com>");
MODULE_LICENSE("GPL");
-
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 491/547] HID: elo: reject short touchscreen reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 490/547] HID: cp2112: validate response report lengths Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 492/547] HID: logitech-dj: validate unnumbered keyboard reports Greg Kroah-Hartman
` (64 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 1cb92fcb2ac344d78737e3c5cb7b061dfb2850b1 upstream.
The HID core invokes raw_event callbacks before validating the report
length. elo_raw_event() only checks the first-byte packet marker before
elo_process_data() reads coordinates, flags, and pressure through offset
seven. A truncated packet beginning with the expected marker can therefore
cause an out-of-bounds read.
Require the complete eight-byte SmartSet packet before parsing it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: d23efc19478a ("HID: add driver for ELO 4000/4500")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-elo.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-elo.c
+++ b/drivers/hid/hid-elo.c
@@ -85,6 +85,9 @@ static int elo_raw_event(struct hid_devi
if (!(hdev->claimed & HID_CLAIMED_INPUT) || list_empty(&hdev->inputs))
return 0;
+ if (size < ELO_SMARTSET_PACKET_SIZE)
+ return 0;
+
hidinput = list_first_entry(&hdev->inputs, struct hid_input, list);
switch (report->id) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 492/547] HID: logitech-dj: validate unnumbered keyboard reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 491/547] HID: elo: reject short touchscreen reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 493/547] HID: mcp2200: validate READ_ALL response length Greg Kroah-Hartman
` (63 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit c2deafcb4c8227771f768d77ed3c0a489250e9b2 upstream.
The HID core invokes raw_event callbacks before validating the report
length. For an unnumbered keyboard report, logi_dj_raw_event() uses the
second byte as temporary storage while prepending a report ID. A one-byte
report therefore makes both the initial write and the later restoration
access data beyond the received report.
Reject unnumbered keyboard reports that do not provide the temporary byte.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 74808f9115ce ("HID: logitech-dj: add support for non unifying receivers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-logitech-dj.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -1790,6 +1790,9 @@ static int logi_dj_raw_event(struct hid_
if (!hdev->report_enum[HID_INPUT_REPORT].numbered) {
if (djrcv_dev->unnumbered_application == HID_GD_KEYBOARD) {
+ if (size < 2)
+ return false;
+
/*
* For the keyboard, we can reuse the same report by
* using the second byte which is constant in the USB
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 493/547] HID: mcp2200: validate READ_ALL response length
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 492/547] HID: logitech-dj: validate unnumbered keyboard reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 494/547] HID: mcp2221: always initialize and cancel init_work Greg Kroah-Hartman
` (62 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 26ce0e6bf0b27fc6a2f490f38555dfd0a27c9605 upstream.
The HID core invokes raw_event callbacks before validating the report
length. mcp2200_raw_event() casts a READ_ALL response to struct
mcp_read_all_resp and reads fields through offset ten without checking that
the response contains the structure.
A one-byte READ_ALL response reproduced the issue under KASAN:
BUG: KASAN: slab-out-of-bounds in mcp2200_raw_event+0x24b/0x3a0
Read of size 1 by task hidtrigger/89
Call Trace:
mcp2200_raw_event+0x24b/0x3a0
kasan_report+0x139/0x170
Reject an incomplete READ_ALL response with a protocol error before reading
its fields. The common completion path then wakes the command waiter with
the error instead of leaving it to time out.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 740329d7120f ("HID: mcp2200: added driver for GPIOs of MCP2200")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2200.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/hid/hid-mcp2200.c
+++ b/drivers/hid/hid-mcp2200.c
@@ -301,6 +301,11 @@ static int mcp2200_raw_event(struct hid_
switch (data[0]) {
case READ_ALL:
+ if (size < sizeof(*all_resp)) {
+ mcp->status = -EPROTO;
+ break;
+ }
+
all_resp = (struct mcp_read_all_resp *) data;
mcp->status = 0;
mcp->gpio_inval = all_resp->io_port_val_bmap;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 494/547] HID: mcp2221: always initialize and cancel init_work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 493/547] HID: mcp2200: validate READ_ALL response length Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 495/547] HID: mcp2221: validate response report length Greg Kroah-Hartman
` (61 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Myeonghun Pak, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 6a006ff898b459e0bd10375d7fbe0ea7f7a132b9 upstream.
The writable gpio_mode_enforce parameter can change between probe and
remove.
If it changes from false to true after probe, remove skips cancellation
of init_work. Pending or running work can then access devm-managed
driver state after teardown. Changing it from true to false can make
remove cancel an uninitialized delayed work item.
Initialize init_work whenever IIO is reachable and cancel it
unconditionally on remove. Keep the parameter check only for scheduling
the initialization.
The false-to-true cancellation gap was previously reported by Sashiko.
We also encountered this issue during our static-analysis research.
Fixes: 200e6c6e94fa ("HID: mcp2221: Add module parameter to enfoce GPIO mode")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-input/20260715143415.916A21F00A3A@smtp.kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2221.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index db0b15622c39..053377dbced2 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -1072,8 +1072,7 @@ static void mcp2221_remove(struct hid_device *hdev)
#if IS_REACHABLE(CONFIG_IIO)
struct mcp2221 *mcp = hid_get_drvdata(hdev);
- if (!gpio_mode_enforce)
- cancel_delayed_work_sync(&mcp->init_work);
+ cancel_delayed_work_sync(&mcp->init_work);
#endif
}
@@ -1347,10 +1346,9 @@ static int mcp2221_probe(struct hid_device *hdev,
#endif
#if IS_REACHABLE(CONFIG_IIO)
- if (!gpio_mode_enforce) {
- INIT_DELAYED_WORK(&mcp->init_work, mcp_init_work);
+ INIT_DELAYED_WORK(&mcp->init_work, mcp_init_work);
+ if (!gpio_mode_enforce)
schedule_delayed_work(&mcp->init_work, msecs_to_jiffies(100));
- }
#endif
return 0;
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 495/547] HID: mcp2221: validate response report length
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 494/547] HID: mcp2221: always initialize and cancel init_work Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 496/547] HID: picoLCD: check for fb_deferred_io_init() error Greg Kroah-Hartman
` (60 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 1ae40774d386b7a51e4799200106429a7e14e8ec upstream.
MCP2221 responses are 64-byte reports, but mcp2221_raw_event() currently
accepts any report of at least four bytes. Several response handlers read
far beyond that minimum. In particular, the I2C status response reads
offset 20 and copies ADC samples starting at offset 50. Other GPIO, SRAM,
and flash response handlers also access fixed offsets beyond byte three.
The HID core invokes raw_event callbacks before validating the report
length, so a truncated response can cause an out-of-bounds read. Require a
complete protocol report before dispatching any response handler.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2221.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -865,7 +865,7 @@ static int mcp2221_raw_event(struct hid_
u8 *buf;
struct mcp2221 *mcp = hid_get_drvdata(hdev);
- if (size < 4)
+ if (size < sizeof(mcp->txbuf))
return 0;
switch (data[0]) {
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 496/547] HID: picoLCD: check for fb_deferred_io_init() error
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 495/547] HID: mcp2221: validate response report length Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 497/547] HID: prodikeys: validate fixed-format MIDI reports Greg Kroah-Hartman
` (59 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
commit feade898fc958ff355101adf12d5632272e64220 upstream.
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently picolcd_init_framebuffer() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Also correct cleanup ordering - defio is initialised after the sysfs file,
so cleanup defio first.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-picolcd_fb.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-picolcd_fb.c
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -531,17 +531,23 @@ int picolcd_init_framebuffer(struct pico
goto err_cleanup;
}
- fb_deferred_io_init(info);
+ error = fb_deferred_io_init(info);
+ if (error) {
+ dev_err(dev, "failed to initialize deferred I/O\n");
+ goto err_sysfs;
+ }
+
error = register_framebuffer(info);
if (error) {
dev_err(dev, "failed to register framebuffer\n");
- goto err_sysfs;
+ goto err_defio;
}
return 0;
+err_defio:
+ fb_deferred_io_cleanup(info);
err_sysfs:
device_remove_file(dev, &dev_attr_fb_update_rate);
- fb_deferred_io_cleanup(info);
err_cleanup:
data->fb_info = NULL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 497/547] HID: prodikeys: validate fixed-format MIDI reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 496/547] HID: picoLCD: check for fb_deferred_io_init() error Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 498/547] HID: pxrc: reject short input reports Greg Kroah-Hartman
` (58 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 0ff37294c41bd925258893310398bc2b45fcd4a7 upstream.
The HID core invokes raw_event callbacks before validating the report
length. Prodikeys reports 0x01 and 0x04 are passed to handlers that always
read bytes one through three, regardless of the supplied size. A truncated
report can therefore cause an out-of-bounds read.
Require four bytes for the two fixed-format reports. Keep report 0x03 on
its existing variable-length path, which derives the number of note pairs
from size and only accesses complete pairs.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 3a370ca1dcf8 ("HID: Prodikeys PC-MIDI HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-prodikeys.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -772,8 +772,13 @@ static int pk_raw_event(struct hid_devic
if (report->id == data[0])
switch (report->id) {
case 0x01: /* midi keys (qwerty)*/
- case 0x03: /* midi keyboard (musical)*/
case 0x04: /* extra/midi keys (qwerty)*/
+ if (size < 4)
+ break;
+ ret = pcmidi_handle_report(pm, report->id,
+ data, size);
+ break;
+ case 0x03: /* midi keyboard (musical)*/
ret = pcmidi_handle_report(pm,
report->id, data, size);
break;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 498/547] HID: pxrc: reject short input reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 497/547] HID: prodikeys: validate fixed-format MIDI reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 499/547] HID: quirks: Always poll the Anne Pro 2 with product ID a292 Greg Kroah-Hartman
` (57 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 0deb22da5a8c6663c3e071f55fd7d7e3189f5517 upstream.
The HID core invokes raw_event callbacks before validating the report
length. pxrc_raw_event() reads byte seven and writes bytes one and seven
without checking that the report contains those bytes.
A one-byte input report reproduced the first invalid access under KASAN:
BUG: KASAN: slab-out-of-bounds in pxrc_raw_event+0x161/0x260
Read of size 1 by task hidtrigger/90
Call Trace:
pxrc_raw_event+0x161/0x260
kasan_report+0x139/0x170
Require all eight bytes before reading or rewriting the report.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: acc3e34613da ("HID: Add driver for PhoenixRC Flight Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-pxrc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-pxrc.c
+++ b/drivers/hid/hid-pxrc.c
@@ -55,6 +55,9 @@ static int pxrc_raw_event(struct hid_dev
{
struct pxrc_priv *priv = hid_get_drvdata(hdev);
+ if (size < 8)
+ return 0;
+
if (priv->alternate)
priv->slider = data[7];
else
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 499/547] HID: quirks: Always poll the Anne Pro 2 with product ID a292
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 498/547] HID: pxrc: reject short input reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 500/547] HID: roccat: isku: reject short button reports Greg Kroah-Hartman
` (56 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gabor Tanz, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Tanz <gabor.tanz@gmail.com>
commit cbc13a78a89d087252947d0a51048e576cfcb3ef upstream.
The wired Anne Pro 2 identifying as 04d9:a292 stops delivering keyboard
input after a period of inactivity. Unplugging and reconnecting the
keyboard restores input.
Keeping ObinsKit running prevents the problem. A read-only userspace
reader that keeps USB HID interface 1 open also prevents it, as does
usbhid.quirks=0x04d9:0xa292:0x00000400 without either application running.
Commit ca28aff0e1dc ("HID: quirks: Always poll Obins Anne Pro 2
keyboard") added HID_QUIRK_ALWAYS_POLL for product ID a293.
The variant identifying as 04d9:a292 exhibits the same symptom.
Apply the quirk to this product ID as well.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Gabor Tanz <gabor.tanz@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -747,6 +747,7 @@
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2 0xa0c2
#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096
+#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A292 0xa292
#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293 0xa293
#define USB_VENDOR_ID_IMATION 0x0718
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -102,6 +102,7 @@ static const struct hid_device_id hid_qu
{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A292), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A), HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 500/547] HID: roccat: isku: reject short button reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 499/547] HID: quirks: Always poll the Anne Pro 2 with product ID a292 Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 501/547] HID: roccat: koneplus: " Greg Kroah-Hartman
` (55 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 93e5f7f6189af76a2b2e2dfe647838a7b9f99d21 upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It passes the buffer to helpers which inspect data[0] and, for a
button report, read the complete struct isku_report_button. A truncated
report can therefore cause an out-of-bounds read.
Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: d41c2a7011df ("HID: roccat: Add support for Isku keyboard")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-isku.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-isku.c
+++ b/drivers/hid/hid-roccat-isku.c
@@ -411,6 +411,9 @@ static int isku_raw_event(struct hid_dev
if (isku == NULL)
return 0;
+ if (size < sizeof(struct isku_report_button))
+ return 0;
+
isku_keep_values_up_to_date(isku, data);
if (isku->roccat_claimed)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 501/547] HID: roccat: koneplus: reject short button reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 500/547] HID: roccat: isku: reject short button reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 502/547] HID: roccat: konepure: " Greg Kroah-Hartman
` (54 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit d879e17a8b4c572c0b53b4e42a36849484e8f00c upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It passes the buffer to helpers which inspect data[0] and, for a
button report, read the complete struct koneplus_mouse_report_button. A
truncated report can therefore cause an out-of-bounds read.
Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: 47dbdbffe15b ("HID: roccat: Add support for Roccat Kone[+] v2")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-koneplus.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -523,6 +523,9 @@ static int koneplus_raw_event(struct hid
if (koneplus == NULL)
return 0;
+ if (size < sizeof(struct koneplus_mouse_report_button))
+ return 0;
+
koneplus_keep_values_up_to_date(koneplus, data);
if (koneplus->roccat_claimed)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 502/547] HID: roccat: konepure: reject short button reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 501/547] HID: roccat: koneplus: " Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 503/547] HID: roccat: kovaplus: " Greg Kroah-Hartman
` (53 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 1590b7c9bea0abe7a5d25dbfe06287c48c238a6f upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It reads the report number without checking the received length
and passes matching data to roccat_report_event(), which copies a complete
struct konepure_mouse_report_button. A truncated report can therefore
cause an out-of-bounds read and expose adjacent data through the Roccat
character device.
Require a complete button report before inspecting or forwarding it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: 8936aa31cd5f ("HID: roccat: add support for Roccat Kone Pure gaming mouse")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-konepure.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-konepure.c
+++ b/drivers/hid/hid-roccat-konepure.c
@@ -181,6 +181,9 @@ static int konepure_raw_event(struct hid
!= USB_INTERFACE_PROTOCOL_MOUSE)
return 0;
+ if (size < sizeof(struct konepure_mouse_report_button))
+ return 0;
+
if (data[0] != KONEPURE_MOUSE_REPORT_NUMBER_BUTTON)
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 503/547] HID: roccat: kovaplus: reject short button reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 502/547] HID: roccat: konepure: " Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 504/547] HID: roccat: pyra: " Greg Kroah-Hartman
` (52 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit e95917a606f486e46f5136fc1b72190742a091d6 upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It passes the buffer to helpers which inspect data[0] and read a
complete struct kovaplus_mouse_report_button for button reports. A
truncated report can therefore cause an out-of-bounds read.
Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: 0e70f97f257e ("HID: roccat: Add support for Kova[+] mouse")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-kovaplus.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -614,6 +614,9 @@ static int kovaplus_raw_event(struct hid
if (kovaplus == NULL)
return 0;
+ if (size < sizeof(struct kovaplus_mouse_report_button))
+ return 0;
+
kovaplus_keep_values_up_to_date(kovaplus, data);
if (kovaplus->roccat_claimed)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 504/547] HID: roccat: pyra: reject short button reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 503/547] HID: roccat: kovaplus: " Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 505/547] HID: roccat: ryos: reject short special reports Greg Kroah-Hartman
` (51 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 493268f459bb6aeeecbc77f2204c11ad74d05213 upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It passes the buffer to helpers which inspect data[0] and read a
complete struct pyra_mouse_event_button for button reports. A truncated
report can therefore cause an out-of-bounds read.
Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: cb7cf3da0daa ("HID: roccat: add driver for Roccat Pyra mouse")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-pyra.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -557,6 +557,9 @@ static int pyra_raw_event(struct hid_dev
if (pyra == NULL)
return 0;
+ if (size < sizeof(struct pyra_mouse_event_button))
+ return 0;
+
pyra_keep_values_up_to_date(pyra, data);
if (pyra->roccat_claimed)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 505/547] HID: roccat: ryos: reject short special reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 504/547] HID: roccat: pyra: " Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 506/547] HID: roccat: savu: " Greg Kroah-Hartman
` (50 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 02f3607d0beb82e76481568bf631235e6a319b47 upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It reads the report number without checking the received length
and passes matching data to roccat_report_event(), which copies a complete
struct ryos_report_special. A truncated report can therefore cause an
out-of-bounds read and expose adjacent data through the Roccat character
device.
Require a complete special report before inspecting or forwarding it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: 6f3a19360545 ("HID: roccat: add support for Ryos MK keyboards")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-ryos.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-ryos.c
+++ b/drivers/hid/hid-roccat-ryos.c
@@ -189,6 +189,9 @@ static int ryos_raw_event(struct hid_dev
!= RYOS_USB_INTERFACE_PROTOCOL)
return 0;
+ if (size < sizeof(struct ryos_report_special))
+ return 0;
+
if (data[0] != RYOS_REPORT_NUMBER_SPECIAL)
return 0;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 506/547] HID: roccat: savu: reject short special reports
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 505/547] HID: roccat: ryos: reject short special reports Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 507/547] HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup Greg Kroah-Hartman
` (49 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Benjamin Tissoires
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
commit 76c51fdc825a0486f8d88ff896d39acec8f377b4 upstream.
The raw event callback runs before HID core validates and zero-pads the
report. It passes the buffer to a helper which inspects data[0] and, for a
special report, reads the complete struct savu_mouse_report_special. A
truncated report can therefore cause an out-of-bounds read.
Require enough data for the special report before calling the helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: 6a2a6390cf09 ("HID: roccat: add support for Roccat Savu")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat-savu.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-roccat-savu.c
+++ b/drivers/hid/hid-roccat-savu.c
@@ -182,6 +182,9 @@ static int savu_raw_event(struct hid_dev
if (savu == NULL)
return 0;
+ if (size < sizeof(struct savu_mouse_report_special))
+ return 0;
+
if (savu->roccat_claimed)
savu_report_to_chrdev(savu, data);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 507/547] HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 506/547] HID: roccat: savu: " Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 508/547] HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out() Greg Kroah-Hartman
` (48 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 0ef3036c68979194fdee77a3a825fb94ef307a54 upstream.
hid_gos_cfg_remove() calls a mutex before canceling delayed work. That
delayed work function calls mcu_property_out(), which holds the same mutex.
Prevent deadlock my removing the mutex prior to stopping the work.
Additionally, since cancel_delayed_work has the potential to re-arm,
switch to disable_delayed_work.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -1425,8 +1425,7 @@ static int hid_gos_cfg_probe(struct hid_
static void hid_gos_cfg_remove(struct hid_device *hdev)
{
- guard(mutex)(&drvdata.cfg_mutex);
- cancel_delayed_work_sync(&drvdata.gos_cfg_setup);
+ disable_delayed_work_sync(&drvdata.gos_cfg_setup);
sysfs_remove_groups(&hdev->dev.kobj, top_level_attr_groups);
hid_hw_close(hdev);
hid_hw_stop(hdev);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 508/547] HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 507/547] HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 509/547] HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback Greg Kroah-Hartman
` (47 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 8ac42b2885322dc7fb03d88c5411e9dbd24f80d9 upstream.
Currently mcu_property_out() blanket returns 0, discarding the ret
value and any errors with it. Wait completion returns a positive value
when it is not timed out, which would error on all successes, so if it
is positive return the ret value from the raw event handler. Only if
it is 0 set it to -EBUSY, otherwise pass the actual error.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/hid-lenovo-go-s.c b/drivers/hid/hid-lenovo-go-s.c
index a72f7f748cb5..68301d4c762a 100644
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -38,6 +38,7 @@ static struct hid_gos_cfg {
struct led_classdev *led_cdev;
struct hid_device *hdev;
struct mutex cfg_mutex; /*ensure single synchronous output report*/
+ int cmd_status;
u8 gp_auto_sleep_time;
u8 gp_dpad_mode;
u8 gp_mode;
@@ -435,7 +436,9 @@ static int hid_gos_raw_event(struct hid_device *hdev, struct hid_report *report,
dev_dbg(&hdev->dev, "Rx data as raw input report: [%*ph]\n",
GO_S_PACKET_SIZE, data);
+ drvdata.cmd_status = ret;
complete(&drvdata.send_cmd_complete);
+
return ret;
}
@@ -474,12 +477,10 @@ static int mcu_property_out(struct hid_device *hdev, u8 command, u8 index,
timeout = (command == GET_PL_TEST) ? 200 : 5;
ret = wait_for_completion_interruptible_timeout(&drvdata.send_cmd_complete,
msecs_to_jiffies(timeout));
-
- if (ret == 0) /* timeout occurred */
- ret = -EBUSY;
+ ret = ret > 0 ? drvdata.cmd_status : ret ?: -EBUSY;
reinit_completion(&drvdata.send_cmd_complete);
- return 0;
+ return ret;
}
static ssize_t gamepad_property_store(struct device *dev,
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 509/547] HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 508/547] HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out() Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 510/547] HID: hid-lenovo-go-s: Add suspend function and gate access under bool Greg Kroah-Hartman
` (46 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 5c07247116ff749e09fe45cef439d7b2b66454b6 upstream.
Adds missing pm_ptr to the .reset_resume callback for hid-lenovo-go-s
Fixes: 3524900cc571bd922a ("HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -1540,7 +1540,7 @@ static struct hid_driver hid_lenovo_go_s
.probe = hid_gos_probe,
.remove = hid_gos_remove,
.raw_event = hid_gos_raw_event,
- .reset_resume = hid_gos_reset_resume,
+ .reset_resume = pm_ptr(hid_gos_reset_resume),
};
module_hid_driver(hid_lenovo_go_s);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 510/547] HID: hid-lenovo-go-s: Add suspend function and gate access under bool.
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 509/547] HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 511/547] HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete Greg Kroah-Hartman
` (45 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit e69b64d3d75eb10177f75d3d4947e032cb46eeb9 upstream.
Currently a device can suspend while delayed work is pending or
executing. Cancel delayed work if it was pending and restart it if it
hasn't run yet. Gate access to show/store functions behind a bool to
prevent access prior to cfg_setup() being completed.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 149 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 149 insertions(+)
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -38,6 +38,8 @@ static struct hid_gos_cfg {
struct led_classdev *led_cdev;
struct hid_device *hdev;
struct mutex cfg_mutex; /*ensure single synchronous output report*/
+ bool gp_registered;
+ bool rgb_registered;
int cmd_status;
u8 gp_auto_sleep_time;
u8 gp_dpad_mode;
@@ -488,10 +490,22 @@ static ssize_t gamepad_property_store(st
const char *buf, size_t count,
enum feature_status_index index)
{
+ bool dev_registered;
size_t size = 1;
u8 val = 0;
int ret;
+ /* rgb_enabled is attached to led_classdev, not hid_device */
+ if (index == FEATURE_RGB_ENABLE)
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata.rgb_registered);
+ else
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata.gp_registered);
+
+ if (!dev_registered)
+ return -ENODEV;
+
switch (index) {
case FEATURE_GAMEPAD_MODE:
ret = sysfs_match_string(gamepad_mode_text, buf);
@@ -572,9 +586,21 @@ static ssize_t gamepad_property_show(str
struct device_attribute *attr, char *buf,
enum feature_status_index index)
{
+ bool dev_registered;
ssize_t count = 0;
u8 i;
+ /* rgb_enabled is attached to led_classdev, not hid_device */
+ if (index == FEATURE_RGB_ENABLE)
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata.rgb_registered);
+ else
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata.gp_registered);
+
+ if (!dev_registered)
+ return -ENODEV;
+
count = mcu_property_out(drvdata.hdev, GET_GAMEPAD_CFG, index, NULL, 0);
if (count < 0)
return count;
@@ -710,10 +736,16 @@ static ssize_t touchpad_property_store(s
const char *buf, size_t count,
enum touchpad_config_index index)
{
+ bool gp_registered;
size_t size = 1;
u8 val = 0;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!gp_registered)
+ return -ENODEV;
+
switch (index) {
case CFG_WINDOWS_MODE:
ret = sysfs_match_string(touchpad_mode_text, buf);
@@ -744,9 +776,15 @@ static ssize_t touchpad_property_show(st
struct device_attribute *attr, char *buf,
enum touchpad_config_index index)
{
+ bool gp_registered;
int ret = 0;
u8 i;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!gp_registered)
+ return -ENODEV;
+
ret = mcu_property_out(drvdata.hdev, GET_TP_PARAM, index, NULL, 0);
if (ret < 0)
return ret;
@@ -773,9 +811,15 @@ static ssize_t touchpad_property_options
char *buf,
enum touchpad_config_index index)
{
+ bool gp_registered;
size_t count = 0;
unsigned int i;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!gp_registered)
+ return -ENODEV;
+
switch (index) {
case CFG_WINDOWS_MODE:
case CFG_LINUX_MODE:
@@ -798,9 +842,15 @@ static ssize_t test_property_show(struct
struct device_attribute *attr, char *buf,
enum test_command_index index)
{
+ bool gp_registered;
size_t count = 0;
u8 i;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!gp_registered)
+ return -ENODEV;
+
switch (index) {
case TEST_TP_MFR:
i = drvdata.tp_manufacturer;
@@ -858,9 +908,15 @@ static ssize_t rgb_effect_store(struct d
{
struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
enum rgb_config_index index;
+ bool rgb_registered;
u8 effect;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = sysfs_match_string(rgb_effect_text, buf);
if (ret < 0)
return ret;
@@ -885,8 +941,14 @@ static ssize_t rgb_effect_store(struct d
static ssize_t rgb_effect_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
+ bool rgb_registered;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = rgb_attr_show();
if (ret)
return ret;
@@ -918,9 +980,15 @@ static ssize_t rgb_speed_store(struct de
{
struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
enum rgb_config_index index;
+ bool rgb_registered;
int val = 0;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = kstrtoint(buf, 10, &val);
if (ret)
return ret;
@@ -948,8 +1016,14 @@ static ssize_t rgb_speed_store(struct de
static ssize_t rgb_speed_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
+ bool rgb_registered;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = rgb_attr_show();
if (ret)
return ret;
@@ -969,9 +1043,15 @@ static ssize_t rgb_speed_range_show(stru
static ssize_t rgb_mode_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t count)
{
+ bool rgb_registered;
int ret;
u8 val;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = sysfs_match_string(rgb_mode_text, buf);
if (ret <= 0)
return ret;
@@ -991,8 +1071,14 @@ static ssize_t rgb_mode_store(struct dev
static ssize_t rgb_mode_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
+ bool rgb_registered;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = rgb_cfg_call(drvdata.hdev, GET_RGB_CFG, LIGHT_MODE_SEL, NULL, 0);
if (ret)
return ret;
@@ -1022,10 +1108,16 @@ static ssize_t rgb_profile_store(struct
struct device_attribute *attr, const char *buf,
size_t count)
{
+ bool rgb_registered;
size_t size = 1;
int ret;
u8 val;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = kstrtou8(buf, 10, &val);
if (ret < 0)
return ret;
@@ -1045,8 +1137,14 @@ static ssize_t rgb_profile_store(struct
static ssize_t rgb_profile_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
+ bool rgb_registered;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return -ENODEV;
+
ret = rgb_cfg_call(drvdata.hdev, GET_RGB_CFG, LIGHT_PROFILE_SEL, NULL, 0);
if (ret)
return ret;
@@ -1068,8 +1166,14 @@ static void hid_gos_brightness_set(struc
{
struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
enum rgb_config_index index;
+ bool rgb_registered;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!rgb_registered)
+ return;
+
if (brightness > led_cdev->max_brightness) {
dev_err(led_cdev->dev, "Invalid argument\n");
return;
@@ -1376,6 +1480,11 @@ static void cfg_setup(struct work_struct
"Failed to retrieve OS Mode: %i\n", ret);
return;
}
+
+ /* Pairs with smp_load_acquire in attribute show/store functions */
+ smp_store_release(&drvdata.gp_registered, true);
+ /* Pairs with smp_load_acquire in attribute show/store functions */
+ smp_store_release(&drvdata.rgb_registered, true);
}
static int hid_gos_cfg_probe(struct hid_device *hdev,
@@ -1435,9 +1544,24 @@ static void hid_gos_cfg_remove(struct hi
static int hid_gos_cfg_reset_resume(struct hid_device *hdev)
{
+ bool gp_registered, rgb_registered;
u8 os_mode = drvdata.os_mode;
int ret;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!gp_registered || !rgb_registered) {
+ ret = schedule_delayed_work(&drvdata.gos_cfg_setup, msecs_to_jiffies(2));
+ if (!ret) {
+ dev_err(&hdev->dev, "Failed to schedule startup delayed work\n");
+ return -ENODEV;
+ }
+
+ return 0;
+ }
+
ret = mcu_property_out(drvdata.hdev, SET_GAMEPAD_CFG,
FEATURE_OS_MODE, &os_mode, 1);
if (ret < 0)
@@ -1525,6 +1649,30 @@ static int hid_gos_reset_resume(struct h
return 0;
}
+static int hid_gos_cfg_suspend(void)
+{
+ disable_delayed_work_sync(&drvdata.gos_cfg_setup);
+
+ return 0;
+}
+
+static int hid_gos_suspend(struct hid_device *hdev, pm_message_t msg)
+{
+ int ret;
+ u8 ep;
+
+ /* Safe assumption. SET_INTERFACE ioctl can't be used while driver is bound */
+ ret = get_endpoint_address(hdev);
+ if (ret <= 0)
+ return 0;
+
+ ep = ret;
+ if (ep == GO_S_CFG_INTF_IN)
+ return hid_gos_cfg_suspend();
+
+ return 0;
+}
+
static const struct hid_device_id hid_gos_devices[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_QHE,
USB_DEVICE_ID_LENOVO_LEGION_GO_S_XINPUT) },
@@ -1541,6 +1689,7 @@ static struct hid_driver hid_lenovo_go_s
.remove = hid_gos_remove,
.raw_event = hid_gos_raw_event,
.reset_resume = pm_ptr(hid_gos_reset_resume),
+ .suspend = pm_ptr(hid_gos_suspend),
};
module_hid_driver(hid_lenovo_go_s);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 511/547] HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 510/547] HID: hid-lenovo-go-s: Add suspend function and gate access under bool Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 512/547] HID: hid-lenovo-go-s: Move attribute init to after device query Greg Kroah-Hartman
` (44 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 6224755416e627badf69b330afec9ac6b85e5098 upstream.
mcu_property_out() reinits send_cmd_complete immediately after a
timeout is detected, before the next command that reuses it is sent.
If the MCU's reply to the timed-out command arrives after this reinit
but before the next command's wait begins, it silently satisfies the
next, unrelated command's wait instead of the one it actually answers,
handing that caller stale data with no way to detect the mismatch.
Track when a command has timed out via cmd_orphaned. Before the next
command reuses the completion, wait a bounded 25ms for a stale reply
to arrive and be consumed, then unconditionally clear the flag and
reinit the completion. This does not fully eliminate the window in
which an unrelated reply could still be received, but bounds it to
a short interval right before a new command is sent. Behavior matches
the solution to the same problem in hid-msi.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -37,6 +37,7 @@ static struct hid_gos_cfg {
struct completion send_cmd_complete;
struct led_classdev *led_cdev;
struct hid_device *hdev;
+ bool orphan_ack_pending;
struct mutex cfg_mutex; /*ensure single synchronous output report*/
bool gp_registered;
bool rgb_registered;
@@ -456,6 +457,19 @@ static int mcu_property_out(struct hid_d
return -EINVAL;
guard(mutex)(&drvdata.cfg_mutex);
+
+ /*
+ * A reply to the previous command may still be in flight. Give it a
+ * short window to arrive and be consumed before this call reinits the
+ * completion, so a late reply can't be mistaken for this command's.
+ */
+ if (drvdata.orphan_ack_pending) {
+ wait_for_completion_timeout(&drvdata.send_cmd_complete, msecs_to_jiffies(25));
+ drvdata.orphan_ack_pending = false;
+ drvdata.cmd_status = -ETIMEDOUT;
+ }
+ reinit_completion(&drvdata.send_cmd_complete);
+
/* We can't use a devm_alloc reusable buffer without side effects during suspend */
dmabuf = kzalloc(GO_S_PACKET_SIZE, GFP_KERNEL);
if (!dmabuf)
@@ -481,7 +495,9 @@ static int mcu_property_out(struct hid_d
msecs_to_jiffies(timeout));
ret = ret > 0 ? drvdata.cmd_status : ret ?: -EBUSY;
- reinit_completion(&drvdata.send_cmd_complete);
+ if (ret)
+ drvdata.orphan_ack_pending = true;
+
return ret;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 512/547] HID: hid-lenovo-go-s: Move attribute init to after device query
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 511/547] HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 513/547] HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg Greg Kroah-Hartman
` (43 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 8f456881ba40a04494440663231ba773a06588f3 upstream.
Currently this driver registers attributes before the MCU is ready to
accept commands. This can lead to attribute access that blocks the MCU
in some rare cases.
Move attribute construction to gos_cfg_setup, after the device has been
queried. Gate creation to drvdata.gp_registered and
drvdata.rgb_registered so a resume before setup has run doesn't prevent
attribute creation or attempt to re-register the same attributes.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 68 +++++++++++++++++++++++------------
1 file changed, 45 insertions(+), 23 deletions(-)
diff --git a/drivers/hid/hid-lenovo-go-s.c b/drivers/hid/hid-lenovo-go-s.c
index 6d98fff6d987..f1a0bcfcdb71 100644
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -1452,6 +1452,7 @@ static struct led_classdev_mc gos_cdev_rgb = {
static void cfg_setup(struct work_struct *work)
{
+ bool gp_registered, rgb_registered;
int ret;
/* MCU */
@@ -1497,10 +1498,53 @@ static void cfg_setup(struct work_struct *work)
return;
}
+ /* Pairs with smp_store_release from below */
+ gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (gp_registered)
+ goto try_rgb;
+
+ ret = sysfs_create_groups(&drvdata.hdev->dev.kobj, top_level_attr_groups);
+ if (ret) {
+ dev_err(&drvdata.hdev->dev,
+ "Failed to create gamepad configuration attributes: %i\n", ret);
+ goto try_rgb;
+ }
+
/* Pairs with smp_load_acquire in attribute show/store functions */
smp_store_release(&drvdata.gp_registered, true);
+ gp_registered = true;
+
+try_rgb:
+ /* Pairs with smp_store_release from below */
+ rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (rgb_registered)
+ goto update_kobjects;
+
+ ret = devm_led_classdev_multicolor_register(&drvdata.hdev->dev, &gos_cdev_rgb);
+ if (ret) {
+ dev_err(&drvdata.hdev->dev,
+ "Failed to create RGB device: %i\n", ret);
+ goto update_kobjects;
+ }
+
+ ret = devm_device_add_group(gos_cdev_rgb.led_cdev.dev, &rgb_attr_group);
+ if (ret) {
+ dev_err(&drvdata.hdev->dev,
+ "Failed to create RGB configuration attributes: %i\n", ret);
+ goto update_kobjects;
+ }
+
+ drvdata.led_cdev = &gos_cdev_rgb.led_cdev;
+
/* Pairs with smp_load_acquire in attribute show/store functions */
smp_store_release(&drvdata.rgb_registered, true);
+ rgb_registered = true;
+
+update_kobjects:
+ if (gp_registered)
+ kobject_uevent(&drvdata.hdev->dev.kobj, KOBJ_CHANGE);
+ if (rgb_registered)
+ kobject_uevent(&drvdata.led_cdev->dev->kobj, KOBJ_CHANGE);
}
static int hid_gos_cfg_probe(struct hid_device *hdev,
@@ -1510,30 +1554,8 @@ static int hid_gos_cfg_probe(struct hid_device *hdev,
hid_set_drvdata(hdev, &drvdata);
drvdata.hdev = hdev;
+
mutex_init(&drvdata.cfg_mutex);
-
- ret = sysfs_create_groups(&hdev->dev.kobj, top_level_attr_groups);
- if (ret) {
- dev_err_probe(&hdev->dev, ret,
- "Failed to create gamepad configuration attributes\n");
- return ret;
- }
-
- ret = devm_led_classdev_multicolor_register(&hdev->dev, &gos_cdev_rgb);
- if (ret) {
- dev_err_probe(&hdev->dev, ret, "Failed to create RGB device\n");
- return ret;
- }
-
- ret = devm_device_add_group(gos_cdev_rgb.led_cdev.dev, &rgb_attr_group);
- if (ret) {
- dev_err_probe(&hdev->dev, ret,
- "Failed to create RGB configuration attributes\n");
- return ret;
- }
-
- drvdata.led_cdev = &gos_cdev_rgb.led_cdev;
-
init_completion(&drvdata.send_cmd_complete);
/* Executing calls prior to returning from probe will lock the MCU. Schedule
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 513/547] HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 512/547] HID: hid-lenovo-go-s: Move attribute init to after device query Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 514/547] HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume Greg Kroah-Hartman
` (42 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 186323f048317e033819291e5d70ad19ded53768 upstream.
Renames hid_gos_cfg struct to gos_cfg_drvdata in preparation for later
fixes.
This is a prerequisite for later fixes. No functional change intended.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 43 +++++++++++++++++++----------------
1 file changed, 24 insertions(+), 19 deletions(-)
diff --git a/drivers/hid/hid-lenovo-go-s.c b/drivers/hid/hid-lenovo-go-s.c
index f1a0bcfcdb71..e5c4104a3adb 100644
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -32,36 +32,41 @@
#define GO_S_CFG_INTF_IN 0x84
#define GO_S_PACKET_SIZE 64
-static struct hid_gos_cfg {
- struct delayed_work gos_cfg_setup;
+static struct gos_cfg_drvdata {
+ /* MCU General Variables */
struct completion send_cmd_complete;
- struct led_classdev *led_cdev;
+ struct delayed_work gos_cfg_setup;
struct hid_device *hdev;
bool orphan_ack_pending;
struct mutex cfg_mutex; /*ensure single synchronous output report*/
- bool gp_registered;
- bool rgb_registered;
int cmd_status;
+
+ /* Gamepad Variables */
u8 gp_auto_sleep_time;
- u8 gp_dpad_mode;
- u8 gp_mode;
- u8 gp_poll_rate;
- u8 imu_bypass_en;
u8 imu_manufacturer;
+ bool gp_registered;
+ u8 tp_windows_mode;
+ u8 tp_manufacturer;
+ u8 tp_linux_mode;
+ u8 imu_bypass_en;
u8 imu_sensor_en;
+ u8 gp_dpad_mode;
+ u8 gp_poll_rate;
u8 mcu_id[12];
u8 mouse_step;
- u8 os_mode;
- u8 rgb_effect;
- u8 rgb_en;
- u8 rgb_mode;
- u8 rgb_profile;
- u8 rgb_speed;
- u8 tp_en;
- u8 tp_linux_mode;
- u8 tp_windows_mode;
u8 tp_version;
- u8 tp_manufacturer;
+ u8 gp_mode;
+ u8 os_mode;
+ u8 tp_en;
+
+ /* RGB Variables */
+ struct led_classdev *led_cdev;
+ bool rgb_registered;
+ u8 rgb_profile;
+ u8 rgb_effect;
+ u8 rgb_speed;
+ u8 rgb_mode;
+ u8 rgb_en;
} drvdata;
struct gos_cfg_attr {
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 514/547] HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 513/547] HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 515/547] HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct Greg Kroah-Hartman
` (41 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 81e8c0bb3831fb84ef44417bba1b52333d0580a9 upstream.
Adds kobject_uevent notification after setting os_mode attribute on resume.
Fixes: 3524900cc571bd922a ("HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -1618,6 +1618,7 @@ static int hid_gos_cfg_reset_resume(stru
if (drvdata.os_mode != os_mode)
return -ENODEV;
+ kobject_uevent(&drvdata.hdev->dev.kobj, KOBJ_CHANGE);
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 515/547] HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 514/547] HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 516/547] HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata Greg Kroah-Hartman
` (40 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit 7a5673e5f0f71cfe4004c1f1c3112cd1ea8ae1d9 upstream.
In the next patch I will switch drvdata from static global to a
devm_kzalloc struct. In preparation for that, move the led_classdev_mc
to be a member of the gos_cfg_drvdata struct. As part of that effort,
provide a constant name when accessing it and access the led_classdev
through the led_classdev_mc.
Fixes: be6d7dbb368ba840d7 ("HID: hid-lenovo-go-s: Add RGB LED control interface")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 73 +++++++++++++++++------------------
1 file changed, 36 insertions(+), 37 deletions(-)
diff --git a/drivers/hid/hid-lenovo-go-s.c b/drivers/hid/hid-lenovo-go-s.c
index e5c4104a3adb..c77c297a04cb 100644
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -60,7 +60,7 @@ static struct gos_cfg_drvdata {
u8 tp_en;
/* RGB Variables */
- struct led_classdev *led_cdev;
+ struct led_classdev_mc led_mc;
bool rgb_registered;
u8 rgb_profile;
u8 rgb_effect;
@@ -347,7 +347,7 @@ static int hid_gos_pl_test_event(struct command_report *cmd_rep)
static int hid_gos_light_event(struct command_report *cmd_rep)
{
- struct led_classdev_mc *mc_cdev;
+ struct led_classdev_mc *led_mc;
int ret = 0;
switch (cmd_rep->sub_cmd) {
@@ -362,12 +362,12 @@ static int hid_gos_light_event(struct command_report *cmd_rep)
case USR_LIGHT_PROFILE_1:
case USR_LIGHT_PROFILE_2:
case USR_LIGHT_PROFILE_3:
- mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
+ led_mc = &drvdata.led_mc;
drvdata.rgb_effect = cmd_rep->data[0];
- mc_cdev->subled_info[0].intensity = cmd_rep->data[1];
- mc_cdev->subled_info[1].intensity = cmd_rep->data[2];
- mc_cdev->subled_info[2].intensity = cmd_rep->data[3];
- drvdata.led_cdev->brightness = cmd_rep->data[4];
+ led_mc->subled_info[0].intensity = cmd_rep->data[1];
+ led_mc->subled_info[1].intensity = cmd_rep->data[2];
+ led_mc->subled_info[2].intensity = cmd_rep->data[3];
+ led_mc->led_cdev.brightness = cmd_rep->data[4];
drvdata.rgb_speed = cmd_rep->data[5];
ret = 0;
break;
@@ -927,7 +927,7 @@ static ssize_t rgb_effect_store(struct device *dev,
struct device_attribute *attr, const char *buf,
size_t count)
{
- struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
+ struct led_classdev_mc *led_mc = &drvdata.led_mc;
enum rgb_config_index index;
bool rgb_registered;
u8 effect;
@@ -945,10 +945,10 @@ static ssize_t rgb_effect_store(struct device *dev,
effect = ret;
index = drvdata.rgb_profile + 2;
u8 rgb_profile[6] = { effect,
- mc_cdev->subled_info[0].intensity,
- mc_cdev->subled_info[1].intensity,
- mc_cdev->subled_info[2].intensity,
- drvdata.led_cdev->brightness,
+ led_mc->subled_info[0].intensity,
+ led_mc->subled_info[1].intensity,
+ led_mc->subled_info[2].intensity,
+ led_mc->led_cdev.brightness,
drvdata.rgb_speed };
ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, index, rgb_profile, 6);
@@ -999,7 +999,7 @@ static ssize_t rgb_speed_store(struct device *dev,
struct device_attribute *attr, const char *buf,
size_t count)
{
- struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
+ struct led_classdev_mc *led_mc = &drvdata.led_mc;
enum rgb_config_index index;
bool rgb_registered;
int val = 0;
@@ -1019,10 +1019,10 @@ static ssize_t rgb_speed_store(struct device *dev,
index = drvdata.rgb_profile + 2;
u8 rgb_profile[6] = { drvdata.rgb_effect,
- mc_cdev->subled_info[0].intensity,
- mc_cdev->subled_info[1].intensity,
- mc_cdev->subled_info[2].intensity,
- drvdata.led_cdev->brightness,
+ led_mc->subled_info[0].intensity,
+ led_mc->subled_info[1].intensity,
+ led_mc->subled_info[2].intensity,
+ led_mc->led_cdev.brightness,
val };
ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, index, rgb_profile, 6);
@@ -1185,7 +1185,7 @@ static ssize_t rgb_profile_range_show(struct device *dev,
static void hid_gos_brightness_set(struct led_classdev *led_cdev,
enum led_brightness brightness)
{
- struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(drvdata.led_cdev);
+ struct led_classdev_mc *led_mc = &drvdata.led_mc;
enum rgb_config_index index;
bool rgb_registered;
int ret;
@@ -1202,9 +1202,9 @@ static void hid_gos_brightness_set(struct led_classdev *led_cdev,
index = drvdata.rgb_profile + 2;
u8 rgb_profile[6] = { drvdata.rgb_effect,
- mc_cdev->subled_info[0].intensity,
- mc_cdev->subled_info[1].intensity,
- mc_cdev->subled_info[2].intensity,
+ led_mc->subled_info[0].intensity,
+ led_mc->subled_info[1].intensity,
+ led_mc->subled_info[2].intensity,
brightness,
drvdata.rgb_speed };
@@ -1444,17 +1444,6 @@ static struct mc_subled gos_rgb_subled_info[] = {
},
};
-static struct led_classdev_mc gos_cdev_rgb = {
- .led_cdev = {
- .name = "go_s:rgb:joystick_rings",
- .brightness = 0x50,
- .max_brightness = 0x64,
- .brightness_set = hid_gos_brightness_set,
- },
- .num_colors = ARRAY_SIZE(gos_rgb_subled_info),
- .subled_info = gos_rgb_subled_info,
-};
-
static void cfg_setup(struct work_struct *work)
{
bool gp_registered, rgb_registered;
@@ -1525,22 +1514,20 @@ static void cfg_setup(struct work_struct *work)
if (rgb_registered)
goto update_kobjects;
- ret = devm_led_classdev_multicolor_register(&drvdata.hdev->dev, &gos_cdev_rgb);
+ ret = devm_led_classdev_multicolor_register(&drvdata.hdev->dev, &drvdata.led_mc);
if (ret) {
dev_err(&drvdata.hdev->dev,
"Failed to create RGB device: %i\n", ret);
goto update_kobjects;
}
- ret = devm_device_add_group(gos_cdev_rgb.led_cdev.dev, &rgb_attr_group);
+ ret = devm_device_add_group(drvdata.led_mc.led_cdev.dev, &rgb_attr_group);
if (ret) {
dev_err(&drvdata.hdev->dev,
"Failed to create RGB configuration attributes: %i\n", ret);
goto update_kobjects;
}
- drvdata.led_cdev = &gos_cdev_rgb.led_cdev;
-
/* Pairs with smp_load_acquire in attribute show/store functions */
smp_store_release(&drvdata.rgb_registered, true);
rgb_registered = true;
@@ -1549,7 +1536,7 @@ static void cfg_setup(struct work_struct *work)
if (gp_registered)
kobject_uevent(&drvdata.hdev->dev.kobj, KOBJ_CHANGE);
if (rgb_registered)
- kobject_uevent(&drvdata.led_cdev->dev->kobj, KOBJ_CHANGE);
+ kobject_uevent(&drvdata.led_mc.led_cdev.dev->kobj, KOBJ_CHANGE);
}
static int hid_gos_cfg_probe(struct hid_device *hdev,
@@ -1563,6 +1550,18 @@ static int hid_gos_cfg_probe(struct hid_device *hdev,
mutex_init(&drvdata.cfg_mutex);
init_completion(&drvdata.send_cmd_complete);
+ /* Device is hardwired and name is guaranteed to be unique */
+ drvdata.led_mc.led_cdev.name = "go_s:rgb:joystick_rings";
+ drvdata.led_mc.led_cdev.brightness = 0x50;
+ drvdata.led_mc.led_cdev.max_brightness = 0x64;
+ drvdata.led_mc.led_cdev.color = LED_COLOR_ID_RGB;
+ drvdata.led_mc.led_cdev.brightness_set = hid_gos_brightness_set;
+ drvdata.led_mc.num_colors = 3;
+ drvdata.led_mc.subled_info = devm_kmemdup(&hdev->dev, gos_rgb_subled_info,
+ sizeof(gos_rgb_subled_info), GFP_KERNEL);
+ if (!drvdata.led_mc.subled_info)
+ return -ENOMEM;
+
/* Executing calls prior to returning from probe will lock the MCU. Schedule
* initial data call after probe has completed and MCU can accept calls.
*/
--
2.56.0
^ permalink raw reply related [flat|nested] 560+ messages in thread
* [PATCH 7.3 516/547] HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 515/547] HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 517/547] accel/amdxdna: Add support for AIE2 revision 9 Greg Kroah-Hartman
` (39 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Derek J. Clark, Jiri Kosina
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek J. Clark <derekjohn.clark@gmail.com>
commit d3c157b4cdffd14604c2d8435e279761c511bac2 upstream.
Changes drvdata from static global to devm allocation per device.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lenovo-go-s.c | 501 +++++++++++++++++++++++++-----------------
1 file changed, 300 insertions(+), 201 deletions(-)
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -10,6 +10,7 @@
#include <linux/array_size.h>
#include <linux/cleanup.h>
#include <linux/completion.h>
+#include <linux/container_of.h>
#include <linux/delay.h>
#include <linux/dev_printk.h>
#include <linux/device.h>
@@ -32,7 +33,7 @@
#define GO_S_CFG_INTF_IN 0x84
#define GO_S_PACKET_SIZE 64
-static struct gos_cfg_drvdata {
+struct gos_cfg_drvdata {
/* MCU General Variables */
struct completion send_cmd_complete;
struct delayed_work gos_cfg_setup;
@@ -67,7 +68,7 @@ static struct gos_cfg_drvdata {
u8 rgb_speed;
u8 rgb_mode;
u8 rgb_en;
-} drvdata;
+};
struct gos_cfg_attr {
u8 index;
@@ -243,56 +244,57 @@ static const char *const imu_manufacture
[IMU_ST] = "ST",
};
-static int hid_gos_version_event(u8 *data)
+static int hid_gos_version_event(struct gos_cfg_drvdata *drvdata, u8 *data)
{
struct version_report *ver_rep = (struct version_report *)data;
- drvdata.hdev->firmware_version = get_unaligned_le32(&ver_rep->version);
+ drvdata->hdev->firmware_version = get_unaligned_le32(&ver_rep->version);
return 0;
}
-static int hid_gos_mcu_id_event(struct command_report *cmd_rep)
+static int hid_gos_mcu_id_event(struct gos_cfg_drvdata *drvdata, struct command_report *cmd_rep)
{
- drvdata.mcu_id[0] = cmd_rep->sub_cmd;
- memcpy(&drvdata.mcu_id[1], cmd_rep->data, 11);
+ drvdata->mcu_id[0] = cmd_rep->sub_cmd;
+ memcpy(&drvdata->mcu_id[1], cmd_rep->data, 11);
return 0;
}
-static int hid_gos_gamepad_cfg_event(struct command_report *cmd_rep)
+static int hid_gos_gamepad_cfg_event(struct gos_cfg_drvdata *drvdata,
+ struct command_report *cmd_rep)
{
int ret = 0;
switch (cmd_rep->sub_cmd) {
case FEATURE_GAMEPAD_MODE:
- drvdata.gp_mode = cmd_rep->data[0];
+ drvdata->gp_mode = cmd_rep->data[0];
break;
case FEATURE_AUTO_SLEEP_TIME:
- drvdata.gp_auto_sleep_time = cmd_rep->data[0];
+ drvdata->gp_auto_sleep_time = cmd_rep->data[0];
break;
case FEATURE_IMU_BYPASS:
- drvdata.imu_bypass_en = cmd_rep->data[0];
+ drvdata->imu_bypass_en = cmd_rep->data[0];
break;
case FEATURE_RGB_ENABLE:
- drvdata.rgb_en = cmd_rep->data[0];
+ drvdata->rgb_en = cmd_rep->data[0];
break;
case FEATURE_IMU_ENABLE:
- drvdata.imu_sensor_en = cmd_rep->data[0];
+ drvdata->imu_sensor_en = cmd_rep->data[0];
break;
case FEATURE_TOUCHPAD_ENABLE:
- drvdata.tp_en = cmd_rep->data[0];
+ drvdata->tp_en = cmd_rep->data[0];
break;
case FEATURE_OS_MODE:
- drvdata.os_mode = cmd_rep->data[0];
+ drvdata->os_mode = cmd_rep->data[0];
break;
case FEATURE_POLL_RATE:
- drvdata.gp_poll_rate = cmd_rep->data[0];
+ drvdata->gp_poll_rate = cmd_rep->data[0];
break;
case FEATURE_DPAD_MODE:
- drvdata.gp_dpad_mode = cmd_rep->data[0];
+ drvdata->gp_dpad_mode = cmd_rep->data[0];
break;
case FEATURE_MOUSE_WHEEL_STEP:
- drvdata.mouse_step = cmd_rep->data[0];
+ drvdata->mouse_step = cmd_rep->data[0];
break;
default:
ret = -EINVAL;
@@ -302,16 +304,16 @@ static int hid_gos_gamepad_cfg_event(str
return ret;
}
-static int hid_gos_touchpad_event(struct command_report *cmd_rep)
+static int hid_gos_touchpad_event(struct gos_cfg_drvdata *drvdata, struct command_report *cmd_rep)
{
int ret = 0;
switch (cmd_rep->sub_cmd) {
case CFG_LINUX_MODE:
- drvdata.tp_linux_mode = cmd_rep->data[0];
+ drvdata->tp_linux_mode = cmd_rep->data[0];
break;
case CFG_WINDOWS_MODE:
- drvdata.tp_windows_mode = cmd_rep->data[0];
+ drvdata->tp_windows_mode = cmd_rep->data[0];
break;
default:
ret = -EINVAL;
@@ -321,21 +323,21 @@ static int hid_gos_touchpad_event(struct
return ret;
}
-static int hid_gos_pl_test_event(struct command_report *cmd_rep)
+static int hid_gos_pl_test_event(struct gos_cfg_drvdata *drvdata, struct command_report *cmd_rep)
{
int ret = 0;
switch (cmd_rep->sub_cmd) {
case TEST_TP_MFR:
- drvdata.tp_manufacturer = cmd_rep->data[0];
+ drvdata->tp_manufacturer = cmd_rep->data[0];
ret = 0;
break;
case TEST_IMU_MFR:
- drvdata.imu_manufacturer = cmd_rep->data[0];
+ drvdata->imu_manufacturer = cmd_rep->data[0];
ret = 0;
break;
case TEST_TP_VER:
- drvdata.tp_version = cmd_rep->data[0];
+ drvdata->tp_version = cmd_rep->data[0];
ret = 0;
break;
default:
@@ -345,30 +347,30 @@ static int hid_gos_pl_test_event(struct
return ret;
}
-static int hid_gos_light_event(struct command_report *cmd_rep)
+static int hid_gos_light_event(struct gos_cfg_drvdata *drvdata, struct command_report *cmd_rep)
{
struct led_classdev_mc *led_mc;
int ret = 0;
switch (cmd_rep->sub_cmd) {
case LIGHT_MODE_SEL:
- drvdata.rgb_mode = cmd_rep->data[0];
+ drvdata->rgb_mode = cmd_rep->data[0];
ret = 0;
break;
case LIGHT_PROFILE_SEL:
- drvdata.rgb_profile = cmd_rep->data[0];
+ drvdata->rgb_profile = cmd_rep->data[0];
ret = 0;
break;
case USR_LIGHT_PROFILE_1:
case USR_LIGHT_PROFILE_2:
case USR_LIGHT_PROFILE_3:
- led_mc = &drvdata.led_mc;
- drvdata.rgb_effect = cmd_rep->data[0];
+ led_mc = &drvdata->led_mc;
+ drvdata->rgb_effect = cmd_rep->data[0];
led_mc->subled_info[0].intensity = cmd_rep->data[1];
led_mc->subled_info[1].intensity = cmd_rep->data[2];
led_mc->subled_info[2].intensity = cmd_rep->data[3];
led_mc->led_cdev.brightness = cmd_rep->data[4];
- drvdata.rgb_speed = cmd_rep->data[5];
+ drvdata->rgb_speed = cmd_rep->data[5];
ret = 0;
break;
default:
@@ -401,6 +403,7 @@ static int get_endpoint_address(struct h
static int hid_gos_raw_event(struct hid_device *hdev, struct hid_report *report,
u8 *data, int size)
{
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
struct command_report *cmd_rep;
int ep, ret;
@@ -408,6 +411,9 @@ static int hid_gos_raw_event(struct hid_
if (ep != GO_S_CFG_INTF_IN)
return 0;
+ if (!drvdata)
+ return -ENODEV;
+
if (size != GO_S_PACKET_SIZE)
return -EINVAL;
@@ -415,22 +421,22 @@ static int hid_gos_raw_event(struct hid_
switch (cmd_rep->cmd) {
case GET_VERSION:
- ret = hid_gos_version_event(data);
+ ret = hid_gos_version_event(drvdata, data);
break;
case GET_MCU_ID:
- ret = hid_gos_mcu_id_event(cmd_rep);
+ ret = hid_gos_mcu_id_event(drvdata, cmd_rep);
break;
case GET_GAMEPAD_CFG:
- ret = hid_gos_gamepad_cfg_event(cmd_rep);
+ ret = hid_gos_gamepad_cfg_event(drvdata, cmd_rep);
break;
case GET_TP_PARAM:
- ret = hid_gos_touchpad_event(cmd_rep);
+ ret = hid_gos_touchpad_event(drvdata, cmd_rep);
break;
case GET_PL_TEST:
- ret = hid_gos_pl_test_event(cmd_rep);
+ ret = hid_gos_pl_test_event(drvdata, cmd_rep);
break;
case GET_RGB_CFG:
- ret = hid_gos_light_event(cmd_rep);
+ ret = hid_gos_light_event(drvdata, cmd_rep);
break;
case SET_GAMEPAD_CFG:
case SET_RGB_CFG:
@@ -444,8 +450,8 @@ static int hid_gos_raw_event(struct hid_
dev_dbg(&hdev->dev, "Rx data as raw input report: [%*ph]\n",
GO_S_PACKET_SIZE, data);
- drvdata.cmd_status = ret;
- complete(&drvdata.send_cmd_complete);
+ drvdata->cmd_status = ret;
+ complete(&drvdata->send_cmd_complete);
return ret;
}
@@ -453,27 +459,31 @@ static int hid_gos_raw_event(struct hid_
static int mcu_property_out(struct hid_device *hdev, u8 command, u8 index,
u8 *data, size_t len)
{
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
unsigned char *dmabuf __free(kfree) = NULL;
u8 header[] = { command, index };
size_t header_size = ARRAY_SIZE(header);
int timeout, ret;
+ if (!drvdata)
+ return -ENODEV;
+
if (header_size + len > GO_S_PACKET_SIZE)
return -EINVAL;
- guard(mutex)(&drvdata.cfg_mutex);
+ guard(mutex)(&drvdata->cfg_mutex);
/*
* A reply to the previous command may still be in flight. Give it a
* short window to arrive and be consumed before this call reinits the
* completion, so a late reply can't be mistaken for this command's.
*/
- if (drvdata.orphan_ack_pending) {
- wait_for_completion_timeout(&drvdata.send_cmd_complete, msecs_to_jiffies(25));
- drvdata.orphan_ack_pending = false;
- drvdata.cmd_status = -ETIMEDOUT;
+ if (drvdata->orphan_ack_pending) {
+ wait_for_completion_timeout(&drvdata->send_cmd_complete, msecs_to_jiffies(25));
+ drvdata->orphan_ack_pending = false;
+ drvdata->cmd_status = -ETIMEDOUT;
}
- reinit_completion(&drvdata.send_cmd_complete);
+ reinit_completion(&drvdata->send_cmd_complete);
/* We can't use a devm_alloc reusable buffer without side effects during suspend */
dmabuf = kzalloc(GO_S_PACKET_SIZE, GFP_KERNEL);
@@ -496,12 +506,12 @@ static int mcu_property_out(struct hid_d
/* PL_TEST commands can take longer because they go out to another device */
timeout = (command == GET_PL_TEST) ? 200 : 5;
- ret = wait_for_completion_interruptible_timeout(&drvdata.send_cmd_complete,
+ ret = wait_for_completion_interruptible_timeout(&drvdata->send_cmd_complete,
msecs_to_jiffies(timeout));
- ret = ret > 0 ? drvdata.cmd_status : ret ?: -EBUSY;
+ ret = ret > 0 ? drvdata->cmd_status : ret ?: -EBUSY;
if (ret)
- drvdata.orphan_ack_pending = true;
+ drvdata->orphan_ack_pending = true;
return ret;
}
@@ -511,18 +521,30 @@ static ssize_t gamepad_property_store(st
const char *buf, size_t count,
enum feature_status_index index)
{
+ struct gos_cfg_drvdata *drvdata;
+ struct led_classdev_mc *led_mc;
+ struct led_classdev *led_cdev;
+ struct hid_device *hdev;
bool dev_registered;
size_t size = 1;
u8 val = 0;
int ret;
/* rgb_enabled is attached to led_classdev, not hid_device */
- if (index == FEATURE_RGB_ENABLE)
- /* Pairs with smp_store_release from gos_cfg_setup */
- dev_registered = smp_load_acquire(&drvdata.rgb_registered);
- else
- /* Pairs with smp_store_release from gos_cfg_setup */
- dev_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (index == FEATURE_RGB_ENABLE) {
+ led_cdev = dev_get_drvdata(dev);
+ led_mc = lcdev_to_mccdev(led_cdev);
+ drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
+ hdev = drvdata->hdev;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata->rgb_registered);
+
+ } else {
+ hdev = to_hid_device(dev);
+ drvdata = hid_get_drvdata(hdev);
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata->gp_registered);
+ }
if (!dev_registered)
return -ENODEV;
@@ -595,7 +617,7 @@ static ssize_t gamepad_property_store(st
if (!val)
size = 0;
- ret = mcu_property_out(drvdata.hdev, SET_GAMEPAD_CFG, index, &val,
+ ret = mcu_property_out(hdev, SET_GAMEPAD_CFG, index, &val,
size);
if (ret < 0)
return ret;
@@ -607,79 +629,92 @@ static ssize_t gamepad_property_show(str
struct device_attribute *attr, char *buf,
enum feature_status_index index)
{
+ struct gos_cfg_drvdata *drvdata;
+ struct led_classdev_mc *led_mc;
+ struct led_classdev *led_cdev;
+ struct hid_device *hdev;
bool dev_registered;
+
ssize_t count = 0;
u8 i;
/* rgb_enabled is attached to led_classdev, not hid_device */
- if (index == FEATURE_RGB_ENABLE)
- /* Pairs with smp_store_release from gos_cfg_setup */
- dev_registered = smp_load_acquire(&drvdata.rgb_registered);
- else
- /* Pairs with smp_store_release from gos_cfg_setup */
- dev_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (index == FEATURE_RGB_ENABLE) {
+ led_cdev = dev_get_drvdata(dev);
+ led_mc = lcdev_to_mccdev(led_cdev);
+ drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
+ hdev = drvdata->hdev;
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata->rgb_registered);
+
+ } else {
+ hdev = to_hid_device(dev);
+ drvdata = hid_get_drvdata(hdev);
+ /* Pairs with smp_store_release from gos_cfg_setup */
+ dev_registered = smp_load_acquire(&drvdata->gp_registered);
+ }
if (!dev_registered)
return -ENODEV;
- count = mcu_property_out(drvdata.hdev, GET_GAMEPAD_CFG, index, NULL, 0);
+ count = mcu_property_out(hdev, GET_GAMEPAD_CFG, index, NULL, 0);
if (count < 0)
return count;
switch (index) {
case FEATURE_GAMEPAD_MODE:
- i = drvdata.gp_mode;
+ i = drvdata->gp_mode;
if (i >= ARRAY_SIZE(gamepad_mode_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", gamepad_mode_text[i]);
break;
case FEATURE_AUTO_SLEEP_TIME:
- count = sysfs_emit(buf, "%u\n", drvdata.gp_auto_sleep_time);
+ count = sysfs_emit(buf, "%u\n", drvdata->gp_auto_sleep_time);
break;
case FEATURE_IMU_ENABLE:
- i = drvdata.imu_sensor_en;
+ i = drvdata->imu_sensor_en;
if (i >= ARRAY_SIZE(feature_enabled_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", feature_enabled_text[i]);
break;
case FEATURE_IMU_BYPASS:
- i = drvdata.imu_bypass_en;
+ i = drvdata->imu_bypass_en;
if (i >= ARRAY_SIZE(feature_enabled_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", feature_enabled_text[i]);
break;
case FEATURE_RGB_ENABLE:
- i = drvdata.rgb_en;
+ i = drvdata->rgb_en;
if (i >= ARRAY_SIZE(feature_enabled_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", feature_enabled_text[i]);
break;
case FEATURE_TOUCHPAD_ENABLE:
- i = drvdata.tp_en;
+ i = drvdata->tp_en;
if (i >= ARRAY_SIZE(feature_enabled_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", feature_enabled_text[i]);
break;
case FEATURE_OS_MODE:
- i = drvdata.os_mode;
+ i = drvdata->os_mode;
if (i >= ARRAY_SIZE(os_type_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", os_type_text[i]);
break;
case FEATURE_POLL_RATE:
- i = drvdata.gp_poll_rate;
+ i = drvdata->gp_poll_rate;
if (i >= ARRAY_SIZE(poll_rate_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", poll_rate_text[i]);
break;
case FEATURE_DPAD_MODE:
- i = drvdata.gp_dpad_mode;
+ i = drvdata->gp_dpad_mode;
if (i >= ARRAY_SIZE(dpad_mode_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", dpad_mode_text[i]);
break;
case FEATURE_MOUSE_WHEEL_STEP:
- i = drvdata.mouse_step;
+ i = drvdata->mouse_step;
if (i < 1 || i > 127)
return -EINVAL;
count = sysfs_emit(buf, "%u\n", i);
@@ -757,13 +792,18 @@ static ssize_t touchpad_property_store(s
const char *buf, size_t count,
enum touchpad_config_index index)
{
+ struct hid_device *hdev = to_hid_device(dev);
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
bool gp_registered;
size_t size = 1;
u8 val = 0;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!drvdata)
+ return -ENODEV;
+
+/* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata->gp_registered);
if (!gp_registered)
return -ENODEV;
@@ -786,7 +826,7 @@ static ssize_t touchpad_property_store(s
if (!val)
size = 0;
- ret = mcu_property_out(drvdata.hdev, SET_TP_PARAM, index, &val, size);
+ ret = mcu_property_out(hdev, SET_TP_PARAM, index, &val, size);
if (ret < 0)
return ret;
@@ -797,25 +837,30 @@ static ssize_t touchpad_property_show(st
struct device_attribute *attr, char *buf,
enum touchpad_config_index index)
{
+ struct hid_device *hdev = to_hid_device(dev);
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
bool gp_registered;
int ret = 0;
u8 i;
- /* Pairs with smp_store_release from gos_cfg_setup */
- gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!drvdata)
+ return -ENODEV;
+
+/* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata->gp_registered);
if (!gp_registered)
return -ENODEV;
- ret = mcu_property_out(drvdata.hdev, GET_TP_PARAM, index, NULL, 0);
+ ret = mcu_property_out(hdev, GET_TP_PARAM, index, NULL, 0);
if (ret < 0)
return ret;
switch (index) {
case CFG_WINDOWS_MODE:
- i = drvdata.tp_windows_mode;
+ i = drvdata->tp_windows_mode;
break;
case CFG_LINUX_MODE:
- i = drvdata.tp_linux_mode;
+ i = drvdata->tp_linux_mode;
break;
default:
return -EINVAL;
@@ -832,15 +877,9 @@ static ssize_t touchpad_property_options
char *buf,
enum touchpad_config_index index)
{
- bool gp_registered;
size_t count = 0;
unsigned int i;
- /* Pairs with smp_store_release from gos_cfg_setup */
- gp_registered = smp_load_acquire(&drvdata.gp_registered);
- if (!gp_registered)
- return -ENODEV;
-
switch (index) {
case CFG_WINDOWS_MODE:
case CFG_LINUX_MODE:
@@ -863,30 +902,35 @@ static ssize_t test_property_show(struct
struct device_attribute *attr, char *buf,
enum test_command_index index)
{
+ struct hid_device *hdev = to_hid_device(dev);
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
bool gp_registered;
size_t count = 0;
u8 i;
- /* Pairs with smp_store_release from gos_cfg_setup */
- gp_registered = smp_load_acquire(&drvdata.gp_registered);
+ if (!drvdata)
+ return -ENODEV;
+
+/* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata->gp_registered);
if (!gp_registered)
return -ENODEV;
switch (index) {
case TEST_TP_MFR:
- i = drvdata.tp_manufacturer;
+ i = drvdata->tp_manufacturer;
if (i >= ARRAY_SIZE(touchpad_manufacturer_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", touchpad_manufacturer_text[i]);
break;
case TEST_IMU_MFR:
- i = drvdata.imu_manufacturer;
+ i = drvdata->imu_manufacturer;
if (i >= ARRAY_SIZE(imu_manufacturer_text))
return -EINVAL;
count = sysfs_emit(buf, "%s\n", imu_manufacturer_text[i]);
break;
case TEST_TP_VER:
- count = sysfs_emit(buf, "%u\n", drvdata.tp_version);
+ count = sysfs_emit(buf, "%u\n", drvdata->tp_version);
break;
default:
count = -EINVAL;
@@ -899,7 +943,13 @@ static ssize_t test_property_show(struct
static ssize_t mcu_id_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
- return sysfs_emit(buf, "%*phN\n", 12, &drvdata.mcu_id);
+ struct hid_device *hdev = to_hid_device(dev);
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
+
+ if (!drvdata)
+ return -ENODEV;
+
+ return sysfs_emit(buf, "%*phN\n", 12, &drvdata->mcu_id);
}
static int rgb_cfg_call(struct hid_device *hdev, enum mcu_command_index cmd,
@@ -914,27 +964,29 @@ static int rgb_cfg_call(struct hid_devic
return mcu_property_out(hdev, cmd, index, val, size);
}
-static int rgb_attr_show(void)
+static int rgb_attr_show(struct gos_cfg_drvdata *drvdata)
{
enum rgb_config_index index;
- index = drvdata.rgb_profile + 2;
+ index = drvdata->rgb_profile + 2;
- return rgb_cfg_call(drvdata.hdev, GET_RGB_CFG, index, NULL, 0);
+ return rgb_cfg_call(drvdata->hdev, GET_RGB_CFG, index, NULL, 0);
};
static ssize_t rgb_effect_store(struct device *dev,
struct device_attribute *attr, const char *buf,
size_t count)
{
- struct led_classdev_mc *led_mc = &drvdata.led_mc;
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
enum rgb_config_index index;
bool rgb_registered;
u8 effect;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
@@ -943,41 +995,44 @@ static ssize_t rgb_effect_store(struct d
return ret;
effect = ret;
- index = drvdata.rgb_profile + 2;
+ index = drvdata->rgb_profile + 2;
u8 rgb_profile[6] = { effect,
led_mc->subled_info[0].intensity,
led_mc->subled_info[1].intensity,
led_mc->subled_info[2].intensity,
led_mc->led_cdev.brightness,
- drvdata.rgb_speed };
+ drvdata->rgb_speed };
- ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, index, rgb_profile, 6);
+ ret = rgb_cfg_call(drvdata->hdev, SET_RGB_CFG, index, rgb_profile, 6);
if (ret)
return ret;
- drvdata.rgb_effect = effect;
+ drvdata->rgb_effect = effect;
return count;
};
static ssize_t rgb_effect_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
bool rgb_registered;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
- ret = rgb_attr_show();
+ ret = rgb_attr_show(drvdata);
if (ret)
return ret;
- if (drvdata.rgb_effect >= ARRAY_SIZE(rgb_effect_text))
+ if (drvdata->rgb_effect >= ARRAY_SIZE(rgb_effect_text))
return -EINVAL;
- return sysfs_emit(buf, "%s\n", rgb_effect_text[drvdata.rgb_effect]);
+ return sysfs_emit(buf, "%s\n", rgb_effect_text[drvdata->rgb_effect]);
}
static ssize_t rgb_effect_index_show(struct device *dev,
@@ -999,14 +1054,16 @@ static ssize_t rgb_speed_store(struct de
struct device_attribute *attr, const char *buf,
size_t count)
{
- struct led_classdev_mc *led_mc = &drvdata.led_mc;
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
enum rgb_config_index index;
bool rgb_registered;
int val = 0;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
@@ -1017,19 +1074,19 @@ static ssize_t rgb_speed_store(struct de
if (val < 0 || val > 100)
return -EINVAL;
- index = drvdata.rgb_profile + 2;
- u8 rgb_profile[6] = { drvdata.rgb_effect,
+ index = drvdata->rgb_profile + 2;
+ u8 rgb_profile[6] = { drvdata->rgb_effect,
led_mc->subled_info[0].intensity,
led_mc->subled_info[1].intensity,
led_mc->subled_info[2].intensity,
led_mc->led_cdev.brightness,
val };
- ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, index, rgb_profile, 6);
+ ret = rgb_cfg_call(drvdata->hdev, SET_RGB_CFG, index, rgb_profile, 6);
if (ret)
return ret;
- drvdata.rgb_speed = val;
+ drvdata->rgb_speed = val;
return count;
};
@@ -1037,22 +1094,25 @@ static ssize_t rgb_speed_store(struct de
static ssize_t rgb_speed_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
bool rgb_registered;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
- ret = rgb_attr_show();
+ ret = rgb_attr_show(drvdata);
if (ret)
return ret;
- if (drvdata.rgb_speed > 100)
+ if (drvdata->rgb_speed > 100)
return -EINVAL;
- return sysfs_emit(buf, "%hhu\n", drvdata.rgb_speed);
+ return sysfs_emit(buf, "%hhu\n", drvdata->rgb_speed);
}
static ssize_t rgb_speed_range_show(struct device *dev,
@@ -1064,12 +1124,15 @@ static ssize_t rgb_speed_range_show(stru
static ssize_t rgb_mode_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t count)
{
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
bool rgb_registered;
int ret;
u8 val;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
@@ -1079,12 +1142,12 @@ static ssize_t rgb_mode_store(struct dev
val = ret;
- ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, LIGHT_MODE_SEL, &val,
+ ret = rgb_cfg_call(drvdata->hdev, SET_RGB_CFG, LIGHT_MODE_SEL, &val,
1);
if (ret)
return ret;
- drvdata.rgb_mode = val;
+ drvdata->rgb_mode = val;
return count;
};
@@ -1092,22 +1155,25 @@ static ssize_t rgb_mode_store(struct dev
static ssize_t rgb_mode_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
bool rgb_registered;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
- ret = rgb_cfg_call(drvdata.hdev, GET_RGB_CFG, LIGHT_MODE_SEL, NULL, 0);
+ ret = rgb_cfg_call(drvdata->hdev, GET_RGB_CFG, LIGHT_MODE_SEL, NULL, 0);
if (ret)
return ret;
- if (drvdata.rgb_mode >= ARRAY_SIZE(rgb_mode_text))
+ if (drvdata->rgb_mode >= ARRAY_SIZE(rgb_mode_text))
return -EINVAL;
- return sysfs_emit(buf, "%s\n", rgb_mode_text[drvdata.rgb_mode]);
+ return sysfs_emit(buf, "%s\n", rgb_mode_text[drvdata->rgb_mode]);
};
static ssize_t rgb_mode_index_show(struct device *dev,
@@ -1129,13 +1195,16 @@ static ssize_t rgb_profile_store(struct
struct device_attribute *attr, const char *buf,
size_t count)
{
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
bool rgb_registered;
size_t size = 1;
int ret;
u8 val;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
@@ -1146,11 +1215,11 @@ static ssize_t rgb_profile_store(struct
if (val < 1 || val > 3)
return -EINVAL;
- ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, LIGHT_PROFILE_SEL, &val, size);
+ ret = rgb_cfg_call(drvdata->hdev, SET_RGB_CFG, LIGHT_PROFILE_SEL, &val, size);
if (ret)
return ret;
- drvdata.rgb_profile = val;
+ drvdata->rgb_profile = val;
return count;
};
@@ -1158,22 +1227,25 @@ static ssize_t rgb_profile_store(struct
static ssize_t rgb_profile_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
bool rgb_registered;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return -ENODEV;
- ret = rgb_cfg_call(drvdata.hdev, GET_RGB_CFG, LIGHT_PROFILE_SEL, NULL, 0);
+ ret = rgb_cfg_call(drvdata->hdev, GET_RGB_CFG, LIGHT_PROFILE_SEL, NULL, 0);
if (ret)
return ret;
- if (drvdata.rgb_profile < 1 || drvdata.rgb_profile > 3)
+ if (drvdata->rgb_profile < 1 || drvdata->rgb_profile > 3)
return -EINVAL;
- return sysfs_emit(buf, "%hhu\n", drvdata.rgb_profile);
+ return sysfs_emit(buf, "%hhu\n", drvdata->rgb_profile);
};
static ssize_t rgb_profile_range_show(struct device *dev,
@@ -1185,13 +1257,14 @@ static ssize_t rgb_profile_range_show(st
static void hid_gos_brightness_set(struct led_classdev *led_cdev,
enum led_brightness brightness)
{
- struct led_classdev_mc *led_mc = &drvdata.led_mc;
+ struct led_classdev_mc *led_mc = lcdev_to_mccdev(led_cdev);
+ struct gos_cfg_drvdata *drvdata = container_of(led_mc, struct gos_cfg_drvdata, led_mc);
enum rgb_config_index index;
bool rgb_registered;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!rgb_registered)
return;
@@ -1200,15 +1273,15 @@ static void hid_gos_brightness_set(struc
return;
}
- index = drvdata.rgb_profile + 2;
- u8 rgb_profile[6] = { drvdata.rgb_effect,
+ index = drvdata->rgb_profile + 2;
+ u8 rgb_profile[6] = { drvdata->rgb_effect,
led_mc->subled_info[0].intensity,
led_mc->subled_info[1].intensity,
led_mc->subled_info[2].intensity,
brightness,
- drvdata.rgb_speed };
+ drvdata->rgb_speed };
- ret = rgb_cfg_call(drvdata.hdev, SET_RGB_CFG, index, rgb_profile, 6);
+ ret = rgb_cfg_call(drvdata->hdev, SET_RGB_CFG, index, rgb_profile, 6);
switch (ret) {
case 0:
led_cdev->brightness = brightness;
@@ -1446,127 +1519,138 @@ static struct mc_subled gos_rgb_subled_i
static void cfg_setup(struct work_struct *work)
{
+ struct delayed_work *dwork = container_of(work, struct delayed_work, work);
+ struct gos_cfg_drvdata *drvdata = container_of(dwork, struct gos_cfg_drvdata,
+ gos_cfg_setup);
bool gp_registered, rgb_registered;
int ret;
+ if (!drvdata)
+ return;
+
/* MCU */
- ret = mcu_property_out(drvdata.hdev, GET_MCU_ID, FEATURE_NONE, NULL, 0);
+ ret = mcu_property_out(drvdata->hdev, GET_MCU_ID, FEATURE_NONE, NULL, 0);
if (ret) {
- dev_err(&drvdata.hdev->dev, "Failed to retrieve MCU ID: %i\n",
+ dev_err(&drvdata->hdev->dev, "Failed to retrieve MCU ID: %i\n",
ret);
return;
}
- ret = mcu_property_out(drvdata.hdev, GET_VERSION, FEATURE_NONE, NULL, 0);
+ ret = mcu_property_out(drvdata->hdev, GET_VERSION, FEATURE_NONE, NULL, 0);
if (ret) {
- dev_err(&drvdata.hdev->dev, "Failed to retrieve MCU Version: %i\n", ret);
+ dev_err(&drvdata->hdev->dev, "Failed to retrieve MCU Version: %i\n", ret);
return;
}
- ret = mcu_property_out(drvdata.hdev, GET_PL_TEST, TEST_TP_MFR, NULL, 0);
+ ret = mcu_property_out(drvdata->hdev, GET_PL_TEST, TEST_TP_MFR, NULL, 0);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to retrieve Touchpad Manufacturer: %i\n", ret);
return;
}
- ret = mcu_property_out(drvdata.hdev, GET_PL_TEST, TEST_TP_VER, NULL, 0);
+ ret = mcu_property_out(drvdata->hdev, GET_PL_TEST, TEST_TP_VER, NULL, 0);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to retrieve Touchpad Firmware Version: %i\n", ret);
return;
}
- ret = mcu_property_out(drvdata.hdev, GET_PL_TEST, TEST_IMU_MFR, NULL, 0);
+ ret = mcu_property_out(drvdata->hdev, GET_PL_TEST, TEST_IMU_MFR, NULL, 0);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to retrieve IMU Manufacturer: %i\n", ret);
return;
}
- ret = mcu_property_out(drvdata.hdev, GET_GAMEPAD_CFG, FEATURE_OS_MODE,
+ ret = mcu_property_out(drvdata->hdev, GET_GAMEPAD_CFG, FEATURE_OS_MODE,
NULL, 0);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to retrieve OS Mode: %i\n", ret);
return;
}
- /* Pairs with smp_store_release from below */
- gp_registered = smp_load_acquire(&drvdata.gp_registered);
+/* Pairs with smp_store_release from below */
+ gp_registered = smp_load_acquire(&drvdata->gp_registered);
if (gp_registered)
goto try_rgb;
- ret = sysfs_create_groups(&drvdata.hdev->dev.kobj, top_level_attr_groups);
+ ret = sysfs_create_groups(&drvdata->hdev->dev.kobj, top_level_attr_groups);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to create gamepad configuration attributes: %i\n", ret);
goto try_rgb;
}
- /* Pairs with smp_load_acquire in attribute show/store functions */
- smp_store_release(&drvdata.gp_registered, true);
+/* Pairs with smp_load_acquire in attribute show/store functions */
+ smp_store_release(&drvdata->gp_registered, true);
gp_registered = true;
try_rgb:
- /* Pairs with smp_store_release from below */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+/* Pairs with smp_store_release from below */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (rgb_registered)
goto update_kobjects;
- ret = devm_led_classdev_multicolor_register(&drvdata.hdev->dev, &drvdata.led_mc);
+ ret = devm_led_classdev_multicolor_register(&drvdata->hdev->dev, &drvdata->led_mc);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to create RGB device: %i\n", ret);
goto update_kobjects;
}
- ret = devm_device_add_group(drvdata.led_mc.led_cdev.dev, &rgb_attr_group);
+ ret = devm_device_add_group(drvdata->led_mc.led_cdev.dev, &rgb_attr_group);
if (ret) {
- dev_err(&drvdata.hdev->dev,
+ dev_err(&drvdata->hdev->dev,
"Failed to create RGB configuration attributes: %i\n", ret);
goto update_kobjects;
}
- /* Pairs with smp_load_acquire in attribute show/store functions */
- smp_store_release(&drvdata.rgb_registered, true);
+/* Pairs with smp_load_acquire in attribute show/store functions */
+ smp_store_release(&drvdata->rgb_registered, true);
rgb_registered = true;
update_kobjects:
if (gp_registered)
- kobject_uevent(&drvdata.hdev->dev.kobj, KOBJ_CHANGE);
+ kobject_uevent(&drvdata->hdev->dev.kobj, KOBJ_CHANGE);
if (rgb_registered)
- kobject_uevent(&drvdata.led_mc.led_cdev.dev->kobj, KOBJ_CHANGE);
+ kobject_uevent(&drvdata->led_mc.led_cdev.dev->kobj, KOBJ_CHANGE);
}
static int hid_gos_cfg_probe(struct hid_device *hdev,
const struct hid_device_id *_id)
{
+ struct gos_cfg_drvdata *drvdata;
int ret;
- hid_set_drvdata(hdev, &drvdata);
- drvdata.hdev = hdev;
+ drvdata = devm_kzalloc(&hdev->dev, sizeof(struct gos_cfg_drvdata), GFP_KERNEL);
+ if (!drvdata)
+ return -ENOMEM;
+
+ hid_set_drvdata(hdev, drvdata);
+ drvdata->hdev = hdev;
- mutex_init(&drvdata.cfg_mutex);
- init_completion(&drvdata.send_cmd_complete);
+ mutex_init(&drvdata->cfg_mutex);
+ init_completion(&drvdata->send_cmd_complete);
/* Device is hardwired and name is guaranteed to be unique */
- drvdata.led_mc.led_cdev.name = "go_s:rgb:joystick_rings";
- drvdata.led_mc.led_cdev.brightness = 0x50;
- drvdata.led_mc.led_cdev.max_brightness = 0x64;
- drvdata.led_mc.led_cdev.color = LED_COLOR_ID_RGB;
- drvdata.led_mc.led_cdev.brightness_set = hid_gos_brightness_set;
- drvdata.led_mc.num_colors = 3;
- drvdata.led_mc.subled_info = devm_kmemdup(&hdev->dev, gos_rgb_subled_info,
- sizeof(gos_rgb_subled_info), GFP_KERNEL);
- if (!drvdata.led_mc.subled_info)
+ drvdata->led_mc.led_cdev.name = "go_s:rgb:joystick_rings";
+ drvdata->led_mc.led_cdev.brightness = 0x50;
+ drvdata->led_mc.led_cdev.max_brightness = 0x64;
+ drvdata->led_mc.led_cdev.color = LED_COLOR_ID_RGB;
+ drvdata->led_mc.led_cdev.brightness_set = hid_gos_brightness_set;
+ drvdata->led_mc.num_colors = 3;
+ drvdata->led_mc.subled_info = devm_kmemdup(&hdev->dev, gos_rgb_subled_info,
+ sizeof(gos_rgb_subled_info), GFP_KERNEL);
+ if (!drvdata->led_mc.subled_info)
return -ENOMEM;
/* Executing calls prior to returning from probe will lock the MCU. Schedule
* initial data call after probe has completed and MCU can accept calls.
*/
- INIT_DELAYED_WORK(&drvdata.gos_cfg_setup, &cfg_setup);
- ret = schedule_delayed_work(&drvdata.gos_cfg_setup, msecs_to_jiffies(2));
+ INIT_DELAYED_WORK(&drvdata->gos_cfg_setup, &cfg_setup);
+ ret = schedule_delayed_work(&drvdata->gos_cfg_setup, msecs_to_jiffies(2));
if (!ret) {
dev_err(&hdev->dev, "Failed to schedule startup delayed work\n");
return -ENODEV;
@@ -1577,7 +1661,12 @@ static int hid_gos_cfg_probe(struct hid_
static void hid_gos_cfg_remove(struct hid_device *hdev)
{
- disable_delayed_work_sync(&drvdata.gos_cfg_setup);
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
+
+ if (!drvdata)
+ return;
+
+ disable_delayed_work_sync(&drvdata->gos_cfg_setup);
sysfs_remove_groups(&hdev->dev.kobj, top_level_attr_groups);
hid_hw_close(hdev);
hid_hw_stop(hdev);
@@ -1586,16 +1675,21 @@ static void hid_gos_cfg_remove(struct hi
static int hid_gos_cfg_reset_resume(struct hid_device *hdev)
{
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
bool gp_registered, rgb_registered;
- u8 os_mode = drvdata.os_mode;
+ u8 os_mode;
int ret;
- /* Pairs with smp_store_release from gos_cfg_setup */
- gp_registered = smp_load_acquire(&drvdata.gp_registered);
- /* Pairs with smp_store_release from gos_cfg_setup */
- rgb_registered = smp_load_acquire(&drvdata.rgb_registered);
+ if (!drvdata)
+ return -ENODEV;
+
+ os_mode = drvdata->os_mode;
+/* Pairs with smp_store_release from gos_cfg_setup */
+ gp_registered = smp_load_acquire(&drvdata->gp_registered);
+/* Pairs with smp_store_release from gos_cfg_setup */
+ rgb_registered = smp_load_acquire(&drvdata->rgb_registered);
if (!gp_registered || !rgb_registered) {
- ret = schedule_delayed_work(&drvdata.gos_cfg_setup, msecs_to_jiffies(2));
+ ret = schedule_delayed_work(&drvdata->gos_cfg_setup, msecs_to_jiffies(2));
if (!ret) {
dev_err(&hdev->dev, "Failed to schedule startup delayed work\n");
return -ENODEV;
@@ -1604,20 +1698,20 @@ static int hid_gos_cfg_reset_resume(stru
return 0;
}
- ret = mcu_property_out(drvdata.hdev, SET_GAMEPAD_CFG,
+ ret = mcu_property_out(drvdata->hdev, SET_GAMEPAD_CFG,
FEATURE_OS_MODE, &os_mode, 1);
if (ret < 0)
return ret;
- ret = mcu_property_out(drvdata.hdev, GET_GAMEPAD_CFG,
+ ret = mcu_property_out(drvdata->hdev, GET_GAMEPAD_CFG,
FEATURE_OS_MODE, NULL, 0);
if (ret < 0)
return ret;
- if (drvdata.os_mode != os_mode)
+ if (drvdata->os_mode != os_mode)
return -ENODEV;
- kobject_uevent(&drvdata.hdev->dev.kobj, KOBJ_CHANGE);
+ kobject_uevent(&drvdata->hdev->dev.kobj, KOBJ_CHANGE);
return 0;
}
@@ -1692,9 +1786,14 @@ static int hid_gos_reset_resume(struct h
return 0;
}
-static int hid_gos_cfg_suspend(void)
+static int hid_gos_cfg_suspend(struct hid_device *hdev)
{
- disable_delayed_work_sync(&drvdata.gos_cfg_setup);
+ struct gos_cfg_drvdata *drvdata = hid_get_drvdata(hdev);
+
+ if (!drvdata)
+ return -ENODEV;
+
+ disable_delayed_work_sync(&drvdata->gos_cfg_setup);
return 0;
}
@@ -1711,7 +1810,7 @@ static int hid_gos_suspend(struct hid_de
ep = ret;
if (ep == GO_S_CFG_INTF_IN)
- return hid_gos_cfg_suspend();
+ return hid_gos_cfg_suspend(hdev);
return 0;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 517/547] accel/amdxdna: Add support for AIE2 revision 9
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 516/547] HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 518/547] io_uring/kbuf: advance head when a pickup empties the buffer ring Greg Kroah-Hartman
` (38 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD), Lizhi Hou
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
commit 63e91c1997898f32f68a5dbf68195d68b8e58443 upstream.
aie2_get_dev_revision() fails to recognize AIE2 revision 9 hardware.
Add AIE2_DEV_REVISION_GRGH to the list of supported AIE2 revisions.
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260929181459.928468-1-lizhi.hou@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/amdxdna/aie2_msg_priv.h | 1 +
drivers/accel/amdxdna/npu4_regs.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/accel/amdxdna/aie2_msg_priv.h
+++ b/drivers/accel/amdxdna/aie2_msg_priv.h
@@ -530,6 +530,7 @@ enum aie2_dev_revision {
AIE2_DEV_REVISION_GPT1,
AIE2_DEV_REVISION_GPT2,
AIE2_DEV_REVISION_GPT3,
+ AIE2_DEV_REVISION_GRGH,
AIE2_DEV_REVISION_UNKN,
};
--- a/drivers/accel/amdxdna/npu4_regs.c
+++ b/drivers/accel/amdxdna/npu4_regs.c
@@ -153,6 +153,7 @@ const struct amdxdna_rev_vbnv npu4_rev_v
{ AIE2_DEV_REVISION_GPT1, "NPU Gorgon Point 1" },
{ AIE2_DEV_REVISION_GPT2, "NPU Gorgon Point 2" },
{ AIE2_DEV_REVISION_GPT3, "NPU Gorgon Point 3" },
+ { AIE2_DEV_REVISION_GRGH, "NPU Gorgon Halo" },
{ 0 }
};
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 518/547] io_uring/kbuf: advance head when a pickup empties the buffer ring
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 517/547] accel/amdxdna: Add support for AIE2 revision 9 Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 519/547] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT Greg Kroah-Hartman
` (37 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
Commit 8742f4b5a472c347fe568a73468a2d9e4d630b33 upstream.
io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the
buffers it picked were the last ones available, comparing head to tail.
When the loop breaks because max_len was exhausted the buffer was picked,
but head is left pointing at it, so the flag isn't set if it was the last
buffer. A bundle receive then retries, finds no buffer, and the request,
which has received data, is marked as failed on account of the -ENOBUFS.
That severs a link, and ends a multishot.
Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20261023091711.83481-1-chenyichong@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/kbuf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -326,8 +326,10 @@ static int io_ring_buffers_peek(struct i
arg->out_len += len;
arg->max_len -= len;
- if (!arg->max_len)
+ if (!arg->max_len) {
+ head++;
break;
+ }
buf = io_ring_head_to_buf(br, ++head, bl->mask);
} while (--nr_iovs);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 519/547] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 518/547] io_uring/kbuf: advance head when a pickup empties the buffer ring Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 520/547] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate() Greg Kroah-Hartman
` (36 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
Commit 18d3f56eb6e6500a65d81cf265f0fe74fd9ecab6 upstream.
io_recvmsg() takes the transfer length from the ring provided buffer when
sqe->len is 0, and such a buffer can be up to 4G. min_ret is an int, so 2G
or more makes it negative and the (ret < min_ret) block is skipped, and the
oversized length reaches the socket layer unchanged: an empty socket then
completes with 0 instead of arming poll, and a short read is reported as
complete. Clamp the length to MAX_RW_COUNT, as io_recv() does.
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20261023112209.87979-1-chenyichong@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/net.c | 1 +
1 file changed, 1 insertion(+)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1068,6 +1068,7 @@ retry_multishot:
sel = io_buffer_select(req, &len, sr->buf_group, issue_flags);
if (!sel.addr)
return -ENOBUFS;
+ len = min_t(size_t, len, MAX_RW_COUNT);
if (req->flags & REQ_F_APOLL_MULTISHOT) {
ret = io_recvmsg_prep_multishot(kmsg, sr, &sel.addr, &len);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 520/547] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 519/547] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 521/547] io_uring/register: enforce per-task restrictions in io_uring_register_blind() Greg Kroah-Hartman
` (35 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dominik Maier, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Maier <dmnk@google.com>
Commit e66907c3ba229399ecfb4ef032b95a4a071c894e upstream.
When an IORING_OP_SOCKET request is prepared in io_socket_prep(),
sock->type retains creation flags such as SOCK_CLOEXEC and SOCK_NONBLOCK
until __sys_socket_file() masks them off with SOCK_TYPE_MASK during
execution.
However, io_socket_bpf_populate() copies sock->type into
bctx->socket.type without masking off ~SOCK_TYPE_MASK. As a result, a
cBPF filter inspecting bctx->socket.type against socket types such as
SOCK_DGRAM or SOCK_STREAM can be bypassed by ORing SOCK_CLOEXEC or
SOCK_NONBLOCK into the socket type.
Mask sock->type with SOCK_TYPE_MASK when populating bctx->socket.type.
Fixes: cff1c26b4223 ("io_uring/net: allow filtering on IORING_OP_SOCKET data")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Link: https://patch.msgid.link/20261022232120.2537530-1-dmnk@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1734,7 +1734,7 @@ void io_socket_bpf_populate(struct io_ur
struct io_socket *sock = io_kiocb_to_cmd(req, struct io_socket);
bctx->socket.family = sock->domain;
- bctx->socket.type = sock->type;
+ bctx->socket.type = sock->type & SOCK_TYPE_MASK;
bctx->socket.protocol = sock->protocol;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 521/547] io_uring/register: enforce per-task restrictions in io_uring_register_blind()
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 520/547] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate() Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 522/547] io_uring/net: dont retry a non-blocking connect() that fails with -EAGAIN Greg Kroah-Hartman
` (34 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dominik Maier, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Maier <dmnk@google.com>
Commit 4a93427e99a8524f3612f29ec8bc0da5f8435a51 upstream.
When io_uring_register(2) is invoked with fd == -1, it dispatches
directly to io_uring_register_blind() without checking
current->io_uring_restrict.
As a result, a task with per-task register restrictions installed via
IORING_REGISTER_RESTRICTIONS can still invoke blind registration opcodes
such as IORING_REGISTER_SEND_MSG_RING even when those opcodes are not in
the task's allowed register_op bitmap.
Check current->io_uring_restrict->register_op in
io_uring_register_blind() before dispatching blind registration opcodes.
Fixes: ed82f35b926b ("io_uring: allow registration of per-task restrictions")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Link: https://patch.msgid.link/20261022232121.2538616-1-dmnk@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/register.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/io_uring/register.c
+++ b/io_uring/register.c
@@ -1058,6 +1058,13 @@ static int io_uring_register_send_msg_ri
static int io_uring_register_blind(unsigned int opcode, void __user *arg,
unsigned int nr_args)
{
+ if (current->io_uring_restrict &&
+ current->io_uring_restrict->reg_registered) {
+ opcode = array_index_nospec(opcode, IORING_REGISTER_LAST);
+ if (!test_bit(opcode, current->io_uring_restrict->register_op))
+ return -EACCES;
+ }
+
switch (opcode) {
case IORING_REGISTER_SEND_MSG_RING:
return io_uring_register_send_msg_ring(arg, nr_args);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 522/547] io_uring/net: dont retry a non-blocking connect() that fails with -EAGAIN
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 521/547] io_uring/register: enforce per-task restrictions in io_uring_register_blind() Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 523/547] io_uring: keep the drain active when a deferred drain request is started Greg Kroah-Hartman
` (33 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daan De Meyer, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daan De Meyer <daan@amutable.com>
Commit 71537ed811107c514c0342e98902d489d6d2b7cd upstream.
IORING_OP_CONNECT on an O_NONBLOCK AF_UNIX stream socket retries a
connect that fails with -EAGAIN because the listener's backlog is full.
Polling the client socket doesn't help: an unconnected stream socket
reports EPOLLOUT and EPOLLHUP right away, before the backlog drains. So
io_uring retries the connect until the apoll retry limit is hit, then
punts the request to io-wq. With a full backlog, io_connect() runs 128
times in the submitting task and once more in a new io-wq worker. That
worker stays in the task's thread group, so a later
unshare(CLONE_NEWUSER) fails with -EINVAL.
None of this changes the result. __sys_connect_file() adds the socket's
own O_NONBLOCK to every attempt, so the attempt from io-wq fails with
-EAGAIN as well. That -EAGAIN becomes the CQE result, and connect(2)
returns the same -EAGAIN.
Let's complete the request with -EAGAIN right away when the socket has
O_NONBLOCK set, like connect(2) does. io_accept() already completes
-EAGAIN this way for IORING_ACCEPT_DONTWAIT. -EINPROGRESS still waits
for the connection to complete. A blocking socket still ends up in
io-wq, where the connect sleeps until the listener accepts.
Fixes: f8e85cf255ad ("io_uring: add support for IORING_OP_CONNECT")
Signed-off-by: Daan De Meyer <daan@amutable.com>
Link: https://patch.msgid.link/20261027-b4-io-uring-connect-eagain-v1-1-f4e3aaaa49ee@amutable.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/net.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1878,6 +1878,17 @@ int io_connect(struct io_kiocb *req, uns
if (connect->seen_econnaborted)
goto out;
connect->seen_econnaborted = true;
+ } else if (req->file->f_flags & O_NONBLOCK) {
+ /*
+ * __sys_connect_file() adds O_NONBLOCK from the socket
+ * to every attempt, so a retry from io-wq fails with
+ * -EAGAIN as well. A poll on the socket doesn't wait
+ * until a retry can succeed. For example, an AF_UNIX
+ * client reports EPOLLOUT right away while the
+ * listener's backlog is full. Complete the request
+ * with -EAGAIN, like connect(2) does.
+ */
+ goto out;
}
return -EAGAIN;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 523/547] io_uring: keep the drain active when a deferred drain request is started
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 522/547] io_uring/net: dont retry a non-blocking connect() that fails with -EAGAIN Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 524/547] io_uring/io-wq: no new workers once the exit has begun Greg Kroah-Hartman
` (32 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
Commit 2295613cd3713beffc8665e956135a5d48dfc208 upstream.
ecb6817b769f ends the drain when the dispatched drain request has posted
its CQE and nothing else is deferred. But the deferred list is processed
in between, and if the request it starts is itself a drain request, the
drain is over before that one has even run. A request submitted after
that point then runs ahead of it:
1. P0 in flight, D1 and D2 (both IOSQE_IO_DRAIN) deferred behind it
2. P0 completes, D1 is started
3. D1 completes, drain_done is set, D2 is started, the list is empty
4. IO_RING_F_DRAIN_ACTIVE is cleared with D2 still in flight
Anything submitted now bypasses the drain. The same happens with D2 as
the head of a link, as those aren't tracked in ->drain_req at all.
Have io_queue_deferred() report whether it started a drain request, and
don't end the drain if it did. Starting non-drain requests and ending it
is still fine, they were only waiting on the drain request that just
completed.
Fixes: ecb6817b769f ("io_uring: end the drain when the drain request completes")
Reported-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://lore.kernel.org/io-uring/20261027043323.98916-1-kmehltretter@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -474,9 +474,9 @@ unsigned io_linked_nr(struct io_kiocb *r
return nr;
}
-static __cold noinline void io_queue_deferred(struct io_ring_ctx *ctx)
+static __cold noinline bool io_queue_deferred(struct io_ring_ctx *ctx)
{
- bool drain_seen = false, first = true;
+ bool drain_seen = false, first = true, drain_queued = false;
lockdep_assert_held(&ctx->uring_lock);
__io_req_caches_free(ctx);
@@ -490,17 +490,21 @@ static __cold noinline void io_queue_def
drain_seen |= de->req->flags & REQ_F_IO_DRAIN;
if ((drain_seen || first) && ctx->nr_req_allocated != ctx->nr_drained)
- return;
+ return drain_queued;
list_del_init(&de->list);
ctx->nr_drained -= io_linked_nr(de->req);
- /* it runs alone, track its completion unless it's a link */
- if ((de->req->flags & REQ_F_IO_DRAIN) && !de->req->link)
- ctx->drain_req = de->req;
+ if (de->req->flags & REQ_F_IO_DRAIN) {
+ drain_queued = true;
+ /* it runs alone, track its completion unless it's a link */
+ if (!de->req->link)
+ ctx->drain_req = de->req;
+ }
io_req_task_queue(de->req);
kfree(de);
first = false;
}
+ return drain_queued;
}
void __io_commit_cqring_flush(struct io_ring_ctx *ctx)
@@ -1227,7 +1231,9 @@ void __io_submit_flush_completions(struc
}
if (unlikely(ctx->int_flags & IO_RING_F_DRAIN_ACTIVE)) {
- io_queue_deferred(ctx);
+ /* a drain request started from the list keeps the drain going */
+ if (io_queue_deferred(ctx))
+ drain_done = false;
if (drain_done && list_empty(&ctx->defer_list))
ctx->int_flags &= ~IO_RING_F_DRAIN_ACTIVE;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 524/547] io_uring/io-wq: no new workers once the exit has begun
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 523/547] io_uring: keep the drain active when a deferred drain request is started Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 525/547] io_uring/rsrc: charge buffer arrays and nodes to memcg Greg Kroah-Hartman
` (31 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
Commit 47c68f925062a6013235d06add85a59f7d91e0fb upstream.
io_wq_exit_start() sets IO_WQ_BIT_EXIT, but worker creation task_work
queued before that stays queued until io_wq_exit_workers() cancels it.
In between the task runs its task_work while canceling requests, and a
worker can still get created.
That's a problem for exec. begin_new_exec() calls io_uring_task_cancel()
after de_thread(), when it's supposedly the only thread left, and
io_wq_exit_workers() only waits for ->worker_done, which a worker
completes before do_exit(). So the exiting worker is still in the thread
group, using the mm, files and sighand, while exec replaces them. Easy
to hit with a signal pending when create_io_thread() fails and the retry
gets queued right before execve().
Cancel the queued creation task_work as soon as the exit bit is set.
Pending work that isn't otherwise canceled now ends with -ECANCELED when
the io-wq is destroyed, rather than depending on whether the task
happened to run its task_work first.
Fixes: 685fe7feedb9 ("io-wq: eliminate the need for a manager thread")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[axboe: the barrier is already upstream, see 0e5663856b69, only the
cancel is new]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io-wq.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -1416,6 +1416,12 @@ void io_wq_exit_start(struct io_wq *wq)
set_bit(IO_WQ_BIT_EXIT, &wq->state);
/* Pairs with task_work_add() in io_queue_worker_create(). */
smp_mb__after_atomic();
+ /*
+ * No more workers from here on. The caller is going to run its task
+ * work, and on exec a thread that is created now would still be
+ * around, exiting, by the time that the caller must be on its own.
+ */
+ io_wq_cancel_tw_create(wq);
}
static void io_wq_cancel_tw_create(struct io_wq *wq)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 525/547] io_uring/rsrc: charge buffer arrays and nodes to memcg
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 524/547] io_uring/io-wq: no new workers once the exit has begun Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 526/547] io_uring: charge tctx nodes and personalities Greg Kroah-Hartman
` (30 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
Commit 075d5837bafc317e796548f721b8fbf7add6821d upstream.
The io_mapped_ubuf of a registered buffer has one bio_vec per page,
unless the pages coalesce into huge pages. Huge pages only count against
RLIMIT_MEMLOCK once per ring, so a buffer that maps the same 2MB folio
over and over in a way that defeats coalescing gets a full bvec array
per registration while only the one folio counts as locked. 1GB of that
registered in 100 slots took several times a 64MB memory.max, with 2.6MB
charged.
Allocate the io_mapped_ubuf and the io_rsrc_node with
GFP_KERNEL_ACCOUNT. An object reused from the ring caches stays charged
to whoever allocated it first, same as the io_kiocb cache.
Fixes: de2939388be5 ("io_uring: improve registered buffer accounting for huge pages")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/rsrc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -162,8 +162,9 @@ static struct io_mapped_ubuf *io_alloc_i
int nr_bvecs)
{
if (nr_bvecs <= IO_CACHED_BVECS_SEGS)
- return io_cache_alloc(&ctx->imu_cache, GFP_KERNEL);
- return kvmalloc_flex(struct io_mapped_ubuf, bvec, nr_bvecs);
+ return io_cache_alloc(&ctx->imu_cache, GFP_KERNEL_ACCOUNT);
+ return kvmalloc_flex(struct io_mapped_ubuf, bvec, nr_bvecs,
+ GFP_KERNEL_ACCOUNT);
}
static void io_free_imu(struct io_ring_ctx *ctx, struct io_mapped_ubuf *imu)
@@ -229,7 +230,7 @@ struct io_rsrc_node *io_rsrc_node_alloc(
{
struct io_rsrc_node *node;
- node = io_cache_alloc(&ctx->node_cache, GFP_KERNEL);
+ node = io_cache_alloc(&ctx->node_cache, GFP_KERNEL_ACCOUNT);
if (node) {
node->type = type;
node->refs = 1;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 526/547] io_uring: charge tctx nodes and personalities
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 525/547] io_uring/rsrc: charge buffer arrays and nodes to memcg Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 527/547] io_uring: free XArray nodes left by a failed store Greg Kroah-Hartman
` (29 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
Commit 0b34e7b20a48710b6f53716bf7030920b69fdbdd upstream.
The io_tctx_node allocated the first time a task touches a ring, and
the XArray nodes behind tctx->xa and ctx->personalities, are plain
GFP_KERNEL. tctx->xa is indexed by the ring pointer, so nearly every
entry needs nodes of its own, and a task gets one entry per ring it has
used. 642 threads on 4000 rings held 2.3GB with 59MB charged against a
64MB memory.max.
Allocate the node with GFP_KERNEL_ACCOUNT and set XA_FLAGS_ACCOUNT on
both XArrays.
Fixes: 0f2122045b94 ("io_uring: don't rely on weak ->files references")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 2 +-
io_uring/tctx.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -271,7 +271,7 @@ static __cold struct io_ring_ctx *io_rin
if (ret)
goto free_ref;
init_completion(&ctx->ref_comp);
- xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);
+ xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
mutex_init(&ctx->uring_lock);
init_waitqueue_head(&ctx->cq_wait);
init_waitqueue_head(&ctx->poll_wq);
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -104,7 +104,7 @@ __cold struct io_uring_task *io_uring_al
}
tctx->task = task;
- xa_init(&tctx->xa);
+ xa_init_flags(&tctx->xa, XA_FLAGS_ACCOUNT);
init_waitqueue_head(&tctx->wait);
atomic_set(&tctx->in_cancel, 0);
atomic_set(&tctx->inflight_tracked, 0);
@@ -123,7 +123,7 @@ static int io_tctx_install_node(struct i
if (xa_load(&tctx->xa, (unsigned long)ctx))
return 0;
- node = kmalloc_obj(*node);
+ node = kmalloc_obj(*node, GFP_KERNEL_ACCOUNT);
if (!node)
return -ENOMEM;
node->ctx = ctx;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 527/547] io_uring: free XArray nodes left by a failed store
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 526/547] io_uring: charge tctx nodes and personalities Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 528/547] io_uring/bpf-ops: clear bpf_ctx while submitting SQEs Greg Kroah-Hartman
` (28 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
Commit 51bab09b7ca1a9a6dd9303a3b7ee346f8128c963 upstream.
A failed xa_store() can leave nodes without entries in the tree, and
erasing every entry doesn't free those. An XArray needs xa_destroy()
before it goes away, even an empty one. That was dropped for tctx->xa in
commit ca6484cd308a ("io_uring: no need to call xa_destroy() on empty
xarray") over a lockdep report from freeing the tctx in softirq context,
and ctx->personalities never had it.
Now that the nodes are charged, a store can fail at memory.max and the
leaked nodes stay charged. Call xa_destroy() in io_uring_clean_tctx(),
which the task runs itself in process context before the tctx is freed,
in the error path of __io_uring_add_tctx_node(), and for
ctx->personalities in io_ring_ctx_free().
Fixes: ca6484cd308a ("io_uring: no need to call xa_destroy() on empty xarray")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 1 +
io_uring/tctx.c | 3 +++
2 files changed, 4 insertions(+)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2297,6 +2297,7 @@ static __cold void io_ring_ctx_free(stru
kvfree(ctx->cancel_table.hbs);
xa_destroy(&ctx->io_bl_xa);
xa_destroy(&ctx->hpage_acct);
+ xa_destroy(&ctx->personalities);
kfree(ctx);
}
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -189,6 +189,7 @@ err_free:
io_wq_exit_start(tctx->io_wq);
io_wq_put_and_exit(tctx->io_wq);
}
+ xa_destroy(&tctx->xa);
percpu_counter_destroy(&tctx->inflight);
kfree(tctx);
}
@@ -250,6 +251,8 @@ __cold void io_uring_clean_tctx(struct i
io_uring_del_tctx_node(index);
cond_resched();
}
+ /* A failed xa_store() leaves nodes with no entry behind. */
+ xa_destroy(&tctx->xa);
if (wq) {
/*
* Must be after io_uring_del_tctx_node() (removes nodes under
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 528/547] io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 527/547] io_uring: free XArray nodes left by a failed store Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 529/547] io_uring: free the task context after a grace period Greg Kroah-Hartman
` (27 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
Commit 8543a39f03db8816a2d80d0c92c132a19f2afb48 upstream.
bpf_io_uring_submit_sqes() calls io_submit_sqes() from inside the loop
program, with current->bpf_ctx set, and requests issued inline run with
it set too. The socket code uses has_current_bpf_ctx() to recognize
calls from bpf_setsockopt() and friends, where the caller holds the
socket lock and has already been vetted, and skips both.
So a SOCKET_URING_OP_SETSOCKOPT from the SQ passes sockopt_capable()
without the capability, and runs without lock_sock(). A task with no
capability can set SO_MARK, IP_TRANSPARENT or TCP_REPAIR, and two
threads changing IP_OPTIONS on one socket, one through the ring, double
free in no time. SOCK_DESTROY via IORING_OP_SENDMSG ends up in
tcp_abort() without the lock the same way.
Clear the run context around io_submit_sqes(). The SQEs come from
userspace and must be issued like those of any other ring. They still
run inside the program's RCU tasks trace read section, so a request
that sleeps there holds up that grace period, but other request types
do that already.
Fixes: 890819248a86 ("io_uring/bpf-ops: add kfunc helpers")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/bpf-ops.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/io_uring/bpf-ops.c
+++ b/io_uring/bpf-ops.c
@@ -17,8 +17,22 @@ __bpf_kfunc_start_defs();
__bpf_kfunc int bpf_io_uring_submit_sqes(struct iou_ctx *loop_ctx, u32 nr)
{
struct io_ring_ctx *ctx = io_loop_demangle_ctx(loop_ctx);
+ struct bpf_run_ctx *old_run_ctx;
+ int ret;
- return io_submit_sqes(ctx, nr);
+ /*
+ * The requests come from the SQ, which user space can write, so they
+ * are issued for the task and not for the BPF program. Hide the run
+ * context of the program from them. The users of has_current_bpf_ctx(),
+ * such as sockopt_lock_sock() and sockopt_capable(), take a context for
+ * a call from a BPF helper, whose caller holds the socket lock already
+ * and needs no capability.
+ */
+ old_run_ctx = bpf_set_run_ctx(NULL);
+ ret = io_submit_sqes(ctx, nr);
+ bpf_reset_run_ctx(old_run_ctx);
+
+ return ret;
}
__bpf_kfunc
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 529/547] io_uring: free the task context after a grace period
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 528/547] io_uring/bpf-ops: clear bpf_ctx while submitting SQEs Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 530/547] io_uring/sqpoll: dont wait for the thread to exit Greg Kroah-Hartman
` (26 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
Commit 9f5315d3f4368590c9fe06d4313b7247470bcf15 upstream.
A task other than the owner can free a request, io_ring_exit_work()
running the local task_work of a DEFER_TASKRUN ring for example, or
io_do_iopoll() reaping completions. io_put_task() then takes the else
branch:
percpu_counter_sub(&tctx->inflight, 1);
if (unlikely(atomic_read(&tctx->in_cancel)))
wake_up(&tctx->wait);
put_task_struct(tctx->task);
The first line is what lets the owner leave io_uring_cancel_generic(),
and on exec it frees the tctx right after. Nothing holds that off for
the remaining three lines, the task reference only covers a tctx freed
along with the task_struct. It used to work out because
io_uring_del_tctx_node() took the uring_lock that the freeing side holds
across io_put_task(), until that moved to tctx_lock.
Free the tctx with kfree_rcu(), and enter an RCU read section in
io_put_task() before the count is dropped.
Fixes: 5623eb1ed035 ("io_uring/tctx: add separate lock for list of tctx's in ctx")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/io_uring_types.h | 3 +++
io_uring/io_uring.c | 2 ++
io_uring/tctx.c | 2 +-
3 files changed, 6 insertions(+), 1 deletion(-)
--- a/include/linux/io_uring_types.h
+++ b/include/linux/io_uring_types.h
@@ -161,6 +161,9 @@ struct io_uring_task {
/* drains ->task_list once the task can no longer run task_work */
struct work_struct fallback_work;
+ /* the tctx is freed after a grace period, see io_put_task() */
+ struct rcu_head rcu;
+
struct { /* task_work */
struct mpscq task_list;
struct callback_head task_work;
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -634,6 +634,8 @@ static inline void io_put_task(struct io
if (likely(tctx->task == current)) {
tctx->cached_refs++;
} else {
+ guard(rcu)();
+
percpu_counter_sub(&tctx->inflight, 1);
if (unlikely(atomic_read(&tctx->in_cancel)))
wake_up(&tctx->wait);
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -64,7 +64,7 @@ void io_uring_free_tctx(struct task_stru
WARN_ON_ONCE(tctx->cached_refs);
percpu_counter_destroy(&tctx->inflight);
- kfree(tctx);
+ kfree_rcu(tctx, rcu);
tsk->io_uring = NULL;
}
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 530/547] io_uring/sqpoll: dont wait for the thread to exit
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 529/547] io_uring: free the task context after a grace period Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 531/547] io_uring: defer foreign io-wq enqueues to task_work Greg Kroah-Hartman
` (25 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
Commit 360395e8dbf9d23579f74b84a1af11190813b0f8 upstream.
io_sq_thread_stop() wakes the SQPOLL thread and waits for it to exit.
The thread belongs to the thread group that created the ring, so a
SIGSTOP or the cgroup freezer holds it in get_signal(), and the wake up
doesn't change that. io_ring_exit_work() then sleeps in that wait until
someone continues or kills the process. iou_exit has 64 slots, so 64
closed SQPOLL rings of a stopped process keep every other ring from
being freed, for everyone.
Don't wait. Set the stop bit, wake the thread, and let it exit when it
gets to run again. The sqd can now outlive its last ring, so give it a
second refcount with one reference for the rings and one for the thread,
and free it with the last one. The thread can't reach a freed ring,
rings leave ctx_list before dropping their reference, and the io-wq hash
is refcounted.
Fixes: 16efa4fce3b7 ("io_uring: allow IO worker threads to be frozen")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/sqpoll.c | 28 +++++++++++++++++++++++-----
io_uring/sqpoll.h | 3 ++-
2 files changed, 25 insertions(+), 6 deletions(-)
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -63,6 +63,24 @@ void io_sq_thread_park(struct io_sq_data
}
}
+/*
+ * The sqd has two holders: its rings, as one, and its thread. Neither waits
+ * for the other to let go. The one that lets go last frees the sqd.
+ */
+static void io_sq_data_release(struct io_sq_data *sqd)
+{
+ if (refcount_dec_and_test(&sqd->free_refs))
+ kfree(sqd);
+}
+
+/*
+ * Ask the thread to exit, and don't wait for it. A thread that is stopped or
+ * frozen exits only when a user lets it run again, and the exit work of the
+ * ring would keep its place in the workqueue until then. All rings have left
+ * ctx_list by now and have no request left, so the thread can reach none of
+ * them. What it still uses is its own or counted: the sqd by free_refs, the
+ * hash of its io-wq by hash->refs.
+ */
void io_sq_thread_stop(struct io_sq_data *sqd)
{
struct task_struct *tsk;
@@ -77,7 +95,6 @@ void io_sq_thread_stop(struct io_sq_data
wake_up_process(tsk);
}
mutex_unlock(&sqd->lock);
- wait_for_completion(&sqd->exited);
}
void io_put_sq_data(struct io_sq_data *sqd)
@@ -86,7 +103,7 @@ void io_put_sq_data(struct io_sq_data *s
WARN_ON_ONCE(atomic_read(&sqd->park_pending));
io_sq_thread_stop(sqd);
- kfree(sqd);
+ io_sq_data_release(sqd);
}
}
@@ -160,10 +177,10 @@ static struct io_sq_data *io_get_sq_data
atomic_set(&sqd->park_pending, 0);
refcount_set(&sqd->refs, 1);
+ refcount_set(&sqd->free_refs, 2);
INIT_LIST_HEAD(&sqd->ctx_list);
mutex_init(&sqd->lock);
init_waitqueue_head(&sqd->wait);
- init_completion(&sqd->exited);
return sqd;
}
@@ -424,7 +441,7 @@ static int io_sq_thread(void *data)
io_run_task_work();
mutex_unlock(&sqd->lock);
err_out:
- complete(&sqd->exited);
+ io_sq_data_release(sqd);
do_exit(0);
}
@@ -544,7 +561,8 @@ __cold int io_sq_offload_create(struct i
}
return 0;
err_sqpoll:
- complete(&ctx->sq_data->exited);
+ /* no thread was made: let go of its share */
+ io_sq_data_release(ctx->sq_data);
err:
io_sq_thread_finish(ctx);
return ret;
--- a/io_uring/sqpoll.h
+++ b/io_uring/sqpoll.h
@@ -2,6 +2,8 @@
struct io_sq_data {
refcount_t refs;
+ /* one for all the rings, one for the thread: the last put frees */
+ refcount_t free_refs;
atomic_t park_pending;
struct mutex lock;
@@ -18,7 +20,6 @@ struct io_sq_data {
u64 work_time;
unsigned long state;
- struct completion exited;
};
int io_sq_offload_create(struct io_ring_ctx *ctx, struct io_uring_params *p);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 531/547] io_uring: defer foreign io-wq enqueues to task_work
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 530/547] io_uring/sqpoll: dont wait for the thread to exit Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 532/547] io_uring/timeout: count cancelled timeouts in cq_timeouts Greg Kroah-Hartman
` (24 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kyle Zeng, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
Commit 3de16279b43dc285ed2222aba06cebdc82fdb28b upstream.
An IOPOLL ring without DEFER_TASKRUN can be reaped by a task other than
the one that submitted the I/O. If a polled request is marked
REQ_F_REISSUE, io_free_batch_list() calls io_queue_iowq() with the
original tctx. Ordinary task exit can tear down tctx->io_wq after
draining only the tracked requests. The live request pins the task, but
not its io-wq, so the foreign task can race io_wq_put_and_exit() and
enqueue through a freed or NULL queue.
Forward foreign userspace enqueues to the owning task before accessing
tctx->io_wq. Use a dedicated task_work callback so reissues still go
straight to io-wq, and fail them if task_work is running in cancellation
mode. Preserve the existing PF_KTHREAD cancellation path. This also
covers the other callers of io_queue_iowq() without changing the
worker-owned enqueue path.
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -423,6 +423,17 @@ static __always_inline bool io_assign_fi
return !!req->file;
}
+static void io_req_queue_iowq_tw(struct io_tw_req tw_req, io_tw_token_t tw)
+{
+ struct io_kiocb *req = tw_req.req;
+
+ io_tw_lock(req->ctx, tw);
+ if (unlikely(tw.cancel))
+ io_req_defer_failed(req, -ECANCELED);
+ else
+ io_queue_iowq(req);
+}
+
void io_queue_iowq(struct io_kiocb *req)
{
struct io_uring_task *tctx = req->tctx;
@@ -430,10 +441,17 @@ void io_queue_iowq(struct io_kiocb *req)
BUG_ON(!tctx);
lockdep_assert_held(&req->ctx->uring_lock);
- if ((current->flags & PF_KTHREAD) || !tctx->io_wq) {
- io_req_task_queue_fail(req, -ECANCELED);
+ if (current->flags & PF_KTHREAD)
+ goto cancel;
+
+ /* Only the submitter can safely access its io-wq during task exit. */
+ if (unlikely(current != tctx->task)) {
+ req->io_task_work.func = io_req_queue_iowq_tw;
+ io_req_task_work_add(req);
return;
}
+ if (!tctx->io_wq)
+ goto cancel;
/*
* The file is looked up as late as possible, as it may be the result
@@ -462,6 +480,9 @@ void io_queue_iowq(struct io_kiocb *req)
trace_io_uring_queue_async_work(req, io_wq_is_hashed(&req->work));
io_wq_enqueue(tctx->io_wq, &req->work);
+ return;
+cancel:
+ io_req_task_queue_fail(req, -ECANCELED);
}
unsigned io_linked_nr(struct io_kiocb *req)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 532/547] io_uring/timeout: count cancelled timeouts in cq_timeouts
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 531/547] io_uring: defer foreign io-wq enqueues to task_work Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 533/547] io_uring/net: fix multishot recv length limit accounting Greg Kroah-Hartman
` (23 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheng Yongkang, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Yongkang <teel4res@gmail.com>
Commit 1c8b49851543f41fc8bb18bcd1f15cc93d14b530 upstream.
io_timeout_cancel() posts the cancelled timeout's -ECANCELED CQE without
advancing ctx->cq_timeouts. io_timeout_fn() and io_kill_timeout()
advance it for every timeout CQE they post, and io_flush_timeouts()
computes the number of non-timeout completions as
seq = cached_cq_tail - cq_timeouts
to compare against each off timeout's target_seq. The cancelled
timeout's CQE is therefore counted as a regular completion, so every
cancellation makes an already armed off timeout fire one completion
early.
A ring with a keep-alive timeout of off=4 completes it after two NOPs
when one off=100 victim is cancelled through IORING_OP_ASYNC_CANCEL, and
before any NOP when two victims are cancelled. The cancel CQE should
count, but the cancelled timeouts' -ECANCELED CQEs must not: the
expected counts are three and two NOPs respectively.
Advance cq_timeouts when io_timeout_extract() succeeds, under
timeout_lock and before the -ECANCELED completion is queued, matching
io_timeout_fn() and io_kill_timeout(). The -ENOENT and -EALREADY paths
post no new timeout CQE and keep their accounting. Both the
ASYNC_CANCEL and the TIMEOUT_REMOVE path go through io_timeout_cancel().
Fixes: bfe68a221905 ("io_uring: off timeouts based only on completions")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
Link: https://patch.msgid.link/179328314078.648427.13761781546953594668@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/timeout.c | 3 +++
1 file changed, 3 insertions(+)
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -370,6 +370,9 @@ int io_timeout_cancel(struct io_ring_ctx
raw_spin_lock_irq(&ctx->timeout_lock);
req = io_timeout_extract(ctx, cd);
+ if (!IS_ERR(req))
+ atomic_set(&ctx->cq_timeouts,
+ atomic_read(&ctx->cq_timeouts) + 1);
raw_spin_unlock_irq(&ctx->timeout_lock);
if (IS_ERR(req))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 533/547] io_uring/net: fix multishot recv length limit accounting
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 532/547] io_uring/timeout: count cancelled timeouts in cq_timeouts Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 534/547] ksmbd: fix SMB2 CREATE response buffer overflow Greg Kroah-Hartman
` (22 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheng Yongkang, Jens Axboe
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Yongkang <teel4res@gmail.com>
Commit 3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c upstream.
io_recv_finish() debits sr->mshot_total_len with min_t(int, sel->val,
sr->mshot_total_len). sel->val is the cumulative byte count of the
request: on a bundle retry the receive path adds sr->done_io back to the
return value, and the bundle branch in io_recv_finish() recovers the new
bytes with this_ret = sel->val - sr->done_io. The debit therefore uses
the wrong value after a bundle retry, and the int cast truncates a limit
above INT_MAX.
For an IORING_OP_RECV multishot request with optlen above INT_MAX, the
limit becomes negative when cast to int, so the first completion debits
the entire limit and ends the multishot with IORING_RECV_MSHOT_DONE
while the socket still holds data that covers the limit. With 120 bytes
queued, a 64-byte buffer and optlen 0x80000000, the first 64-byte CQE
lacks IORING_CQE_F_MORE and 56 bytes remain unread; the same setup with
optlen 0x7fffffff posts 64 and 56 bytes with F_MORE.
After a bundle retry, the bytes already debited for the previous
attempts are debited again, so the limit is exhausted early. With 1400
bytes queued, optlen 1000 and buffers of 600, 100, 100, 50, 50 and 200
bytes, the first attempt delivers 700 bytes and retries; the second
delivers 200 more, but the debit accounts for 900 and finishes the
request with a terminal 900-byte CQE while 500 bytes remain unread. The
limit could have been reached.
Debit only the bytes received by this invocation, sel->val -
sr->done_io, and compare as unsigned so a limit above INT_MAX is
accounted correctly. Non-bundle multishot requests keep sr->done_io at
zero, so their accounting is unchanged.
Fixes: 0ebc9a7ecf6a ("io_uring/net: Support multishot receive len cap")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
Link: https://patch.msgid.link/179328314078.648427.10086632105828535293@gmail.com
[axboe: fix-up near-by incorrect comment while in there]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/net.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -881,12 +881,15 @@ static inline bool io_recv_finish(struct
cflags |= IORING_CQE_F_SOCK_NONEMPTY;
if (sel->val > 0 && sr->flags & IORING_RECV_MSHOT_LIM) {
+ unsigned int this_len = sel->val - sr->done_io;
+
/*
- * If sr->len hits zero, the limit has been reached. Mark
- * mshot as finished, and flag MSHOT_DONE as well to prevent
- * a potential bundle from being retried.
+ * If sr->mshot_total_len hits zero, the limit has been reached.
+ * Mark mshot as finished, and flag MSHOT_DONE as well to
+ * prevent a potential bundle from being retried.
*/
- sr->mshot_total_len -= min_t(int, sel->val, sr->mshot_total_len);
+ sr->mshot_total_len -= min_t(unsigned int, this_len,
+ sr->mshot_total_len);
if (!sr->mshot_total_len) {
sr->flags |= IORING_RECV_MSHOT_DONE;
mshot_finished = true;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 534/547] ksmbd: fix SMB2 CREATE response buffer overflow
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 533/547] io_uring/net: fix multishot recv length limit accounting Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 535/547] ksmbd: fix out-of-bounds read when padding the final compound response Greg Kroah-Hartman
` (21 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 713c31a3a225b6239a37ac7fbfb394567f8b3519 ]
smb2_allocate_rsp_buf() uses the MAX_CIFS_SMALL_BUFFER_SIZE
(448-byte) buffer for a single SMB2_CREATE response. That buffer also
holds a 4-byte length field, which only leaves 444 bytes for the SMB2
body.
The AAPL response made this buffer too small. After 8f1b796ff113, a
request with AAPL response contexts may need at least 456 bytes. In
the 456-byte case, create_aapl_rsp_buf() is appended last, clears 128
bytes, and writes 12 bytes past the allocation.
KASAN reports:
BUG: KASAN: slab-out-of-bounds in create_aapl_rsp_buf+0x31/0x6e0
Write of size 128 at addr ffff88800370954c by task kworker/0:0/9
...
create_aapl_rsp_buf+0x31/0x6e0
smb2_open+0x58f9/0xef10
...
smb2_allocate_rsp_buf+0x19d/0x370
...
The buggy address is located 332 bytes inside of
allocated 448-byte region [ffff888003709400, ffff8880037095c0)
Reserve enough space for any fixed CREATE response KSMBD can build.
Store the required allocation size in the per-dialect values table.
This keeps the small buffer for other commands and avoids using the max
transaction buffer for every CREATE.
Fixes: 8f1b796ff113 ("ksmbd: add AAPL kAAPL_SERVER_QUERY create context support")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Stable-dep-of: 714f27729121 ("ksmbd: fix out-of-bounds read when padding the final compound response")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/common/smbglob.h | 1 +
fs/smb/server/smb2ops.c | 33 +++++++++++++++++++++++++++++++++
fs/smb/server/smb2pdu.c | 6 +++++-
3 files changed, 39 insertions(+), 1 deletion(-)
--- a/fs/smb/common/smbglob.h
+++ b/fs/smb/common/smbglob.h
@@ -40,6 +40,7 @@ struct smb_version_values {
size_t create_disk_id_size;
size_t create_posix_size;
size_t create_aapl_size;
+ size_t create_rsp_size;
};
static inline unsigned int get_rfc1002_len(void *buf)
--- a/fs/smb/server/smb2ops.c
+++ b/fs/smb/server/smb2ops.c
@@ -13,6 +13,35 @@
#include "server.h"
#include "stats.h"
+/*
+ * work->response_sz includes the RFC1002 length field while smb_get_msg()
+ * skips over it. Durable v1 and v2 response contexts are mutually exclusive,
+ * and POSIX CREATE contexts are only negotiated for SMB3.1.1.
+ */
+#define SMB2_CREATE_RSP_SIZE(lease_size, durable_size) \
+ (sizeof(__be32) + offsetof(struct smb2_create_rsp, Buffer) + \
+ (lease_size) + (durable_size) + \
+ sizeof(struct create_mxac_rsp) + \
+ sizeof(struct create_disk_id_rsp) + \
+ AAPL_RSP_MAX_SIZE)
+
+#define SMB21_CREATE_RSP_SIZE \
+ SMB2_CREATE_RSP_SIZE(sizeof(struct create_lease), \
+ sizeof(struct create_durable_rsp))
+
+#define SMB3_CREATE_DURABLE_RSP_SIZE \
+ ((sizeof(struct create_durable_rsp) > \
+ sizeof(struct create_durable_rsp_v2)) ? \
+ sizeof(struct create_durable_rsp) : \
+ sizeof(struct create_durable_rsp_v2))
+
+#define SMB3_CREATE_RSP_SIZE \
+ SMB2_CREATE_RSP_SIZE(sizeof(struct create_lease_v2), \
+ SMB3_CREATE_DURABLE_RSP_SIZE)
+
+#define SMB311_CREATE_RSP_SIZE \
+ (SMB3_CREATE_RSP_SIZE + sizeof(struct create_posix_rsp))
+
static struct smb_version_values smb21_server_values = {
.version_string = SMB21_VERSION_STRING,
.protocol_id = SMB21_PROT_ID,
@@ -38,6 +67,7 @@ static struct smb_version_values smb21_s
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
.create_aapl_size = AAPL_RSP_MAX_SIZE,
+ .create_rsp_size = SMB21_CREATE_RSP_SIZE,
};
static struct smb_version_values smb30_server_values = {
@@ -66,6 +96,7 @@ static struct smb_version_values smb30_s
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
.create_aapl_size = AAPL_RSP_MAX_SIZE,
+ .create_rsp_size = SMB3_CREATE_RSP_SIZE,
};
static struct smb_version_values smb302_server_values = {
@@ -94,6 +125,7 @@ static struct smb_version_values smb302_
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
.create_aapl_size = AAPL_RSP_MAX_SIZE,
+ .create_rsp_size = SMB3_CREATE_RSP_SIZE,
};
static struct smb_version_values smb311_server_values = {
@@ -122,6 +154,7 @@ static struct smb_version_values smb311_
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
.create_aapl_size = AAPL_RSP_MAX_SIZE,
+ .create_rsp_size = SMB311_CREATE_RSP_SIZE,
};
static struct smb_version_ops smb2_0_server_ops = {
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -873,14 +873,18 @@ static void smb2_update_lock_sequence(st
int smb2_allocate_rsp_buf(struct ksmbd_work *work)
{
struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
+ struct smb_version_values *vals = work->conn->vals;
size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE;
- size_t large_sz = small_sz + work->conn->vals->max_trans_size;
+ size_t large_sz = small_sz + vals->max_trans_size;
size_t sz = small_sz;
int cmd = le16_to_cpu(hdr->Command);
if (cmd == SMB2_IOCTL_HE || cmd == SMB2_QUERY_DIRECTORY_HE)
sz = large_sz;
+ if (cmd == SMB2_CREATE_HE)
+ sz = max_t(size_t, sz, vals->create_rsp_size);
+
if (cmd == SMB2_QUERY_INFO_HE) {
struct smb2_query_info_req *req;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 535/547] ksmbd: fix out-of-bounds read when padding the final compound response
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 534/547] ksmbd: fix SMB2 CREATE response buffer overflow Greg Kroah-Hartman
@ 2026-11-04 21:11 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 536/547] ksmbd: use clear_and_wake_up_bit() directly Greg Kroah-Hartman
` (20 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Bridges, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <icb@fastmail.org>
[ Upstream commit 714f27729121d59f103ca4dad7b0c2d1c125cd71 ]
Compound response handling pads the last response of a compound to an
8-byte boundary by growing the final iov and the RFC1002 length.
smb2_allocate_rsp_buf() allocates exactly response_sz. A command can
fill the response buffer to within 7 bytes of its end, for example a
QUERY_INFO whose output is bounded only by the space left. The padding
can then run past the allocation, and ksmbd_tcp_writev() reads those
bytes when it sends the response.
BUG: KASAN: slab-out-of-bounds in _copy_from_iter+0x744/0x10e0
Call Trace:
_copy_from_iter+0x744/0x10e0
tcp_sendmsg_locked+0x2290/0x3f80
ksmbd_tcp_writev+0x10c7/0x1ab0 [ksmbd]
Allocate room for the padding when the request is a compound, as
smb2_read() and smb2_read_pipe() do for their payloads. response_sz is
unchanged, so commands still fill only up to it, and kvzalloc() zeroes
the padding.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -876,7 +876,7 @@ int smb2_allocate_rsp_buf(struct ksmbd_w
struct smb_version_values *vals = work->conn->vals;
size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE;
size_t large_sz = small_sz + vals->max_trans_size;
- size_t sz = small_sz;
+ size_t sz = small_sz, pad_sz = 0;
int cmd = le16_to_cpu(hdr->Command);
if (cmd == SMB2_IOCTL_HE || cmd == SMB2_QUERY_DIRECTORY_HE)
@@ -902,10 +902,17 @@ int smb2_allocate_rsp_buf(struct ksmbd_w
}
/* allocate large response buf for chained commands */
- if (le32_to_cpu(hdr->NextCommand) > 0)
+ if (le32_to_cpu(hdr->NextCommand) > 0) {
sz = large_sz;
+ /*
+ * is_chained_smb2_message() pads the last response of a
+ * compound to 8 bytes, which can take it past response_sz.
+ * Leave room for the padding. kvzalloc() zeroes it.
+ */
+ pad_sz = ALIGN(sz - sizeof(__be32), 8) - (sz - sizeof(__be32));
+ }
- work->response_buf = kvzalloc(sz, KSMBD_DEFAULT_GFP);
+ work->response_buf = kvzalloc(sz + pad_sz, KSMBD_DEFAULT_GFP);
if (!work->response_buf)
return -ENOMEM;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 536/547] ksmbd: use clear_and_wake_up_bit() directly
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-11-04 21:11 ` [PATCH 7.3 535/547] ksmbd: fix out-of-bounds read when padding the final compound response Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 537/547] ksmbd: track delivery of queued TCP writes Greg Kroah-Hartman
` (19 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Daijiamu, ChenXiaoSong,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daijiamu <3058704216@qq.com>
[ Upstream commit 8852052e32df965a76daecbd8cda0ecf950b54df ]
clear_and_wake_up_bit() was introduced by commit 8236b0ae31c8 ("bdi:
wake up concurrent wb_shutdown() callers.") to replace the open-coded
clear_bit_unlock() + smp_mb__after_atomic() + wake_up_bit() sequence.
Replace the sequence and drop the now-trivial wake_up_oplock_break()
wrapper, calling the helper directly at each call site.
Suggested-by: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Signed-off-by: Daijiamu <3058704216@qq.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Stable-dep-of: f728cfee6929 ("ksmbd: fix app-instance non-durable supersede session UAF")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/oplock.c | 20 ++++++--------------
1 file changed, 6 insertions(+), 14 deletions(-)
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -763,14 +763,6 @@ static bool wait_for_break_ack(struct op
return false;
}
-static void wake_up_oplock_break(struct oplock_info *opinfo)
-{
- clear_bit_unlock(0, &opinfo->pending_break);
- /* memory barrier is needed for wake_up_bit() */
- smp_mb__after_atomic();
- wake_up_bit(&opinfo->pending_break, 0);
-}
-
static bool oplock_break_set_ack_wait(struct oplock_info *opinfo)
{
bool ret = false;
@@ -826,13 +818,13 @@ static int oplock_break_pending(struct o
if (opinfo->level <= req_op_level) {
if (opinfo->is_lease == false) {
- wake_up_oplock_break(opinfo);
+ clear_and_wake_up_bit(0, &opinfo->pending_break);
return 1;
}
if (opinfo->o_lease->state !=
(SMB2_LEASE_HANDLE_CACHING_LE |
SMB2_LEASE_READ_CACHING_LE)) {
- wake_up_oplock_break(opinfo);
+ clear_and_wake_up_bit(0, &opinfo->pending_break);
return 1;
}
}
@@ -1260,7 +1252,7 @@ again:
SMB2_LEASE_HANDLE_CACHING_LE)) {
if (!oplock_break_set_ack_wait(brk_opinfo)) {
atomic_dec_if_positive(&brk_opinfo->breaking_cnt);
- wake_up_oplock_break(brk_opinfo);
+ clear_and_wake_up_bit(0, &brk_opinfo->pending_break);
return -ENOENT;
}
} else
@@ -1309,7 +1301,7 @@ again:
lease->state != SMB2_LEASE_NONE_LE)))
goto again;
- wake_up_oplock_break(brk_opinfo);
+ clear_and_wake_up_bit(0, &brk_opinfo->pending_break);
return err;
} else {
err = oplock_break_pending(brk_opinfo, req_op_level);
@@ -1319,7 +1311,7 @@ again:
if (brk_opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
brk_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
if (!oplock_break_set_ack_wait(brk_opinfo)) {
- wake_up_oplock_break(brk_opinfo);
+ clear_and_wake_up_bit(0, &brk_opinfo->pending_break);
return -ENOENT;
}
}
@@ -1342,7 +1334,7 @@ again:
ksmbd_debug(OPLOCK, "oplock granted = %d\n", brk_opinfo->level);
if (brk_opinfo->op_state == OPLOCK_CLOSING)
err = -EAGAIN;
- wake_up_oplock_break(brk_opinfo);
+ clear_and_wake_up_bit(0, &brk_opinfo->pending_break);
return err;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 537/547] ksmbd: track delivery of queued TCP writes
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 536/547] ksmbd: use clear_and_wake_up_bit() directly Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 538/547] ksmbd: retry break notifications on another connection Greg Kroah-Hartman
` (18 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pan Guihua, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit c0632d2010ffc006eed9becc8d0d10d54f294bbd ]
A nonblocking break send must distinguish a PDU accepted by TCP from one
still queued in ksmbd. Retrying an accepted PDU can send duplicates, while
abandoning a partial send can corrupt the stream.
Queue owned PDU bytes when TCP cannot accept the full message. Track the
stream position through socket delivery and TCP ACK, and expose it to break
retries. Bound retained data and stop queued writes during teardown.
Reported-by: Pan Guihua <pan.guihua@datatom.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Stable-dep-of: f728cfee6929 ("ksmbd: fix app-instance non-durable supersede session UAF")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/connection.c | 52 ++++++-
fs/smb/server/connection.h | 24 +++
fs/smb/server/transport_tcp.c | 299 ++++++++++++++++++++++++++++++++++++++++--
3 files changed, 356 insertions(+), 19 deletions(-)
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -458,17 +458,13 @@ void ksmbd_all_conn_set_status(struct ks
void ksmbd_conn_abort(struct ksmbd_conn *conn)
{
- bool shutdown = false;
-
spin_lock(&conn->request_lock);
- if (!ksmbd_conn_exiting(conn) && !ksmbd_conn_releasing(conn)) {
+ if (!ksmbd_conn_exiting(conn) && !ksmbd_conn_releasing(conn))
ksmbd_conn_set_exiting(conn);
- shutdown = true;
- }
spin_unlock(&conn->request_lock);
wake_up_all(&conn->req_running_q);
- if (shutdown && conn->transport->ops->shutdown)
+ if (conn->transport->ops->shutdown)
conn->transport->ops->shutdown(conn->transport);
}
@@ -535,12 +531,19 @@ static int __ksmbd_conn_write(struct ksm
tx->need_invalidate_rkey = work->need_invalidate_rkey;
tx->remote_key = work->remote_key;
- ksmbd_conn_lock(conn);
+ if (tx->tracking) {
+ /* A busy writer must not consume the break's retry budget. */
+ if (!mutex_trylock(&conn->srv_mutex))
+ return -EAGAIN;
+ } else {
+ ksmbd_conn_lock(conn);
+ }
sent = conn->transport->ops->writev(conn->transport, tx);
ksmbd_conn_unlock(conn);
if (sent < 0) {
- pr_err("Failed to send message: %d\n", sent);
+ if (!tx->tracking || sent != -EAGAIN)
+ pr_err("Failed to send message: %d\n", sent);
return sent;
}
@@ -554,6 +557,20 @@ int ksmbd_conn_write(struct ksmbd_work *
return __ksmbd_conn_write(work, &tx);
}
+int ksmbd_conn_write_tracked(struct ksmbd_work *work,
+ struct ksmbd_tx_tracking *tracking)
+{
+ struct ksmbd_transport_write tx = {};
+
+ tracking->valid = false;
+ /* Transports without delivery tracking keep their synchronous send path. */
+ if (work->conn->transport->ops->is_acked) {
+ tx.msg_flags = MSG_DONTWAIT;
+ tx.tracking = tracking;
+ }
+ return __ksmbd_conn_write(work, &tx);
+}
+
int ksmbd_conn_write_eor(struct ksmbd_work *work)
{
struct ksmbd_transport_write tx = {
@@ -807,7 +824,12 @@ recheck:
}
}
+ /* Exclude new break senders before draining their work references. */
+ spin_lock(&conn->request_lock);
ksmbd_conn_set_releasing(conn);
+ spin_unlock(&conn->request_lock);
+ /* TCP writers waiting for queue space must release their work references. */
+ wake_up_all(&conn->req_running_q);
ksmbd_conn_cancel_async_requests(conn);
/* Wait till all reference dropped to the Server object*/
ksmbd_debug(CONN, "Wait for all pending requests(%d)\n", atomic_read(&conn->r_count));
@@ -834,6 +856,20 @@ void ksmbd_conn_r_count_inc(struct ksmbd
atomic_inc(&conn->r_count);
}
+/* The caller already owns a connection reference. */
+bool ksmbd_conn_r_count_inc_if_good(struct ksmbd_conn *conn)
+{
+ bool ret = false;
+
+ spin_lock(&conn->request_lock);
+ if (ksmbd_conn_good(conn)) {
+ atomic_inc(&conn->r_count);
+ ret = true;
+ }
+ spin_unlock(&conn->request_lock);
+ return ret;
+}
+
void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn)
{
/*
--- a/fs/smb/server/connection.h
+++ b/fs/smb/server/connection.h
@@ -102,6 +102,8 @@ struct ksmbd_conn {
wait_queue_head_t r_count_q;
/* Lock to protect requests list*/
spinlock_t request_lock;
+ /* Set under request_lock at teardown start and kept set thereafter. */
+ bool releasing;
struct list_head requests;
struct list_head async_requests;
int connection_type;
@@ -161,6 +163,13 @@ struct ksmbd_conn_ops {
int (*terminate_fn)(struct ksmbd_conn *conn);
};
+struct ksmbd_tx_tracking {
+ /* Required TCP byte count, including transport and socket queues. */
+ u64 end;
+ unsigned long retry_after;
+ bool valid;
+};
+
struct ksmbd_transport_write {
struct kvec *iov;
int iov_cnt;
@@ -168,6 +177,7 @@ struct ksmbd_transport_write {
bool need_invalidate_rkey;
unsigned int remote_key;
int msg_flags;
+ struct ksmbd_tx_tracking *tracking;
};
struct ksmbd_transport_ops {
@@ -175,8 +185,12 @@ struct ksmbd_transport_ops {
void (*shutdown)(struct ksmbd_transport *t);
int (*read)(struct ksmbd_transport *t, char *buf,
unsigned int size, int max_retries);
+ /* Retained bytes must be privately owned before a full result is returned. */
int (*writev)(struct ksmbd_transport *t,
const struct ksmbd_transport_write *tx);
+ /* Optional delivery tracking for nonblocking break sends. */
+ bool (*is_acked)(struct ksmbd_transport *t,
+ const struct ksmbd_tx_tracking *tracking);
int (*rdma_read)(struct ksmbd_transport *t,
void *buf, unsigned int len,
struct smbdirect_buffer_descriptor_v1 *desc,
@@ -216,6 +230,8 @@ int ksmbd_conn_wq_init(void);
void ksmbd_conn_wq_destroy(void);
bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c);
int ksmbd_conn_write(struct ksmbd_work *work);
+int ksmbd_conn_write_tracked(struct ksmbd_work *work,
+ struct ksmbd_tx_tracking *tracking);
int ksmbd_conn_write_eor(struct ksmbd_work *work);
int ksmbd_conn_rdma_read(struct ksmbd_conn *conn,
void *buf, unsigned int buflen,
@@ -234,6 +250,7 @@ void ksmbd_conn_transport_destroy(void);
void ksmbd_conn_lock(struct ksmbd_conn *conn);
void ksmbd_conn_unlock(struct ksmbd_conn *conn);
void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn);
+bool ksmbd_conn_r_count_inc_if_good(struct ksmbd_conn *conn);
void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn);
/*
@@ -249,7 +266,8 @@ static inline bool ksmbd_conn_new(struct
static inline bool ksmbd_conn_good(struct ksmbd_conn *conn)
{
- return READ_ONCE(conn->status) == KSMBD_SESS_GOOD;
+ return !READ_ONCE(conn->releasing) &&
+ READ_ONCE(conn->status) == KSMBD_SESS_GOOD;
}
static inline unsigned int
@@ -283,7 +301,8 @@ static inline bool ksmbd_conn_exiting(st
static inline bool ksmbd_conn_releasing(struct ksmbd_conn *conn)
{
- return READ_ONCE(conn->status) == KSMBD_SESS_RELEASING;
+ return READ_ONCE(conn->releasing) ||
+ READ_ONCE(conn->status) == KSMBD_SESS_RELEASING;
}
static inline void ksmbd_conn_set_new(struct ksmbd_conn *conn)
@@ -318,6 +337,7 @@ static inline void ksmbd_conn_set_exitin
static inline void ksmbd_conn_set_releasing(struct ksmbd_conn *conn)
{
+ WRITE_ONCE(conn->releasing, true);
WRITE_ONCE(conn->status, KSMBD_SESS_RELEASING);
}
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -5,6 +5,7 @@
*/
#include <linux/freezer.h>
+#include <linux/uio.h>
#include "smb_common.h"
#include "server.h"
@@ -29,11 +30,30 @@ static LIST_HEAD(iface_list);
static int bind_additional_ifaces;
+struct tcp_tx {
+ struct list_head list;
+ size_t len;
+ size_t offset;
+ unsigned long deadline;
+ int msg_flags;
+ u8 data[];
+};
+
struct tcp_transport {
struct ksmbd_transport transport;
struct socket *sock;
struct kvec *iov;
unsigned int nr_iov;
+ /* Serializes queue access and socket writes. Never taken by callbacks. */
+ struct mutex tx_lock;
+ struct list_head tx_queue;
+ struct delayed_work tx_work;
+ size_t tx_queued;
+ /* TCP byte positions for accepted PDUs and bytes passed to the socket. */
+ u64 tx_end;
+ u64 tx_sent;
+ bool tx_stopped;
+ void (*write_space)(struct sock *sk);
};
static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops;
@@ -42,6 +62,10 @@ static void tcp_stop_kthread(struct task
static void ksmbd_tcp_stop_listener(struct interface *iface);
static struct interface *alloc_iface(char *ifname);
static void ksmbd_tcp_disconnect(struct ksmbd_transport *t);
+static void ksmbd_tcp_shutdown(struct ksmbd_transport *t);
+static void ksmbd_tcp_tx_work(struct work_struct *work);
+static void ksmbd_tcp_write_space(struct sock *sk);
+static void ksmbd_tcp_stop_tx(struct tcp_transport *t);
#define KSMBD_TRANS(t) (&(t)->transport)
#define TCP_TRANS(t) ((struct tcp_transport *)container_of(t, \
@@ -66,6 +90,9 @@ static struct tcp_transport *alloc_trans
if (!t)
return NULL;
t->sock = client_sk;
+ mutex_init(&t->tx_lock);
+ INIT_LIST_HEAD(&t->tx_queue);
+ INIT_DELAYED_WORK(&t->tx_work, ksmbd_tcp_tx_work);
conn = ksmbd_conn_alloc();
if (!conn) {
@@ -85,13 +112,26 @@ static struct tcp_transport *alloc_trans
conn->inet_addr = inet_sk(client_sk->sk)->inet_daddr;
conn->inet_hash = ipv4_addr_hash(inet_sk(client_sk->sk)->inet_daddr);
#endif
- down_write(&conn_list_lock);
- hash_add(conn_list, &conn->hlist, conn->inet_hash);
- up_write(&conn_list_lock);
-
conn->transport = KSMBD_TRANS(t);
KSMBD_TRANS(t)->conn = conn;
KSMBD_TRANS(t)->ops = &ksmbd_tcp_transport_ops;
+
+ lock_sock(client_sk->sk);
+ t->tx_end = tcp_sk(client_sk->sk)->bytes_acked +
+ (u32)(tcp_sk(client_sk->sk)->write_seq -
+ tcp_sk(client_sk->sk)->snd_una);
+ t->tx_sent = t->tx_end;
+ release_sock(client_sk->sk);
+
+ write_lock_bh(&client_sk->sk->sk_callback_lock);
+ t->write_space = client_sk->sk->sk_write_space;
+ client_sk->sk->sk_user_data = t;
+ client_sk->sk->sk_write_space = ksmbd_tcp_write_space;
+ write_unlock_bh(&client_sk->sk->sk_callback_lock);
+
+ down_write(&conn_list_lock);
+ hash_add(conn_list, &conn->hlist, conn->inet_hash);
+ up_write(&conn_list_lock);
return t;
}
@@ -99,6 +139,7 @@ static void ksmbd_tcp_free_transport(str
{
struct tcp_transport *t = TCP_TRANS(kt);
+ ksmbd_tcp_stop_tx(t);
sock_release(t->sock);
kfree(t->iov);
kfree(t);
@@ -106,7 +147,8 @@ static void ksmbd_tcp_free_transport(str
static void free_transport(struct tcp_transport *t)
{
- kernel_sock_shutdown(t->sock, SHUT_RDWR);
+ ksmbd_tcp_shutdown(KSMBD_TRANS(t));
+ ksmbd_tcp_stop_tx(t);
ksmbd_conn_free(KSMBD_TRANS(t)->conn);
}
@@ -431,15 +473,251 @@ static int ksmbd_tcp_read(struct ksmbd_t
return ksmbd_tcp_readv(TCP_TRANS(t), &iov, 1, to_read, max_retries);
}
+static bool ksmbd_tcp_tx_has_space(struct tcp_transport *t, size_t size)
+{
+ size_t limit = max_t(size_t, READ_ONCE(t->sock->sk->sk_sndbuf), size);
+
+ /* Allow one large response, but bound the retained response buffers. */
+ return READ_ONCE(t->tx_queued) <= limit - size;
+}
+
+static struct tcp_tx *ksmbd_tcp_alloc_tx(const struct ksmbd_transport_write *tx,
+ size_t offset)
+{
+ struct tcp_tx *msg;
+ struct iov_iter iter;
+ size_t remaining = tx->size - offset;
+
+ msg = kvmalloc(struct_size(msg, data, remaining), KSMBD_DEFAULT_GFP);
+ if (!msg)
+ return NULL;
+
+ iov_iter_kvec(&iter, ITER_SOURCE, tx->iov, tx->iov_cnt, tx->size);
+ iov_iter_advance(&iter, offset);
+ if (!copy_from_iter_full(msg->data, remaining, &iter)) {
+ kvfree(msg);
+ return NULL;
+ }
+ msg->len = remaining;
+ msg->offset = 0;
+ msg->msg_flags = tx->msg_flags;
+ return msg;
+}
+
+static void ksmbd_tcp_purge_tx(struct tcp_transport *t)
+{
+ struct tcp_tx *msg, *next;
+
+ list_for_each_entry_safe(msg, next, &t->tx_queue, list) {
+ list_del(&msg->list);
+ kvfree(msg);
+ }
+ WRITE_ONCE(t->tx_queued, 0);
+}
+
+static bool ksmbd_tcp_send_retry(int ret)
+{
+ return ret == -EAGAIN || ret == -EINTR || ret == -ERESTARTSYS ||
+ ret == -ENOMEM;
+}
+
+static void ksmbd_tcp_tx_work(struct work_struct *work)
+{
+ struct tcp_transport *t = container_of(to_delayed_work(work),
+ struct tcp_transport, tx_work);
+ unsigned long delay = 0;
+ unsigned int budget = 16;
+ bool failed = false;
+ int ret;
+
+ mutex_lock(&t->tx_lock);
+ while (!READ_ONCE(t->tx_stopped) && !list_empty(&t->tx_queue) && budget--) {
+ struct tcp_tx *msg = list_first_entry(&t->tx_queue, struct tcp_tx, list);
+ struct msghdr hdr = {
+ .msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT | msg->msg_flags,
+ };
+ struct kvec iov = {
+ .iov_base = msg->data + msg->offset,
+ .iov_len = msg->len - msg->offset,
+ };
+
+ /* MSG_DONTWAIT bypasses sk_sndtimeo, including for retained PDUs. */
+ if (time_after_eq(jiffies, msg->deadline)) {
+ WRITE_ONCE(t->tx_stopped, true);
+ failed = true;
+ break;
+ }
+ ret = kernel_sendmsg(t->sock, &hdr, &iov, 1, iov.iov_len);
+ if (ret > 0) {
+ msg->offset += ret;
+ t->tx_sent += ret;
+ if (msg->offset == msg->len) {
+ WRITE_ONCE(t->tx_queued, t->tx_queued - msg->len);
+ list_del(&msg->list);
+ kvfree(msg);
+ continue;
+ }
+ } else if (!ksmbd_tcp_send_retry(ret)) {
+ WRITE_ONCE(t->tx_stopped, true);
+ failed = true;
+ break;
+ }
+ /*
+ * Write-space notifications normally resume the head of the queue.
+ * Also retry after memory pressure, which may produce no notification.
+ */
+ delay = max_t(unsigned long, 1, HZ / 10);
+ break;
+ }
+ if (READ_ONCE(t->tx_stopped))
+ ksmbd_tcp_purge_tx(t);
+ else if (!list_empty(&t->tx_queue))
+ queue_delayed_work(system_unbound_wq, &t->tx_work, delay);
+ mutex_unlock(&t->tx_lock);
+ wake_up_all(&t->transport.conn->req_running_q);
+
+ if (failed)
+ ksmbd_conn_abort(t->transport.conn);
+}
+
+static void ksmbd_tcp_write_space(struct sock *sk)
+{
+ struct tcp_transport *t;
+
+ read_lock_bh(&sk->sk_callback_lock);
+ t = sk->sk_user_data;
+ if (t) {
+ t->write_space(sk);
+ if (!READ_ONCE(t->tx_stopped) && sk_stream_is_writeable(sk))
+ mod_delayed_work(system_unbound_wq, &t->tx_work, 0);
+ }
+ read_unlock_bh(&sk->sk_callback_lock);
+}
+
+static void ksmbd_tcp_stop_tx(struct tcp_transport *t)
+{
+ struct sock *sk = t->sock->sk;
+
+ WRITE_ONCE(t->tx_stopped, true);
+ write_lock_bh(&sk->sk_callback_lock);
+ if (sk->sk_user_data == t) {
+ sk->sk_write_space = t->write_space;
+ sk->sk_user_data = NULL;
+ }
+ write_unlock_bh(&sk->sk_callback_lock);
+ cancel_delayed_work_sync(&t->tx_work);
+ mutex_lock(&t->tx_lock);
+ ksmbd_tcp_purge_tx(t);
+ mutex_unlock(&t->tx_lock);
+ wake_up_all(&t->transport.conn->req_running_q);
+}
+
static int ksmbd_tcp_writev(struct ksmbd_transport *t,
const struct ksmbd_transport_write *tx)
{
- struct msghdr smb_msg = {
- .msg_flags = MSG_NOSIGNAL | tx->msg_flags,
+ struct tcp_transport *tt = TCP_TRANS(t);
+ struct sock *sk = tt->sock->sk;
+ struct msghdr hdr = {
+ .msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT | tx->msg_flags,
};
+ struct tcp_tx *msg;
+ unsigned long deadline = jiffies + KSMBD_TCP_SEND_TIMEOUT;
+ long timeout;
+ int sent = 0;
+
+ for (;;) {
+ if (tx->msg_flags & MSG_DONTWAIT) {
+ if (!mutex_trylock(&tt->tx_lock))
+ return -EAGAIN;
+ } else {
+ mutex_lock(&tt->tx_lock);
+ }
+ if (READ_ONCE(tt->tx_stopped) || ksmbd_conn_exiting(t->conn) ||
+ ksmbd_conn_releasing(t->conn)) {
+ mutex_unlock(&tt->tx_lock);
+ return -EPIPE;
+ }
+ if (ksmbd_tcp_tx_has_space(tt, tx->size))
+ break;
+ mutex_unlock(&tt->tx_lock);
+ if (tx->msg_flags & MSG_DONTWAIT)
+ return -EAGAIN;
+ timeout = deadline - jiffies;
+ if (time_after_eq(jiffies, deadline) ||
+ !wait_event_timeout(t->conn->req_running_q,
+ READ_ONCE(tt->tx_stopped) ||
+ ksmbd_conn_exiting(t->conn) ||
+ ksmbd_conn_releasing(t->conn) ||
+ ksmbd_tcp_tx_has_space(tt, tx->size),
+ timeout)) {
+ /* A queued PDU may already have a prefix in the socket. */
+ ksmbd_conn_abort(t->conn);
+ return -EAGAIN;
+ }
+ }
- return kernel_sendmsg(TCP_TRANS(t)->sock, &smb_msg, tx->iov,
- tx->iov_cnt, tx->size);
+ /* Avoid an extra copy when the socket accepts the whole PDU at once. */
+ if (list_empty(&tt->tx_queue)) {
+ sent = kernel_sendmsg(tt->sock, &hdr, tx->iov, tx->iov_cnt, tx->size);
+ if (sent > 0) {
+ tt->tx_sent += sent;
+ if (sent == tx->size)
+ goto accepted;
+ } else if (ksmbd_tcp_send_retry(sent)) {
+ sent = 0;
+ } else {
+ WRITE_ONCE(tt->tx_stopped, true);
+ mutex_unlock(&tt->tx_lock);
+ ksmbd_conn_abort(t->conn);
+ return sent ?: -EPIPE;
+ }
+ }
+
+ /* The request buffers can be freed as soon as writev returns. */
+ msg = ksmbd_tcp_alloc_tx(tx, sent);
+ if (!msg) {
+ if (sent)
+ WRITE_ONCE(tt->tx_stopped, true);
+ mutex_unlock(&tt->tx_lock);
+ if (sent)
+ ksmbd_conn_abort(t->conn);
+ return -ENOMEM;
+ }
+ msg->deadline = deadline;
+ list_add_tail(&msg->list, &tt->tx_queue);
+ WRITE_ONCE(tt->tx_queued, tt->tx_queued + msg->len);
+ queue_delayed_work(system_unbound_wq, &tt->tx_work, 0);
+
+accepted:
+ tt->tx_end += tx->size;
+ if (tx->tracking) {
+ /* Include retained data, without retaining the caller's tracking object. */
+ tx->tracking->end = tt->tx_end;
+ lock_sock(sk);
+ tx->tracking->retry_after =
+ clamp_t(unsigned long, 6UL * inet_csk(sk)->icsk_rto,
+ msecs_to_jiffies(1200), 6 * HZ);
+ release_sock(sk);
+ tx->tracking->valid = true;
+ }
+ mutex_unlock(&tt->tx_lock);
+ return tx->size;
+}
+
+static bool ksmbd_tcp_is_acked(struct ksmbd_transport *t,
+ const struct ksmbd_tx_tracking *tracking)
+{
+ struct tcp_transport *tt = TCP_TRANS(t);
+ struct sock *sk = tt->sock->sk;
+ bool acked;
+
+ mutex_lock(&tt->tx_lock);
+ lock_sock(sk);
+ acked = tt->tx_sent >= tracking->end &&
+ tcp_sk(sk)->bytes_acked >= tracking->end;
+ release_sock(sk);
+ mutex_unlock(&tt->tx_lock);
+ return acked;
}
static void ksmbd_tcp_disconnect(struct ksmbd_transport *t)
@@ -451,7 +729,9 @@ static void ksmbd_tcp_disconnect(struct
static void ksmbd_tcp_shutdown(struct ksmbd_transport *t)
{
+ WRITE_ONCE(TCP_TRANS(t)->tx_stopped, true);
kernel_sock_shutdown(TCP_TRANS(t)->sock, SHUT_RDWR);
+ wake_up_all(&t->conn->req_running_q);
}
static void tcp_destroy_socket(struct socket *ksmbd_socket)
@@ -724,6 +1004,7 @@ int ksmbd_tcp_set_interfaces(char *ifc_l
static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops = {
.read = ksmbd_tcp_read,
.writev = ksmbd_tcp_writev,
+ .is_acked = ksmbd_tcp_is_acked,
.disconnect = ksmbd_tcp_disconnect,
.shutdown = ksmbd_tcp_shutdown,
.free_transport = ksmbd_tcp_free_transport,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 538/547] ksmbd: retry break notifications on another connection
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 537/547] ksmbd: track delivery of queued TCP writes Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 539/547] ksmbd: fix app-instance non-durable supersede session UAF Greg Kroah-Hartman
` (17 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pan Guihua, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit 14ad1f21fbf05179116dd6ef4ab3b6556478fa50 ]
An oplock or lease break belongs to an open that can outlive its original
channel. A draining channel or stalled TCP writer can otherwise leave the
break pending until timeout or invalidate a durable open.
Snapshot the owner's live channels and try eligible connections with the
same notification. Track TCP delivery separately from the SMB ACK, retry
when a channel stops progressing, and share one break deadline. Run
ordinary break waits on a dedicated workqueue so blocked request
responses do not stall breaks.
Publish NONE before sending a level II break, which requires no ACK, so
an unsolicited ACK observes the completed level while TCP delivery is
pending.
Keep the first rename lease notification in the request context and
enqueue the interim writer only after the notification is accepted. Join
that work before returning so a blocked interim response does not stop
notification retries or release the request early.
Reported-by: Pan Guihua <pan.guihua@datatom.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Stable-dep-of: f728cfee6929 ("ksmbd: fix app-instance non-durable supersede session UAF")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/ksmbd_work.c | 19
fs/smb/server/ksmbd_work.h | 2
fs/smb/server/mgmt/user_session.c | 31 +
fs/smb/server/mgmt/user_session.h | 3
fs/smb/server/oplock.c | 867 +++++++++++++++++++++-----------------
fs/smb/server/oplock.h | 14
fs/smb/server/vfs_cache.c | 2
7 files changed, 545 insertions(+), 393 deletions(-)
--- a/fs/smb/server/ksmbd_work.c
+++ b/fs/smb/server/ksmbd_work.c
@@ -16,6 +16,7 @@
static struct kmem_cache *work_cache;
static struct workqueue_struct *ksmbd_wq;
+static struct workqueue_struct *ksmbd_break_wq;
static int ksmbd_reserve_iov(struct ksmbd_work *work, int need_iov_cnt)
{
@@ -113,6 +114,12 @@ int ksmbd_workqueue_init(void)
ksmbd_wq = alloc_workqueue("ksmbd-io", WQ_PERCPU, 0);
if (!ksmbd_wq)
return -ENOMEM;
+ ksmbd_break_wq = alloc_workqueue("ksmbd-break", WQ_UNBOUND, 0);
+ if (!ksmbd_break_wq) {
+ destroy_workqueue(ksmbd_wq);
+ ksmbd_wq = NULL;
+ return -ENOMEM;
+ }
return 0;
}
@@ -120,6 +127,8 @@ void ksmbd_workqueue_destroy(void)
{
destroy_workqueue(ksmbd_wq);
ksmbd_wq = NULL;
+ destroy_workqueue(ksmbd_break_wq);
+ ksmbd_break_wq = NULL;
}
bool ksmbd_queue_work(struct ksmbd_work *work)
@@ -127,6 +136,16 @@ bool ksmbd_queue_work(struct ksmbd_work
return queue_work(ksmbd_wq, &work->work);
}
+void ksmbd_queue_io_work(struct work_struct *work)
+{
+ queue_work(ksmbd_wq, work);
+}
+
+void ksmbd_queue_break_work(struct work_struct *work)
+{
+ queue_work(ksmbd_break_wq, work);
+}
+
static inline void __ksmbd_iov_pin(struct ksmbd_work *work, void *ib,
unsigned int ib_len)
{
--- a/fs/smb/server/ksmbd_work.h
+++ b/fs/smb/server/ksmbd_work.h
@@ -156,6 +156,8 @@ int ksmbd_work_pool_init(void);
int ksmbd_workqueue_init(void);
void ksmbd_workqueue_destroy(void);
bool ksmbd_queue_work(struct ksmbd_work *work);
+void ksmbd_queue_io_work(struct work_struct *work);
+void ksmbd_queue_break_work(struct work_struct *work);
int ksmbd_iov_pin_rsp_read(struct ksmbd_work *work, void *ib, int len,
void *aux_buf, unsigned int aux_size);
int ksmbd_iov_pin_rsp(struct ksmbd_work *work, void *ib, int len);
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -767,6 +767,37 @@ struct ksmbd_session *ksmbd_session_look
return sess;
}
+/* The caller holds a session reference and must put each returned connection. */
+unsigned int ksmbd_session_get_channels(struct ksmbd_session *sess,
+ struct ksmbd_conn **conns,
+ unsigned int max_conns)
+{
+ struct channel *chann;
+ unsigned long index;
+ unsigned int nr_conns = 0;
+
+ /*
+ * Channel connections are borrowed. Unregister can leave the channel
+ * list in a pinned session after removing it from the registry, so
+ * chann_lock alone does not keep those connections alive. Only collect
+ * registered sessions, excluding both unregister and connection cleanup
+ * until the connection references have been taken.
+ */
+ down_read(&sessions_table_lock);
+ if (hlist_unhashed(&sess->hlist))
+ goto out;
+ down_read(&sess->chann_lock);
+ xa_for_each(&sess->ksmbd_chann_list, index, chann) {
+ if (nr_conns == max_conns)
+ break;
+ conns[nr_conns++] = ksmbd_conn_get(chann->conn);
+ }
+ up_read(&sess->chann_lock);
+out:
+ up_read(&sessions_table_lock);
+ return nr_conns;
+}
+
struct ksmbd_session *ksmbd_session_lookup_all_states(struct ksmbd_conn *conn,
unsigned long long id)
{
--- a/fs/smb/server/mgmt/user_session.h
+++ b/fs/smb/server/mgmt/user_session.h
@@ -99,6 +99,9 @@ void ksmbd_session_release_slot(struct k
void ksmbd_session_destroy(struct ksmbd_session *sess);
struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id);
+unsigned int ksmbd_session_get_channels(struct ksmbd_session *sess,
+ struct ksmbd_conn **conns,
+ unsigned int max_conns);
struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
unsigned long long id);
bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -87,6 +87,7 @@ static struct oplock_info *alloc_opinfo(
return NULL;
opinfo->sess = sess;
+ opinfo->session_id = sess->id;
opinfo->conn = ksmbd_conn_get(work->conn);
opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
opinfo->op_state = OPLOCK_STATE_NONE;
@@ -302,15 +303,9 @@ static struct oplock_info *opinfo_get_li
opinfo = list_first_entry_or_null(&ci->m_op_list, struct oplock_info,
op_entry);
if (opinfo) {
- if (opinfo->conn == NULL ||
- !atomic_inc_not_zero(&opinfo->refcount))
+ /* A live open may still be bound to a disconnected channel. */
+ if (!atomic_inc_not_zero(&opinfo->refcount))
opinfo = NULL;
- else {
- if (ksmbd_conn_releasing(opinfo->conn)) {
- atomic_dec(&opinfo->refcount);
- opinfo = NULL;
- }
- }
if (opinfo && snapshot && opinfo->o_fp &&
opinfo->o_fp != skip_fp &&
@@ -367,7 +362,7 @@ static void opinfo_del(struct oplock_inf
lease_del_open(opinfo);
down_write(&ci->m_lock);
- list_del(&opinfo->op_entry);
+ list_del_init(&opinfo->op_entry);
up_write(&ci->m_lock);
}
@@ -639,19 +634,27 @@ static void grant_none_oplock(struct opl
static inline int compare_guid_key(struct oplock_info *opinfo,
const char *guid1, const char *key1)
{
- const char *guid2, *key2;
+ struct lease *lease = opinfo->o_lease;
+ struct lease_table *lb;
struct ksmbd_conn *conn;
+ int ret = 0;
- conn = READ_ONCE(opinfo->conn);
- if (!conn)
+ if (memcmp(key1, lease->lease_key, SMB2_LEASE_KEY_SIZE))
return 0;
- guid2 = conn->ClientGUID;
- key2 = opinfo->o_lease->lease_key;
- if (!memcmp(guid1, guid2, SMB2_CLIENT_GUID_SIZE) &&
- !memcmp(key1, key2, SMB2_LEASE_KEY_SIZE))
- return 1;
- return 0;
+ /* The caller holds ci->m_lock, which protects opinfo->conn. */
+ conn = READ_ONCE(opinfo->conn);
+ if (conn)
+ return !memcmp(guid1, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE);
+
+ /* A detached durable lease retains its client identity in the table. */
+ read_lock(&lease_list_lock);
+ lb = lease->l_lb;
+ if (lb)
+ ret = !memcmp(guid1, lb->client_guid, SMB2_CLIENT_GUID_SIZE);
+ read_unlock(&lease_list_lock);
+
+ return ret;
}
/**
@@ -681,7 +684,7 @@ static struct oplock_info *same_client_h
*/
down_read(&ci->m_lock);
list_for_each_entry(opinfo, &ci->m_op_list, op_entry) {
- if (!opinfo->is_lease || !opinfo->conn)
+ if (!opinfo->is_lease)
continue;
lease = opinfo->o_lease;
@@ -734,35 +737,6 @@ static struct oplock_info *same_client_h
return m_opinfo;
}
-static bool wait_for_break_ack(struct oplock_info *opinfo)
-{
- int rc = 0;
-
- rc = wait_event_interruptible_timeout(opinfo->oplock_q,
- opinfo->op_state == OPLOCK_STATE_NONE ||
- opinfo->op_state == OPLOCK_CLOSING,
- OPLOCK_WAIT_TIME);
-
- /* is this a timeout ? */
- if (!rc) {
- spin_lock(&opinfo->state_lock);
- if (opinfo->op_state == OPLOCK_CLOSING) {
- spin_unlock(&opinfo->state_lock);
- return false;
- }
- if (opinfo->is_lease) {
- opinfo->o_lease->state = SMB2_LEASE_NONE_LE;
- lease_update_oplock_levels(opinfo->o_lease);
- }
- opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
- opinfo->op_state = OPLOCK_STATE_NONE;
- spin_unlock(&opinfo->state_lock);
- return true;
- }
-
- return false;
-}
-
static bool oplock_break_set_ack_wait(struct oplock_info *opinfo)
{
bool ret = false;
@@ -842,330 +816,492 @@ static bool lease_break_needed(struct op
return opinfo->level > req_op_level;
}
-/**
- * __smb2_oplock_break_noti() - send smb2 oplock break cmd from conn
- * to client
- * @wk: smb work object
- *
- * There are two ways this function can be called. 1- while file open we break
- * from exclusive/batch lock to levelII oplock and 2- while file write/truncate
- * we break from levelII oplock no oplock.
- * work->request_buf contains oplock_info.
- */
-static void __smb2_oplock_break_noti(struct work_struct *wk)
+struct smb2_break_channel {
+ struct list_head list;
+ struct ksmbd_conn *conn;
+ struct ksmbd_tx_tracking tracking;
+ bool queued;
+ bool delivered;
+ bool failed;
+};
+
+static bool smb2_break_complete(struct oplock_info *opinfo, bool expect_ack)
{
- struct smb2_oplock_break *rsp = NULL;
- struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
- struct ksmbd_conn *conn = work->conn;
- struct oplock_break_info *br_info = work->request_buf;
- struct smb2_hdr *rsp_hdr;
- struct ksmbd_file *fp;
+ bool complete;
- fp = ksmbd_lookup_global_fd(br_info->fid);
- if (!fp)
- goto out;
+ spin_lock(&opinfo->state_lock);
+ complete = opinfo->op_state == OPLOCK_CLOSING ||
+ (expect_ack && opinfo->op_state == OPLOCK_STATE_NONE);
+ spin_unlock(&opinfo->state_lock);
+ return complete;
+}
- if (allocate_interim_rsp_buf(work)) {
- pr_err("smb2_allocate_rsp_buf failed! ");
- ksmbd_fd_put(work, fp);
- goto out;
+static int smb2_break_failed(struct oplock_info *opinfo, bool expect_ack)
+{
+ spin_lock(&opinfo->state_lock);
+ /* An ACK or close which won the race has already completed the break. */
+ if (opinfo->op_state == OPLOCK_CLOSING ||
+ (expect_ack && opinfo->op_state == OPLOCK_STATE_NONE)) {
+ spin_unlock(&opinfo->state_lock);
+ return 0;
}
+ if (opinfo->is_lease) {
+ opinfo->o_lease->state = SMB2_LEASE_NONE_LE;
+ opinfo->o_lease->new_state = SMB2_LEASE_NONE_LE;
+ lease_update_oplock_levels(opinfo->o_lease);
+ atomic_set(&opinfo->breaking_cnt, 0);
+ }
+ opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+ opinfo->op_state = OPLOCK_STATE_NONE;
+ spin_unlock(&opinfo->state_lock);
+ wake_up_interruptible_all(&opinfo->oplock_q);
+ wake_up_interruptible_all(&opinfo->oplock_brk);
+ return ksmbd_invalidate_durable_fd(opinfo->fid);
+}
- rsp_hdr = smb_get_msg(work->response_buf);
- memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
- rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
- rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
- rsp_hdr->CreditRequest = cpu_to_le16(0);
- rsp_hdr->Command = SMB2_OPLOCK_BREAK;
- rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR);
- rsp_hdr->NextCommand = 0;
- rsp_hdr->MessageId = cpu_to_le64(-1);
- rsp_hdr->Id.SyncId.ProcessId = 0;
- rsp_hdr->Id.SyncId.TreeId = 0;
- rsp_hdr->SessionId = 0;
- memset(rsp_hdr->Signature, 0, 16);
-
- rsp = smb_get_msg(work->response_buf);
-
- rsp->StructureSize = cpu_to_le16(24);
- if (!br_info->open_trunc &&
- (br_info->level == SMB2_OPLOCK_LEVEL_BATCH ||
- br_info->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE))
- rsp->OplockLevel = SMB2_OPLOCK_LEVEL_II;
- else
- rsp->OplockLevel = SMB2_OPLOCK_LEVEL_NONE;
- rsp->Reserved = 0;
- rsp->Reserved2 = 0;
- rsp->PersistentFid = fp->persistent_id;
- rsp->VolatileFid = fp->volatile_id;
-
- ksmbd_fd_put(work, fp);
- if (ksmbd_iov_pin_rsp(work, (void *)rsp,
- sizeof(struct smb2_oplock_break)))
- goto out;
-
- ksmbd_debug(OPLOCK,
- "sending oplock break v_id %llu p_id = %llu lock level = %d\n",
- rsp->VolatileFid, rsp->PersistentFid, rsp->OplockLevel);
-
- ksmbd_conn_write(work);
+static int smb2_break_add_channel(struct list_head *head, struct ksmbd_conn *conn)
+{
+ struct smb2_break_channel *channel;
-out:
- ksmbd_free_work_struct(work);
- ksmbd_conn_r_count_dec(conn);
- ksmbd_conn_put(conn);
+ channel = kzalloc_obj(*channel, KSMBD_DEFAULT_GFP);
+ if (!channel)
+ return -ENOMEM;
+ channel->conn = ksmbd_conn_get(conn);
+ list_add_tail(&channel->list, head);
+ return 0;
}
/*
- * Select and pin the connection used for an oplock break before doing any
- * allocations which may sleep. The caller of oplock_break() holds a live
- * reference on ci (a file being opened, a file being operated on, or an
- * explicit ksmbd_inode_lookup_lock() reference in the parent lease break
- * paths), so the inode cannot be freed during the call and its lock is
- * reachable without dereferencing opinfo->o_fp, which is not pinned by
- * the oplock reference and may be freed by a concurrent close.
- *
- * opinfo->conn is cleared under ci->m_lock by session_fd_check() when the
- * durable handle owning the oplock is disconnected, reassigned by
- * ksmbd_reopen_durable_fd() under the same lock, and the last
- * ksmbd_conn_put() of the old connection frees it. Holding the read lock
- * excludes both writers, so the connection cannot be freed while it is
- * selected.
+ * Snapshot connections before sending. References keep their transports alive,
+ * while r_count is taken separately for each write, under request_lock.
*/
-static struct ksmbd_conn *smb2_oplock_break_conn_get(struct oplock_info *opinfo,
- struct ksmbd_inode *ci)
-{
+static int smb2_break_collect_channels(struct oplock_info *opinfo,
+ struct ksmbd_inode *ci,
+ struct smb2_break_channel *owner,
+ struct list_head *head,
+ struct smb2_oplock_break *rsp)
+{
+ struct ksmbd_session *sess = NULL;
+ struct ksmbd_conn *session_conns[KSMBD_MAX_CHANNELS];
+ struct ksmbd_file_table *ft;
+ struct ksmbd_file *fp;
struct ksmbd_conn *conn;
+ struct lease_table *lb;
+ char guid[SMB2_CLIENT_GUID_SIZE];
+ u64 session_id = 0;
+ unsigned int nr_conns, i;
+ bool have_guid = false;
+ int bkt, ret = 0;
+ /* m_lock protects membership and binding, but not the session's lifetime. */
down_read(&ci->m_lock);
- conn = READ_ONCE(opinfo->conn);
- if (conn && !ksmbd_conn_releasing(conn))
- conn = ksmbd_conn_get(conn);
- else
- conn = NULL;
+ if (!list_empty(&opinfo->op_entry)) {
+ if (!opinfo->is_lease) {
+ rsp->PersistentFid = READ_ONCE(opinfo->o_fp->persistent_id);
+ rsp->VolatileFid = READ_ONCE(opinfo->o_fp->volatile_id);
+ if (!has_file_id(rsp->PersistentFid) ||
+ !has_file_id(rsp->VolatileFid)) {
+ /* A detached oplock must take the failed-break path. */
+ ret = opinfo->conn ? -ENOENT : -ENOTCONN;
+ goto unlock;
+ }
+ session_id = opinfo->session_id;
+ }
+ conn = opinfo->conn;
+ if (conn) {
+ owner->conn = ksmbd_conn_get(conn);
+ memcpy(guid, conn->ClientGUID, sizeof(guid));
+ have_guid = true;
+ }
+ } else {
+ ret = -ENOENT;
+ }
+unlock:
up_read(&ci->m_lock);
+ if (ret)
+ return ret;
- return conn;
-}
-
-/**
- * smb2_oplock_break_noti() - send smb2 exclusive/batch to level2 oplock
- * break command from server to client
- * @opinfo: oplock info object
- * @ci: inode owning the break target's oplock list, pinned by
- * the caller
- *
- * Return: 0 on success, otherwise error
- */
-static int smb2_oplock_break_noti(struct oplock_info *opinfo,
- struct ksmbd_inode *ci)
-{
- struct ksmbd_conn *conn;
- struct oplock_break_info *br_info;
- int ret = 0;
- struct ksmbd_work *work;
+ if (opinfo->is_lease && !have_guid) {
+ read_lock(&lease_list_lock);
+ lb = opinfo->o_lease->l_lb;
+ if (lb) {
+ memcpy(guid, lb->client_guid, sizeof(guid));
+ have_guid = true;
+ if (lb->conn)
+ owner->conn = ksmbd_conn_get(lb->conn);
+ }
+ read_unlock(&lease_list_lock);
+ }
+ if (owner->conn)
+ list_add_tail(&owner->list, head);
- conn = smb2_oplock_break_conn_get(opinfo, ci);
- if (!conn)
- return ksmbd_invalidate_durable_fd(opinfo->fid);
+ if (!opinfo->is_lease) {
+ /* Session teardown takes m_lock while holding the session table lock. */
+ sess = ksmbd_session_lookup_slowpath(session_id);
+ if (!sess)
+ return -ENOENT;
- work = ksmbd_alloc_work_struct();
- if (!work) {
- ksmbd_conn_put(conn);
- return -ENOMEM;
+ /* Revalidate the binding and IDs after taking a safe session reference. */
+ down_read(&ci->m_lock);
+ if (list_empty(&opinfo->op_entry) || opinfo->sess != sess) {
+ ret = -ENOENT;
+ } else {
+ ft = &sess->file_table;
+ read_lock(&ft->lock);
+ fp = opinfo->o_fp;
+ if (fp->f_state == FP_CLOSED ||
+ !has_file_id(fp->volatile_id) ||
+ idr_find(ft->idr, fp->volatile_id) != fp) {
+ ret = -ENOENT;
+ } else {
+ rsp->PersistentFid = READ_ONCE(fp->persistent_id);
+ rsp->VolatileFid = fp->volatile_id;
+ }
+ read_unlock(&ft->lock);
+ }
+ up_read(&ci->m_lock);
+ if (ret) {
+ ksmbd_user_session_put(sess);
+ return ret;
+ }
}
- br_info = kmalloc_obj(struct oplock_break_info, KSMBD_DEFAULT_GFP);
- if (!br_info) {
- ksmbd_free_work_struct(work);
- ksmbd_conn_put(conn);
- return -ENOMEM;
+ if (opinfo->is_lease && have_guid) {
+ down_read(&conn_list_lock);
+ hash_for_each(conn_list, bkt, conn, hlist) {
+ if (conn == owner->conn || !ksmbd_conn_good(conn) ||
+ memcmp(conn->ClientGUID, guid, sizeof(guid)))
+ continue;
+ ret = smb2_break_add_channel(head, conn);
+ if (ret)
+ break;
+ }
+ up_read(&conn_list_lock);
+ } else if (!opinfo->is_lease && sess && sess->dialect >= SMB30_PROT_ID) {
+ nr_conns = ksmbd_session_get_channels(sess, session_conns,
+ ARRAY_SIZE(session_conns));
+ for (i = 0; i < nr_conns; i++) {
+ conn = session_conns[i];
+ if (!ret && conn && conn != owner->conn && ksmbd_conn_good(conn))
+ ret = smb2_break_add_channel(head, conn);
+ /* Drop all snapshot references, also on allocation failure. */
+ ksmbd_conn_put(conn);
+ }
}
+ ksmbd_user_session_put(sess);
- br_info->level = opinfo->level;
- br_info->fid = opinfo->fid;
- br_info->open_trunc = opinfo->open_trunc;
-
- work->request_buf = (char *)br_info;
- /* Transfer the reference acquired by smb2_oplock_break_conn_get(). */
- work->conn = conn;
- work->sess = opinfo->sess;
-
- ksmbd_conn_r_count_inc(conn);
- if (opinfo->op_state == OPLOCK_ACK_WAIT) {
- INIT_WORK(&work->work, __smb2_oplock_break_noti);
- ksmbd_queue_work(work);
-
- if (wait_for_break_ack(opinfo))
- ret = ksmbd_invalidate_durable_fd(opinfo->fid);
- } else {
- __smb2_oplock_break_noti(&work->work);
- if (opinfo->level == SMB2_OPLOCK_LEVEL_II)
- opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
- }
- return ret;
+ /* Allocation pressure may limit retries, but must not discard the owner. */
+ return list_empty(head) ? (ret ?: -ENOTCONN) : 0;
}
-/**
- * __smb2_lease_break_noti() - send lease break command from server
- * to client
- * @wk: smb work object
- */
-static void __smb2_lease_break_noti(struct work_struct *wk)
+static bool smb2_break_delivered(struct list_head *head, bool require_live)
{
- struct smb2_lease_break *rsp = NULL;
- struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
- struct ksmbd_conn *conn = work->conn;
- struct lease_break_info *br_info = work->request_buf;
- struct smb2_hdr *rsp_hdr;
+ struct smb2_break_channel *channel;
+ struct ksmbd_conn *conn;
- if (allocate_interim_rsp_buf(work)) {
- ksmbd_debug(OPLOCK, "smb2_allocate_rsp_buf failed! ");
- goto out;
+ list_for_each_entry(channel, head, list) {
+ conn = channel->conn;
+ if (!channel->queued || (require_live && !ksmbd_conn_good(conn)))
+ continue;
+ /* A synchronous send needs no separate delivery probe. */
+ if (channel->delivered || !channel->tracking.valid ||
+ conn->transport->ops->is_acked(conn->transport,
+ &channel->tracking)) {
+ channel->delivered = true;
+ return true;
+ }
}
-
- rsp_hdr = smb_get_msg(work->response_buf);
- memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
- rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
- rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
- rsp_hdr->CreditRequest = cpu_to_le16(0);
- rsp_hdr->Command = SMB2_OPLOCK_BREAK;
- rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR);
- rsp_hdr->NextCommand = 0;
- rsp_hdr->MessageId = cpu_to_le64(-1);
- rsp_hdr->Id.SyncId.ProcessId = 0;
- rsp_hdr->Id.SyncId.TreeId = 0;
- rsp_hdr->SessionId = 0;
- memset(rsp_hdr->Signature, 0, 16);
-
- rsp = smb_get_msg(work->response_buf);
- rsp->StructureSize = cpu_to_le16(44);
- rsp->Epoch = br_info->epoch;
- rsp->Flags = 0;
-
- if (br_info->curr_state & (SMB2_LEASE_WRITE_CACHING_LE |
- SMB2_LEASE_HANDLE_CACHING_LE))
- rsp->Flags = SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED;
-
- memcpy(rsp->LeaseKey, br_info->lease_key, SMB2_LEASE_KEY_SIZE);
- rsp->CurrentLeaseState = br_info->curr_state;
- rsp->NewLeaseState = br_info->new_state;
- rsp->BreakReason = 0;
- rsp->AccessMaskHint = 0;
- rsp->ShareMaskHint = 0;
-
- if (ksmbd_iov_pin_rsp(work, (void *)rsp,
- sizeof(struct smb2_lease_break)))
- goto out;
-
- ksmbd_conn_write(work);
-
-out:
- ksmbd_free_work_struct(work);
- ksmbd_conn_r_count_dec(conn);
- ksmbd_conn_put(conn);
+ return false;
}
-/*
- * Select and pin the connection used for a lease break before doing any
- * allocations which may sleep. opinfo->conn is cleared under ci->m_lock,
- * while lease->l_lb and the lease table lifetime are protected by
- * lease_list_lock.
- */
-static struct ksmbd_conn *smb2_lease_break_conn_get(struct oplock_info *opinfo)
+static bool smb2_break_has_unsent_channels(struct list_head *head)
{
- struct lease *lease = opinfo->o_lease;
- struct lease_table *lb;
- struct ksmbd_conn *conn;
+ struct smb2_break_channel *channel;
- /* Keep the connection which owns the open, when it is still active. */
- down_read(&lease->ci->m_lock);
- conn = READ_ONCE(opinfo->conn);
- if (conn && !ksmbd_conn_releasing(conn))
- conn = ksmbd_conn_get(conn);
- else
- conn = NULL;
- up_read(&lease->ci->m_lock);
-
- if (conn || lease->version != 2)
- return conn;
+ list_for_each_entry(channel, head, list) {
+ if (!channel->queued && !channel->failed)
+ return true;
+ }
+ return false;
+}
- /* Otherwise route v2 lease breaks through the shared lease channel. */
- read_lock(&lease_list_lock);
- lb = lease->l_lb;
- if (lb && lb->conn && !ksmbd_conn_releasing(lb->conn))
- conn = ksmbd_conn_get(lb->conn);
- read_unlock(&lease_list_lock);
+static int smb2_break_wait(struct oplock_info *opinfo, struct list_head *head,
+ struct smb2_break_channel *sent_channel,
+ bool expect_ack, bool wait_ack, bool can_retry,
+ unsigned long retry_at, unsigned long deadline)
+{
+ unsigned long remaining;
+ long ret;
- return conn;
+ for (;;) {
+ if (smb2_break_complete(opinfo, expect_ack))
+ return 0;
+ if (!wait_ack && smb2_break_delivered(head, false))
+ return 0;
+ if (time_after_eq(jiffies, deadline))
+ return -ETIMEDOUT;
+ /* TCP delivery followed by a slow SMB ACK is not a send failure. */
+ if (can_retry && !smb2_break_delivered(head, true) &&
+ ((sent_channel && !ksmbd_conn_good(sent_channel->conn)) ||
+ time_after_eq(jiffies, retry_at)))
+ return -EAGAIN;
+
+ remaining = min_t(unsigned long, deadline - jiffies,
+ max_t(unsigned long, 1, HZ / 10));
+ ret = wait_event_interruptible_timeout(opinfo->oplock_q,
+ smb2_break_complete(opinfo, expect_ack),
+ remaining);
+ if (ret < 0)
+ return ret;
+ }
}
-/**
- * smb2_lease_break_noti() - break lease when a new client request
- * write lease
- * @opinfo: contains lease state information
- * @sync: send the lease break notification synchronously
- * @inc_epoch: increment the lease epoch before sending the break
- *
- * Return: 0 on success, otherwise error
- */
-static int smb2_lease_break_noti(struct oplock_info *opinfo, bool sync,
- bool inc_epoch)
+static void smb2_break_init_header(struct smb2_hdr *hdr)
+{
+ memset(hdr, 0, sizeof(*hdr));
+ hdr->ProtocolId = SMB2_PROTO_NUMBER;
+ hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
+ hdr->Command = SMB2_OPLOCK_BREAK;
+ hdr->Flags = SMB2_FLAGS_SERVER_TO_REDIR;
+ hdr->MessageId = cpu_to_le64(-1);
+}
+
+/* Build one notification and reuse its payload and epoch on each connection. */
+static int smb2_break_notify(struct oplock_info *opinfo, struct ksmbd_inode *ci,
+ bool expect_ack, bool wait_ack, bool inc_epoch,
+ struct work_struct *interim_work)
{
- struct ksmbd_conn *conn;
+ struct smb2_break_channel owner = {}, *channel, *tmp, *last = NULL;
struct ksmbd_work *work;
- struct lease_break_info *br_info;
+ struct smb2_oplock_break *oplock_rsp;
+ struct smb2_lease_break *lease_rsp;
struct lease *lease = opinfo->o_lease;
-
- conn = smb2_lease_break_conn_get(opinfo);
- if (!conn)
- return ksmbd_invalidate_durable_fd(opinfo->fid);
-
+ unsigned long deadline, retry_at;
+ int ret, size;
+ LIST_HEAD(channels);
+
+ if (smb2_break_complete(opinfo, expect_ack)) {
+ ret = 0;
+ goto out_interim;
+ }
+ wait_ack = wait_ack && expect_ack;
work = ksmbd_alloc_work_struct();
if (!work) {
- ksmbd_conn_put(conn);
- return -ENOMEM;
+ ret = smb2_break_failed(opinfo, expect_ack);
+ goto out_interim;
}
+ ret = allocate_interim_rsp_buf(work);
+ if (ret)
+ goto failed;
+ oplock_rsp = smb_get_msg(work->response_buf);
+ smb2_break_init_header(&oplock_rsp->hdr);
- br_info = kmalloc_obj(struct lease_break_info, KSMBD_DEFAULT_GFP);
- if (!br_info) {
- ksmbd_free_work_struct(work);
- ksmbd_conn_put(conn);
- return -ENOMEM;
- }
+ ret = smb2_break_collect_channels(opinfo, ci, &owner, &channels, oplock_rsp);
+ if (ret == -ENOENT)
+ goto out;
+ if (ret)
+ goto failed;
- br_info->curr_state = lease->state;
- br_info->new_state = lease->new_state;
- if (lease->version == 2) {
- if (inc_epoch)
- lease->epoch++;
- br_info->epoch = cpu_to_le16(lease->epoch);
- } else {
- br_info->epoch = 0;
+ spin_lock(&opinfo->state_lock);
+ if (opinfo->op_state == OPLOCK_CLOSING ||
+ (expect_ack && opinfo->op_state == OPLOCK_STATE_NONE)) {
+ spin_unlock(&opinfo->state_lock);
+ ret = 0;
+ goto out;
}
- memcpy(br_info->lease_key, lease->lease_key, SMB2_LEASE_KEY_SIZE);
-
- work->request_buf = (char *)br_info;
- /* Transfer the reference acquired by smb2_lease_break_conn_get(). */
- work->conn = conn;
- work->sess = opinfo->sess;
-
- ksmbd_conn_r_count_inc(conn);
- if (opinfo->op_state == OPLOCK_ACK_WAIT) {
- if (sync) {
- __smb2_lease_break_noti(&work->work);
- } else {
- INIT_WORK(&work->work, __smb2_lease_break_noti);
- ksmbd_queue_work(work);
+ if (opinfo->is_lease) {
+ lease_rsp = smb_get_msg(work->response_buf);
+ lease_rsp->StructureSize = cpu_to_le16(44);
+ if (lease->version == 2) {
+ if (inc_epoch)
+ lease->epoch++;
+ lease_rsp->Epoch = cpu_to_le16(lease->epoch);
}
+ if (lease->state & (SMB2_LEASE_WRITE_CACHING_LE |
+ SMB2_LEASE_HANDLE_CACHING_LE))
+ lease_rsp->Flags = SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED;
+ memcpy(lease_rsp->LeaseKey, lease->lease_key, SMB2_LEASE_KEY_SIZE);
+ lease_rsp->CurrentLeaseState = lease->state;
+ lease_rsp->NewLeaseState = lease->new_state;
+ size = sizeof(*lease_rsp);
} else {
- __smb2_lease_break_noti(&work->work);
- if (opinfo->o_lease->new_state == SMB2_LEASE_NONE_LE) {
- opinfo->o_lease->state = SMB2_LEASE_NONE_LE;
- lease_update_oplock_levels(opinfo->o_lease);
+ oplock_rsp->StructureSize = cpu_to_le16(24);
+ oplock_rsp->OplockLevel = !opinfo->open_trunc &&
+ (opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
+ opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) ?
+ SMB2_OPLOCK_LEVEL_II : SMB2_OPLOCK_LEVEL_NONE;
+ /*
+ * A level II break needs no ACK. Publish NONE before sending so
+ * an unsolicited ACK cannot observe II while delivery is pending.
+ */
+ if (!expect_ack)
+ opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+ size = sizeof(*oplock_rsp);
+ }
+ spin_unlock(&opinfo->state_lock);
+ ret = ksmbd_iov_pin_rsp(work, oplock_rsp, size);
+ if (ret)
+ goto failed;
+
+ deadline = jiffies + OPLOCK_WAIT_TIME;
+retry:
+ list_for_each_entry(channel, &channels, list) {
+ if (channel->queued || channel->failed)
+ continue;
+ if (smb2_break_complete(opinfo, expect_ack)) {
+ ret = 0;
+ goto out;
+ }
+ if (time_after_eq(jiffies, deadline)) {
+ ret = -ETIMEDOUT;
+ break;
+ }
+ if (!ksmbd_conn_r_count_inc_if_good(channel->conn)) {
+ channel->failed = true;
+ ret = -ENOTCONN;
+ continue;
+ }
+ work->conn = channel->conn;
+ ret = ksmbd_conn_write_tracked(work, &channel->tracking);
+ ksmbd_conn_r_count_dec(channel->conn);
+ if (ret) {
+ /* Only a nonblocking send guarantees no bytes on -EAGAIN. */
+ if (ret != -EAGAIN || !channel->conn->transport->ops->is_acked)
+ channel->failed = true;
+ continue;
+ }
+ channel->queued = true;
+ if (interim_work) {
+ ksmbd_queue_io_work(interim_work);
+ interim_work = NULL;
+ }
+ last = channel;
+ retry_at = jiffies + channel->tracking.retry_after;
+ ret = smb2_break_wait(opinfo, &channels, channel, expect_ack,
+ wait_ack, smb2_break_has_unsent_channels(&channels),
+ retry_at, deadline);
+ if (ret != -EAGAIN)
+ goto done;
+ }
+ if (smb2_break_has_unsent_channels(&channels)) {
+ /* Allow busy writers to make progress before another nonblocking pass. */
+ retry_at = jiffies + max_t(unsigned long, 1, HZ / 10);
+ ret = smb2_break_wait(opinfo, &channels, NULL, expect_ack,
+ wait_ack, true, retry_at, deadline);
+ if (ret == -EAGAIN)
+ goto retry;
+ } else if (last) {
+ /* Give already queued notifications the rest of the shared wait. */
+ ret = smb2_break_wait(opinfo, &channels, last, expect_ack,
+ wait_ack, false, deadline, deadline);
+ }
+
+done:
+ if (ret)
+ goto failed;
+ if (!expect_ack && opinfo->is_lease) {
+ spin_lock(&opinfo->state_lock);
+ if (opinfo->op_state != OPLOCK_CLOSING) {
+ lease->state = lease->new_state;
+ lease_update_oplock_levels(lease);
}
+ spin_unlock(&opinfo->state_lock);
}
- return 0;
+ goto out;
+failed:
+ ret = smb2_break_failed(opinfo, expect_ack);
+out:
+ ksmbd_free_work_struct(work);
+ list_for_each_entry_safe(channel, tmp, &channels, list) {
+ list_del(&channel->list);
+ ksmbd_conn_put(channel->conn);
+ if (channel != &owner)
+ kfree(channel);
+ }
+out_interim:
+ if (interim_work)
+ ksmbd_queue_io_work(interim_work);
+ return ret;
+}
+
+struct smb2_interim_work {
+ struct work_struct work;
+ struct ksmbd_work *in_work;
+};
+
+static void smb2_break_interim_work(struct work_struct *work)
+{
+ struct smb2_interim_work *iw = container_of(work, struct smb2_interim_work, work);
+
+ if (!setup_async_work(iw->in_work, NULL, NULL)) {
+ smb2_send_interim_resp(iw->in_work, STATUS_PENDING);
+ release_async_work(iw->in_work);
+ }
+}
+
+struct smb2_break_work {
+ struct work_struct work;
+ struct oplock_info *opinfo;
+ struct ksmbd_inode *ci;
+ bool expect_ack;
+ bool wait_ack;
+ bool inc_epoch;
+ int ret;
+};
+
+static void smb2_break_notify_work(struct work_struct *work)
+{
+ struct smb2_break_work *bw = container_of(work, struct smb2_break_work, work);
+
+ bw->ret = smb2_break_notify(bw->opinfo, bw->ci, bw->expect_ack,
+ bw->wait_ack, bw->inc_epoch, NULL);
+}
+
+static int smb2_break_notify_with_interim(struct oplock_info *opinfo,
+ struct ksmbd_inode *ci,
+ bool expect_ack, bool wait_ack,
+ bool inc_epoch, struct ksmbd_work *in_work,
+ bool notify_first)
+{
+ struct smb2_break_work bw = {
+ .opinfo = opinfo,
+ .ci = ci,
+ .expect_ack = expect_ack,
+ .wait_ack = wait_ack,
+ .inc_epoch = inc_epoch,
+ };
+
+ if (!in_work)
+ return smb2_break_notify(opinfo, ci, expect_ack, wait_ack, inc_epoch, NULL);
+
+ if (notify_first) {
+ struct smb2_interim_work iw = { .in_work = in_work };
+ int ret;
+
+ /*
+ * Rename sends the first notification in the request context.
+ * Queue the interim writer after that send so a blocked response
+ * cannot stop notification retries or the break ACK wait.
+ */
+ INIT_WORK_ONSTACK(&iw.work, smb2_break_interim_work);
+ ret = smb2_break_notify(opinfo, ci, expect_ack, wait_ack,
+ inc_epoch, &iw.work);
+ flush_work(&iw.work);
+ destroy_work_on_stack(&iw.work);
+ return ret;
+ }
+
+ /* A blocked interim writer must not stop notification sends or retries. */
+ INIT_WORK_ONSTACK(&bw.work, smb2_break_notify_work);
+ ksmbd_queue_break_work(&bw.work);
+ if (!setup_async_work(in_work, NULL, NULL)) {
+ smb2_send_interim_resp(in_work, STATUS_PENDING);
+ release_async_work(in_work);
+ }
+ /* The caller keeps opinfo and ci alive until the notifier has finished. */
+ flush_work(&bw.work);
+ destroy_work_on_stack(&bw.work);
+ return bw.ret;
}
static void wait_lease_breaking(struct oplock_info *opinfo)
@@ -1187,10 +1323,11 @@ static void wait_lease_breaking(struct o
static int oplock_break(struct oplock_info *brk_opinfo, struct ksmbd_inode *ci,
int req_op_level, struct ksmbd_work *in_work,
- bool share_break, bool sync_lease_break)
+ bool share_break, bool notify_first)
{
int err = 0;
bool sent_interim = false;
+ bool expect_ack = false;
/* Need to break exclusive/batch oplock, write lease or overwrite_if */
ksmbd_debug(OPLOCK,
@@ -1248,8 +1385,9 @@ again:
}
}
- if (lease->state & (SMB2_LEASE_WRITE_CACHING_LE |
- SMB2_LEASE_HANDLE_CACHING_LE)) {
+ expect_ack = lease->state & (SMB2_LEASE_WRITE_CACHING_LE |
+ SMB2_LEASE_HANDLE_CACHING_LE);
+ if (expect_ack) {
if (!oplock_break_set_ack_wait(brk_opinfo)) {
atomic_dec_if_positive(&brk_opinfo->breaking_cnt);
clear_and_wake_up_bit(0, &brk_opinfo->pending_break);
@@ -1265,16 +1403,12 @@ again:
inc_epoch = false;
lease->reuse_epoch = false;
}
- err = smb2_lease_break_noti(brk_opinfo, sync_lease_break, inc_epoch);
+ err = smb2_break_notify_with_interim(brk_opinfo, ci, expect_ack,
+ wait_ack, inc_epoch,
+ sent_interim ? NULL : in_work,
+ notify_first);
+ sent_interim = true;
inc_epoch = false;
- if (in_work && !sent_interim) {
- setup_async_work(in_work, NULL, NULL);
- smb2_send_interim_resp(in_work, STATUS_PENDING);
- release_async_work(in_work);
- sent_interim = true;
- }
- if (wait_ack && !err && wait_for_break_ack(brk_opinfo))
- err = ksmbd_invalidate_durable_fd(brk_opinfo->fid);
ksmbd_debug(OPLOCK, "oplock granted = %d\n", brk_opinfo->level);
if (brk_opinfo->op_state == OPLOCK_CLOSING)
@@ -1310,26 +1444,16 @@ again:
if (brk_opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
brk_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
+ expect_ack = true;
if (!oplock_break_set_ack_wait(brk_opinfo)) {
clear_and_wake_up_bit(0, &brk_opinfo->pending_break);
return -ENOENT;
}
}
-
- /*
- * Keep a conflicting CREATE asynchronous while waiting for an
- * oplock-break acknowledgement. Besides avoiding a blocked client
- * request, this lets a replay arrive while the original CREATE is
- * still pending and be rejected with FILE_NOT_AVAILABLE.
- */
- if (in_work) {
- setup_async_work(in_work, NULL, NULL);
- smb2_send_interim_resp(in_work, STATUS_PENDING);
- release_async_work(in_work);
- }
}
- err = smb2_oplock_break_noti(brk_opinfo, ci);
+ err = smb2_break_notify_with_interim(brk_opinfo, ci, expect_ack,
+ true, false, in_work, false);
ksmbd_debug(OPLOCK, "oplock granted = %d\n", brk_opinfo->level);
if (brk_opinfo->op_state == OPLOCK_CLOSING)
@@ -1491,7 +1615,7 @@ void smb_send_parent_lease_break_noti(st
down_read(&p_ci->m_lock);
list_for_each_entry(opinfo, &p_ci->m_op_list, op_entry) {
- if (opinfo->conn == NULL || !opinfo->is_lease)
+ if (!opinfo->is_lease)
continue;
if (opinfo->o_lease->state != SMB2_OPLOCK_LEVEL_NONE &&
@@ -1502,11 +1626,6 @@ void smb_send_parent_lease_break_noti(st
if (!atomic_inc_not_zero(&opinfo->refcount))
continue;
- if (ksmbd_conn_releasing(opinfo->conn)) {
- opinfo_put(opinfo);
- continue;
- }
-
if (oplock_break_add(&brk_list, opinfo))
opinfo_put(opinfo);
}
@@ -1539,18 +1658,13 @@ void smb_lazy_parent_lease_break_close(s
down_read(&p_ci->m_lock);
list_for_each_entry(opinfo, &p_ci->m_op_list, op_entry) {
- if (opinfo->conn == NULL || !opinfo->is_lease)
+ if (!opinfo->is_lease)
continue;
if (opinfo->o_lease->state != SMB2_OPLOCK_LEVEL_NONE) {
if (!atomic_inc_not_zero(&opinfo->refcount))
continue;
- if (ksmbd_conn_releasing(opinfo->conn)) {
- opinfo_put(opinfo);
- continue;
- }
-
if (oplock_break_add(&brk_list, opinfo))
opinfo_put(opinfo);
}
@@ -1699,7 +1813,11 @@ int smb_grant_oplock(struct ksmbd_work *
err = oplock_break(prev_opinfo, ci, break_level, work,
share_ret < 0 && prev_opinfo->is_lease, false);
- if (prev_durable_detached || (prev_durable_open && err == -ENOENT))
+ /* Keep a detached durable lease if its break retains handle caching. */
+ if ((prev_durable_detached &&
+ (!prev_op_has_lease ||
+ !(prev_opinfo->o_lease->state & SMB2_LEASE_HANDLE_CACHING_LE))) ||
+ (prev_durable_open && err == -ENOENT))
ksmbd_invalidate_durable_fd(prev_fid);
opinfo_put(prev_opinfo);
if (err == -EAGAIN) {
@@ -1803,8 +1921,7 @@ static bool smb_break_all_write_oplock(s
}
brk_opinfo->open_trunc = is_trunc;
- oplock_break(brk_opinfo, fp->f_ci, SMB2_OPLOCK_LEVEL_II, work, false,
- false);
+ oplock_break(brk_opinfo, fp->f_ci, SMB2_OPLOCK_LEVEL_II, work, false, false);
sent_break = true;
opinfo_put(brk_opinfo);
@@ -1819,12 +1936,12 @@ static bool smb_break_all_write_oplock(s
* @is_trunc: truncate on open
* @send_interim: send interim response to the client
* @send_oplock_break: send oplock break notification to the client
- * @sync_lease_break: send the lease break notification synchronously
+ * @notify_first: send the lease break notification before the interim response
*/
static void __smb_break_all_levII_oplock(struct ksmbd_work *work,
struct ksmbd_file *fp, int is_trunc,
bool send_interim, bool send_oplock_break,
- bool sync_lease_break)
+ bool notify_first)
{
struct oplock_info *op, *brk_op;
struct oplock_break_entry *ent, *tmp;
@@ -1842,17 +1959,9 @@ static void __smb_break_all_levII_oplock
down_read(&ci->m_lock);
list_for_each_entry(brk_op, &ci->m_op_list, op_entry) {
- if (brk_op->conn == NULL)
- continue;
-
if (!atomic_inc_not_zero(&brk_op->refcount))
continue;
- if (ksmbd_conn_releasing(brk_op->conn)) {
- opinfo_put(brk_op);
- continue;
- }
-
if (!brk_op->is_lease &&
brk_op->level != SMB2_OPLOCK_LEVEL_II) {
ksmbd_debug(OPLOCK, "unexpected oplock(0x%x)\n",
@@ -1867,10 +1976,8 @@ static void __smb_break_all_levII_oplock
goto next;
if (op && op->is_lease && brk_op->is_lease &&
- !memcmp(conn->ClientGUID, brk_op->conn->ClientGUID,
- SMB2_CLIENT_GUID_SIZE) &&
- !memcmp(op->o_lease->lease_key, brk_op->o_lease->lease_key,
- SMB2_LEASE_KEY_SIZE))
+ compare_guid_key(brk_op, conn->ClientGUID,
+ op->o_lease->lease_key))
goto next;
brk_op->open_trunc = is_trunc;
@@ -1900,7 +2007,7 @@ next:
brk_op->is_lease && !is_trunc ?
SMB2_OPLOCK_LEVEL_II : SMB2_OPLOCK_LEVEL_NONE,
send_interim && !sent_interim ? work : NULL,
- false, sync_lease_break);
+ false, notify_first);
}
sent_interim = true;
list_del(&ent->list);
--- a/fs/smb/server/oplock.h
+++ b/fs/smb/server/oplock.h
@@ -62,6 +62,7 @@ struct lease {
struct oplock_info {
struct ksmbd_conn *conn;
struct ksmbd_session *sess;
+ u64 session_id;
struct ksmbd_work *work;
struct ksmbd_file *o_fp;
int level;
@@ -82,19 +83,6 @@ struct oplock_info {
struct rcu_head rcu;
};
-struct lease_break_info {
- __le32 curr_state;
- __le32 new_state;
- __le16 epoch;
- char lease_key[SMB2_LEASE_KEY_SIZE];
-};
-
-struct oplock_break_info {
- int level;
- int open_trunc;
- int fid;
-};
-
int smb_grant_oplock(struct ksmbd_work *work, int req_op_level,
u64 pid, struct ksmbd_file *fp, __u16 tid,
struct lease_ctx_info *lctx, int share_ret, bool replay);
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1815,6 +1815,7 @@ static bool session_fd_check(struct ksmb
ksmbd_conn_put(op->conn);
op->conn = NULL;
op->sess = NULL;
+ op->session_id = 0;
}
up_write(&ci->m_lock);
@@ -1995,6 +1996,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd
continue;
op->conn = ksmbd_conn_get(fp->conn);
op->sess = work->sess;
+ op->session_id = work->sess->id;
}
up_write(&ci->m_lock);
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 539/547] ksmbd: fix app-instance non-durable supersede session UAF
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 538/547] ksmbd: retry break notifications on another connection Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 540/547] ksmbd: fix invalid pointer dereference when get_inode_acl() fails Greg Kroah-Hartman
` (16 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Bridges, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <icb@fastmail.org>
[ Upstream commit f728cfee6929057087c303d07d7a6a7c61196b48 ]
ksmbd_close_fd_app_instance_id() supersedes a prior open that has the
same AppInstanceId. It reaches that open's session through opinfo->sess.
This pointer is not refcounted.
Session teardown detaches durable handles before it frees the session.
It does not detach a non-durable open. That open still points at the
session through opinfo->sess after the session is freed. Another session
can supersede the open at the same time. The supersede then takes a
write lock through the stale pointer, in the freed session's file table.
BUG: KASAN: slab-use-after-free in _raw_write_lock+0x71/0xd0
Call Trace:
_raw_write_lock+0x71/0xd0
ksmbd_close_fd_app_instance_id+0xd9/0x670 [ksmbd]
smb2_open+0x3e10/0xd910 [ksmbd]
Freed by task 212:
ksmbd_session_destroy+0x38d/0x480 [ksmbd]
Fix this by looking the session up by opinfo->session_id. The lookup
returns a reference, as smb2_break_collect_channels() does. Recheck that
opinfo->sess still points at it before using it.
Do the lookup without m_lock held. destroy_previous_session() takes
m_lock under the session table lock, and taking them in the other order
here would deadlock.
Fixes: 16c30649709d ("ksmbd: handle durable v2 app instance id")
Cc: stable@vger.kernel.org # e0386cd6498b: ksmbd: validate AppInstanceId takeover target
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/vfs_cache.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1054,7 +1054,9 @@ int ksmbd_close_fd_app_instance_id(struc
struct ksmbd_file *fp, bool *closed)
{
struct ksmbd_file_table *ft;
+ struct ksmbd_session *sess;
struct oplock_info *opinfo;
+ u64 session_id;
int n_to_drop = 0;
*closed = false;
@@ -1067,10 +1069,35 @@ int ksmbd_close_fd_app_instance_id(struc
up_read(&fp->f_ci->m_lock);
goto out;
}
+ /*
+ * opinfo->sess is not refcounted, and m_lock does not keep it alive.
+ * The owner can be torn down while we hold only a reference to fp.
+ * Look the owner up by id to take a real reference instead.
+ */
+ session_id = opinfo->session_id;
+ up_read(&fp->f_ci->m_lock);
+
+ /* destroy_previous_session() takes m_lock under sessions_table_lock. */
+ sess = ksmbd_session_lookup_slowpath(session_id);
+ if (!sess)
+ goto out;
- ft = &opinfo->sess->file_table;
+ down_read(&fp->f_ci->m_lock);
+ if (opinfo->sess != sess) {
+ up_read(&fp->f_ci->m_lock);
+ ksmbd_user_session_put(sess);
+ goto out;
+ }
+ ft = &sess->file_table;
write_lock(&ft->lock);
- if (fp->f_state == FP_INITED && has_file_id(fp->volatile_id) &&
+ /*
+ * The table may already be detached by destroy_previous_session().
+ * A new session could also reuse the old id and address and pass the
+ * check above. Only remove fp if this table still publishes it.
+ */
+ if (ft->idr && fp->f_state == FP_INITED &&
+ has_file_id(fp->volatile_id) &&
+ idr_find(ft->idr, fp->volatile_id) == fp &&
ksmbd_app_instance_id_matches(work, fp)) {
idr_remove(ft->idr, fp->volatile_id);
fp->volatile_id = KSMBD_NO_FID;
@@ -1078,6 +1105,7 @@ int ksmbd_close_fd_app_instance_id(struc
}
write_unlock(&ft->lock);
up_read(&fp->f_ci->m_lock);
+ ksmbd_user_session_put(sess);
opinfo_put(opinfo);
opinfo = NULL;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 540/547] ksmbd: fix invalid pointer dereference when get_inode_acl() fails
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 539/547] ksmbd: fix app-instance non-durable supersede session UAF Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 541/547] ksmbd: use the existing xattr name for a named stream Greg Kroah-Hartman
` (15 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Henry Hu, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Hu <huhai@kylinos.cn>
[ Upstream commit 19d180c7baab7126af5848ed87d5f7b5add0cef2 ]
When get_inode_acl() fails, it returns an ERR_PTR(), but
ksmbd_acls_fattr() stored that pointer in smb_fattr without
checking for errors. Later callers then passed the error pointer
to security descriptor helpers or posix_acl_release(), resulting
in an invalid pointer dereference.
This was reproduced on an XFS-backed share when xfs_get_acl()
returned ERR_PTR(-ENOMEM). Querying the SMB ACL from a CIFS client
triggered the crash:
BUG: unable to handle page fault for address: fffffffffffffff8
RIP: smb_acl_sec_desc_scratch_len+0x58/0x90 [ksmbd]
Call Trace:
smb2_query_info+0x40d/0x17c0 [ksmbd]
handle_ksmbd_work+0x1ca/0x770 [ksmbd]
Fix this by checking the return values from get_inode_acl() in
ksmbd_acls_fattr(). Treat -EOPNOTSUPP as indicating that no ACL is
available, and propagate all other errors to the callers. Update
smb2_open() and smb2_get_info_sec() to handle these errors.
Cc: stable@vger.kernel.org
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Henry Hu <huhai@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Retained the non-const struct mnt_idmap * parameter in ksmbd_acls_fattr() to match the existing UID/GID mapping helpers. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 42 ++++++++++++++++++++++++++++++++++--------
1 file changed, 34 insertions(+), 8 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3694,10 +3694,11 @@ static int smb2_create_sd_buffer(struct
le32_to_cpu(sd_buf->ccontext.DataLength), true, false);
}
-static void ksmbd_acls_fattr(struct smb_fattr *fattr,
- struct mnt_idmap *idmap,
- struct inode *inode)
+static int ksmbd_acls_fattr(struct smb_fattr *fattr,
+ struct mnt_idmap *idmap,
+ struct inode *inode)
{
+ struct posix_acl *acl;
vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
@@ -3708,10 +3709,28 @@ static void ksmbd_acls_fattr(struct smb_
fattr->cf_dacls = NULL;
if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
- fattr->cf_acls = get_inode_acl(inode, ACL_TYPE_ACCESS);
- if (S_ISDIR(inode->i_mode))
- fattr->cf_dacls = get_inode_acl(inode, ACL_TYPE_DEFAULT);
+ acl = get_inode_acl(inode, ACL_TYPE_ACCESS);
+ if (IS_ERR(acl)) {
+ if (acl != ERR_PTR(-EOPNOTSUPP))
+ return PTR_ERR(acl);
+ acl = NULL;
+ }
+ fattr->cf_acls = acl;
+
+ if (S_ISDIR(inode->i_mode)) {
+ acl = get_inode_acl(inode, ACL_TYPE_DEFAULT);
+ if (IS_ERR(acl)) {
+ if (acl != ERR_PTR(-EOPNOTSUPP)) {
+ posix_acl_release(fattr->cf_acls);
+ return PTR_ERR(acl);
+ }
+ acl = NULL;
+ }
+ fattr->cf_dacls = acl;
+ }
}
+
+ return 0;
}
enum {
@@ -4931,7 +4950,10 @@ resolve_path:
int pntsd_size;
size_t scratch_len;
- ksmbd_acls_fattr(&fattr, idmap, inode);
+ rc = ksmbd_acls_fattr(&fattr, idmap, inode);
+ if (rc)
+ goto err_out;
+
scratch_len = smb_acl_sec_desc_scratch_len(&fattr,
NULL, 0,
OWNER_SECINFO | GROUP_SECINFO |
@@ -7793,7 +7815,11 @@ static int smb2_get_info_sec(struct ksmb
idmap = file_mnt_idmap(fp->filp);
inode = file_inode(fp->filp);
- ksmbd_acls_fattr(&fattr, idmap, inode);
+ rc = ksmbd_acls_fattr(&fattr, idmap, inode);
+ if (rc) {
+ ksmbd_fd_put(work, fp);
+ return rc;
+ }
if (test_share_config_flag(work->tcon->share_conf,
KSMBD_SHARE_FLAG_ACL_XATTR))
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 541/547] ksmbd: use the existing xattr name for a named stream
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 540/547] ksmbd: fix invalid pointer dereference when get_inode_acl() fails Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 542/547] ksmbd: fix named stream write and EOF handling Greg Kroah-Hartman
` (14 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
[ Upstream commit a7d1d52748e0fe4d06fdb871fc9899904fbba93f ]
SMB stream names are case-insensitive, but ksmbd stores each named
stream in an xattr whose name is case-sensitive. Opening an existing
stream finds its xattr with a case-insensitive match, yet the handle
keeps the name as the client spelled it, and every later operation that
needs an exact name uses that spelling:
- a WRITE or an end-of-file change creates a second xattr, so a stream
created as "Foo" and written through "foo" ends up stored twice, and
which value a later lookup returns depends on xattr list order;
- delete-on-close and delete-pending removal can fail with -ENODATA,
or remove only a case-variant copy and leave the original;
- the share mode check compares stream names with strcmp(), so two
opens of the same stream that differ only in case do not conflict.
Have ksmbd_vfs_casexattr_len() copy the matching xattr's name into the
handle when the stream is opened, so later operations use the name
already on disk. The match must have the same length as the name it
replaces; the stream lookup passes a length that includes the
terminating NUL, which already guarantees that, and the check makes the
copy safe for any caller. A stream that does not exist yet keeps the
client's spelling, as before.
smb2_rename() compares and looks up fp->stream.name case-insensitively,
so it behaves the same with either spelling.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: retained non-const mnt_idmap pointers and passed NULL for the new argument in the additional get_file_stream_info() caller ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 10 +++++-----
fs/smb/server/vfs.c | 9 +++++++--
fs/smb/server/vfs.h | 2 +-
3 files changed, 13 insertions(+), 8 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3367,7 +3367,7 @@ static int smb2_set_ea(struct smb2_ea_in
path->dentry,
attr_name,
XATTR_USER_PREFIX_LEN +
- eabuf->EaNameLength);
+ eabuf->EaNameLength, NULL);
/* delete the EA only when it exits */
if (rc > 0) {
@@ -3439,11 +3439,11 @@ static noinline int smb2_set_stream_name
fp->stream.name = xattr_stream_name;
fp->stream.size = xattr_stream_size;
- /* Check if there is stream prefix in xattr space */
+ /* Keep the existing xattr's case for subsequent writes and removal. */
rc = ksmbd_vfs_casexattr_len(idmap,
path->dentry,
xattr_stream_name,
- xattr_stream_size);
+ xattr_stream_size, xattr_stream_name);
if (rc >= 0)
return 0;
if (rc != -ENOENT && rc != -ENODATA)
@@ -3496,7 +3496,7 @@ static loff_t ksmbd_stream_eof(struct ks
ssize_t slen = ksmbd_vfs_casexattr_len(file_mnt_idmap(fp->filp),
fp->filp->f_path.dentry,
fp->stream.name,
- fp->stream.size);
+ fp->stream.size, NULL);
return slen < 0 ? 0 : (loff_t)slen;
}
@@ -7085,7 +7085,7 @@ static int get_file_stream_info(struct k
*/
slen = ksmbd_vfs_casexattr_len(file_mnt_idmap(fp->filp),
path->dentry, stream_name,
- strlen(stream_name) + 1);
+ strlen(stream_name) + 1, NULL);
ssize = slen < 0 ? 0 : (loff_t)slen;
file_info->StreamSize = cpu_to_le64(ssize);
file_info->StreamAllocationSize = cpu_to_le64(ssize);
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1911,7 +1911,7 @@ int ksmbd_vfs_fill_dentry_attrs(struct k
ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
struct dentry *dentry, char *attr_name,
- int attr_name_len)
+ int attr_name_len, char *actual_name)
{
char *name, *xattr_list = NULL;
ssize_t value_len = -ENOENT, xattr_list_len;
@@ -1929,8 +1929,13 @@ ssize_t ksmbd_vfs_casexattr_len(struct m
ksmbd_debug(VFS, "%s, len %zd\n", name, strlen(name));
if (strncasecmp(attr_name, name, attr_name_len))
continue;
+ if (actual_name && strlen(name) + 1 != attr_name_len)
+ continue;
value_len = ksmbd_vfs_xattr_len(idmap, dentry, name);
+ /* The caller provides attr_name_len bytes for the actual name. */
+ if (value_len >= 0 && actual_name)
+ memcpy(actual_name, name, attr_name_len);
break;
}
@@ -2085,7 +2090,7 @@ int ksmbd_vfs_copy_file_ranges(struct ks
src_file_size = ksmbd_vfs_casexattr_len(
file_mnt_idmap(src_fp->filp),
src_fp->filp->f_path.dentry,
- src_fp->stream.name, src_fp->stream.size);
+ src_fp->stream.name, src_fp->stream.size, NULL);
revert_creds(saved_cred);
if (src_file_size < 0)
return src_file_size;
--- a/fs/smb/server/vfs.h
+++ b/fs/smb/server/vfs.h
@@ -110,7 +110,7 @@ ssize_t ksmbd_vfs_getxattr(struct mnt_id
char **xattr_buf);
ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
struct dentry *dentry, char *attr_name,
- int attr_name_len);
+ int attr_name_len, char *actual_name);
int ksmbd_vfs_setxattr(struct mnt_idmap *idmap,
const struct path *path, const char *attr_name,
void *attr_value, size_t attr_size, int flags,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 542/547] ksmbd: fix named stream write and EOF handling
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 541/547] ksmbd: use the existing xattr name for a named stream Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 543/547] ksmbd: rebind completed CREATE replays without draining the old channel Greg Kroah-Hartman
` (13 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
[ Upstream commit 02165c8d402392278a5cd2cf97645ed73a7ad4a1 ]
An SMB WRITE to an existing named stream can silently discard data after
its written range. ksmbd stores streams as xattr values, but the write
path passes offset + count as the length of the replacement xattr even
when the old stream is longer. Writing 26 bytes at offset 0 to a 60-byte
stream reports 26 bytes written while discarding the remaining 34 bytes.
Keep the existing xattr length when an in-place write ends before EOF.
Reject writes that cross XATTR_SIZE_MAX rather than storing only the
portion that fits while reporting the full requested count.
Commit 4ea0bb8aaedf ("ksmbd: handle set/get info file for streamed file")
intentionally skipped ordinary inode truncation for stream handles: an
EOF SetInfo on an ADS had truncated the base file. That fixed the base
file corruption but left stream EOF changes reporting success without
resizing the stream. Handle these requests by resizing only the stream
xattr; the base file size remains untouched. Zero-fill stream extensions.
This is needed alongside the write fix: a short write's accidental
truncation previously masked an ignored explicit EOF change. The stream
resize helper returns xattr errors directly rather than using the
base-file truncate path's EBADF conversion.
Fixes: f44158485826 ("cifsd: add file operations")
Fixes: 4ea0bb8aaedf ("ksmbd: handle set/get info file for streamed file")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Used non-const mnt_idmap pointers in stream write and truncate helpers to match existing xattr APIs. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 5 ++-
fs/smb/server/vfs.c | 72 ++++++++++++++++++++++++++++++++++++++++++------
fs/smb/server/vfs.h | 1
3 files changed, 68 insertions(+), 10 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8438,6 +8438,8 @@ static int set_end_of_file_info(struct k
newsize = le64_to_cpu(file_eof_info->EndOfFile);
inode = file_inode(fp->filp);
+ if (ksmbd_stream_fd(fp))
+ return ksmbd_vfs_stream_truncate(fp, newsize);
/*
* If FILE_END_OF_FILE_INFORMATION of set_info_file is called
@@ -8446,8 +8448,7 @@ static int set_end_of_file_info(struct k
* truncate of some filesystem like FAT32 fill zero data in
* truncated range.
*/
- if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC &&
- ksmbd_stream_fd(fp) == false) {
+ if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC) {
ksmbd_debug(SMB, "truncated to newsize %lld\n", newsize);
rc = ksmbd_vfs_truncate(work, fp, newsize);
if (rc) {
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -392,23 +392,21 @@ static int ksmbd_vfs_stream_write(struct
const struct cred *saved_cred;
char *stream_buf = NULL, *wbuf;
struct mnt_idmap *idmap = file_mnt_idmap(fp->filp);
- size_t size;
+ size_t size, write_end;
ssize_t v_len;
int err = 0;
ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",
*pos, count);
- if (*pos >= XATTR_SIZE_MAX) {
+ if (*pos < 0 || *pos >= XATTR_SIZE_MAX) {
pr_err("stream write position %lld is out of bounds\n", *pos);
return -EINVAL;
}
- size = *pos + count;
- if (size > XATTR_SIZE_MAX) {
- size = XATTR_SIZE_MAX;
- count = XATTR_SIZE_MAX - *pos;
- }
+ if (count > XATTR_SIZE_MAX - *pos)
+ return -EFBIG;
+ write_end = *pos + count;
saved_cred = override_creds(fp->filp->f_cred);
v_len = ksmbd_vfs_getcasexattr(idmap,
@@ -421,6 +419,8 @@ static int ksmbd_vfs_stream_write(struct
err = v_len;
goto out_revert;
}
+ /* Preserve the tail of an existing stream on an in-place write. */
+ size = max_t(size_t, v_len, write_end);
if (v_len < size) {
wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
@@ -449,13 +449,69 @@ out_revert:
if (err < 0)
goto out;
else
- fp->stream.pos = size;
+ fp->stream.pos = write_end;
err = 0;
out:
kvfree(stream_buf);
return err;
}
+/**
+ * ksmbd_vfs_stream_truncate() - change the length of a named stream
+ * @fp: stream file handle
+ * @newsize: new stream length
+ *
+ * Resize the stream xattr without changing the base inode size.
+ *
+ * Return: 0 on success, otherwise a negative error code
+ */
+int ksmbd_vfs_stream_truncate(struct ksmbd_file *fp, loff_t newsize)
+{
+ const struct cred *saved_cred;
+ struct mnt_idmap *idmap = file_mnt_idmap(fp->filp);
+ char *stream_buf = NULL, *new_buf = NULL;
+ ssize_t v_len;
+ int err;
+
+ if (newsize < 0)
+ return -EINVAL;
+ if (newsize > XATTR_SIZE_MAX)
+ return -EFBIG;
+
+ saved_cred = override_creds(fp->filp->f_cred);
+ v_len = ksmbd_vfs_getcasexattr(idmap, fp->filp->f_path.dentry,
+ fp->stream.name, fp->stream.size,
+ &stream_buf);
+ if (v_len < 0) {
+ err = v_len;
+ goto out;
+ }
+ if (v_len == newsize) {
+ err = 0;
+ goto out;
+ }
+
+ new_buf = stream_buf;
+ if (newsize > v_len) {
+ new_buf = kvzalloc(newsize, KSMBD_DEFAULT_GFP);
+ if (!new_buf) {
+ err = -ENOMEM;
+ goto out;
+ }
+ if (v_len)
+ memcpy(new_buf, stream_buf, v_len);
+ }
+
+ err = ksmbd_vfs_setxattr(idmap, &fp->filp->f_path, fp->stream.name,
+ new_buf, newsize, 0, true);
+ if (new_buf != stream_buf)
+ kvfree(new_buf);
+out:
+ kvfree(stream_buf);
+ revert_creds(saved_cred);
+ return err;
+}
+
/**
* ksmbd_vfs_write() - vfs helper for smb file write
* @work: work
--- a/fs/smb/server/vfs.h
+++ b/fs/smb/server/vfs.h
@@ -83,6 +83,7 @@ int ksmbd_vfs_read(struct ksmbd_work *wo
int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp,
char *buf, size_t count, loff_t *pos, bool sync,
ssize_t *written);
+int ksmbd_vfs_stream_truncate(struct ksmbd_file *fp, loff_t newsize);
int ksmbd_vfs_fsync(struct ksmbd_work *work, u64 fid, u64 p_id);
int ksmbd_vfs_remove_file(struct ksmbd_work *work, const struct path *path);
int ksmbd_vfs_link(struct ksmbd_work *work,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 543/547] ksmbd: rebind completed CREATE replays without draining the old channel
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 542/547] ksmbd: fix named stream write and EOF handling Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 544/547] ksmbd: fix use-after-free after a failed durable reconnect Greg Kroah-Hartman
` (12 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pan Guihua, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit 864bbcd5dc5e70d639a3011eae81a872b69ff402 ]
A completed DurableHandleReqV2 CREATE can be replayed through another
channel while its original channel is exiting. The existing replay path
returns the open but leaves its connection and oplock references pointing
at the old channel. Its open count also stays on that channel, and a
later CLOSE through the surviving channel decrements the wrong counter.
After checking the owner, lease key and persistent flag, verify that an
active open is still published in the requesting session's file table.
Do this even when no oplock was granted, and before processing a consumed
replay. Do not read a borrowed opinfo session pointer for this check.
Keep a healthy original binding. If the original channel is exiting or
releasing, move the open and its own oplock references to the requesting
channel. Serialize this with CLOSE using the session file-table lock,
and with detach, reconnect and notification snapshots using m_lock.
The earlier lock index and lease-table changes make their lifetimes
independent of this connection change. No old-channel r_count wait is
needed, including when an unrelated request remains active there.
Account final close against fp->conn in one place, balance durable detach
and reconnect, and transfer the count with a replay binding change. A
final global lookup put may run after CLOSE has removed the volatile id;
unlink the open from the inode list on that final close as well.
A live completed CREATE replay may follow a break that lowered the
durable open's batch oplock. Apply the batch eligibility check only to
detached reconnects, while retaining the owner, lease key and persistent
flag checks for active replays.
Fixes: bb8bf7eb13b5 ("ksmbd: add SMB3 request replay support")
Reported-by: Pan Guihua <pan.guihua@datatom.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Retain the file lifetime and connection accounting groundwork needed by
failed durable reconnect cleanup. Always unlink the open from the inode
list on final close, including when a global lookup owns the last put.
Charge that close to the bound connection and balance the count across
durable detach, reconnect and reconnect failure.
Serialize detach and reconnect with the inode lock, reject reopening a
closed handle, and detach only the oplock belonging to that open. Preserve
the existing byte-range lock connection lists and their reference transfers.
Active CREATE replay rebinding is omitted because the independent lock
indexing it requires is absent; no new helper is introduced.
Prepare CREATE error cleanup to distinguish an open retained by the request
from one that has not acquired that reference. Close and complete a retained
request open explicitly, while preserving the existing put for the other
case. This supplies the cleanup branch required by the durable reconnect
unpublication fix without the unrelated tree-disconnect changes.
Assisted-by: LLM
Stable-dep-of: 248b5819591c ("ksmbd: fix use-after-free after a failed durable reconnect")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Depends on <20261103170318.645584-1-sashal@kernel.org>
fs/smb/server/smb2pdu.c | 10 +++-
fs/smb/server/vfs_cache.c | 101 +++++++++++++++-------------------------------
2 files changed, 41 insertions(+), 70 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5520,8 +5520,14 @@ err_out2:
if (!rsp->hdr.Status)
rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
- if (fp && !dh_info.replay)
- ksmbd_fd_put(work, fp);
+ if (fp && !dh_info.replay) {
+ if (work->request_open == fp) {
+ ksmbd_close_fd(work, fp->volatile_id);
+ smb2_complete_request_open(work);
+ } else {
+ ksmbd_fd_put(work, fp);
+ }
+ }
smb2_set_err_rsp(work);
ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status);
}
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -605,7 +605,7 @@ static void __ksmbd_remove_fd(struct ksm
list_del_init(&fp->node);
up_write(&fp->f_ci->m_lock);
- if (!has_file_id(fp->volatile_id))
+ if (!ft || !has_file_id(fp->volatile_id))
return;
write_lock(&ft->lock);
@@ -621,8 +621,7 @@ static void __ksmbd_close_fd(struct ksmb
fd_limit_close();
ksmbd_remove_durable_fd(fp);
- if (ft)
- __ksmbd_remove_fd(ft, fp);
+ __ksmbd_remove_fd(ft, fp);
close_id_del_oplock(fp);
filp = fp->filp;
@@ -705,6 +704,7 @@ static void __ksmbd_close_fd(struct ksmb
* in which case there is nothing to drop here.
*/
if (fp->conn) {
+ atomic_dec(&fp->conn->stats.open_files_count);
ksmbd_conn_put(fp->conn);
fp->conn = NULL;
}
@@ -822,22 +822,7 @@ static struct ksmbd_file *__ksmbd_lookup
static void __put_fd_final(struct ksmbd_work *work, struct ksmbd_file *fp)
{
- /*
- * Detached durable fp -- session_fd_check() cleared fp->conn at
- * preserve, so this fp is no longer tracked by any conn's
- * stats.open_files_count. This happens when
- * ksmbd_scavenger_dispose_dh() hands the final close off to an
- * m_fp_list walker (e.g. ksmbd_lookup_fd_inode()) whose work->conn
- * is unrelated to the conn that originally opened the handle; close
- * via the NULL-ft path so we do not underflow that unrelated
- * counter.
- */
- if (!fp->conn) {
- __ksmbd_close_fd(NULL, fp);
- return;
- }
- __ksmbd_close_fd(&work->sess->file_table, fp);
- atomic_dec(&work->conn->stats.open_files_count);
+ __ksmbd_close_fd(fp->conn ? &work->sess->file_table : NULL, fp);
}
static void set_close_state_blocked_works(struct ksmbd_file *fp)
@@ -1117,11 +1102,8 @@ int ksmbd_close_fd_app_instance_id(struc
up_write(&fp->f_ci->m_lock);
*closed = true;
- if (atomic_sub_and_test(n_to_drop, &fp->refcount)) {
- if (fp->conn)
- atomic_dec(&fp->conn->stats.open_files_count);
+ if (atomic_sub_and_test(n_to_drop, &fp->refcount))
__ksmbd_close_fd(NULL, fp);
- }
return 0;
out:
@@ -1412,7 +1394,7 @@ static int ksmbd_mark_fp_closed(struct k
return 1;
}
-static int
+static void
__close_file_table_ids(struct ksmbd_session *sess,
struct ksmbd_tree_connect *tcon,
bool (*skip)(struct ksmbd_tree_connect *tcon,
@@ -1423,7 +1405,6 @@ __close_file_table_ids(struct ksmbd_sess
struct ksmbd_file_table *ft = &sess->file_table;
struct ksmbd_file *fp;
unsigned int id = 0;
- int num = 0;
while (1) {
int n_to_drop;
@@ -1507,10 +1488,8 @@ __close_file_table_ids(struct ksmbd_sess
}
/*
- * fp->volatile_id is already cleared to prevent stale idr
- * removal from a deferred final close. Remove fp from
- * m_fp_list here because __ksmbd_remove_fd() will skip the
- * list unlink when volatile_id is KSMBD_NO_FID.
+ * Stop inode walkers from finding the open after close is committed.
+ * Final close also unlinks fp if a global lookup owns the last put.
*/
down_write(&fp->f_ci->m_lock);
list_del_init(&fp->node);
@@ -1529,22 +1508,13 @@ __close_file_table_ids(struct ksmbd_sess
* the original reference until ksmbd_update_fstate()
* observes the cleared volatile id.
*
- * If we end up as the final putter, finalize fp and
- * account the open_files_count decrement via the caller's
- * atomic_sub(num, ...). Otherwise the remaining user's
- * ksmbd_fd_put() reaches __put_fd_final(), which does its
- * own atomic_dec(&open_files_count), so we must not count
- * this fp here -- doing so would double-decrement the
- * connection-wide counter.
+ * The final close accounts the open against fp->conn,
+ * including when an in-flight user drops the last reference.
*/
- if (atomic_sub_and_test(n_to_drop, &fp->refcount)) {
+ if (atomic_sub_and_test(n_to_drop, &fp->refcount))
__ksmbd_close_fd(NULL, fp);
- num++;
- }
id++;
}
-
- return num;
}
static inline bool is_reconnectable(struct ksmbd_file *fp)
@@ -1833,20 +1803,18 @@ static bool session_fd_check(struct ksmb
* / ksmbd_reopen_durable_fd()), so conn stays valid for the whole
* body of this function regardless of any op->conn puts below.
*/
- conn = fp->conn;
ci = fp->f_ci;
down_write(&ci->m_lock);
+ conn = fp->conn;
list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
lockdep_is_held(&ci->m_lock)) {
- if (op->conn != conn)
+ if (op->o_fp != fp)
continue;
ksmbd_conn_put(op->conn);
op->conn = NULL;
op->sess = NULL;
op->session_id = 0;
}
- up_write(&ci->m_lock);
-
list_for_each_entry_safe(smb_lock, tmp_lock, &fp->lock_list, flist) {
struct ksmbd_conn *lock_conn = smb_lock->conn;
@@ -1859,15 +1827,17 @@ static bool session_fd_check(struct ksmb
ksmbd_conn_put(lock_conn);
}
- spin_lock(&fp->f_lock);
+ write_lock(&global_ft.lock);
fp->conn = NULL;
fp->tcon = NULL;
fp->volatile_id = KSMBD_NO_FID;
- spin_unlock(&fp->f_lock);
if (fp->durable_timeout)
fp->durable_scavenger_timeout =
jiffies_to_msecs(jiffies) + fp->durable_timeout;
+ atomic_dec(&conn->stats.open_files_count);
+ write_unlock(&global_ft.lock);
+ up_write(&ci->m_lock);
/* Drop fp's own reference on conn. */
ksmbd_conn_put(conn);
@@ -1876,22 +1846,12 @@ static bool session_fd_check(struct ksmb
void ksmbd_close_tree_conn_fds(struct ksmbd_work *work)
{
- int num = __close_file_table_ids(work->sess,
- work->tcon,
- tree_conn_fd_check,
- false);
-
- atomic_sub(num, &work->conn->stats.open_files_count);
+ __close_file_table_ids(work->sess, work->tcon, tree_conn_fd_check, false);
}
void ksmbd_close_session_fds(struct ksmbd_work *work)
{
- int num = __close_file_table_ids(work->sess,
- work->tcon,
- session_fd_check,
- true);
-
- atomic_sub(num, &work->conn->stats.open_files_count);
+ __close_file_table_ids(work->sess, work->tcon, session_fd_check, true);
}
int ksmbd_init_global_file_table(void)
@@ -1955,24 +1915,27 @@ int ksmbd_validate_name_reconnect(struct
int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
{
- struct ksmbd_inode *ci;
+ struct ksmbd_inode *ci = fp->f_ci;
struct oplock_info *op;
struct ksmbd_conn *conn = work->conn;
struct ksmbd_share_config *old_share;
struct ksmbd_lock *smb_lock;
unsigned int old_f_state;
+ int ret = -EBADF;
+ down_write(&ci->m_lock);
write_lock(&global_ft.lock);
- if ((!fp->is_durable && !fp->is_persistent) || fp->conn || fp->tcon) {
+ if ((!fp->is_durable && !fp->is_persistent) || fp->conn || fp->tcon ||
+ fp->f_state != FP_INITED) {
write_unlock(&global_ft.lock);
pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon);
- return -EBADF;
+ goto out;
}
if (has_file_id(fp->volatile_id)) {
write_unlock(&global_ft.lock);
pr_err("Still in use durable fd: %llu\n", fp->volatile_id);
- return -EBADF;
+ goto out;
}
/*
@@ -1992,6 +1955,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd
fp->conn = ksmbd_conn_get(conn);
fp->tcon = work->tcon;
spin_unlock(&fp->f_lock);
+ atomic_inc(&conn->stats.open_files_count);
write_unlock(&global_ft.lock);
__open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
@@ -2003,10 +1967,11 @@ int ksmbd_reopen_durable_fd(struct ksmbd
fp->share_conf = old_share;
fp->f_state = old_f_state;
spin_unlock(&fp->f_lock);
+ atomic_dec(&conn->stats.open_files_count);
write_unlock(&global_ft.lock);
ksmbd_conn_put(conn);
ksmbd_share_config_put(work->tcon->share_conf);
- return -EBADF;
+ goto out;
}
list_for_each_entry(smb_lock, &fp->lock_list, flist) {
@@ -2016,8 +1981,6 @@ int ksmbd_reopen_durable_fd(struct ksmbd
spin_unlock(&conn->llist_lock);
}
- ci = fp->f_ci;
- down_write(&ci->m_lock);
list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
lockdep_is_held(&ci->m_lock)) {
if (op->conn || op->o_fp != fp)
@@ -2026,7 +1989,6 @@ int ksmbd_reopen_durable_fd(struct ksmbd
op->sess = work->sess;
op->session_id = work->sess->id;
}
- up_write(&ci->m_lock);
spin_lock(&fp->f_lock);
fp->owner.uid = fp->owner.gid = 0;
@@ -2035,7 +1997,10 @@ int ksmbd_reopen_durable_fd(struct ksmbd
spin_unlock(&fp->f_lock);
ksmbd_share_config_put(old_share);
- return 0;
+ ret = 0;
+out:
+ up_write(&ci->m_lock);
+ return ret;
}
int ksmbd_init_file_table(struct ksmbd_file_table *ft)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 544/547] ksmbd: fix use-after-free after a failed durable reconnect
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 543/547] ksmbd: rebind completed CREATE replays without draining the old channel Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 545/547] rust_binder: wake epoll on self-work queued to poll thread Greg Kroah-Hartman
` (11 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Bridges, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <icb@fastmail.org>
[ Upstream commit 248b5819591c577727930e4e255a455235fab50a ]
ksmbd_reopen_durable_fd() republishes a detached durable handle in the
reconnecting session's file table and takes no reference for that entry.
If smb2_open() then fails, cleanup relies on the final ksmbd_fd_put() to
remove the volatile id.
Two reconnects of the same handle can both take a lookup reference before
either attaches it. If the one that reopens first then fails and drops
its references first, the other request makes the final put through
ksmbd_put_durable_fd(). That frees the handle without removing the first
session's table entry, so tearing that session down writes to freed
memory.
BUG: KASAN: slab-use-after-free in __close_file_table_ids+0x14d/0x740 [ksmbd]
Call Trace:
__close_file_table_ids+0x14d/0x740 [ksmbd]
ksmbd_destroy_file_table+0x76/0x100 [ksmbd]
ksmbd_session_destroy+0xf8/0x480 [ksmbd]
ksmbd_dispose_sessions+0x13e/0x200 [ksmbd]
ksmbd_conn_sessions_cleanup+0x4c3/0x6d0 [ksmbd]
Freed by task 1030:
__ksmbd_close_fd+0x97d/0x1000 [ksmbd]
smb2_open+0x14eb/0xd9f0 [ksmbd]
Commit 3515503322f4 ("ksmbd: fix durable reconnect error path file
lifetime") handles a final put made by the reconnecting request, but not
one made by another holder.
Remove the volatile id under the file-table lock on this error path,
before the references are dropped, as ksmbd_close_fd() does on the
request_open path just above. Removal then no longer depends on which
holder makes the final put. The stale comment in the reconnect cleanup
is updated to match. A successful reconnect is unchanged.
Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 9 +++++----
fs/smb/server/vfs_cache.c | 28 ++++++++++++++++++++++++++++
fs/smb/server/vfs_cache.h | 2 ++
3 files changed, 35 insertions(+), 4 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5525,6 +5525,8 @@ err_out2:
ksmbd_close_fd(work, fp->volatile_id);
smb2_complete_request_open(work);
} else {
+ if (dh_info.reconnected && fp == dh_info.fp)
+ ksmbd_unpublish_reopened_fd(work, fp);
ksmbd_fd_put(work, fp);
}
}
@@ -5538,10 +5540,9 @@ err_out2:
if (dh_info.reconnected) {
/*
* If reconnect succeeded, fp was republished in the
- * session file table. On a later error, ksmbd_fd_put()
- * above drops the session reference; drop the durable
- * lookup reference through the same session-aware path so
- * final close removes the volatile id before freeing fp.
+ * session file table, and the error path above has
+ * already removed its volatile id. Drop the durable
+ * lookup reference through the same session-aware path.
*/
if (rc && fp == dh_info.fp)
ksmbd_fd_put(work, dh_info.fp);
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -851,6 +851,34 @@ void ksmbd_wake_session_blocked_works(st
read_unlock(&ft->lock);
}
+/**
+ * ksmbd_unpublish_reopened_fd() - remove a reopened durable handle from the
+ * session file table after its CREATE failed
+ * @work: smb work of the failed CREATE
+ * @fp: durable handle republished by ksmbd_reopen_durable_fd()
+ *
+ * The reopen publishes @fp in this session's table without taking a reference
+ * for the entry, so the CREATE error path's puts need not be the last ones.
+ * Another holder of a global-table reference, such as a concurrent reconnect
+ * of the same handle, can drop the last one through ksmbd_put_durable_fd(),
+ * which frees @fp without touching this table. Remove the id here, while
+ * the caller still holds its references.
+ *
+ * Every path that removes the id before the final put also clears
+ * @fp->volatile_id under ft->lock, so a valid id is still @fp's entry.
+ */
+void ksmbd_unpublish_reopened_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
+{
+ struct ksmbd_file_table *ft = &work->sess->file_table;
+
+ write_lock(&ft->lock);
+ if (has_file_id(fp->volatile_id)) {
+ idr_remove(ft->idr, fp->volatile_id);
+ fp->volatile_id = KSMBD_NO_FID;
+ }
+ write_unlock(&ft->lock);
+}
+
int ksmbd_close_fd(struct ksmbd_work *work, u64 id)
{
struct ksmbd_file *fp;
--- a/fs/smb/server/vfs_cache.h
+++ b/fs/smb/server/vfs_cache.h
@@ -198,6 +198,8 @@ static inline bool ksmbd_stream_fd(struc
int ksmbd_init_file_table(struct ksmbd_file_table *ft);
void ksmbd_destroy_file_table(struct ksmbd_session *sess);
int ksmbd_close_fd(struct ksmbd_work *work, u64 id);
+void ksmbd_unpublish_reopened_fd(struct ksmbd_work *work,
+ struct ksmbd_file *fp);
struct ksmbd_file *ksmbd_lookup_fd_fast(struct ksmbd_work *work, u64 id);
struct ksmbd_file *ksmbd_lookup_foreign_fd(struct ksmbd_work *work, u64 id);
struct ksmbd_file *ksmbd_lookup_fd_slow(struct ksmbd_work *work, u64 id,
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 545/547] rust_binder: wake epoll on self-work queued to poll thread
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 544/547] ksmbd: fix use-after-free after a failed durable reconnect Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 546/547] media: rc: Fix build failure with CONFIG_LIRC disabled Greg Kroah-Hartman
` (10 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Poil Zero, Alice Ryhl,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <aliceryhl@google.com>
[ Upstream commit 985955d8e6b2b15cfd65b7ac6893e3a5a90c5870 ]
When a thread pushes work to its own todo list, InnerThread::push_work()
returns PushWorkRes::OkNotifyPoll if the thread uses epoll, but four
call sites in thread.rs discard this return value. As a result, a
non-blocking BC_* write that enqueues work onto the calling thread's
todo list without also reading will not wake epoll. Check the return
value and call self.process.notify_poll(false) when
PushWorkRes::OkNotifyPoll is returned.
This is similar to commit 97830f3c3088 ("binder: signal epoll threads of
self-work"), but in C Binder pending thread work also prevented
subsequent process work from waking epoll, causing a permanent hang,
which is not the case in Rust Binder. This means that in practice, it
merely delays notifications rather than completely failing to send them.
Cc: stable@kernel.org
Fixes: dbb17c9ea756 ("rust_binder: move (e)poll wait queue to Process")
Reported-by: Poil Zero <poilandgginchi@gmail.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20261016-binder-poll-self-work-v1-1-c29c87d99abb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ sashal: adapted reply_inner() to unconditional immediate completion because TransactionFlag::DeferComplete is absent ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder/thread.rs | 38 +++++++++++++++++++++++++++-----------
1 file changed, 27 insertions(+), 11 deletions(-)
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -344,13 +344,13 @@ impl InnerThread {
}
}
- fn push_return_work(&mut self, reply: u32) {
+ fn push_return_work(&mut self, reply: u32) -> PushWorkRes {
if let Ok(work) = ListArc::try_from_arc(self.return_work.clone()) {
work.set_error_code(reply);
- // Not notifying: Reply to current thread.
- let _ = self.push_work(work);
+ self.push_work(work)
} else {
pr_warn!("Thread return work is already in use.");
+ PushWorkRes::Ok
}
}
@@ -669,8 +669,12 @@ impl Thread {
pub(crate) fn push_work_if_looper(&self, work: DLArc<dyn DeliverToRead>) -> BinderResult {
let mut inner = self.inner.lock();
if inner.is_looper() && !inner.is_dead {
- // Not notifying: Reply to current thread.
- let _ = inner.push_work(work);
+ // Not notifying work_condvar: Reply to current thread.
+ let res = inner.push_work(work);
+ drop(inner);
+ if matches!(res, PushWorkRes::OkNotifyPoll) {
+ self.process.notify_poll(false);
+ }
Ok(())
} else {
drop(inner);
@@ -683,7 +687,11 @@ impl Thread {
}
pub(crate) fn push_return_work(&self, reply: u32) {
- self.inner.lock().push_return_work(reply);
+ // Not notifying work_condvar: Reply to current thread.
+ let res = self.inner.lock().push_return_work(reply);
+ if matches!(res, PushWorkRes::OkNotifyPoll) {
+ self.process.notify_poll(false);
+ }
}
pub(crate) fn pop_work_even_if_deferred(&self) -> Option<DLArc<dyn DeliverToRead>> {
@@ -1416,8 +1424,11 @@ impl Thread {
let process = orig.from.process.clone();
let allow_fds = orig.flags.contains(TransactionFlag::AcceptFds);
let reply = Transaction::new_reply(self, process, info, allow_fds)?;
- // Not notifying: Reply to current thread.
- let _ = self.inner.lock().push_work(completion);
+ // Not notifying work_condvar: Reply to current thread.
+ let res = self.inner.lock().push_work(completion);
+ if matches!(res, PushWorkRes::OkNotifyPoll) {
+ self.process.notify_poll(false);
+ }
orig.from.deliver_reply(Ok(reply), &orig, None);
Ok(())
})()
@@ -1456,10 +1467,15 @@ impl Thread {
let list_completion =
DTRWrap::arc_try_new(DeliverCode::new(code, self.process.task.pid()))?;
let completion = list_completion.clone_arc();
- // Not notifying: Reply to current thread.
- let _ = self.inner.lock().push_work(list_completion);
+ // Not notifying work_condvar: Reply to current thread.
+ let res = self.inner.lock().push_work(list_completion);
match transaction.submit(info) {
- Ok(()) => Ok(()),
+ Ok(()) => {
+ if matches!(res, PushWorkRes::OkNotifyPoll) {
+ self.process.notify_poll(false);
+ }
+ Ok(())
+ }
Err(err) => {
completion.skip();
Err(err)
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 546/547] media: rc: Fix build failure with CONFIG_LIRC disabled
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 545/547] rust_binder: wake epoll on self-work queued to poll thread Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 547/547] ksmbd: keep retry timeout clamp bounds constant Greg Kroah-Hartman
` (9 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, kernel test robot, Sean Young
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 0c795849fd70d6bdb99aea5dd08d9b43128612f6 upstream.
commit 37efd09ba2c6 ("media: rc: Ensure registered is cleared in error
path") broke the build if CONFIG_LIRC was not enabled.
Fixes: 37efd09ba2c6 ("media: rc: Ensure registered is cleared in error path")
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202609230511.Em5Osw74-lkp@intel.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/lirc_dev.c | 3 +++
drivers/media/rc/rc-main.c | 3 +--
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -775,6 +775,9 @@ void lirc_unregister(struct rc_dev *dev)
unsigned long flags;
struct lirc_fh *fh;
+ if (!device_is_registered(&dev->lirc_dev))
+ return;
+
dev_dbg(&dev->dev, "lirc_dev: driver %s unregistered from minor = %d\n",
dev->driver_name, MINOR(dev->lirc_dev.devt));
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1986,8 +1986,7 @@ out_lirc:
scoped_guard(mutex, &dev->lock)
dev->registered = false;
- if (device_is_registered(&dev->lirc_dev))
- lirc_unregister(dev);
+ lirc_unregister(dev);
device_del(&dev->dev);
/* registered already cleared above */
goto out_free_table;
^ permalink raw reply [flat|nested] 560+ messages in thread
* [PATCH 7.3 547/547] ksmbd: keep retry timeout clamp bounds constant
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 546/547] media: rc: Fix build failure with CONFIG_LIRC disabled Greg Kroah-Hartman
@ 2026-11-04 21:12 ` Greg Kroah-Hartman
2026-11-05 0:27 ` [PATCH 7.3 000/547] 7.3.2-rc1 review Ronald Warsow
` (8 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-04 21:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, kernel test robot, Namjae Jeon
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 146c3fc6540e24eef6296395a35bf5b924182e8b upstream.
With CONFIG_HZ=1024, msecs_to_jiffies(1200) includes an overflow check
that calls jiffies_to_msecs(MAX_JIFFY_OFFSET). Its saturation branch
returns MAX_JIFFY_OFFSET, which exceeds the six-second upper bound.
GCC 10.5 carries that branch into clamp_t()'s bounds check and fails to
build ksmbd_tcp_writev() on MIPS.
Compute the 1200 ms lower bound with DIV_ROUND_UP() instead, so both
bounds are compile-time constants. The lower bound still rounds up to
the next jiffy, and the retry interval remains between 1.2 and 6 seconds.
Fixes: c0632d2010ff ("ksmbd: track delivery of queued TCP writes")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610251743.jztr17Ib-lkp@intel.com/
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/transport_tcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -696,7 +696,7 @@ accepted:
lock_sock(sk);
tx->tracking->retry_after =
clamp_t(unsigned long, 6UL * inet_csk(sk)->icsk_rto,
- msecs_to_jiffies(1200), 6 * HZ);
+ DIV_ROUND_UP(1200 * HZ, MSEC_PER_SEC), 6 * HZ);
release_sock(sk);
tx->tracking->valid = true;
}
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-11-04 21:12 ` [PATCH 7.3 547/547] ksmbd: keep retry timeout clamp bounds constant Greg Kroah-Hartman
@ 2026-11-05 0:27 ` Ronald Warsow
2026-11-05 18:39 ` Sasha Levin
2026-11-05 3:08 ` SJ Park
` (7 subsequent siblings)
555 siblings, 1 reply; 560+ messages in thread
From: Ronald Warsow @ 2026-11-05 0:27 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
Hi
kernel build / boot test on x86_64 (11th Gen Intel Core i5-11400).
not bisected, just "visual grepped" on the linux-stable-rc.git log !
I need to revert:
"x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()"
commit 7f85bfd44bcccf315eb30145e9c2a2fd9f6f8a87
otherwise I get:
[ 0.105981] x86/fpu: Enabled xstate features 0x2ff, context size is
2568 bytes, using 'compacted' format.
[ 0.108036] ------------[ cut here ]------------
[ 0.108037] CPA detected W^X violation: 8000000000000123 ->
0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 101000
[ 0.108039] WARNING: arch/x86/mm/pat/set_memory.c:722 at
__change_page_attr_set_clr+0xc4c/0x11f0, CPU#0: swapper/0/0
[ 0.108043] Modules linked in:
[ 0.108045] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
7.3.2-rc1_MY-g75eaee7a6465 #1 PREEMPT(lazy)
[ 0.108047] Hardware name: ASUS System Product Name/ROG STRIX B560-G
GAMING WIFI, BIOS 2501 05/22/2026
[ 0.108048] RIP: 0010:__change_page_attr_set_clr+0xc65/0x11f0
[ 0.108050] Code: 7c 24 4c 00 0f 85 e9 03 00 00 48 8d 3d a4 78 01 03
48 8b 34 24 4d 89 e9 4d 8d 84 24 ff 0f 00 00 4c 89 e1 48 89 c2 48 89 04
24 <67> 48 0f b9 3a 48 8b 04 24 48 ba 00 f0 ff ff ff ff 0f 00 48 21 d3
[ 0.108052] RSP: 0000:ffffffff85203c40 EFLAGS: 00010246
[ 0.108053] RAX: 0000000000000123 RBX: 8000000101000123 RCX:
ffffffffc0400000
[ 0.108054] RDX: 0000000000000123 RSI: 8000000000000123 RDI:
ffffffff857c8f70
[ 0.108055] RBP: 8000000101000123 R08: ffffffffc0400fff R09:
0000000000101000
[ 0.108056] R10: 0000000000000123 R11: 0000000000000000 R12:
ffffffffc0400000
[ 0.108056] R13: 0000000000101000 R14: 000ffffffffff000 R15:
ffffffff85203d40
[ 0.108057] FS: 0000000000000000(0000) GS:ffff97940910f000(0000)
knlGS:0000000000000000
[ 0.108058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.108059] CR2: ffff979067570000 CR3: 0000000126238001 CR4:
0000000000770ef0
[ 0.108060] PKRU: 55555554
[ 0.108061] Call Trace:
[ 0.108062] <TASK>
[ 0.108064] ? _vm_unmap_aliases+0x229/0x2a0
[ 0.108067] change_page_attr_set_clr+0x154/0x5a0
[ 0.108070] ? perf_get_hw_event_config+0x28/0x30
[ 0.108072] set_memory_x+0x39/0x50
[ 0.108073] apply_retpolines+0x695/0x710
[ 0.108077] ? perf_get_hw_event_config+0x28/0x30
[ 0.108078] ? __pfx_x86_pmu_filter+0x7/0x10
[ 0.108080] ? perf_get_hw_event_config+0x2d/0x30
[ 0.108081] alternative_instructions+0x37/0xc0
[ 0.108086] arch_cpu_finalize_init+0x11b/0x170
[ 0.108087] start_kernel+0x9ae/0xa50
[ 0.108089] x86_64_start_reservations+0x24/0x30
[ 0.108091] x86_64_start_kernel+0x121/0x130
[ 0.108092] common_startup_64+0x13e/0x158
[ 0.108095] </TASK>
[ 0.108095] ---[ end trace 0000000000000000 ]---
Thanks
Tested-by: Ronald Warsow <rwarsow@gmx.de>
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-11-05 0:27 ` [PATCH 7.3 000/547] 7.3.2-rc1 review Ronald Warsow
@ 2026-11-05 3:08 ` SJ Park
2026-11-05 8:10 ` Peter Schneider
` (6 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: SJ Park @ 2026-11-05 3:08 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: SJ Park, stable, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Wed, 4 Nov 2026 16:03:04 -0500 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000.
> Anything received after that time might be too late.
This rc kernel passes DAMON functionality test [1] on my test machine.
Tested-by: SJ Park <sj@kernel.org>
[1] https://github.com/damonitor/damon-tests/tree/next/corr
Thanks,
SJ
[...]
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-11-05 3:08 ` SJ Park
@ 2026-11-05 8:10 ` Peter Schneider
2026-11-05 12:17 ` Takeshi Ogasawara
` (5 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Peter Schneider @ 2026-11-05 8:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 04.11.2026 um 22:03 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697v2 server. No dmesg oddities or regressions found.
On my machine, I don't see the issue Ronald Warsow reported.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-11-05 8:10 ` Peter Schneider
@ 2026-11-05 12:17 ` Takeshi Ogasawara
2026-11-05 14:16 ` Ron Economos
` (4 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Takeshi Ogasawara @ 2026-11-05 12:17 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Hi Greg
On Thu, Nov 5, 2026 at 8:41 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.3.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Linux version 7.3.2-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 7.3.2-rc1rv-g75eaee7a6465
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 16.2.1 20260810, GNU ld (GNU
Binutils) 2.47) #1 SMP PREEMPT_DYNAMIC Thu Nov 5 20:31:07 JST 2026
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-11-05 12:17 ` Takeshi Ogasawara
@ 2026-11-05 14:16 ` Ron Economos
2026-11-05 15:30 ` Pavel Machek
` (3 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Ron Economos @ 2026-11-05 14:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 11/4/26 13:03, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.3.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-11-05 14:16 ` Ron Economos
@ 2026-11-05 15:30 ` Pavel Machek
2026-11-05 16:16 ` Brett A C Sheffield
` (2 subsequent siblings)
555 siblings, 0 replies; 560+ messages in thread
From: Pavel Machek @ 2026-11-05 15:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 501 bytes --]
Hi!
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-7.3.y
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Best regards,
Pavel
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 330/547] xfs: cross-reference the primary superblock
2026-11-04 21:08 ` [PATCH 7.3 330/547] xfs: cross-reference the primary superblock Greg Kroah-Hartman
@ 2026-11-05 15:38 ` Barry K. Nathan
0 siblings, 0 replies; 560+ messages in thread
From: Barry K. Nathan @ 2026-11-05 15:38 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Darrick J. Wong, Christoph Hellwig, Carlos Maiolino
On 11/4/26 1:08 PM, Greg Kroah-Hartman wrote:
> 7.3-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Darrick J. Wong <djwong@kernel.org>
>
> commit 0c61016006ab08f8346f9e7b1e38559bd4ea499e upstream.
>
> Make sure we cross-reference the primary superblock against the rest of
> the AG 0 space metadata. Drop the unused @bp parameter of
> xchk_superblock_xref to avoid complaints about uninitialized variables.
>
> Cc: stable@vger.kernel.org # v4.16
> Fixes: 52dc4b44af7419 ("xfs: cross-reference with the bnobt")
> Signed-off-by: Darrick J. Wong <djwong@kernel.org>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Carlos Maiolino <cem@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> fs/xfs/scrub/agheader.c | 15 +++++++--------
> 1 file changed, 7 insertions(+), 8 deletions(-)
>
> --- a/fs/xfs/scrub/agheader.c
> +++ b/fs/xfs/scrub/agheader.c
> @@ -35,8 +35,7 @@ xchk_setup_agheader(
> /* Cross-reference with the other btrees. */
> STATIC void
> xchk_superblock_xref(
> - struct xfs_scrub *sc,
> - struct xfs_buf *bp)
> + struct xfs_scrub *sc)
> {
> struct xfs_mount *mp = sc->mp;
> xfs_agnumber_t agno = sc->sm->sm_agno;
> @@ -106,16 +105,12 @@ xchk_superblock(
> struct xfs_dsb *sb;
> struct xfs_perag *pag;
> size_t sblen;
> - xfs_agnumber_t agno;
> + xfs_agnumber_t agno = sc->sm->sm_agno;
> uint32_t v2_ok;
> __be32 features_mask;
> int error;
> __be16 vernum_mask;
>
> - agno = sc->sm->sm_agno;
> - if (agno == 0)
> - return 0;
> -
> /*
> * Grab an active reference to the perag structure. If we can't get
> * it, we're racing with something that's tearing down the AG, so
> @@ -125,6 +120,9 @@ xchk_superblock(
> if (!pag)
> return -ENOENT;
>
> + if (agno == 0)
> + goto out_xref;
> +
> error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp);
> /*
> * The superblock verifier can return several different error codes
> @@ -430,7 +428,8 @@ xchk_superblock(
> if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen))
> xchk_block_set_corrupt(sc, bp);
>
> - xchk_superblock_xref(sc, bp);
> +out_xref:
> + xchk_superblock_xref(sc);
> out_pag:
> xfs_perag_put(pag);
> return error;
>
>
This patch is breaking the build for me with CONFIG_WERROR enabled,
for both 6.18.61-rc1 and 7.3.2-rc1, on both arm64 and amd64, when
I compile with clang (I tried 19.1.7, 22.1.8 and 23.1.5). It only
happens if I build with CONFIG_XFS_ONLINE_SCRUB enabled. However, it
doesn't happen with 7.4-rc1, and it does not happen with gcc.
fs/xfs/scrub/agheader.c:123:6: error: variable 'error' is used uninitialized
whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
123 | if (agno == 0)
| ^~~~~~~~~
fs/xfs/scrub/agheader.c:435:9: note: uninitialized use occurs here
435 | return error;
| ^~~~~
fs/xfs/scrub/agheader.c:123:2: note: remove the 'if' if its condition is always
false
123 | if (agno == 0)
| ^~~~~~~~~~~~~~
124 | goto out_xref;
| ~~~~~~~~~~~~~
fs/xfs/scrub/agheader.c:111:13: note: initialize the variable 'error' to silence
this warning
111 | int error;
| ^
| = 0
1 error generated.
make[4]: *** [scripts/Makefile.build:287: fs/xfs/scrub/agheader.o] Error 1
make[3]: *** [scripts/Makefile.build:544: fs/xfs] Error 2
make[2]: *** [scripts/Makefile.build:544: fs] Error 2
make[2]: *** Waiting for unfinished jobs....
I bisected 7.3.2-rc1 and this patch is the culprit. Reverting it fixes
the build on both 6.18.61-rc1 and 7.3.2-rc1. Another possible fix, which
built successfully for me on top of both 6.18.61-rc1 and 7.3.2-rc1, is to
cherry-pick commit 612d2e7506c3553b1deedc694846d1c0364ae446 from mainline
("xfs: read primary superblock from disk during scrub").
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-11-05 15:30 ` Pavel Machek
@ 2026-11-05 16:16 ` Brett A C Sheffield
2026-11-05 21:56 ` Florian Fainelli
2026-11-05 23:15 ` Shuah Khan
555 siblings, 0 replies; 560+ messages in thread
From: Brett A C Sheffield @ 2026-11-05 16:16 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
044/044 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 7.3.2-rc1-g75eaee7a6465 #1 SMP PREEMPT_DYNAMIC Thu Nov 5 16:12:05 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-05 0:27 ` [PATCH 7.3 000/547] 7.3.2-rc1 review Ronald Warsow
@ 2026-11-05 18:39 ` Sasha Levin
2026-11-05 19:58 ` Ronald Warsow
0 siblings, 1 reply; 560+ messages in thread
From: Sasha Levin @ 2026-11-05 18:39 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: Sasha Levin, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr,
Ronald Warsow
> I need to revert:
>
> "x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()"
>
> otherwise I get:
>
> [ 0.108037] ------------[ cut here ]------------
> [ 0.108037] CPA detected W^X
Could you send your .config and the full dmesg around the W^X warning, and let
us know whether current mainline shows the same warning? The patch stays queued
for now.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-05 18:39 ` Sasha Levin
@ 2026-11-05 19:58 ` Ronald Warsow
0 siblings, 0 replies; 560+ messages in thread
From: Ronald Warsow @ 2026-11-05 19:58 UTC (permalink / raw)
To: Sasha Levin, Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 267909 bytes --]
On 05.11.26 19:39, Sasha Levin wrote:
>> I need to revert:
>>
>> "x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()"
>>
>> otherwise I get:
>>
>> [ 0.108037] ------------[ cut here ]------------
>> [ 0.108037] CPA detected W^X
>
> Could you send your .config and the full dmesg around the W^X warning, and let
> us know whether current mainline shows the same warning? The patch stays queued
> for now.
>
mainline (7.4.0-rc1) is fine.
.config and dmesg (inline and attached).
my .config (mostly what Fedora provides, cleaned for my devices):
#
# Automatically generated file; DO NOT EDIT.
# Linux/x86 7.3.2-rc1 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20261029 (Red Hat 16.2.1-3)"
CONFIG_CC_IS_GCC=y
CONFIG_GCC_VERSION=160201
CONFIG_CLANG_VERSION=0
CONFIG_AS_IS_GNU=y
CONFIG_AS_VERSION=20285426
CONFIG_LD_IS_BFD=y
CONFIG_LD_VERSION=20285426
CONFIG_LLD_VERSION=0
CONFIG_RUSTC_VERSION=0
CONFIG_RUSTC_LLVM_VERSION=0
CONFIG_RUSTC_LLVM_MAJOR_VERSION=0
CONFIG_CC_CAN_LINK=y
CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
CONFIG_TOOLS_SUPPORT_RELR=y
CONFIG_CC_HAS_ASM_INLINE=y
CONFIG_CC_HAS_ASSUME=y
CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
CONFIG_CC_HAS_COUNTED_BY=y
CONFIG_CC_HAS_COUNTED_BY_PTR=y
CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
CONFIG_CC_OPT_INLINE_MEMSET="-finline-stringops=memset"
CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
CONFIG_PAHOLE_VERSION=132
CONFIG_IRQ_WORK=y
CONFIG_BUILDTIME_TABLE_SORT=y
CONFIG_THREAD_INFO_IN_TASK=y
#
# General setup
#
CONFIG_INIT_ENV_ARG_LIMIT=32
# CONFIG_COMPILE_TEST is not set
CONFIG_WERROR=y
# CONFIG_UAPI_HEADER_TEST is not set
CONFIG_LOCALVERSION="_MY"
CONFIG_LOCALVERSION_AUTO=y
CONFIG_BUILD_SALT=""
CONFIG_HAVE_KERNEL_GZIP=y
CONFIG_HAVE_KERNEL_BZIP2=y
CONFIG_HAVE_KERNEL_LZMA=y
CONFIG_HAVE_KERNEL_XZ=y
CONFIG_HAVE_KERNEL_LZO=y
CONFIG_HAVE_KERNEL_LZ4=y
CONFIG_HAVE_KERNEL_ZSTD=y
# CONFIG_KERNEL_GZIP is not set
# CONFIG_KERNEL_BZIP2 is not set
# CONFIG_KERNEL_LZMA is not set
# CONFIG_KERNEL_XZ is not set
# CONFIG_KERNEL_LZO is not set
# CONFIG_KERNEL_LZ4 is not set
CONFIG_KERNEL_ZSTD=y
CONFIG_DEFAULT_INIT=""
CONFIG_DEFAULT_HOSTNAME="(none)"
CONFIG_SYSVIPC=y
CONFIG_SYSVIPC_SYSCTL=y
CONFIG_SYSVIPC_COMPAT=y
CONFIG_POSIX_MQUEUE=y
CONFIG_POSIX_MQUEUE_SYSCTL=y
CONFIG_WATCH_QUEUE=y
CONFIG_CROSS_MEMORY_ATTACH=y
CONFIG_AUDIT=y
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
CONFIG_AUDITSYSCALL=y
#
# IRQ subsystem
#
CONFIG_GENERIC_IRQ_PROBE=y
CONFIG_GENERIC_IRQ_SHOW=y
CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
CONFIG_GENERIC_PENDING_IRQ=y
CONFIG_GENERIC_IRQ_MIGRATION=y
CONFIG_GENERIC_IRQ_INJECTION=y
CONFIG_HARDIRQS_SW_RESEND=y
CONFIG_IRQ_DOMAIN=y
CONFIG_IRQ_DOMAIN_HIERARCHY=y
CONFIG_GENERIC_MSI_IRQ=y
CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y
CONFIG_GENERIC_IRQ_RESERVATION_MODE=y
CONFIG_GENERIC_IRQ_STAT_SNAPSHOT=y
CONFIG_IRQ_FORCED_THREADING=y
CONFIG_SPARSE_IRQ=y
# CONFIG_GENERIC_IRQ_DEBUGFS is not set
# end of IRQ subsystem
CONFIG_CLOCKSOURCE_WATCHDOG=y
CONFIG_ARCH_CLOCKSOURCE_INIT=y
CONFIG_ARCH_WANTS_CLOCKSOURCE_READ_INLINE=y
CONFIG_GENERIC_CLOCKEVENTS=y
CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y
CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
CONFIG_GENERIC_CLOCKEVENTS_COUPLED=y
CONFIG_GENERIC_CLOCKEVENTS_COUPLED_INLINE=y
CONFIG_GENERIC_CMOS_UPDATE=y
CONFIG_HRTIMER_REARM_DEFERRED=y
CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y
CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
CONFIG_CONTEXT_TRACKING=y
CONFIG_CONTEXT_TRACKING_IDLE=y
#
# Timers subsystem
#
CONFIG_TICK_ONESHOT=y
CONFIG_NO_HZ_COMMON=y
# CONFIG_HZ_PERIODIC is not set
# CONFIG_NO_HZ_IDLE is not set
CONFIG_NO_HZ_FULL=y
CONFIG_CONTEXT_TRACKING_USER=y
# CONFIG_CONTEXT_TRACKING_USER_FORCE is not set
# CONFIG_NO_HZ is not set
CONFIG_HIGH_RES_TIMERS=y
# CONFIG_POSIX_AUX_CLOCKS is not set
# end of Timers subsystem
CONFIG_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y
#
# BPF subsystem
#
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_JIT_DEFAULT_ON=y
CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
CONFIG_BPF_PRELOAD=y
CONFIG_BPF_PRELOAD_UMD=m
CONFIG_BPF_LSM=y
# end of BPF subsystem
CONFIG_PREEMPT_BUILD=y
CONFIG_ARCH_HAS_PREEMPT_LAZY=y
# CONFIG_PREEMPT is not set
CONFIG_PREEMPT_LAZY=y
# CONFIG_PREEMPT_RT is not set
CONFIG_PREEMPT_COUNT=y
CONFIG_HAS_SEPARATE_PREEMPT_RESCHED_BITS=y
CONFIG_PREEMPTION=y
CONFIG_PREEMPT_DYNAMIC=y
CONFIG_SCHED_CORE=y
CONFIG_SCHED_CLASS_EXT=y
#
# CPU/Task time and stats accounting
#
CONFIG_VIRT_CPU_ACCOUNTING=y
CONFIG_VIRT_CPU_ACCOUNTING_GEN=y
CONFIG_IRQ_TIME_ACCOUNTING=y
CONFIG_HAVE_SCHED_AVG_IRQ=y
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_XACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
CONFIG_PSI=y
# CONFIG_PSI_DEFAULT_DISABLED is not set
# end of CPU/Task time and stats accounting
CONFIG_CPU_ISOLATION=y
#
# RCU Subsystem
#
CONFIG_TREE_RCU=y
CONFIG_PREEMPT_RCU=y
# CONFIG_RCU_EXPERT is not set
CONFIG_TREE_SRCU=y
CONFIG_TASKS_RCU_GENERIC=y
CONFIG_NEED_TASKS_RCU=y
CONFIG_TASKS_RCU=y
CONFIG_TASKS_RUDE_RCU=y
CONFIG_TASKS_TRACE_RCU=y
CONFIG_RCU_STALL_COMMON=y
CONFIG_RCU_NEED_SEGCBLIST=y
CONFIG_RCU_NOCB_CPU=y
# CONFIG_RCU_NOCB_CPU_DEFAULT_ALL is not set
# CONFIG_RCU_LAZY is not set
# end of RCU Subsystem
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
# CONFIG_IKHEADERS is not set
CONFIG_LOG_BUF_SHIFT=18
CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
CONFIG_PRINTK_INDEX=y
CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
#
# Scheduler features
#
CONFIG_UCLAMP_TASK=y
CONFIG_UCLAMP_BUCKETS_COUNT=5
# end of Scheduler features
CONFIG_ARCH_HAS_PTE_PROTNONE=y
CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y
CONFIG_CC_HAS_INT128=y
CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
CONFIG_CC_MS_EXTENSIONS="-fms-extensions"
CONFIG_GCC10_NO_ARRAY_BOUNDS=y
CONFIG_CC_NO_ARRAY_BOUNDS=y
CONFIG_GCC_NO_STRINGOP_OVERFLOW=y
CONFIG_CC_NO_STRINGOP_OVERFLOW=y
CONFIG_ARCH_SUPPORTS_INT128=y
CONFIG_NUMA_BALANCING=y
CONFIG_SCHED_CACHE=y
CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y
CONFIG_SLAB_OBJ_EXT=y
CONFIG_CGROUPS=y
CONFIG_PAGE_COUNTER=y
# CONFIG_CGROUP_FAVOR_DYNMODS is not set
CONFIG_MEMCG=y
CONFIG_MEMCG_V1=y
CONFIG_BLK_CGROUP=y
CONFIG_CGROUP_WRITEBACK=y
CONFIG_CGROUP_SCHED=y
CONFIG_GROUP_SCHED_WEIGHT=y
CONFIG_GROUP_SCHED_BANDWIDTH=y
CONFIG_FAIR_GROUP_SCHED=y
CONFIG_CFS_BANDWIDTH=y
# CONFIG_RT_GROUP_SCHED is not set
CONFIG_EXT_GROUP_SCHED=y
CONFIG_EXT_SUB_SCHED=y
CONFIG_SCHED_MM_CID=y
CONFIG_UCLAMP_TASK_GROUP=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_RDMA=y
CONFIG_CGROUP_DMEM=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_HUGETLB=y
CONFIG_CPUSETS=y
# CONFIG_CPUSETS_V1 is not set
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PERF=y
CONFIG_CGROUP_BPF=y
CONFIG_CGROUP_MISC=y
# CONFIG_CGROUP_DEBUG is not set
CONFIG_SOCK_CGROUP_DATA=y
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_TIME_NS=y
CONFIG_TIME_NS_VDSO=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y
CONFIG_CHECKPOINT_RESTORE=y
CONFIG_SCHED_AUTOGROUP=y
CONFIG_RELAY=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE=""
CONFIG_RD_GZIP=y
CONFIG_RD_BZIP2=y
CONFIG_RD_LZMA=y
CONFIG_RD_XZ=y
CONFIG_RD_LZO=y
CONFIG_RD_LZ4=y
CONFIG_RD_ZSTD=y
CONFIG_BOOT_CONFIG=y
# CONFIG_BOOT_CONFIG_FORCE is not set
# CONFIG_BOOT_CONFIG_EMBED is not set
CONFIG_ARCH_SUPPORTS_CMDLINE_FROM_BOOTCONFIG=y
CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=1021
# CONFIG_INITRAMFS_PRESERVE_MTIME is not set
CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_LD_ORPHAN_WARN=y
CONFIG_LD_ORPHAN_WARN_LEVEL="error"
CONFIG_HAVE_UID16=y
CONFIG_SYSCTL_EXCEPTION_TRACE=y
# CONFIG_SYSFS_SYSCALL is not set
CONFIG_HAVE_PCSPKR_PLATFORM=y
CONFIG_EXPERT=y
CONFIG_UID16=y
CONFIG_MULTIUSER=y
CONFIG_SGETMASK_SYSCALL=y
CONFIG_FHANDLE=y
CONFIG_POSIX_TIMERS=y
CONFIG_PRINTK=y
CONFIG_BUG=y
CONFIG_ELF_CORE=y
CONFIG_PCSPKR_PLATFORM=y
# CONFIG_BASE_SMALL is not set
CONFIG_FUTEX=y
CONFIG_FUTEX_PI=y
CONFIG_FUTEX_PRIVATE_HASH=y
CONFIG_FUTEX_MPOL=y
CONFIG_HAVE_FUTEX_ROBUST_UNLOCK=y
CONFIG_FUTEX_ROBUST_UNLOCK=y
CONFIG_EPOLL=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EVENTFD=y
CONFIG_SHMEM=y
CONFIG_AIO=y
CONFIG_IO_URING=y
# CONFIG_IO_URING_MOCK_FILE is not set
CONFIG_ADVISE_SYSCALLS=y
CONFIG_MEMBARRIER=y
CONFIG_KCMP=y
CONFIG_RSEQ=y
# CONFIG_RSEQ_SLICE_EXTENSION is not set
# CONFIG_RSEQ_STATS is not set
# CONFIG_RSEQ_DEBUG_DEFAULT_ENABLE is not set
CONFIG_CACHESTAT_SYSCALL=y
CONFIG_KALLSYMS=y
# CONFIG_KALLSYMS_SELFTEST is not set
# CONFIG_KALLSYMS_ALL is not set
CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS=y
CONFIG_HAVE_PERF_EVENTS=y
CONFIG_GUEST_PERF_EVENTS=y
CONFIG_PERF_GUEST_MEDIATED_PMU=y
#
# Kernel Performance Events And Counters
#
CONFIG_PERF_EVENTS=y
# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
# end of Kernel Performance Events And Counters
CONFIG_SYSTEM_DATA_VERIFICATION=y
# CONFIG_PROFILING is not set
CONFIG_TRACEPOINTS=y
#
# Kexec and crash features
#
CONFIG_CRASH_RESERVE=y
CONFIG_VMCORE_INFO=y
CONFIG_KEXEC_CORE=y
CONFIG_HAVE_IMA_KEXEC=y
CONFIG_KEXEC=y
CONFIG_KEXEC_FILE=y
CONFIG_KEXEC_SIG=y
# CONFIG_KEXEC_SIG_FORCE is not set
CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y
CONFIG_KEXEC_JUMP=y
CONFIG_CRASH_DUMP=y
CONFIG_CRASH_HOTPLUG=y
CONFIG_CRASH_MAX_MEMORY_RANGES=8192
# end of Kexec and crash features
#
# Live Update and Kexec HandOver
#
CONFIG_KEXEC_HANDOVER=y
# CONFIG_KEXEC_HANDOVER_DEBUG is not set
CONFIG_KEXEC_HANDOVER_DEBUGFS=y
# CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT is not set
# CONFIG_LIVEUPDATE is not set
# end of Live Update and Kexec HandOver
# end of General setup
CONFIG_64BIT=y
CONFIG_X86_64=y
CONFIG_X86=y
CONFIG_INSTRUCTION_DECODER=y
CONFIG_OUTPUT_FORMAT="elf64-x86-64"
CONFIG_LOCKDEP_SUPPORT=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_MMU=y
CONFIG_ARCH_MMAP_RND_BITS_MIN=28
CONFIG_ARCH_MMAP_RND_BITS_MAX=32
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
CONFIG_GENERIC_ISA_DMA=y
CONFIG_GENERIC_BUG=y
CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
CONFIG_ARCH_MAY_HAVE_PC_FDC=y
CONFIG_GENERIC_CALIBRATE_DELAY=y
CONFIG_ARCH_HAS_CPU_RELAX=y
CONFIG_ARCH_HIBERNATION_POSSIBLE=y
CONFIG_ARCH_SUSPEND_POSSIBLE=y
CONFIG_AUDIT_ARCH=y
CONFIG_HAVE_INTEL_TXT=y
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_FIX_EARLYCON_MEM=y
CONFIG_PGTABLE_LEVELS=5
#
# Processor type and features
#
CONFIG_SMP=y
CONFIG_X86_X2APIC=y
CONFIG_X86_POSTED_MSI=y
CONFIG_X86_MPPARSE=y
CONFIG_X86_CPU_RESCTRL=y
CONFIG_X86_FRED=y
# CONFIG_X86_EXTENDED_PLATFORM is not set
CONFIG_X86_INTEL_LPSS=y
# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
CONFIG_IOSF_MBI=y
# CONFIG_IOSF_MBI_DEBUG is not set
CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y
CONFIG_SCHED_OMIT_FRAME_POINTER=y
# CONFIG_HYPERVISOR_GUEST is not set
CONFIG_CC_HAS_MARCH_NATIVE=y
CONFIG_X86_NATIVE_CPU=y
CONFIG_X86_INTERNODE_CACHE_SHIFT=6
CONFIG_X86_L1_CACHE_SHIFT=6
CONFIG_X86_TSC=y
CONFIG_X86_HAVE_PAE=y
CONFIG_X86_CX8=y
CONFIG_X86_CMOV=y
CONFIG_X86_MINIMUM_CPU_FAMILY=64
CONFIG_X86_DEBUGCTLMSR=y
CONFIG_IA32_FEAT_CTL=y
CONFIG_X86_VMX_FEATURE_NAMES=y
CONFIG_PROCESSOR_SELECT=y
CONFIG_CPU_SUP_INTEL=y
# CONFIG_CPU_SUP_AMD is not set
# CONFIG_CPU_SUP_HYGON is not set
# CONFIG_CPU_SUP_CENTAUR is not set
# CONFIG_CPU_SUP_ZHAOXIN is not set
CONFIG_HPET_TIMER=y
CONFIG_HPET_EMULATE_RTC=y
CONFIG_DMI=y
CONFIG_BOOT_VESA_SUPPORT=y
CONFIG_MAXSMP=y
CONFIG_NR_CPUS_RANGE_BEGIN=8192
CONFIG_NR_CPUS_RANGE_END=8192
CONFIG_NR_CPUS_DEFAULT=8192
CONFIG_NR_CPUS=8192
CONFIG_SCHED_MC_PRIO=y
CONFIG_X86_LOCAL_APIC=y
CONFIG_ACPI_MADT_WAKEUP=y
CONFIG_X86_IO_APIC=y
CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
CONFIG_X86_MCE=y
CONFIG_X86_MCELOG_LEGACY=y
CONFIG_X86_MCE_INTEL=y
# CONFIG_X86_MCE_AMD is not set
CONFIG_X86_MCE_THRESHOLD=y
# CONFIG_X86_MCE_INJECT is not set
#
# Performance monitoring
#
CONFIG_PERF_EVENTS_INTEL_UNCORE=y
CONFIG_PERF_EVENTS_INTEL_RAPL=y
CONFIG_PERF_EVENTS_INTEL_CSTATE=y
# end of Performance monitoring
CONFIG_X86_16BIT=y
CONFIG_X86_ESPFIX64=y
CONFIG_X86_VSYSCALL_EMULATION=y
CONFIG_X86_IOPL_IOPERM=y
CONFIG_MICROCODE=y
# CONFIG_MICROCODE_LATE_LOADING is not set
# CONFIG_MICROCODE_DBG is not set
CONFIG_X86_MSR=y
CONFIG_X86_CPUID=y
CONFIG_X86_DIRECT_GBPAGES=y
CONFIG_X86_CPA_STATISTICS=y
CONFIG_NUMA=y
# CONFIG_AMD_NUMA is not set
CONFIG_X86_64_ACPI_NUMA=y
CONFIG_NODES_SHIFT=10
CONFIG_ARCH_SPARSEMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_DEFAULT=y
CONFIG_ARCH_PROC_KCORE_TEXT=y
CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
CONFIG_X86_PMEM_LEGACY_DEVICE=y
CONFIG_X86_PMEM_LEGACY=y
CONFIG_X86_CHECK_BIOS_CORRUPTION=y
# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set
CONFIG_MTRR=y
CONFIG_MTRR_SANITIZER=y
CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1
CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
CONFIG_X86_PAT=y
CONFIG_X86_UMIP=y
CONFIG_CC_HAS_IBT=y
CONFIG_X86_CET=y
CONFIG_X86_KERNEL_IBT=y
CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
CONFIG_ARCH_PKEY_BITS=4
# CONFIG_X86_INTEL_TSX_MODE_OFF is not set
# CONFIG_X86_INTEL_TSX_MODE_ON is not set
CONFIG_X86_INTEL_TSX_MODE_AUTO=y
CONFIG_X86_SGX=y
CONFIG_X86_USER_SHADOW_STACK=y
# CONFIG_INTEL_TDX_HOST is not set
CONFIG_EFI=y
CONFIG_EFI_STUB=y
CONFIG_EFI_HANDOVER_PROTOCOL=y
CONFIG_EFI_MIXED=y
CONFIG_EFI_RUNTIME_MAP=y
# CONFIG_HZ_100 is not set
# CONFIG_HZ_250 is not set
# CONFIG_HZ_300 is not set
CONFIG_HZ_1000=y
CONFIG_HZ=1000
CONFIG_SCHED_HRTICK=y
CONFIG_ARCH_SUPPORTS_KEXEC=y
CONFIG_ARCH_SUPPORTS_KEXEC_FILE=y
CONFIG_ARCH_SELECTS_KEXEC_FILE=y
CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY=y
CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y
CONFIG_ARCH_SUPPORTS_KEXEC_SIG_FORCE=y
CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y
CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y
CONFIG_ARCH_SUPPORTS_KEXEC_HANDOVER=y
CONFIG_ARCH_SUPPORTS_CRASH_DUMP=y
CONFIG_ARCH_DEFAULT_CRASH_DUMP=y
CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG=y
CONFIG_ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION=y
CONFIG_PHYSICAL_START=0x1000000
CONFIG_RELOCATABLE=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_X86_NEED_RELOCS=y
CONFIG_PHYSICAL_ALIGN=0x200000
CONFIG_RANDOMIZE_MEMORY=y
CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa
CONFIG_HOTPLUG_CPU=y
# CONFIG_COMPAT_VDSO is not set
CONFIG_LEGACY_VSYSCALL_XONLY=y
# CONFIG_LEGACY_VSYSCALL_NONE is not set
# CONFIG_CMDLINE_BOOL is not set
CONFIG_MODIFY_LDT_SYSCALL=y
# CONFIG_STRICT_SIGALTSTACK_SIZE is not set
CONFIG_HAVE_LIVEPATCH=y
CONFIG_HAVE_KLP_BUILD=y
CONFIG_X86_BUS_LOCK_DETECT=y
# end of Processor type and features
CONFIG_CC_HAS_NAMED_AS=y
CONFIG_CC_HAS_NAMED_AS_FIXED_SANITIZERS=y
CONFIG_USE_X86_SEG_SUPPORT=y
CONFIG_CC_HAS_SLS=y
CONFIG_CC_HAS_RETURN_THUNK=y
CONFIG_CC_HAS_ENTRY_PADDING=y
CONFIG_FUNCTION_PADDING_CFI=11
CONFIG_FUNCTION_PADDING_BYTES=16
CONFIG_CALL_PADDING=y
CONFIG_HAVE_CALL_THUNKS=y
CONFIG_CALL_THUNKS=y
CONFIG_CPU_MITIGATIONS=y
CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y
CONFIG_MITIGATION_RETPOLINE=y
CONFIG_MITIGATION_RETHUNK=y
CONFIG_MITIGATION_CALL_DEPTH_TRACKING=y
# CONFIG_CALL_THUNKS_DEBUG is not set
CONFIG_MITIGATION_IBRS_ENTRY=y
CONFIG_MITIGATION_SLS=y
CONFIG_MITIGATION_GDS=y
CONFIG_MITIGATION_RFDS=y
CONFIG_MITIGATION_SPECTRE_BHI=y
CONFIG_MITIGATION_MDS=y
CONFIG_MITIGATION_TAA=y
CONFIG_MITIGATION_MMIO_STALE_DATA=y
CONFIG_MITIGATION_L1TF=y
CONFIG_MITIGATION_RETBLEED=y
CONFIG_MITIGATION_SPECTRE_V1=y
CONFIG_MITIGATION_SPECTRE_V2=y
CONFIG_MITIGATION_SRBDS=y
CONFIG_MITIGATION_SSB=y
CONFIG_MITIGATION_ITS=y
CONFIG_MITIGATION_VMSCAPE=y
CONFIG_ARCH_HAS_ADD_PAGES=y
#
# Power management and ACPI options
#
CONFIG_ARCH_HIBERNATION_HEADER=y
CONFIG_SUSPEND=y
CONFIG_SUSPEND_FREEZER=y
# CONFIG_SUSPEND_SKIP_SYNC is not set
CONFIG_HIBERNATE_CALLBACKS=y
CONFIG_HIBERNATION=y
CONFIG_HIBERNATION_SNAPSHOT_DEV=y
CONFIG_HIBERNATION_COMP_LZO=y
# CONFIG_HIBERNATION_COMP_LZ4 is not set
CONFIG_HIBERNATION_DEF_COMP="lzo"
CONFIG_PM_STD_PARTITION=""
CONFIG_PM_SLEEP=y
CONFIG_PM_SLEEP_SMP=y
# CONFIG_PM_AUTOSLEEP is not set
# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
# CONFIG_PM_WAKELOCKS is not set
# CONFIG_PM_QOS_CPU_SYSTEM_WAKEUP is not set
CONFIG_PM=y
CONFIG_PM_DEBUG=y
# CONFIG_PM_ADVANCED_DEBUG is not set
# CONFIG_PM_TEST_SUSPEND is not set
CONFIG_PM_SLEEP_DEBUG=y
# CONFIG_DPM_WATCHDOG is not set
# CONFIG_PM_TRACE_RTC is not set
CONFIG_PM_CLK=y
# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
CONFIG_ENERGY_MODEL=y
CONFIG_ARCH_SUPPORTS_ACPI=y
CONFIG_ACPI=y
CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
CONFIG_ACPI_THERMAL_LIB=y
# CONFIG_ACPI_DEBUGGER is not set
CONFIG_ACPI_SPCR_TABLE=y
CONFIG_ACPI_FPDT=y
CONFIG_ACPI_LPIT=y
CONFIG_ACPI_SLEEP=y
CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
CONFIG_ACPI_EC=y
# CONFIG_ACPI_EC_DEBUGFS is not set
CONFIG_ACPI_AC=y
CONFIG_ACPI_BATTERY=y
CONFIG_ACPI_BUTTON=y
CONFIG_ACPI_VIDEO=m
CONFIG_ACPI_FAN=y
CONFIG_ACPI_TAD=y
# CONFIG_ACPI_DOCK is not set
CONFIG_ACPI_CPU_FREQ_PSS=y
CONFIG_ACPI_PROCESSOR_CSTATE=y
CONFIG_ACPI_PROCESSOR_IDLE=y
CONFIG_ACPI_CPPC_LIB=y
CONFIG_ACPI_PROCESSOR=y
CONFIG_ACPI_HOTPLUG_CPU=y
CONFIG_ACPI_PROCESSOR_AGGREGATOR=y
CONFIG_ACPI_THERMAL=y
CONFIG_ACPI_PLATFORM_PROFILE=m
CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_DEBUG=y
CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_CONTAINER=y
CONFIG_ACPI_HOTPLUG_IOAPIC=y
CONFIG_ACPI_SBS=m
CONFIG_ACPI_HED=y
CONFIG_ACPI_BGRT=y
# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
CONFIG_ACPI_NFIT=y
# CONFIG_NFIT_SECURITY_DEBUG is not set
CONFIG_ACPI_NUMA=y
CONFIG_ACPI_HMAT=y
CONFIG_HAVE_ACPI_APEI=y
CONFIG_HAVE_ACPI_APEI_NMI=y
CONFIG_ACPI_APEI=y
CONFIG_ACPI_APEI_GHES=y
# CONFIG_ACPI_APEI_PCIEAER is not set
CONFIG_ACPI_APEI_MEMORY_FAILURE=y
# CONFIG_ACPI_APEI_EINJ is not set
# CONFIG_ACPI_APEI_GHES_NVIDIA is not set
# CONFIG_ACPI_APEI_ERST_DEBUG is not set
CONFIG_ACPI_DPTF=y
CONFIG_DPTF_POWER=m
CONFIG_DPTF_PCH_FIVR=m
CONFIG_ACPI_EXTLOG=m
# CONFIG_ACPI_CONFIGFS is not set
# CONFIG_ACPI_PFRUT is not set
CONFIG_ACPI_PCC=y
CONFIG_ACPI_FFH=y
CONFIG_ACPI_MRRM=y
CONFIG_PMIC_OPREGION=y
CONFIG_ACPI_VIOT=y
CONFIG_ACPI_PRMT=y
CONFIG_X86_PM_TIMER=y
#
# CPU Frequency scaling
#
CONFIG_CPU_FREQ=y
CONFIG_CPU_FREQ_GOV_ATTR_SET=y
CONFIG_CPU_FREQ_GOV_COMMON=y
CONFIG_CPU_FREQ_STAT=y
# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
CONFIG_CPU_FREQ_GOV_POWERSAVE=y
CONFIG_CPU_FREQ_GOV_USERSPACE=y
CONFIG_CPU_FREQ_GOV_ONDEMAND=y
CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
#
# CPU frequency scaling drivers
#
CONFIG_X86_INTEL_PSTATE=y
# CONFIG_X86_PCC_CPUFREQ is not set
# CONFIG_X86_AMD_PSTATE is not set
# CONFIG_X86_ACPI_CPUFREQ is not set
# CONFIG_X86_SPEEDSTEP_CENTRINO is not set
# CONFIG_X86_P4_CLOCKMOD is not set
#
# shared options
#
CONFIG_CPUFREQ_ARCH_CUR_FREQ=y
# end of CPU Frequency scaling
#
# CPU Idle
#
CONFIG_CPU_IDLE=y
CONFIG_CPU_IDLE_GOV_LADDER=y
CONFIG_CPU_IDLE_GOV_MENU=y
# CONFIG_CPU_IDLE_GOV_TEO is not set
# end of CPU Idle
CONFIG_INTEL_IDLE=y
# end of Power management and ACPI options
#
# Bus options (PCI etc.)
#
CONFIG_PCI_DIRECT=y
CONFIG_PCI_MMCONFIG=y
CONFIG_MMCONF_FAM10H=y
# CONFIG_ISA_BUS is not set
CONFIG_ISA_DMA_API=y
# end of Bus options (PCI etc.)
#
# Binary Emulations
#
CONFIG_IA32_EMULATION=y
# CONFIG_IA32_EMULATION_DEFAULT_DISABLED is not set
# CONFIG_X86_X32_ABI is not set
CONFIG_COMPAT_32=y
CONFIG_COMPAT=y
CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
# end of Binary Emulations
CONFIG_KVM_COMMON=y
CONFIG_HAVE_KVM_PFNCACHE=y
CONFIG_HAVE_KVM_IRQCHIP=y
CONFIG_HAVE_KVM_IRQ_ROUTING=y
CONFIG_HAVE_KVM_DIRTY_RING=y
CONFIG_HAVE_KVM_DIRTY_RING_TSO=y
CONFIG_HAVE_KVM_DIRTY_RING_ACQ_REL=y
CONFIG_KVM_MMIO=y
CONFIG_KVM_ASYNC_PF=y
CONFIG_HAVE_KVM_MSI=y
CONFIG_HAVE_KVM_READONLY_MEM=y
CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y
CONFIG_KVM_VFIO=y
CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y
CONFIG_KVM_GENERIC_PRE_FAULT_MEMORY=y
CONFIG_KVM_COMPAT=y
CONFIG_HAVE_KVM_IRQ_BYPASS=m
CONFIG_HAVE_KVM_NO_POLL=y
CONFIG_VIRT_XFER_TO_GUEST_WORK=y
CONFIG_HAVE_KVM_PM_NOTIFIER=y
CONFIG_KVM_GENERIC_HARDWARE_ENABLING=y
CONFIG_KVM_ELIDE_TLB_FLUSH_IF_YOUNG=y
CONFIG_KVM_MMU_LOCKLESS_AGING=y
CONFIG_KVM_GUEST_MEMFD=y
CONFIG_VIRTUALIZATION=y
CONFIG_KVM_X86=m
CONFIG_KVM=m
CONFIG_KVM_WERROR=y
# CONFIG_KVM_SW_PROTECTED_VM is not set
CONFIG_KVM_INTEL=m
# CONFIG_KVM_INTEL_PROVE_VE is not set
CONFIG_X86_SGX_KVM=y
CONFIG_KVM_IOAPIC=y
CONFIG_KVM_SMM=y
CONFIG_KVM_HYPERV=y
# CONFIG_KVM_XEN is not set
# CONFIG_KVM_PROVE_MMU is not set
CONFIG_KVM_MAX_NR_VCPUS=4096
CONFIG_X86_REQUIRED_FEATURE_ALWAYS=y
CONFIG_X86_REQUIRED_FEATURE_NOPL=y
CONFIG_X86_REQUIRED_FEATURE_CX8=y
CONFIG_X86_REQUIRED_FEATURE_CMOV=y
CONFIG_X86_REQUIRED_FEATURE_CPUID=y
CONFIG_X86_REQUIRED_FEATURE_FPU=y
CONFIG_X86_REQUIRED_FEATURE_PAE=y
CONFIG_X86_REQUIRED_FEATURE_PSE=y
CONFIG_X86_REQUIRED_FEATURE_PGE=y
CONFIG_X86_REQUIRED_FEATURE_MSR=y
CONFIG_X86_REQUIRED_FEATURE_FXSR=y
CONFIG_X86_REQUIRED_FEATURE_XMM=y
CONFIG_X86_REQUIRED_FEATURE_XMM2=y
CONFIG_X86_REQUIRED_FEATURE_LM=y
CONFIG_X86_DISABLED_FEATURE_VME=y
CONFIG_X86_DISABLED_FEATURE_K6_MTRR=y
CONFIG_X86_DISABLED_FEATURE_CYRIX_ARR=y
CONFIG_X86_DISABLED_FEATURE_CENTAUR_MCR=y
CONFIG_X86_DISABLED_FEATURE_UNRET=y
CONFIG_X86_DISABLED_FEATURE_LAM=y
CONFIG_X86_DISABLED_FEATURE_XENPV=y
CONFIG_X86_DISABLED_FEATURE_TDX_GUEST=y
CONFIG_X86_DISABLED_FEATURE_SEV_SNP=y
CONFIG_X86_DISABLED_FEATURE_INVLPGB=y
CONFIG_AS_WRUSS=y
CONFIG_ARCH_CONFIGURES_CPU_MITIGATIONS=y
#
# General architecture-dependent options
#
CONFIG_HOTPLUG_SMT=y
CONFIG_ARCH_SUPPORTS_SCHED_SMT=y
CONFIG_ARCH_SUPPORTS_SCHED_CLUSTER=y
CONFIG_ARCH_SUPPORTS_SCHED_MC=y
CONFIG_SCHED_SMT=y
CONFIG_SCHED_CLUSTER=y
CONFIG_SCHED_MC=y
CONFIG_HOTPLUG_CORE_SYNC=y
CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
CONFIG_HOTPLUG_CORE_SYNC_FULL=y
CONFIG_HOTPLUG_SPLIT_STARTUP=y
CONFIG_HOTPLUG_PARALLEL=y
CONFIG_GENERIC_IRQ_ENTRY=y
CONFIG_GENERIC_SYSCALL=y
CONFIG_GENERIC_ENTRY=y
CONFIG_ARCH_SUPPORTS_SYSCALL_USER_DISPATCH=y
CONFIG_SYSCALL_USER_DISPATCH=y
CONFIG_KPROBES=y
CONFIG_JUMP_LABEL=y
# CONFIG_STATIC_KEYS_SELFTEST is not set
# CONFIG_STATIC_CALL_SELFTEST is not set
CONFIG_OPTPROBES=y
CONFIG_KPROBES_ON_FTRACE=y
CONFIG_UPROBES=y
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
CONFIG_ARCH_USE_BUILTIN_BSWAP=y
CONFIG_KRETPROBES=y
CONFIG_KRETPROBE_ON_RETHOOK=y
CONFIG_USER_RETURN_NOTIFIER=y
CONFIG_HAVE_IOREMAP_PROT=y
CONFIG_HAVE_KPROBES=y
CONFIG_HAVE_KRETPROBES=y
CONFIG_HAVE_OPTPROBES=y
CONFIG_HAVE_KPROBES_ON_FTRACE=y
CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y
CONFIG_HAVE_NMI=y
CONFIG_TRACE_IRQFLAGS_SUPPORT=y
CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
CONFIG_HAVE_ARCH_TRACEHOOK=y
CONFIG_HAVE_DMA_CONTIGUOUS=y
CONFIG_GENERIC_SMP_IDLE_THREAD=y
CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
CONFIG_ARCH_HAS_SET_MEMORY=y
CONFIG_ARCH_HAS_SET_DIRECT_MAP=y
CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y
CONFIG_ARCH_HAS_DELAY_TIMER=y
CONFIG_ARCH_HAS_CPU_PASID=y
CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
CONFIG_ARCH_WANTS_NO_INSTR=y
CONFIG_ARCH_MEMORY_ORDER_TSO=y
CONFIG_HAVE_ASM_MODVERSIONS=y
CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
CONFIG_HAVE_RSEQ=y
CONFIG_HAVE_RUST=y
CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y
CONFIG_HAVE_HW_BREAKPOINT=y
CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y
CONFIG_HAVE_USER_RETURN_NOTIFIER=y
CONFIG_HAVE_PERF_EVENTS_NMI=y
CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y
CONFIG_UNWIND_USER=y
CONFIG_HAVE_UNWIND_USER_FP=y
CONFIG_HAVE_PERF_REGS=y
CONFIG_HAVE_PERF_USER_STACK_DUMP=y
CONFIG_HAVE_ARCH_JUMP_LABEL=y
CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y
CONFIG_MMU_GATHER_TABLE_FREE=y
CONFIG_MMU_GATHER_RCU_TABLE_FREE=y
CONFIG_MMU_GATHER_MERGE_VMAS=y
CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM=y
CONFIG_MMU_LAZY_TLB_REFCOUNT=y
CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
CONFIG_ARCH_HAVE_EXTRA_ELF_NOTES=y
CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS=y
CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
CONFIG_HAVE_CMPXCHG_LOCAL=y
CONFIG_HAVE_CMPXCHG_DOUBLE=y
CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y
CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y
CONFIG_HAVE_ARCH_SECCOMP=y
CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
# CONFIG_SECCOMP_CACHE_DEBUG is not set
CONFIG_HAVE_ARCH_KSTACK_ERASE=y
CONFIG_HAVE_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR_STRONG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
CONFIG_LTO_NONE=y
CONFIG_ARCH_SUPPORTS_CFI=y
CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
CONFIG_HAVE_CONTEXT_TRACKING_USER=y
CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y
CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
CONFIG_HAVE_MOVE_PUD=y
CONFIG_HAVE_MOVE_PMD=y
CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y
CONFIG_HAVE_ARCH_HUGE_VMAP=y
CONFIG_HAVE_ARCH_HUGE_VMALLOC=y
CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
CONFIG_ARCH_WANT_PMD_MKWRITE=y
CONFIG_HAVE_ARCH_SOFT_DIRTY=y
CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
CONFIG_MODULES_USE_ELF_RELA=y
CONFIG_ARCH_HAS_EXECMEM_ROX=y
CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y
CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y
CONFIG_SOFTIRQ_ON_OWN_STACK=y
CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
CONFIG_HAVE_EXIT_THREAD=y
CONFIG_ARCH_MMAP_RND_BITS=28
CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y
CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8
CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES=y
CONFIG_HAVE_PAGE_SIZE_4KB=y
CONFIG_PAGE_SIZE_4KB=y
CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
CONFIG_PAGE_SHIFT=12
CONFIG_HAVE_OBJTOOL=y
CONFIG_HAVE_JUMP_LABEL_HACK=y
CONFIG_HAVE_NOINSTR_HACK=y
CONFIG_HAVE_NOINSTR_VALIDATION=y
CONFIG_HAVE_UACCESS_VALIDATION=y
CONFIG_HAVE_STACK_VALIDATION=y
CONFIG_HAVE_RELIABLE_STACKTRACE=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_COMPAT_OLD_SIGACTION=y
CONFIG_COMPAT_32BIT_TIME=y
CONFIG_ARCH_SUPPORTS_RT=y
CONFIG_HAVE_ARCH_VMAP_STACK=y
CONFIG_VMAP_STACK=y
CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y
CONFIG_RANDOMIZE_KSTACK_OFFSET=y
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
CONFIG_STRICT_KERNEL_RWX=y
CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
CONFIG_STRICT_MODULE_RWX=y
CONFIG_ARCH_HAS_CPU_RESCTRL=y
CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y
CONFIG_ARCH_USE_MEMREMAP_PROT=y
# CONFIG_LOCK_EVENT_COUNTS is not set
CONFIG_ARCH_HAS_MEM_ENCRYPT=y
CONFIG_HAVE_STATIC_CALL=y
CONFIG_HAVE_STATIC_CALL_INLINE=y
CONFIG_HAVE_PREEMPT_DYNAMIC=y
CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y
CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y
CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y
CONFIG_ARCH_HAS_ELFCORE_COMPAT=y
CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y
CONFIG_DYNAMIC_SIGFRAME=y
CONFIG_HAVE_ARCH_NODE_DEV_GROUP=y
CONFIG_ARCH_HAS_HW_PTE_YOUNG=y
CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y
CONFIG_ARCH_HAS_KERNEL_FPU_SUPPORT=y
CONFIG_ARCH_VMLINUX_NEEDS_RELOCS=y
CONFIG_HAVE_GENERIC_TIF_BITS=y
#
# GCOV-based kernel profiling
#
# CONFIG_GCOV_KERNEL is not set
CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
# end of GCOV-based kernel profiling
CONFIG_HAVE_GCC_PLUGINS=y
CONFIG_FUNCTION_ALIGNMENT_4B=y
CONFIG_FUNCTION_ALIGNMENT_16B=y
CONFIG_FUNCTION_ALIGNMENT=16
CONFIG_CC_HAS_MIN_FUNCTION_ALIGNMENT=y
CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y
CONFIG_ARCH_HAS_CPU_ATTACK_VECTORS=y
CONFIG_HAVE_ARCH_GET_SECUREBOOT=y
# end of General architecture-dependent options
CONFIG_RT_MUTEXES=y
CONFIG_MODULE_SIG_FORMAT=y
CONFIG_MODULES=y
CONFIG_MODULE_DEBUGFS=y
# CONFIG_MODULE_DEBUG is not set
# CONFIG_MODULE_FORCE_LOAD is not set
CONFIG_MODULE_UNLOAD=y
# CONFIG_MODULE_FORCE_UNLOAD is not set
CONFIG_MODULE_UNLOAD_TAINT_TRACKING=y
# CONFIG_MODVERSIONS is not set
# CONFIG_MODULE_SRCVERSION_ALL is not set
CONFIG_MODULE_SIG=y
# CONFIG_MODULE_SIG_FORCE is not set
CONFIG_MODULE_SIG_ALL=y
# CONFIG_MODULE_SIG_SHA256 is not set
# CONFIG_MODULE_SIG_SHA384 is not set
CONFIG_MODULE_SIG_SHA512=y
# CONFIG_MODULE_SIG_SHA3_256 is not set
# CONFIG_MODULE_SIG_SHA3_384 is not set
# CONFIG_MODULE_SIG_SHA3_512 is not set
CONFIG_MODULE_SIG_HASH="sha512"
CONFIG_MODULE_COMPRESS=y
# CONFIG_MODULE_COMPRESS_GZIP is not set
CONFIG_MODULE_COMPRESS_XZ=y
# CONFIG_MODULE_COMPRESS_ZSTD is not set
# CONFIG_MODULE_COMPRESS_ALL is not set
CONFIG_MODULE_DECOMPRESS=y
# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
CONFIG_MODPROBE_PATH="/usr/bin/modprobe"
# CONFIG_TRIM_UNUSED_KSYMS is not set
CONFIG_MODULES_TREE_LOOKUP=y
CONFIG_BLOCK=y
CONFIG_BLOCK_LEGACY_AUTOLOAD=y
CONFIG_BLK_RQ_ALLOC_TIME=y
CONFIG_BLK_CGROUP_RWSTAT=y
CONFIG_BLK_CGROUP_PUNT_BIO=y
CONFIG_BLK_DEV_BSG_COMMON=y
CONFIG_BLK_ICQ=y
CONFIG_BLK_DEV_BSGLIB=y
CONFIG_BLK_DEV_INTEGRITY=y
CONFIG_BLK_DEV_WRITE_MOUNTED=y
CONFIG_BLK_DEV_ZONED=y
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_BLK_WBT=y
CONFIG_BLK_WBT_MQ=y
CONFIG_BLK_CGROUP_IOLATENCY=y
CONFIG_BLK_CGROUP_IOCOST=y
CONFIG_BLK_CGROUP_IOPRIO=y
CONFIG_BLK_DEBUG_FS=y
CONFIG_BLK_SED_OPAL=y
CONFIG_BLK_INLINE_ENCRYPTION=y
CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y
#
# Partition Types
#
CONFIG_PARTITION_ADVANCED=y
# CONFIG_ACORN_PARTITION is not set
# CONFIG_AIX_PARTITION is not set
# CONFIG_OSF_PARTITION is not set
# CONFIG_AMIGA_PARTITION is not set
# CONFIG_ATARI_PARTITION is not set
# CONFIG_MAC_PARTITION is not set
CONFIG_MSDOS_PARTITION=y
# CONFIG_BSD_DISKLABEL is not set
# CONFIG_MINIX_SUBPARTITION is not set
# CONFIG_SOLARIS_X86_PARTITION is not set
# CONFIG_UNIXWARE_DISKLABEL is not set
CONFIG_LDM_PARTITION=y
# CONFIG_LDM_DEBUG is not set
# CONFIG_SGI_PARTITION is not set
# CONFIG_ULTRIX_PARTITION is not set
# CONFIG_SUN_PARTITION is not set
# CONFIG_KARMA_PARTITION is not set
CONFIG_EFI_PARTITION=y
# CONFIG_SYSV68_PARTITION is not set
# CONFIG_CMDLINE_PARTITION is not set
# end of Partition Types
CONFIG_BLK_PM=y
CONFIG_BLOCK_HOLDER_DEPRECATED=y
CONFIG_BLK_MQ_STACKING=y
# CONFIG_BLK_ERROR_INJECTION is not set
#
# IO Schedulers
#
CONFIG_MQ_IOSCHED_DEADLINE=y
CONFIG_MQ_IOSCHED_KYBER=y
CONFIG_IOSCHED_BFQ=y
CONFIG_BFQ_GROUP_IOSCHED=y
# CONFIG_BFQ_CGROUP_DEBUG is not set
# end of IO Schedulers
CONFIG_PREEMPT_NOTIFIERS=y
CONFIG_PADATA=y
CONFIG_ASN1=y
CONFIG_UNINLINE_SPIN_UNLOCK=y
CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
CONFIG_MUTEX_SPIN_ON_OWNER=y
CONFIG_RWSEM_SPIN_ON_OWNER=y
CONFIG_LOCK_SPIN_ON_OWNER=y
CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
CONFIG_QUEUED_SPINLOCKS=y
# CONFIG_QUEUED_SPINLOCKS_TRACE_CONTENDED_RELEASE is not set
CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
CONFIG_QUEUED_RWLOCKS=y
CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y
CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y
CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y
CONFIG_FREEZER=y
#
# Executable file formats
#
CONFIG_BINFMT_ELF=y
CONFIG_COMPAT_BINFMT_ELF=y
CONFIG_ELFCORE=y
CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
CONFIG_BINFMT_SCRIPT=y
CONFIG_BINFMT_MISC=m
CONFIG_COREDUMP=y
# end of Executable file formats
#
# Memory Management options
#
CONFIG_SWAP=y
CONFIG_ZSWAP=y
# CONFIG_ZSWAP_DEFAULT_ON is not set
CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_DEFLATE is not set
CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZO=y
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_842 is not set
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4 is not set
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4HC is not set
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD is not set
CONFIG_ZSWAP_COMPRESSOR_DEFAULT="lzo"
CONFIG_ZSMALLOC=y
#
# Zsmalloc allocator options
#
#
# Zsmalloc is a common backend allocator for zswap & zram
#
# CONFIG_ZSMALLOC_STAT is not set
CONFIG_ZSMALLOC_CHAIN_SIZE=8
# end of Zsmalloc allocator options
#
# Slab allocator options
#
CONFIG_SLUB=y
CONFIG_KVFREE_RCU_BATCHED=y
# CONFIG_SLUB_TINY is not set
# CONFIG_SLAB_MERGE_DEFAULT is not set
CONFIG_SLAB_FREELIST_RANDOM=y
CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_SLAB_BUCKETS=y
# CONFIG_SLUB_STATS is not set
CONFIG_KMALLOC_PARTITION_CACHES=y
CONFIG_KMALLOC_PARTITION_RANDOM=y
# end of Slab allocator options
CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
# CONFIG_COMPAT_BRK is not set
CONFIG_SPARSEMEM=y
CONFIG_SPARSEMEM_EXTREME=y
CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
CONFIG_SPARSEMEM_VMEMMAP=y
CONFIG_SPARSEMEM_VMEMMAP_PREINIT=y
CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=y
CONFIG_ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP=y
CONFIG_ARCH_WANT_HUGETLB_VMEMMAP_PREINIT=y
CONFIG_HAVE_GUP_FAST=y
CONFIG_MEMBLOCK_KHO_SCRATCH=y
CONFIG_NUMA_KEEP_MEMINFO=y
CONFIG_MEMORY_ISOLATION=y
CONFIG_EXCLUSIVE_SYSTEM_RAM=y
CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
# CONFIG_MEMORY_HOTPLUG is not set
CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
CONFIG_SPLIT_PTE_PTLOCKS=y
CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y
CONFIG_SPLIT_PMD_PTLOCKS=y
CONFIG_BALLOON=y
CONFIG_BALLOON_MIGRATION=y
CONFIG_COMPACTION=y
CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
CONFIG_PAGE_REPORTING=y
CONFIG_NUMA_MIGRATION=y
CONFIG_MIGRATION=y
CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y
CONFIG_ARCH_HAS_PMD_SOFTLEAVES=y
CONFIG_CONTIG_ALLOC=y
CONFIG_PCP_BATCH_SCALE_MAX=5
CONFIG_PHYS_ADDR_T_64BIT=y
CONFIG_MMU_NOTIFIER=y
CONFIG_KSM=y
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
CONFIG_MEMORY_FAILURE=y
CONFIG_HWPOISON_INJECT=m
CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
CONFIG_ARCH_WANTS_THP_SWAP=y
# CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is not set
CONFIG_MM_ID=y
CONFIG_TRANSPARENT_HUGEPAGE=y
# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set
CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
# CONFIG_TRANSPARENT_HUGEPAGE_NEVER is not set
CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_NEVER=y
# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS is not set
# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_WITHIN_SIZE is not set
# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ADVISE is not set
CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_NEVER=y
# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ALWAYS is not set
# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE is not set
# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE is not set
CONFIG_THP_SWAP=y
# CONFIG_NO_PAGE_MAPCOUNT is not set
CONFIG_PAGE_MAPCOUNT=y
CONFIG_PGTABLE_HAS_HUGE_LEAVES=y
CONFIG_HAVE_GIGANTIC_FOLIOS=y
CONFIG_ASYNC_KERNEL_PGTABLE_FREE=y
CONFIG_ARCH_SUPPORTS_HUGE_PFNMAP=y
CONFIG_ARCH_SUPPORTS_PMD_PFNMAP=y
CONFIG_ARCH_SUPPORTS_PUD_PFNMAP=y
CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
CONFIG_USE_PERCPU_NUMA_NODE_ID=y
CONFIG_HAVE_SETUP_PER_CPU_AREA=y
CONFIG_CMA=y
# CONFIG_CMA_DEBUGFS is not set
CONFIG_CMA_SYSFS=y
CONFIG_CMA_AREAS=7
CONFIG_PAGE_BLOCK_MAX_ORDER=10
CONFIG_MEM_SOFT_DIRTY=y
CONFIG_GENERIC_EARLY_IOREMAP=y
# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
CONFIG_PAGE_IDLE_FLAG=y
CONFIG_IDLE_PAGE_TRACKING=y
CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y
CONFIG_ARCH_HAS_ZONE_DMA_SET=y
CONFIG_ZONE_DMA=y
CONFIG_ZONE_DMA32=y
CONFIG_VMAP_PFN=y
CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
CONFIG_ARCH_HAS_PKEYS=y
CONFIG_ARCH_USES_PG_ARCH_2=y
CONFIG_VM_EVENT_COUNTERS=y
# CONFIG_PERCPU_STATS is not set
# CONFIG_GUP_TEST is not set
# CONFIG_DMAPOOL_TEST is not set
CONFIG_ARCH_HAS_PTE_SPECIAL=y
CONFIG_MEMFD_CREATE=y
CONFIG_SECRETMEM=y
# CONFIG_ANON_VMA_NAME is not set
CONFIG_HAVE_ARCH_USERFAULTFD_WP=y
CONFIG_HAVE_ARCH_USERFAULTFD_MINOR=y
CONFIG_USERFAULTFD_RWP=y
CONFIG_USERFAULTFD=y
CONFIG_PTE_MARKER_UFFD_WP=y
CONFIG_LRU_GEN=y
CONFIG_LRU_GEN_ENABLED=y
# CONFIG_LRU_GEN_STATS is not set
CONFIG_LRU_GEN_WALKS_MMU=y
CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y
CONFIG_PER_VMA_LOCK=y
CONFIG_LOCK_MM_AND_FIND_VMA=y
CONFIG_IOMMU_MM_DATA=y
CONFIG_EXECMEM=y
CONFIG_NUMA_MEMBLKS=y
# CONFIG_NUMA_EMU is not set
CONFIG_ARCH_HAS_USER_SHADOW_STACK=y
CONFIG_PT_RECLAIM=y
#
# Data Access Monitoring
#
CONFIG_DAMON=y
# CONFIG_DAMON_DEBUG_SANITY is not set
CONFIG_DAMON_VADDR=y
CONFIG_DAMON_PADDR=y
CONFIG_DAMON_SYSFS=y
CONFIG_DAMON_RECLAIM=y
# CONFIG_DAMON_LRU_SORT is not set
CONFIG_DAMON_STAT=y
# CONFIG_DAMON_STAT_ENABLED_DEFAULT is not set
# end of Data Access Monitoring
# end of Memory Management options
CONFIG_NET=y
CONFIG_NET_INGRESS=y
CONFIG_NET_EGRESS=y
CONFIG_NET_XGRESS=y
CONFIG_SKB_DECRYPTED=y
CONFIG_SKB_EXTENSIONS=y
CONFIG_NET_DEVMEM=y
CONFIG_NET_CRC32C=y
#
# Networking options
#
CONFIG_PACKET=y
CONFIG_PACKET_DIAG=y
# CONFIG_INET_PSP is not set
CONFIG_UNIX=y
CONFIG_AF_UNIX_OOB=y
CONFIG_UNIX_DIAG=y
CONFIG_TLS=y
CONFIG_TLS_DEVICE=y
CONFIG_XFRM=y
CONFIG_XFRM_OFFLOAD=y
CONFIG_XFRM_ALGO=y
CONFIG_XFRM_USER=y
# CONFIG_XFRM_USER_COMPAT is not set
# CONFIG_XFRM_INTERFACE is not set
CONFIG_XFRM_SUB_POLICY=y
CONFIG_XFRM_MIGRATE=y
# CONFIG_XFRM_STATISTICS is not set
CONFIG_XFRM_AH=m
CONFIG_XFRM_ESP=m
CONFIG_XFRM_IPCOMP=m
# CONFIG_NET_KEY is not set
# CONFIG_XFRM_IPTFS is not set
CONFIG_XFRM_ESPINTCP=y
# CONFIG_DIBS is not set
CONFIG_XDP_SOCKETS=y
CONFIG_XDP_SOCKETS_DIAG=y
CONFIG_NET_HANDSHAKE=y
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_FIB_TRIE_STATS=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_IP_ROUTE_CLASSID=y
# CONFIG_IP_PNP is not set
CONFIG_NET_IPIP=m
CONFIG_NET_IPGRE_DEMUX=m
CONFIG_NET_IP_TUNNEL=m
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE_COMMON=y
CONFIG_IP_MROUTE=y
CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
CONFIG_SYN_COOKIES=y
CONFIG_NET_IPVTI=m
CONFIG_NET_UDP_TUNNEL=m
CONFIG_NET_FOU=m
CONFIG_NET_FOU_IP_TUNNELS=y
CONFIG_INET_AH=m
CONFIG_INET_ESP=m
CONFIG_INET_ESP_OFFLOAD=m
CONFIG_INET_ESPINTCP=y
CONFIG_INET_IPCOMP=m
CONFIG_INET_TABLE_PERTURB_ORDER=16
CONFIG_INET_XFRM_TUNNEL=m
CONFIG_INET_TUNNEL=m
CONFIG_INET_DIAG=y
CONFIG_INET_TCP_DIAG=y
CONFIG_INET_UDP_DIAG=y
CONFIG_INET_RAW_DIAG=y
CONFIG_INET_DIAG_DESTROY=y
# CONFIG_TCP_CONG_ADVANCED is not set
CONFIG_TCP_CONG_CUBIC=y
CONFIG_DEFAULT_TCP_CONG="cubic"
CONFIG_TCP_AO=y
CONFIG_TCP_MD5SIG=y
CONFIG_IPV6=y
CONFIG_IPV6_ROUTER_PREF=y
CONFIG_IPV6_ROUTE_INFO=y
CONFIG_IPV6_OPTIMISTIC_DAD=y
CONFIG_INET6_AH=m
CONFIG_INET6_ESP=m
CONFIG_INET6_ESP_OFFLOAD=m
CONFIG_INET6_ESPINTCP=y
CONFIG_INET6_IPCOMP=m
CONFIG_IPV6_MIP6=y
CONFIG_IPV6_ILA=m
CONFIG_INET6_XFRM_TUNNEL=m
CONFIG_INET6_TUNNEL=m
CONFIG_IPV6_VTI=m
CONFIG_IPV6_SIT=m
CONFIG_IPV6_SIT_6RD=y
CONFIG_IPV6_NDISC_NODETYPE=y
CONFIG_IPV6_TUNNEL=m
CONFIG_IPV6_GRE=m
CONFIG_IPV6_FOU=m
CONFIG_IPV6_FOU_TUNNEL=m
CONFIG_IPV6_MULTIPLE_TABLES=y
CONFIG_IPV6_SUBTREES=y
CONFIG_IPV6_MROUTE=y
CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
CONFIG_IPV6_PIMSM_V2=y
CONFIG_IPV6_SEG6_LWTUNNEL=y
CONFIG_IPV6_SEG6_HMAC=y
CONFIG_IPV6_SEG6_BPF=y
CONFIG_IPV6_RPL_LWTUNNEL=y
CONFIG_IPV6_IOAM6_LWTUNNEL=y
CONFIG_NETLABEL=y
CONFIG_MPTCP=y
CONFIG_INET_MPTCP_DIAG=y
CONFIG_MPTCP_IPV6=y
CONFIG_NETWORK_SECMARK=y
CONFIG_NET_PTP_CLASSIFY=y
CONFIG_NETWORK_PHY_TIMESTAMPING=y
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_BRIDGE_NETFILTER=m
#
# Core Netfilter Configuration
#
CONFIG_NETFILTER_INGRESS=y
CONFIG_NETFILTER_EGRESS=y
CONFIG_NETFILTER_NETLINK=y
CONFIG_NETFILTER_FAMILY_BRIDGE=y
CONFIG_NETFILTER_FAMILY_ARP=y
CONFIG_NETFILTER_BPF_LINK=y
CONFIG_NETFILTER_NETLINK_HOOK=m
CONFIG_NETFILTER_NETLINK_ACCT=m
CONFIG_NETFILTER_NETLINK_QUEUE=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NETFILTER_NETLINK_OSF=m
CONFIG_NF_CONNTRACK=m
CONFIG_NF_LOG_SYSLOG=m
CONFIG_NETFILTER_CONNCOUNT=m
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_SECMARK=y
CONFIG_NF_CONNTRACK_ZONES=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
# CONFIG_NF_CONNTRACK_TIMEOUT is not set
CONFIG_NF_CONNTRACK_TIMESTAMP=y
CONFIG_NF_CONNTRACK_LABELS=y
CONFIG_NF_CT_PROTO_GRE=y
CONFIG_NF_CT_PROTO_SCTP=y
CONFIG_NF_CONNTRACK_AMANDA=m
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_H323=m
CONFIG_NF_CONNTRACK_IRC=m
CONFIG_NF_CONNTRACK_BROADCAST=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
CONFIG_NF_CONNTRACK_SNMP=m
CONFIG_NF_CONNTRACK_PPTP=m
CONFIG_NF_CONNTRACK_SANE=m
CONFIG_NF_CONNTRACK_SIP=m
CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_CT_NETLINK_HELPER=m
CONFIG_NETFILTER_NETLINK_GLUE_CT=y
CONFIG_NF_NAT=m
CONFIG_NF_NAT_AMANDA=m
CONFIG_NF_NAT_FTP=m
CONFIG_NF_NAT_IRC=m
CONFIG_NF_NAT_SIP=m
CONFIG_NF_NAT_TFTP=m
CONFIG_NF_NAT_REDIRECT=y
CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NETFILTER_SYNPROXY=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_CT=m
# CONFIG_NFT_EXTHDR_DCCP is not set
CONFIG_NFT_FLOW_OFFLOAD=m
CONFIG_NFT_CONNLIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_TUNNEL=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_REJECT_INET=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_HASH=m
CONFIG_NFT_FIB=m
CONFIG_NFT_FIB_INET=m
CONFIG_NFT_XFRM=m
CONFIG_NFT_SOCKET=m
# CONFIG_NFT_OSF is not set
CONFIG_NFT_TPROXY=m
CONFIG_NFT_SYNPROXY=m
CONFIG_NF_DUP_NETDEV=m
CONFIG_NFT_DUP_NETDEV=m
CONFIG_NFT_FWD_NETDEV=m
CONFIG_NFT_FIB_NETDEV=m
CONFIG_NFT_REJECT_NETDEV=m
CONFIG_NF_FLOW_TABLE_INET=m
CONFIG_NF_FLOW_TABLE=m
CONFIG_NF_FLOW_TABLE_PROCFS=y
CONFIG_NETFILTER_XTABLES=y
# CONFIG_NETFILTER_XTABLES_COMPAT is not set
CONFIG_NETFILTER_XTABLES_LEGACY=y
#
# Xtables combined modules
#
CONFIG_NETFILTER_XT_MARK=m
CONFIG_NETFILTER_XT_CONNMARK=m
CONFIG_NETFILTER_XT_SET=m
#
# Xtables targets
#
CONFIG_NETFILTER_XT_TARGET_AUDIT=m
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_HL=m
CONFIG_NETFILTER_XT_TARGET_HMARK=m
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
CONFIG_NETFILTER_XT_TARGET_LED=m
CONFIG_NETFILTER_XT_TARGET_LOG=m
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_NAT=m
CONFIG_NETFILTER_XT_TARGET_NETMAP=m
CONFIG_NETFILTER_XT_TARGET_NFLOG=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
CONFIG_NETFILTER_XT_TARGET_RATEEST=m
CONFIG_NETFILTER_XT_TARGET_REDIRECT=m
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
CONFIG_NETFILTER_XT_TARGET_TEE=m
CONFIG_NETFILTER_XT_TARGET_TPROXY=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
#
# Xtables matches
#
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NETFILTER_XT_MATCH_CGROUP=m
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ECN=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_HL=m
CONFIG_NETFILTER_XT_MATCH_IPCOMP=m
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MATCH_L2TP=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_NFACCT=m
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_RATEEST=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_RECENT=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_TIME=m
CONFIG_NETFILTER_XT_MATCH_U32=m
# end of Core Netfilter Configuration
CONFIG_IP_SET=m
CONFIG_IP_SET_MAX=256
CONFIG_IP_SET_BITMAP_IP=m
CONFIG_IP_SET_BITMAP_IPMAC=m
CONFIG_IP_SET_BITMAP_PORT=m
CONFIG_IP_SET_HASH_IP=m
CONFIG_IP_SET_HASH_IPMARK=m
CONFIG_IP_SET_HASH_IPPORT=m
CONFIG_IP_SET_HASH_IPPORTIP=m
CONFIG_IP_SET_HASH_IPPORTNET=m
CONFIG_IP_SET_HASH_IPMAC=m
CONFIG_IP_SET_HASH_MAC=m
CONFIG_IP_SET_HASH_NETPORTNET=m
CONFIG_IP_SET_HASH_NET=m
CONFIG_IP_SET_HASH_NETNET=m
CONFIG_IP_SET_HASH_NETPORT=m
CONFIG_IP_SET_HASH_NETIFACE=m
CONFIG_IP_SET_LIST_SET=m
CONFIG_IP_VS=m
CONFIG_IP_VS_IPV6=y
# CONFIG_IP_VS_DEBUG is not set
CONFIG_IP_VS_TAB_BITS=12
#
# IPVS transport protocol load balancing support
#
CONFIG_IP_VS_PROTO_TCP=y
CONFIG_IP_VS_PROTO_UDP=y
CONFIG_IP_VS_PROTO_AH_ESP=y
CONFIG_IP_VS_PROTO_ESP=y
CONFIG_IP_VS_PROTO_AH=y
CONFIG_IP_VS_PROTO_SCTP=y
#
# IPVS scheduler
#
CONFIG_IP_VS_RR=m
CONFIG_IP_VS_WRR=m
CONFIG_IP_VS_LC=m
CONFIG_IP_VS_WLC=m
CONFIG_IP_VS_FO=m
CONFIG_IP_VS_OVF=m
CONFIG_IP_VS_LBLC=m
CONFIG_IP_VS_LBLCR=m
CONFIG_IP_VS_DH=m
CONFIG_IP_VS_SH=m
CONFIG_IP_VS_MH=m
CONFIG_IP_VS_SED=m
CONFIG_IP_VS_NQ=m
CONFIG_IP_VS_TWOS=m
#
# IPVS SH scheduler
#
CONFIG_IP_VS_SH_TAB_BITS=8
#
# IPVS MH scheduler
#
CONFIG_IP_VS_MH_TAB_INDEX=12
#
# IPVS application helper
#
CONFIG_IP_VS_FTP=m
CONFIG_IP_VS_NFCT=y
CONFIG_IP_VS_PE_SIP=m
#
# IP: Netfilter Configuration
#
CONFIG_NF_DEFRAG_IPV4=m
CONFIG_IP_NF_IPTABLES_LEGACY=m
CONFIG_NF_SOCKET_IPV4=m
CONFIG_NF_TPROXY_IPV4=m
CONFIG_NF_TABLES_IPV4=y
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_DUP_IPV4=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NF_TABLES_ARP=y
CONFIG_NF_DUP_IPV4=m
CONFIG_NF_LOG_ARP=m
CONFIG_NF_LOG_IPV4=m
CONFIG_NF_REJECT_IPV4=m
CONFIG_NF_NAT_SNMP_BASIC=m
CONFIG_NF_NAT_PPTP=m
CONFIG_NF_NAT_H323=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_RPFILTER=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_SYNPROXY=m
# CONFIG_IP_NF_NAT is not set
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_ECN=m
# CONFIG_IP_NF_TARGET_TTL is not set
# CONFIG_IP_NF_RAW is not set
# CONFIG_IP_NF_SECURITY is not set
# CONFIG_IP_NF_ARPTABLES is not set
CONFIG_NFT_COMPAT_ARP=m
# CONFIG_IP_NF_ARPFILTER is not set
CONFIG_IP_NF_ARP_MANGLE=m
# end of IP: Netfilter Configuration
#
# IPv6: Netfilter Configuration
#
CONFIG_IP6_NF_IPTABLES_LEGACY=m
CONFIG_NF_SOCKET_IPV6=m
CONFIG_NF_TPROXY_IPV6=m
CONFIG_NF_TABLES_IPV6=y
CONFIG_NFT_REJECT_IPV6=m
CONFIG_NFT_DUP_IPV6=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NF_DUP_IPV6=m
CONFIG_NF_REJECT_IPV6=m
CONFIG_NF_LOG_IPV6=m
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP6_NF_MATCH_AH=m
CONFIG_IP6_NF_MATCH_EUI64=m
CONFIG_IP6_NF_MATCH_FRAG=m
CONFIG_IP6_NF_MATCH_OPTS=m
CONFIG_IP6_NF_MATCH_HL=m
CONFIG_IP6_NF_MATCH_IPV6HEADER=m
CONFIG_IP6_NF_MATCH_MH=m
CONFIG_IP6_NF_MATCH_RPFILTER=m
CONFIG_IP6_NF_MATCH_RT=m
CONFIG_IP6_NF_MATCH_SRH=m
# CONFIG_IP6_NF_TARGET_HL is not set
CONFIG_IP6_NF_FILTER=m
CONFIG_IP6_NF_TARGET_REJECT=m
CONFIG_IP6_NF_TARGET_SYNPROXY=m
CONFIG_IP6_NF_MANGLE=m
# CONFIG_IP6_NF_RAW is not set
# CONFIG_IP6_NF_SECURITY is not set
# CONFIG_IP6_NF_NAT is not set
CONFIG_IP6_NF_TARGET_NPT=m
# end of IPv6: Netfilter Configuration
CONFIG_NF_DEFRAG_IPV6=m
CONFIG_NF_TABLES_BRIDGE=m
CONFIG_NFT_BRIDGE_META=m
CONFIG_NFT_BRIDGE_REJECT=m
CONFIG_NF_CONNTRACK_BRIDGE=m
# CONFIG_BRIDGE_NF_EBTABLES_LEGACY is not set
CONFIG_BRIDGE_NF_EBTABLES=m
CONFIG_BRIDGE_EBT_802_3=m
CONFIG_BRIDGE_EBT_AMONG=m
CONFIG_BRIDGE_EBT_ARP=m
CONFIG_BRIDGE_EBT_IP=m
CONFIG_BRIDGE_EBT_IP6=m
CONFIG_BRIDGE_EBT_LIMIT=m
CONFIG_BRIDGE_EBT_MARK=m
CONFIG_BRIDGE_EBT_PKTTYPE=m
CONFIG_BRIDGE_EBT_STP=m
CONFIG_BRIDGE_EBT_VLAN=m
CONFIG_BRIDGE_EBT_ARPREPLY=m
CONFIG_BRIDGE_EBT_DNAT=m
CONFIG_BRIDGE_EBT_MARK_T=m
CONFIG_BRIDGE_EBT_REDIRECT=m
CONFIG_BRIDGE_EBT_SNAT=m
CONFIG_BRIDGE_EBT_LOG=m
CONFIG_BRIDGE_EBT_NFLOG=m
# CONFIG_IP_SCTP is not set
CONFIG_RDS=m
CONFIG_RDS_TCP=m
# CONFIG_RDS_DEBUG is not set
# CONFIG_TIPC is not set
# CONFIG_ATM is not set
# CONFIG_L2TP is not set
CONFIG_STP=y
CONFIG_BRIDGE=y
CONFIG_BRIDGE_IGMP_SNOOPING=y
# CONFIG_BRIDGE_VLAN_FILTERING is not set
# CONFIG_BRIDGE_MRP is not set
# CONFIG_BRIDGE_CFM is not set
# CONFIG_NET_DSA is not set
CONFIG_VLAN_8021Q=m
# CONFIG_VLAN_8021Q_GVRP is not set
# CONFIG_VLAN_8021Q_MVRP is not set
CONFIG_LLC=y
# CONFIG_LLC2 is not set
# CONFIG_X25 is not set
# CONFIG_LAPB is not set
# CONFIG_PHONET is not set
CONFIG_6LOWPAN=m
# CONFIG_6LOWPAN_DEBUGFS is not set
# CONFIG_6LOWPAN_NHC is not set
# CONFIG_IEEE802154 is not set
CONFIG_NET_SCHED=y
#
# Queueing/Scheduling
#
CONFIG_NET_SCH_HTB=m
CONFIG_NET_SCH_HFSC=m
CONFIG_NET_SCH_PRIO=m
CONFIG_NET_SCH_MULTIQ=m
CONFIG_NET_SCH_RED=m
CONFIG_NET_SCH_SFB=m
CONFIG_NET_SCH_SFQ=m
CONFIG_NET_SCH_TEQL=m
CONFIG_NET_SCH_TBF=m
CONFIG_NET_SCH_CBS=m
CONFIG_NET_SCH_ETF=m
CONFIG_NET_SCH_MQPRIO_LIB=m
CONFIG_NET_SCH_TAPRIO=m
CONFIG_NET_SCH_GRED=m
CONFIG_NET_SCH_NETEM=m
CONFIG_NET_SCH_DRR=m
CONFIG_NET_SCH_MQPRIO=m
# CONFIG_NET_SCH_SKBPRIO is not set
CONFIG_NET_SCH_CHOKE=m
CONFIG_NET_SCH_QFQ=m
CONFIG_NET_SCH_CODEL=m
CONFIG_NET_SCH_FQ_CODEL=y
CONFIG_NET_SCH_CAKE=m
CONFIG_NET_SCH_FQ=m
CONFIG_NET_SCH_HHF=m
# CONFIG_NET_SCH_PIE is not set
CONFIG_NET_SCH_PLUG=m
CONFIG_NET_SCH_ETS=m
CONFIG_NET_SCH_BPF=y
CONFIG_NET_SCH_DUALPI2=m
# CONFIG_NET_SCH_DEFAULT is not set
#
# Classification
#
CONFIG_NET_CLS=y
CONFIG_NET_CLS_BASIC=m
CONFIG_NET_CLS_ROUTE4=m
CONFIG_NET_CLS_FW=m
CONFIG_NET_CLS_U32=m
CONFIG_CLS_U32_PERF=y
CONFIG_CLS_U32_MARK=y
CONFIG_NET_CLS_FLOW=m
CONFIG_NET_CLS_CGROUP=y
CONFIG_NET_CLS_BPF=m
CONFIG_NET_CLS_FLOWER=m
CONFIG_NET_CLS_MATCHALL=m
CONFIG_NET_EMATCH=y
CONFIG_NET_EMATCH_STACK=32
CONFIG_NET_EMATCH_CMP=m
CONFIG_NET_EMATCH_NBYTE=m
CONFIG_NET_EMATCH_U32=m
CONFIG_NET_EMATCH_META=m
CONFIG_NET_EMATCH_TEXT=m
CONFIG_NET_EMATCH_IPSET=m
CONFIG_NET_EMATCH_IPT=m
# CONFIG_NET_CLS_ACT is not set
CONFIG_NET_SCH_FIFO=y
# CONFIG_DCB is not set
CONFIG_DNS_RESOLVER=y
# CONFIG_BATMAN_ADV is not set
# CONFIG_OPENVSWITCH is not set
CONFIG_VSOCKETS=y
CONFIG_VSOCKETS_DIAG=y
# CONFIG_VSOCKETS_LOOPBACK is not set
# CONFIG_VIRTIO_VSOCKETS is not set
CONFIG_VIRTIO_VSOCKETS_COMMON=m
CONFIG_NETLINK_DIAG=y
CONFIG_MPLS=y
CONFIG_NET_MPLS_GSO=m
CONFIG_MPLS_ROUTING=m
CONFIG_MPLS_IPTUNNEL=m
# CONFIG_NET_NSH is not set
# CONFIG_HSR is not set
CONFIG_NET_SWITCHDEV=y
CONFIG_NET_L3_MASTER_DEV=y
# CONFIG_QRTR is not set
# CONFIG_NET_NCSI is not set
CONFIG_PCPU_DEV_REFCNT=y
CONFIG_MAX_SKB_FRAGS=17
CONFIG_RPS=y
CONFIG_RFS_ACCEL=y
CONFIG_SOCK_RX_QUEUE_MAPPING=y
CONFIG_XPS=y
CONFIG_CGROUP_NET_PRIO=y
CONFIG_CGROUP_NET_CLASSID=y
CONFIG_NET_RX_BUSY_POLL=y
CONFIG_BQL=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_NET_FLOW_LIMIT=y
#
# Network testing
#
# CONFIG_NET_PKTGEN is not set
# CONFIG_NET_DROP_MONITOR is not set
# end of Network testing
# end of Networking options
# CONFIG_CAN is not set
CONFIG_BT=m
CONFIG_BT_BREDR=y
CONFIG_BT_RFCOMM=m
CONFIG_BT_RFCOMM_TTY=y
CONFIG_BT_BNEP=m
CONFIG_BT_BNEP_MC_FILTER=y
CONFIG_BT_BNEP_PROTO_FILTER=y
CONFIG_BT_HIDP=m
CONFIG_BT_LE=y
CONFIG_BT_LE_L2CAP_ECRED=y
CONFIG_BT_6LOWPAN=m
CONFIG_BT_LEDS=y
CONFIG_BT_MSFTEXT=y
# CONFIG_BT_AOSPEXT is not set
# CONFIG_BT_DEBUGFS is not set
# CONFIG_BT_SELFTEST is not set
#
# Bluetooth device drivers
#
CONFIG_BT_INTEL=m
CONFIG_BT_HCIBTUSB=m
CONFIG_BT_HCIBTUSB_AUTOSUSPEND=y
CONFIG_BT_HCIBTUSB_POLL_SYNC=y
# CONFIG_BT_HCIBTUSB_BCM is not set
# CONFIG_BT_HCIBTUSB_MTK is not set
# CONFIG_BT_HCIBTUSB_RTL is not set
CONFIG_BT_HCIUART=m
CONFIG_BT_HCIUART_SERDEV=y
CONFIG_BT_HCIUART_H4=y
# CONFIG_BT_HCIUART_NOKIA is not set
CONFIG_BT_HCIUART_BCSP=y
# CONFIG_BT_HCIUART_ATH3K is not set
# CONFIG_BT_HCIUART_LL is not set
# CONFIG_BT_HCIUART_3WIRE is not set
CONFIG_BT_HCIUART_INTEL=y
# CONFIG_BT_HCIUART_BCM is not set
# CONFIG_BT_HCIUART_RTL is not set
# CONFIG_BT_HCIUART_QCA is not set
CONFIG_BT_HCIUART_AG6XX=y
# CONFIG_BT_HCIUART_MRVL is not set
# CONFIG_BT_HCIUART_AML is not set
# CONFIG_BT_HCIBCM203X is not set
# CONFIG_BT_HCIBCM4377 is not set
# CONFIG_BT_HCIBPA10X is not set
# CONFIG_BT_HCIBFUSB is not set
CONFIG_BT_HCIVHCI=m
# CONFIG_BT_MRVL is not set
# CONFIG_BT_ATH3K is not set
# CONFIG_BT_MTKUART is not set
# CONFIG_BT_VIRTIO is not set
CONFIG_BT_NXPUART=m
CONFIG_BT_INTEL_PCIE=m
# end of Bluetooth device drivers
CONFIG_AF_RXRPC=m
CONFIG_AF_RXRPC_IPV6=y
# CONFIG_AF_RXRPC_INJECT_LOSS is not set
# CONFIG_AF_RXRPC_INJECT_RX_DELAY is not set
CONFIG_AF_RXRPC_DEBUG=y
CONFIG_RXKAD=y
CONFIG_RXGK=y
# CONFIG_RXPERF is not set
CONFIG_AF_KCM=y
CONFIG_STREAM_PARSER=y
CONFIG_MCTP=y
CONFIG_FIB_RULES=y
CONFIG_WIRELESS=y
CONFIG_CFG80211=m
# CONFIG_NL80211_TESTMODE is not set
# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
# CONFIG_CFG80211_CERTIFICATION_ONUS is not set
CONFIG_CFG80211_REQUIRE_SIGNED_REGDB=y
CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS=y
CONFIG_CFG80211_DEFAULT_PS=y
CONFIG_CFG80211_DEBUGFS=y
CONFIG_CFG80211_CRDA_SUPPORT=y
# CONFIG_CFG80211_WEXT is not set
CONFIG_MAC80211=m
CONFIG_MAC80211_HAS_RC=y
CONFIG_MAC80211_RC_MINSTREL=y
CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
CONFIG_MAC80211_RC_DEFAULT="minstrel_ht"
CONFIG_MAC80211_MESH=y
CONFIG_MAC80211_LEDS=y
CONFIG_MAC80211_DEBUGFS=y
# CONFIG_MAC80211_MESSAGE_TRACING is not set
# CONFIG_MAC80211_DEBUG_MENU is not set
CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
CONFIG_RFKILL=y
CONFIG_RFKILL_LEDS=y
CONFIG_RFKILL_INPUT=y
CONFIG_RFKILL_GPIO=y
# CONFIG_NET_9P is not set
CONFIG_CEPH_LIB=y
# CONFIG_CEPH_LIB_PRETTYDEBUG is not set
# CONFIG_CEPH_LIB_USE_DNS_RESOLVER is not set
# CONFIG_NFC is not set
# CONFIG_PSAMPLE is not set
CONFIG_NET_IFE=m
CONFIG_LWTUNNEL=y
CONFIG_LWTUNNEL_BPF=y
CONFIG_DST_CACHE=y
CONFIG_GRO_CELLS=y
CONFIG_SOCK_VALIDATE_XMIT=y
CONFIG_NET_SELFTESTS=y
CONFIG_NET_SOCK_MSG=y
CONFIG_PAGE_POOL=y
# CONFIG_PAGE_POOL_STATS is not set
CONFIG_FAILOVER=y
CONFIG_ETHTOOL_NETLINK=y
#
# Device Drivers
#
CONFIG_HAVE_PCI=y
CONFIG_GENERIC_PCI_IOMAP=y
CONFIG_PCI=y
CONFIG_PCI_DOMAINS=y
CONFIG_PCIEPORTBUS=y
CONFIG_HOTPLUG_PCI_PCIE=y
CONFIG_PCIEAER=y
CONFIG_PCIEAER_INJECT=y
CONFIG_PCIE_ECRC=y
CONFIG_PCIEASPM=y
CONFIG_PCIEASPM_DEFAULT=y
# CONFIG_PCIEASPM_POWERSAVE is not set
# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
# CONFIG_PCIEASPM_PERFORMANCE is not set
CONFIG_PCIE_PME=y
CONFIG_PCIE_DPC=y
CONFIG_PCIE_PTM=y
CONFIG_PCIE_EDR=y
CONFIG_PCI_MSI=y
CONFIG_PCI_QUIRKS=y
# CONFIG_PCI_DEBUG is not set
# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
CONFIG_PCI_STUB=y
CONFIG_PCI_PF_STUB=y
CONFIG_PCI_ATS=y
# CONFIG_PCI_TSM is not set
CONFIG_PCI_DOE=y
CONFIG_PCI_LOCKLESS_CONFIG=y
CONFIG_PCI_IOV=y
CONFIG_PCI_NPEM=y
CONFIG_PCI_PRI=y
CONFIG_PCI_PASID=y
CONFIG_PCIE_TPH=y
CONFIG_PCI_LABEL=y
CONFIG_VGA_ARB=y
CONFIG_VGA_ARB_MAX_GPUS=16
CONFIG_HOTPLUG_PCI=y
# CONFIG_HOTPLUG_PCI_ACPI is not set
# CONFIG_HOTPLUG_PCI_CPCI is not set
# CONFIG_HOTPLUG_PCI_OCTEONEP is not set
# CONFIG_HOTPLUG_PCI_SHPC is not set
#
# PCI controller drivers
#
CONFIG_VMD=m
#
# Cadence-based PCIe controllers
#
# end of Cadence-based PCIe controllers
#
# DesignWare-based PCIe controllers
#
# CONFIG_PCI_MESON is not set
# CONFIG_PCIE_DW_PLAT_HOST is not set
# end of DesignWare-based PCIe controllers
#
# Mobiveil-based PCIe controllers
#
# end of Mobiveil-based PCIe controllers
#
# PLDA-based PCIe controllers
#
# end of PLDA-based PCIe controllers
# end of PCI controller drivers
#
# PCI Endpoint
#
# CONFIG_PCI_ENDPOINT is not set
# end of PCI Endpoint
#
# PCI switch controller drivers
#
# CONFIG_PCI_SW_SWITCHTEC is not set
# end of PCI switch controller drivers
# CONFIG_PCI_PWRCTRL_GENERIC is not set
# CONFIG_PCI_PWRCTRL_TC9563 is not set
# CONFIG_CXL_BUS is not set
# CONFIG_PCCARD is not set
# CONFIG_RAPIDIO is not set
# CONFIG_PC104 is not set
#
# Generic Driver Options
#
CONFIG_AUXILIARY_BUS=y
# CONFIG_UEVENT_HELPER is not set
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS_SAFE=y
CONFIG_DRIVER_DEFERRED_PROBE_TIMEOUT=10
CONFIG_STANDALONE=y
CONFIG_PREVENT_FIRMWARE_BUILD=y
#
# Firmware loader
#
CONFIG_FW_LOADER=y
CONFIG_FW_LOADER_DEBUG=y
CONFIG_FW_LOADER_PAGED_BUF=y
CONFIG_FW_LOADER_SYSFS=y
CONFIG_EXTRA_FIRMWARE=""
# CONFIG_FW_LOADER_USER_HELPER is not set
CONFIG_FW_LOADER_COMPRESS=y
CONFIG_FW_LOADER_COMPRESS_XZ=y
CONFIG_FW_LOADER_COMPRESS_ZSTD=y
CONFIG_FW_CACHE=y
CONFIG_FW_UPLOAD=y
# end of Firmware loader
CONFIG_WANT_DEV_COREDUMP=y
CONFIG_ALLOW_DEV_COREDUMP=y
CONFIG_DEV_COREDUMP=y
# CONFIG_DEBUG_DRIVER is not set
# CONFIG_DEBUG_DEVRES is not set
# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
CONFIG_HMEM_REPORTING=y
# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
CONFIG_GENERIC_CPU_DEVICES=y
CONFIG_GENERIC_CPU_AUTOPROBE=y
CONFIG_GENERIC_CPU_VULNERABILITIES=y
CONFIG_REGMAP=y
CONFIG_REGMAP_I2C=y
CONFIG_REGMAP_MMIO=y
CONFIG_DMA_SHARED_BUFFER=y
# CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set
# end of Generic Driver Options
#
# Bus devices
#
# CONFIG_MHI_BUS is not set
# CONFIG_MHI_BUS_EP is not set
# end of Bus devices
CONFIG_CONNECTOR=y
CONFIG_PROC_EVENTS=y
#
# Firmware Drivers
#
#
# ARM System Control and Management Interface Protocol
#
# end of ARM System Control and Management Interface Protocol
# CONFIG_EDD is not set
CONFIG_FIRMWARE_MEMMAP=y
CONFIG_DMIID=y
CONFIG_DMI_SYSFS=y
CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
# CONFIG_FW_CFG_SYSFS is not set
CONFIG_SYSFB=y
CONFIG_SYSFB_SIMPLEFB=y
# CONFIG_GOOGLE_FIRMWARE is not set
#
# EFI (Extensible Firmware Interface) Support
#
CONFIG_EFI_ESRT=y
CONFIG_EFI_VARS_PSTORE=y
# CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set
CONFIG_EFI_SOFT_RESERVE=y
CONFIG_EFI_DXE_MEM_ATTRIBUTES=y
CONFIG_EFI_RUNTIME_WRAPPERS=y
# CONFIG_EFI_BOOTLOADER_CONTROL is not set
# CONFIG_EFI_CAPSULE_LOADER is not set
# CONFIG_EFI_TEST is not set
CONFIG_EFI_DEV_PATH_PARSER=y
CONFIG_APPLE_PROPERTIES=y
# CONFIG_RESET_ATTACK_MITIGATION is not set
CONFIG_EFI_RCI2_TABLE=y
# CONFIG_EFI_DISABLE_PCI_DMA is not set
CONFIG_EFI_EARLYCON=y
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS=y
# CONFIG_EFI_DISABLE_RUNTIME is not set
CONFIG_EFI_COCO_SECRET=y
CONFIG_OVMF_DEBUG_LOG=y
CONFIG_EFI_SBAT_FILE=""
# end of EFI (Extensible Firmware Interface) Support
CONFIG_UEFI_CPER=y
CONFIG_UEFI_CPER_X86=y
#
# Qualcomm firmware drivers
#
# CONFIG_QCOM_PAS is not set
# CONFIG_QCOM_SCM is not set
# end of Qualcomm firmware drivers
#
# Tegra firmware driver
#
# end of Tegra firmware driver
# end of Firmware Drivers
CONFIG_FWCTL=y
# CONFIG_GNSS is not set
# CONFIG_MTD is not set
# CONFIG_OF is not set
CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
# CONFIG_PARPORT is not set
CONFIG_PNP=y
# CONFIG_PNP_DEBUG_MESSAGES is not set
#
# Protocols
#
CONFIG_PNPACPI=y
CONFIG_BLK_DEV=y
# CONFIG_BLK_DEV_NULL_BLK is not set
# CONFIG_BLK_DEV_FD is not set
CONFIG_CDROM=y
# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
CONFIG_ZRAM=y
CONFIG_ZRAM_BACKEND_LZ4=y
CONFIG_ZRAM_BACKEND_LZ4HC=y
CONFIG_ZRAM_BACKEND_ZSTD=y
CONFIG_ZRAM_BACKEND_DEFLATE=y
CONFIG_ZRAM_BACKEND_842=y
CONFIG_ZRAM_BACKEND_LZO=y
CONFIG_ZRAM_DEF_COMP_LZORLE=y
# CONFIG_ZRAM_DEF_COMP_LZO is not set
# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
# CONFIG_ZRAM_DEF_COMP_DEFLATE is not set
# CONFIG_ZRAM_DEF_COMP_842 is not set
CONFIG_ZRAM_DEF_COMP="lzo-rle"
CONFIG_ZRAM_WRITEBACK=y
# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set
# CONFIG_ZRAM_MEMORY_TRACKING is not set
CONFIG_ZRAM_MULTI_COMP=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_LOOP_MIN_COUNT=0
# CONFIG_BLK_DEV_DRBD is not set
# CONFIG_BLK_DEV_NBD is not set
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_COUNT=16
CONFIG_BLK_DEV_RAM_SIZE=16384
# CONFIG_ATA_OVER_ETH is not set
CONFIG_VIRTIO_BLK=y
# CONFIG_BLK_DEV_RBD is not set
# CONFIG_BLK_DEV_UBLK is not set
# CONFIG_BLK_DEV_ZONED_LOOP is not set
#
# NVME Support
#
CONFIG_NVME_CORE=y
CONFIG_BLK_DEV_NVME=y
CONFIG_NVME_MULTIPATH=y
# CONFIG_NVME_VERBOSE_ERRORS is not set
CONFIG_NVME_HWMON=y
# CONFIG_NVME_FC is not set
# CONFIG_NVME_TCP is not set
# CONFIG_NVME_HOST_AUTH is not set
CONFIG_NVME_TARGET=y
# CONFIG_NVME_TARGET_DEBUGFS is not set
CONFIG_NVME_TARGET_PASSTHRU=y
# CONFIG_NVME_TARGET_LOOP is not set
# CONFIG_NVME_TARGET_FC is not set
# CONFIG_NVME_TARGET_TCP is not set
# CONFIG_NVME_TARGET_AUTH is not set
# end of NVME Support
#
# Misc devices
#
# CONFIG_AD525X_DPOT is not set
# CONFIG_DUMMY_IRQ is not set
# CONFIG_PHANTOM is not set
# CONFIG_RPMB is not set
# CONFIG_TI_FPC202 is not set
# CONFIG_TIFM_CORE is not set
# CONFIG_ICS932S401 is not set
# CONFIG_ENCLOSURE_SERVICES is not set
# CONFIG_HP_ILO is not set
# CONFIG_APDS9802ALS is not set
# CONFIG_ISL29003 is not set
# CONFIG_ISL29020 is not set
# CONFIG_SENSORS_TSL2550 is not set
# CONFIG_SENSORS_BH1770 is not set
# CONFIG_HMC6352 is not set
# CONFIG_DS1682 is not set
# CONFIG_LATTICE_ECP3_CONFIG is not set
# CONFIG_SRAM is not set
# CONFIG_DW_XDATA_PCIE is not set
# CONFIG_PCI_ENDPOINT_TEST is not set
# CONFIG_XILINX_SDFEC is not set
# CONFIG_NTSYNC is not set
# CONFIG_NSM is not set
# CONFIG_C2PORT is not set
#
# EEPROM support
#
# CONFIG_EEPROM_MAX6875 is not set
# CONFIG_EEPROM_93CX6 is not set
# CONFIG_EEPROM_IDT_89HPESX is not set
# end of EEPROM support
# CONFIG_CB710_CORE is not set
# CONFIG_SENSORS_LIS3_I2C is not set
# CONFIG_ALTERA_STAPL is not set
CONFIG_INTEL_MEI=m
CONFIG_INTEL_MEI_ME=m
CONFIG_INTEL_MEI_TXE=m
CONFIG_INTEL_MEI_GSC=m
# CONFIG_INTEL_MEI_CSC is not set
CONFIG_INTEL_MEI_VSC_HW=m
CONFIG_INTEL_MEI_VSC=m
CONFIG_INTEL_MEI_HDCP=m
CONFIG_INTEL_MEI_PXP=m
CONFIG_INTEL_MEI_GSC_PROXY=m
# CONFIG_VMWARE_VMCI is not set
# CONFIG_GENWQE is not set
# CONFIG_BCM_VK is not set
# CONFIG_MISC_ALCOR_PCI is not set
# CONFIG_MISC_RTSX_PCI is not set
# CONFIG_MISC_RTSX_USB is not set
# CONFIG_UACCE is not set
# CONFIG_PVPANIC is not set
# CONFIG_GP_PCI1XXXX is not set
# CONFIG_KEBA_CP500 is not set
# CONFIG_INTEL_SSEI is not set
# end of Misc devices
#
# SCSI device support
#
CONFIG_SCSI_MOD=y
# CONFIG_RAID_ATTRS is not set
CONFIG_SCSI_COMMON=y
CONFIG_SCSI=y
CONFIG_SCSI_DMA=y
CONFIG_SCSI_PROC_FS=y
#
# SCSI support type (disk, tape, CD-ROM)
#
CONFIG_BLK_DEV_SD=y
# CONFIG_CHR_DEV_ST is not set
CONFIG_BLK_DEV_SR=y
CONFIG_CHR_DEV_SG=y
CONFIG_BLK_DEV_BSG=y
# CONFIG_CHR_DEV_SCH is not set
CONFIG_SCSI_CONSTANTS=y
CONFIG_SCSI_LOGGING=y
CONFIG_SCSI_SCAN_ASYNC=y
#
# SCSI Transports
#
# CONFIG_SCSI_SPI_ATTRS is not set
# CONFIG_SCSI_FC_ATTRS is not set
# CONFIG_SCSI_ISCSI_ATTRS is not set
# CONFIG_SCSI_SAS_ATTRS is not set
# CONFIG_SCSI_SAS_LIBSAS is not set
# CONFIG_SCSI_SRP_ATTRS is not set
# end of SCSI Transports
# CONFIG_SCSI_LOWLEVEL is not set
# CONFIG_SCSI_DH is not set
# end of SCSI device support
CONFIG_ATA=y
CONFIG_SATA_HOST=y
CONFIG_PATA_TIMINGS=y
CONFIG_ATA_VERBOSE_ERROR=y
CONFIG_ATA_FORCE=y
CONFIG_ATA_ACPI=y
# CONFIG_SATA_ZPODD is not set
# CONFIG_SATA_PMP is not set
#
# Controllers with non-SFF native interface
#
CONFIG_SATA_AHCI=y
CONFIG_SATA_MOBILE_LPM_POLICY=3
# CONFIG_SATA_AHCI_PLATFORM is not set
# CONFIG_AHCI_DWC is not set
# CONFIG_SATA_INIC162X is not set
# CONFIG_SATA_ACARD_AHCI is not set
# CONFIG_SATA_SIL24 is not set
# CONFIG_ATA_SFF is not set
CONFIG_MD=y
# CONFIG_BLK_DEV_MD is not set
# CONFIG_BCACHE is not set
CONFIG_BLK_DEV_DM_BUILTIN=y
CONFIG_BLK_DEV_DM=y
# CONFIG_DM_DEBUG is not set
# CONFIG_DM_UNSTRIPED is not set
# CONFIG_DM_CRYPT is not set
# CONFIG_DM_INLINECRYPT is not set
# CONFIG_DM_SNAPSHOT is not set
# CONFIG_DM_THIN_PROVISIONING is not set
# CONFIG_DM_CACHE is not set
# CONFIG_DM_WRITECACHE is not set
# CONFIG_DM_EBS is not set
# CONFIG_DM_ERA is not set
# CONFIG_DM_CLONE is not set
# CONFIG_DM_MIRROR is not set
# CONFIG_DM_RAID is not set
# CONFIG_DM_ZERO is not set
# CONFIG_DM_MULTIPATH is not set
# CONFIG_DM_DELAY is not set
# CONFIG_DM_DUST is not set
# CONFIG_DM_INIT is not set
CONFIG_DM_UEVENT=y
# CONFIG_DM_FLAKEY is not set
# CONFIG_DM_VERITY is not set
# CONFIG_DM_SWITCH is not set
# CONFIG_DM_LOG_WRITES is not set
# CONFIG_DM_INTEGRITY is not set
# CONFIG_DM_ZONED is not set
CONFIG_DM_AUDIT=y
# CONFIG_DM_VDO is not set
# CONFIG_DM_PCACHE is not set
# CONFIG_TARGET_CORE is not set
# CONFIG_FUSION is not set
#
# IEEE 1394 (FireWire) support
#
# CONFIG_FIREWIRE is not set
# CONFIG_FIREWIRE_NOSY is not set
# end of IEEE 1394 (FireWire) support
# CONFIG_MACINTOSH_DRIVERS is not set
CONFIG_NETDEVICES=y
CONFIG_NET_CORE=y
# CONFIG_BONDING is not set
# CONFIG_DUMMY is not set
CONFIG_WIREGUARD=m
# CONFIG_WIREGUARD_DEBUG is not set
# CONFIG_OVPN is not set
# CONFIG_EQUALIZER is not set
# CONFIG_NET_FC is not set
# CONFIG_IFB is not set
# CONFIG_NET_TEAM is not set
# CONFIG_MACVLAN is not set
CONFIG_IPVLAN_L3S=y
CONFIG_IPVLAN=m
CONFIG_IPVTAP=m
# CONFIG_VXLAN is not set
# CONFIG_GENEVE is not set
# CONFIG_BAREUDP is not set
# CONFIG_GTP is not set
# CONFIG_PFCP is not set
# CONFIG_AMT is not set
CONFIG_MACSEC=y
CONFIG_NETCONSOLE=y
CONFIG_NETCONSOLE_DYNAMIC=y
# CONFIG_NETCONSOLE_EXTENDED_LOG is not set
CONFIG_NETPOLL=y
CONFIG_NET_POLL_CONTROLLER=y
CONFIG_TUN=m
CONFIG_TAP=m
# CONFIG_TUN_VNET_CROSS_LE is not set
CONFIG_VETH=m
CONFIG_VIRTIO_NET=y
CONFIG_NLMON=y
CONFIG_NETKIT=y
# CONFIG_NET_VRF is not set
# CONFIG_VSOCKMON is not set
# CONFIG_ARCNET is not set
CONFIG_ETHERNET=y
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_NET_VENDOR_ADAPTEC is not set
# CONFIG_NET_VENDOR_AGERE is not set
# CONFIG_NET_VENDOR_ALACRITECH is not set
# CONFIG_NET_VENDOR_ALIBABA is not set
# CONFIG_ALTERA_TSE is not set
# CONFIG_NET_VENDOR_AMAZON is not set
# CONFIG_NET_VENDOR_AMD is not set
# CONFIG_NET_VENDOR_AQUANTIA is not set
# CONFIG_NET_VENDOR_ARC is not set
# CONFIG_NET_VENDOR_ASIX is not set
# CONFIG_NET_VENDOR_ATHEROS is not set
# CONFIG_CX_ECAT is not set
# CONFIG_NET_VENDOR_BROADCOM is not set
# CONFIG_NET_VENDOR_CADENCE is not set
# CONFIG_NET_VENDOR_CAVIUM is not set
# CONFIG_NET_VENDOR_CHELSIO is not set
# CONFIG_NET_VENDOR_CISCO is not set
# CONFIG_NET_VENDOR_CORTINA is not set
# CONFIG_NET_VENDOR_DAVICOM is not set
# CONFIG_NET_VENDOR_DEC is not set
# CONFIG_NET_VENDOR_DLINK is not set
# CONFIG_NET_VENDOR_EMULEX is not set
# CONFIG_NET_VENDOR_ENGLEDER is not set
# CONFIG_NET_VENDOR_EZCHIP is not set
# CONFIG_NET_VENDOR_FUNGIBLE is not set
# CONFIG_NET_VENDOR_GOOGLE is not set
# CONFIG_NET_VENDOR_HISILICON is not set
# CONFIG_NET_VENDOR_HUAWEI is not set
# CONFIG_NET_VENDOR_I825XX is not set
CONFIG_NET_VENDOR_INTEL=y
# CONFIG_E100 is not set
# CONFIG_E1000 is not set
# CONFIG_E1000E is not set
# CONFIG_IGB is not set
# CONFIG_IGBVF is not set
# CONFIG_IXGBE is not set
# CONFIG_IXGBEVF is not set
# CONFIG_I40E is not set
# CONFIG_I40EVF is not set
# CONFIG_ICE is not set
# CONFIG_FM10K is not set
CONFIG_IGC=y
# CONFIG_IDPF is not set
# CONFIG_IXD is not set
# CONFIG_JME is not set
# CONFIG_NET_VENDOR_ADI is not set
# CONFIG_NET_VENDOR_LITEX is not set
# CONFIG_NET_VENDOR_MARVELL is not set
# CONFIG_NET_VENDOR_MELLANOX is not set
# CONFIG_NET_VENDOR_META is not set
# CONFIG_NET_VENDOR_MICREL is not set
# CONFIG_NET_VENDOR_MICROCHIP is not set
# CONFIG_NET_VENDOR_MICROSEMI is not set
# CONFIG_NET_VENDOR_MICROSOFT is not set
# CONFIG_NET_VENDOR_MUCSE is not set
# CONFIG_NET_VENDOR_MYRI is not set
# CONFIG_FEALNX is not set
# CONFIG_NET_VENDOR_NI is not set
# CONFIG_NET_VENDOR_NATSEMI is not set
# CONFIG_NET_VENDOR_NETRONOME is not set
# CONFIG_NET_VENDOR_NVIDIA is not set
# CONFIG_NET_VENDOR_OKI is not set
# CONFIG_ETHOC is not set
# CONFIG_NET_VENDOR_PENSANDO is not set
# CONFIG_NET_VENDOR_QLOGIC is not set
# CONFIG_NET_VENDOR_BROCADE is not set
# CONFIG_NET_VENDOR_QUALCOMM is not set
# CONFIG_NET_VENDOR_RDC is not set
# CONFIG_NET_VENDOR_REALTEK is not set
# CONFIG_NET_VENDOR_RENESAS is not set
# CONFIG_NET_VENDOR_ROCKER is not set
# CONFIG_NET_VENDOR_SAMSUNG is not set
# CONFIG_NET_VENDOR_SEEQ is not set
# CONFIG_NET_VENDOR_SILAN is not set
# CONFIG_NET_VENDOR_SIS is not set
# CONFIG_NET_VENDOR_SOLARFLARE is not set
# CONFIG_NET_VENDOR_SMSC is not set
# CONFIG_NET_VENDOR_SOCIONEXT is not set
# CONFIG_NET_VENDOR_STMICRO is not set
# CONFIG_NET_VENDOR_SUN is not set
# CONFIG_NET_VENDOR_SYNOPSYS is not set
# CONFIG_NET_VENDOR_TEHUTI is not set
# CONFIG_NET_VENDOR_TI is not set
# CONFIG_NET_VENDOR_VERTEXCOM is not set
# CONFIG_NET_VENDOR_VIA is not set
# CONFIG_NET_VENDOR_WANGXUN is not set
# CONFIG_NET_VENDOR_WIZNET is not set
# CONFIG_NET_VENDOR_XILINX is not set
# CONFIG_NET_VENDOR_ZTE is not set
# CONFIG_FDDI is not set
CONFIG_PHYLIB=y
CONFIG_LED_TRIGGER_PHY=y
# CONFIG_FIXED_PHY is not set
#
# MII PHY device drivers
#
# CONFIG_AS21XXX_PHY is not set
# CONFIG_AIR_AN8801_PHY is not set
# CONFIG_AIR_EN8811H_PHY is not set
# CONFIG_AMD_PHY is not set
# CONFIG_ADIN_PHY is not set
# CONFIG_ADIN1100_PHY is not set
# CONFIG_ADIN1140_PHY is not set
# CONFIG_AQUANTIA_PHY is not set
# CONFIG_AX88796B_PHY is not set
# CONFIG_BROADCOM_PHY is not set
# CONFIG_BCM54140_PHY is not set
# CONFIG_BCM7XXX_PHY is not set
# CONFIG_BCM84881_PHY is not set
# CONFIG_BCM87XX_PHY is not set
# CONFIG_CICADA_PHY is not set
# CONFIG_CORTINA_PHY is not set
# CONFIG_DAVICOM_PHY is not set
# CONFIG_ICPLUS_PHY is not set
# CONFIG_LXT_PHY is not set
# CONFIG_INTEL_XWAY_PHY is not set
# CONFIG_LSI_ET1011C_PHY is not set
# CONFIG_MARVELL_PHY is not set
# CONFIG_MARVELL_10G_PHY is not set
# CONFIG_MARVELL_88Q2XXX_PHY is not set
# CONFIG_MARVELL_88X2222_PHY is not set
# CONFIG_MAXLINEAR_GPHY is not set
# CONFIG_MAXLINEAR_86110_PHY is not set
# CONFIG_MEDIATEK_GE_PHY is not set
# CONFIG_MICREL_PHY is not set
# CONFIG_MICROCHIP_T1S_PHY is not set
# CONFIG_MICROCHIP_PHY is not set
# CONFIG_MICROCHIP_T1_PHY is not set
# CONFIG_MICROSEMI_PHY is not set
# CONFIG_MOTORCOMM_PHY is not set
# CONFIG_NATIONAL_PHY is not set
# CONFIG_NXP_CBTX_PHY is not set
# CONFIG_NXP_C45_TJA11XX_PHY is not set
# CONFIG_NXP_TJA11XX_PHY is not set
# CONFIG_NCN26000_PHY is not set
# CONFIG_QCA83XX_PHY is not set
# CONFIG_QCA808X_PHY is not set
# CONFIG_QSEMI_PHY is not set
# CONFIG_REALTEK_PHY is not set
# CONFIG_RENESAS_PHY is not set
# CONFIG_ROCKCHIP_PHY is not set
# CONFIG_SMSC_PHY is not set
# CONFIG_STE10XP is not set
# CONFIG_TERANETICS_PHY is not set
# CONFIG_DP83822_PHY is not set
# CONFIG_DP83TC811_PHY is not set
# CONFIG_DP83848_PHY is not set
# CONFIG_DP83867_PHY is not set
# CONFIG_DP83869_PHY is not set
# CONFIG_DP83TD510_PHY is not set
# CONFIG_DP83TG720_PHY is not set
# CONFIG_VITESSE_PHY is not set
# CONFIG_XILINX_GMII2RGMII is not set
#
# MCTP Device Drivers
#
# CONFIG_MCTP_SERIAL is not set
# CONFIG_MCTP_TRANSPORT_USBLIB is not set
# CONFIG_MCTP_TRANSPORT_USB is not set
# end of MCTP Device Drivers
#
# MDIO controller drivers
#
CONFIG_FWNODE_MDIO=y
CONFIG_ACPI_MDIO=y
# CONFIG_MDIO_BITBANG is not set
# CONFIG_MDIO_BCM_UNIMAC is not set
# CONFIG_MDIO_MVUSB is not set
# CONFIG_MDIO_MSCC_MIIM is not set
# CONFIG_MDIO_THUNDER is not set
#
# MDIO Multiplexers
#
# end of MDIO Multiplexers
# end of MDIO controller drivers
#
# PCS device drivers
#
# CONFIG_PCS_XPCS is not set
# end of PCS device drivers
# CONFIG_PPP is not set
# CONFIG_SLIP is not set
# CONFIG_USB_NET_DRIVERS is not set
CONFIG_WLAN=y
# CONFIG_WLAN_VENDOR_ADMTEK is not set
# CONFIG_WLAN_VENDOR_ATH is not set
# CONFIG_WLAN_VENDOR_ATMEL is not set
# CONFIG_WLAN_VENDOR_BROADCOM is not set
CONFIG_WLAN_VENDOR_INTEL=y
# CONFIG_IPW2100 is not set
# CONFIG_IPW2200 is not set
# CONFIG_IWL4965 is not set
# CONFIG_IWL3945 is not set
CONFIG_IWLWIFI=m
CONFIG_IWLWIFI_LEDS=y
CONFIG_IWLDVM=m
CONFIG_IWLMVM=m
CONFIG_IWLMLD=m
CONFIG_IWLWIFI_OPMODE_MODULAR=y
#
# Debugging Options
#
CONFIG_IWLWIFI_DEBUG=y
CONFIG_IWLWIFI_DEBUGFS=y
# CONFIG_IWLWIFI_DEVICE_TRACING is not set
# end of Debugging Options
# CONFIG_WLAN_VENDOR_INTERSIL is not set
# CONFIG_WLAN_VENDOR_MARVELL is not set
# CONFIG_WLAN_VENDOR_MEDIATEK is not set
# CONFIG_WLAN_VENDOR_MICROCHIP is not set
CONFIG_WLAN_VENDOR_MORSEMICRO=y
# CONFIG_MM81X_USB is not set
CONFIG_WLAN_VENDOR_NXP=y
# CONFIG_WLAN_VENDOR_PURELIFI is not set
# CONFIG_WLAN_VENDOR_RALINK is not set
# CONFIG_WLAN_VENDOR_REALTEK is not set
# CONFIG_WLAN_VENDOR_RSI is not set
# CONFIG_WLAN_VENDOR_SILABS is not set
# CONFIG_WLAN_VENDOR_ST is not set
# CONFIG_WLAN_VENDOR_TI is not set
# CONFIG_WLAN_VENDOR_ZYDAS is not set
# CONFIG_WLAN_VENDOR_QUANTENNA is not set
# CONFIG_MAC80211_HWSIM is not set
# CONFIG_VIRT_WIFI is not set
# CONFIG_WAN is not set
#
# Wireless WAN
#
# CONFIG_WWAN is not set
# end of Wireless WAN
# CONFIG_VMXNET3 is not set
# CONFIG_FUJITSU_ES is not set
# CONFIG_USB4_NET is not set
# CONFIG_NETDEVSIM is not set
CONFIG_NET_FAILOVER=y
#
# Input device support
#
CONFIG_INPUT=y
CONFIG_INPUT_LEDS=y
# CONFIG_INPUT_FF_MEMLESS is not set
# CONFIG_INPUT_SPARSEKMAP is not set
# CONFIG_INPUT_MATRIXKMAP is not set
CONFIG_INPUT_VIVALDIFMAP=y
#
# Userland interfaces
#
CONFIG_INPUT_MOUSEDEV=y
# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
# CONFIG_INPUT_JOYDEV is not set
CONFIG_INPUT_EVDEV=y
#
# Input Device Drivers
#
CONFIG_INPUT_KEYBOARD=y
# CONFIG_KEYBOARD_ADP5588 is not set
# CONFIG_KEYBOARD_APPLESPI is not set
CONFIG_KEYBOARD_ATKBD=y
# CONFIG_KEYBOARD_QT1050 is not set
# CONFIG_KEYBOARD_QT1070 is not set
# CONFIG_KEYBOARD_QT2160 is not set
# CONFIG_KEYBOARD_DLINK_DIR685 is not set
# CONFIG_KEYBOARD_LKKBD is not set
# CONFIG_KEYBOARD_GPIO is not set
# CONFIG_KEYBOARD_GPIO_POLLED is not set
# CONFIG_KEYBOARD_TCA8418 is not set
# CONFIG_KEYBOARD_MATRIX is not set
# CONFIG_KEYBOARD_CHARLIEPLEX is not set
# CONFIG_KEYBOARD_LM8323 is not set
# CONFIG_KEYBOARD_LM8333 is not set
# CONFIG_KEYBOARD_MAX7359 is not set
# CONFIG_KEYBOARD_MPR121 is not set
# CONFIG_KEYBOARD_NEWTON is not set
# CONFIG_KEYBOARD_OPENCORES is not set
# CONFIG_KEYBOARD_SAMSUNG is not set
# CONFIG_KEYBOARD_STOWAWAY is not set
# CONFIG_KEYBOARD_SUNKBD is not set
# CONFIG_KEYBOARD_TM2_TOUCHKEY is not set
# CONFIG_KEYBOARD_XTKBD is not set
# CONFIG_KEYBOARD_CYPRESS_SF is not set
CONFIG_INPUT_MOUSE=y
# CONFIG_MOUSE_PS2 is not set
# CONFIG_MOUSE_SERIAL is not set
# CONFIG_MOUSE_APPLETOUCH is not set
# CONFIG_MOUSE_BCM5974 is not set
# CONFIG_MOUSE_CYAPA is not set
# CONFIG_MOUSE_ELAN_I2C is not set
# CONFIG_MOUSE_VSXXXAA is not set
# CONFIG_MOUSE_GPIO is not set
# CONFIG_MOUSE_SYNAPTICS_I2C is not set
# CONFIG_MOUSE_SYNAPTICS_USB is not set
# CONFIG_INPUT_JOYSTICK is not set
# CONFIG_INPUT_TABLET is not set
# CONFIG_INPUT_TOUCHSCREEN is not set
# CONFIG_INPUT_MISC is not set
# CONFIG_RMI4_CORE is not set
#
# Hardware I/O ports
#
CONFIG_SERIO=y
CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
CONFIG_SERIO_I8042=y
CONFIG_SERIO_SERPORT=y
# CONFIG_SERIO_PCIPS2 is not set
CONFIG_SERIO_LIBPS2=y
# CONFIG_SERIO_RAW is not set
# CONFIG_SERIO_ALTERA_PS2 is not set
# CONFIG_SERIO_PS2MULT is not set
# CONFIG_SERIO_ARC_PS2 is not set
# CONFIG_SERIO_GPIO_PS2 is not set
# CONFIG_USERIO is not set
# CONFIG_GAMEPORT is not set
# end of Hardware I/O ports
# end of Input device support
#
# Character devices
#
CONFIG_TTY=y
CONFIG_VT=y
CONFIG_CONSOLE_TRANSLATIONS=y
CONFIG_VT_CONSOLE=y
CONFIG_VT_CONSOLE_SLEEP=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_UNIX98_PTYS=y
# CONFIG_LEGACY_PTYS is not set
# CONFIG_LEGACY_TIOCSTI is not set
CONFIG_LDISC_AUTOLOAD=y
#
# Serial drivers
#
CONFIG_SERIAL_EARLYCON=y
CONFIG_SERIAL_8250=y
CONFIG_SERIAL_8250_PNP=y
# CONFIG_SERIAL_8250_16550A_VARIANTS is not set
# CONFIG_SERIAL_8250_FINTEK is not set
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_8250_DMA=y
CONFIG_SERIAL_8250_PCILIB=y
CONFIG_SERIAL_8250_PCI=y
# CONFIG_SERIAL_8250_EXAR is not set
CONFIG_SERIAL_8250_MOXA_PCIE=y
CONFIG_SERIAL_8250_NR_UARTS=32
CONFIG_SERIAL_8250_RUNTIME_UARTS=32
# CONFIG_SERIAL_8250_EXTENDED is not set
# CONFIG_SERIAL_8250_PCI1XXXX is not set
# CONFIG_SERIAL_8250_DW is not set
# CONFIG_SERIAL_8250_RT288X is not set
# CONFIG_SERIAL_8250_LPSS is not set
# CONFIG_SERIAL_8250_MID is not set
# CONFIG_SERIAL_8250_PERICOM is not set
# CONFIG_SERIAL_8250_NI is not set
#
# Non-8250 serial port support
#
# CONFIG_SERIAL_MAX3100 is not set
# CONFIG_SERIAL_MAX310X is not set
# CONFIG_SERIAL_UARTLITE is not set
CONFIG_SERIAL_CORE=y
CONFIG_SERIAL_CORE_CONSOLE=y
CONFIG_CONSOLE_POLL=y
# CONFIG_SERIAL_JSM is not set
# CONFIG_SERIAL_LANTIQ is not set
# CONFIG_SERIAL_SCCNXP is not set
# CONFIG_SERIAL_SC16IS7XX is not set
# CONFIG_SERIAL_ALTERA_JTAGUART is not set
# CONFIG_SERIAL_ALTERA_UART is not set
# CONFIG_SERIAL_ARC is not set
# CONFIG_SERIAL_RP2 is not set
# CONFIG_SERIAL_FSL_LPUART is not set
# CONFIG_SERIAL_FSL_LINFLEXUART is not set
# CONFIG_SERIAL_SPRD is not set
# end of Serial drivers
CONFIG_SERIAL_MCTRL_GPIO=y
# CONFIG_SERIAL_NONSTANDARD is not set
# CONFIG_N_GSM is not set
# CONFIG_NOZOMI is not set
# CONFIG_NULL_TTY is not set
CONFIG_HVC_DRIVER=y
CONFIG_SERIAL_DEV_BUS=y
CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
# CONFIG_TTY_PRINTK is not set
CONFIG_VIRTIO_CONSOLE=y
# CONFIG_IPMI_HANDLER is not set
CONFIG_HW_RANDOM=y
CONFIG_HW_RANDOM_TIMERIOMEM=y
CONFIG_HW_RANDOM_INTEL=y
# CONFIG_HW_RANDOM_AMD is not set
# CONFIG_HW_RANDOM_BA431 is not set
# CONFIG_HW_RANDOM_VIA is not set
CONFIG_HW_RANDOM_VIRTIO=y
# CONFIG_HW_RANDOM_XIPHERA is not set
CONFIG_DEVMEM=y
CONFIG_NVRAM=y
CONFIG_DEVPORT=y
CONFIG_HPET=y
# CONFIG_HPET_MMAP is not set
CONFIG_HANGCHECK_TIMER=m
CONFIG_TCG_TPM=y
# CONFIG_TCG_TPM2_HMAC is not set
CONFIG_HW_RANDOM_TPM=y
CONFIG_TCG_TIS_CORE=y
CONFIG_TCG_TIS=y
CONFIG_TCG_TIS_SPI=m
CONFIG_TCG_TIS_SPI_CR50=y
CONFIG_TCG_TIS_I2C=m
CONFIG_TCG_TIS_I2C_CR50=m
# CONFIG_TCG_TIS_I2C_ATMEL is not set
CONFIG_TCG_TIS_I2C_INFINEON=m
CONFIG_TCG_TIS_I2C_NUVOTON=m
CONFIG_TCG_NSC=m
CONFIG_TCG_ATMEL=m
CONFIG_TCG_INFINEON=m
CONFIG_TCG_CRB=y
CONFIG_TCG_VTPM_PROXY=m
# CONFIG_TCG_TIS_ST33ZP24_I2C is not set
# CONFIG_TCG_TIS_ST33ZP24_SPI is not set
# CONFIG_TELCLOCK is not set
# CONFIG_XILLYBUS is not set
# CONFIG_XILLYUSB is not set
# end of Character devices
#
# I2C support
#
CONFIG_I2C=y
CONFIG_ACPI_I2C_OPREGION=y
CONFIG_I2C_BOARDINFO=y
CONFIG_I2C_CHARDEV=y
CONFIG_I2C_MUX=y
#
# Multiplexer I2C Chip support
#
# CONFIG_I2C_MUX_GPIO is not set
# CONFIG_I2C_MUX_LTC4306 is not set
# CONFIG_I2C_MUX_PCA9541 is not set
# CONFIG_I2C_MUX_PCA954x is not set
# CONFIG_I2C_MUX_REG is not set
# CONFIG_I2C_MUX_MLXCPLD is not set
# end of Multiplexer I2C Chip support
CONFIG_I2C_HELPER_AUTO=y
CONFIG_I2C_SMBUS=y
CONFIG_I2C_ALGOBIT=m
#
# I2C Hardware Bus support
#
#
# PC SMBus host controller drivers
#
# CONFIG_I2C_ALI1535 is not set
# CONFIG_I2C_ALI1563 is not set
# CONFIG_I2C_ALI15X3 is not set
# CONFIG_I2C_AMD756 is not set
# CONFIG_I2C_AMD8111 is not set
# CONFIG_I2C_AMD_MP2 is not set
CONFIG_I2C_I801=y
# CONFIG_I2C_ISCH is not set
# CONFIG_I2C_ISMT is not set
# CONFIG_I2C_PIIX4 is not set
# CONFIG_I2C_NFORCE2 is not set
# CONFIG_I2C_NVIDIA_GPU is not set
# CONFIG_I2C_SIS5595 is not set
# CONFIG_I2C_SIS630 is not set
# CONFIG_I2C_SIS96X is not set
# CONFIG_I2C_VIA is not set
# CONFIG_I2C_VIAPRO is not set
# CONFIG_I2C_ZHAOXIN is not set
#
# ACPI drivers
#
# CONFIG_I2C_SCMI is not set
#
# I2C system bus drivers (mostly embedded / system-on-chip)
#
# CONFIG_I2C_CBUS_GPIO is not set
# CONFIG_I2C_DESIGNWARE_CORE is not set
# CONFIG_I2C_EMEV2 is not set
# CONFIG_I2C_GPIO is not set
# CONFIG_I2C_OCORES is not set
# CONFIG_I2C_PCA_PLATFORM is not set
# CONFIG_I2C_SIMTEC is not set
# CONFIG_I2C_XILINX is not set
#
# External I2C/SMBus adapter drivers
#
# CONFIG_I2C_DIOLAN_U2C is not set
# CONFIG_I2C_CP2615 is not set
# CONFIG_I2C_PCI1XXXX is not set
# CONFIG_I2C_ROBOTFUZZ_OSIF is not set
# CONFIG_I2C_TAOS_EVM is not set
# CONFIG_I2C_TINY_USB is not set
#
# Other I2C/SMBus bus drivers
#
# CONFIG_I2C_MLXCPLD is not set
# CONFIG_I2C_VIRTIO is not set
# end of I2C Hardware Bus support
# CONFIG_I2C_STUB is not set
# CONFIG_I2C_SLAVE is not set
# CONFIG_I2C_DEBUG_CORE is not set
# CONFIG_I2C_DEBUG_ALGO is not set
# CONFIG_I2C_DEBUG_BUS is not set
# end of I2C support
# CONFIG_I3C is not set
CONFIG_I3C_OR_I2C=y
CONFIG_SPI=y
# CONFIG_SPI_DEBUG is not set
CONFIG_SPI_MASTER=y
CONFIG_SPI_MEM=y
#
# SPI Master Controller Drivers
#
# CONFIG_SPI_ALTERA is not set
# CONFIG_SPI_AXI_SPI_ENGINE is not set
# CONFIG_SPI_BITBANG is not set
# CONFIG_SPI_CADENCE is not set
# CONFIG_SPI_CH341 is not set
# CONFIG_SPI_DESIGNWARE is not set
# CONFIG_SPI_GPIO is not set
CONFIG_SPI_INTEL=y
CONFIG_SPI_INTEL_PCI=y
# CONFIG_SPI_INTEL_PLATFORM is not set
# CONFIG_SPI_MICROCHIP_CORE_QSPI is not set
# CONFIG_SPI_MICROCHIP_CORE_SPI is not set
# CONFIG_SPI_LANTIQ_SSC is not set
# CONFIG_SPI_OC_TINY is not set
# CONFIG_SPI_PCI1XXXX is not set
# CONFIG_SPI_PXA2XX is not set
# CONFIG_SPI_SC18IS602 is not set
# CONFIG_SPI_SIFIVE is not set
# CONFIG_SPI_MXIC is not set
# CONFIG_SPI_VIRTIO is not set
# CONFIG_SPI_XCOMM is not set
# CONFIG_SPI_XILINX is not set
# CONFIG_SPI_ZYNQMP_GQSPI is not set
# CONFIG_SPI_AMD is not set
#
# SPI Multiplexer support
#
CONFIG_SPI_MUX=y
#
# SPI Protocol Masters
#
CONFIG_SPI_SPIDEV=y
# CONFIG_SPI_LOOPBACK_TEST is not set
# CONFIG_SPI_TLE62X0 is not set
# CONFIG_SPI_SLAVE is not set
CONFIG_SPI_DYNAMIC=y
# CONFIG_SPMI is not set
# CONFIG_HSI is not set
CONFIG_PPS=y
# CONFIG_PPS_DEBUG is not set
#
# PPS clients support
#
# CONFIG_PPS_CLIENT_KTIMER is not set
# CONFIG_PPS_CLIENT_LDISC is not set
# CONFIG_PPS_CLIENT_GPIO is not set
# CONFIG_PPS_GENERATOR is not set
#
# PTP clock support
#
CONFIG_PTP_1588_CLOCK=y
CONFIG_PTP_1588_CLOCK_OPTIONAL=y
# CONFIG_DP83640_PHY is not set
# CONFIG_PTP_1588_CLOCK_INES is not set
CONFIG_PTP_1588_CLOCK_VMCLOCK=m
# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set
# CONFIG_PTP_1588_CLOCK_IDTCM is not set
# CONFIG_PTP_1588_CLOCK_FC3W is not set
# CONFIG_PTP_1588_CLOCK_MOCK is not set
# CONFIG_PTP_NETC_V4_TIMER is not set
# end of PTP clock support
#
# DPLL device support
#
# CONFIG_ZL3073X_I2C is not set
# CONFIG_ZL3073X_SPI is not set
# end of DPLL device support
CONFIG_PINCTRL=y
CONFIG_PINMUX=y
CONFIG_PINCONF=y
CONFIG_GENERIC_PINCONF=y
# CONFIG_DEBUG_PINCTRL is not set
# CONFIG_PINCTRL_AMD is not set
# CONFIG_PINCTRL_CY8C95X0 is not set
# CONFIG_PINCTRL_MCP23S08 is not set
# CONFIG_PINCTRL_SX150X is not set
#
# Intel pinctrl drivers
#
# CONFIG_PINCTRL_BAYTRAIL is not set
# CONFIG_PINCTRL_CHERRYVIEW is not set
# CONFIG_PINCTRL_LYNXPOINT is not set
CONFIG_PINCTRL_INTEL=y
CONFIG_PINCTRL_INTEL_PLATFORM=y
# CONFIG_PINCTRL_ALDERLAKE is not set
# CONFIG_PINCTRL_BROXTON is not set
# CONFIG_PINCTRL_CANNONLAKE is not set
# CONFIG_PINCTRL_CEDARFORK is not set
# CONFIG_PINCTRL_DENVERTON is not set
# CONFIG_PINCTRL_ELKHARTLAKE is not set
# CONFIG_PINCTRL_EMMITSBURG is not set
# CONFIG_PINCTRL_GEMINILAKE is not set
# CONFIG_PINCTRL_ICELAKE is not set
# CONFIG_PINCTRL_JASPERLAKE is not set
# CONFIG_PINCTRL_LAKEFIELD is not set
# CONFIG_PINCTRL_LEWISBURG is not set
# CONFIG_PINCTRL_METEORLAKE is not set
# CONFIG_PINCTRL_METEORPOINT is not set
# CONFIG_PINCTRL_SUNRISEPOINT is not set
CONFIG_PINCTRL_TIGERLAKE=y
# end of Intel pinctrl drivers
#
# Renesas pinctrl drivers
#
# end of Renesas pinctrl drivers
CONFIG_GPIOLIB_LEGACY=y
CONFIG_GPIOLIB=y
CONFIG_GPIOLIB_FASTPATH_LIMIT=512
CONFIG_GPIO_ACPI=y
CONFIG_GPIOLIB_IRQCHIP=y
# CONFIG_DEBUG_GPIO is not set
# CONFIG_GPIO_SYSFS is not set
CONFIG_GPIO_CDEV=y
# CONFIG_GPIO_CDEV_V1 is not set
#
# Memory mapped GPIO drivers
#
# CONFIG_GPIO_ALTERA is not set
# CONFIG_GPIO_AMDPT is not set
# CONFIG_GPIO_BY_PINCTRL is not set
# CONFIG_GPIO_DWAPB is not set
# CONFIG_GPIO_GENERIC_PLATFORM is not set
# CONFIG_GPIO_GRANITERAPIDS is not set
# CONFIG_GPIO_MB86S7X is not set
# CONFIG_GPIO_POLARFIRE_SOC is not set
# CONFIG_GPIO_WAVESHARE_DSI_TOUCH is not set
# CONFIG_GPIO_XILINX is not set
# CONFIG_GPIO_AMD_FCH is not set
# end of Memory mapped GPIO drivers
#
# Port-mapped I/O GPIO drivers
#
# CONFIG_GPIO_VX855 is not set
# CONFIG_GPIO_F7188X is not set
# CONFIG_GPIO_IT87 is not set
# CONFIG_GPIO_NOVALAKE is not set
# CONFIG_GPIO_SCH311X is not set
# CONFIG_GPIO_WINBOND is not set
# CONFIG_GPIO_WS16C48 is not set
# end of Port-mapped I/O GPIO drivers
#
# I2C GPIO expanders
#
# CONFIG_GPIO_FXL6408 is not set
# CONFIG_GPIO_DS4520 is not set
# CONFIG_GPIO_MAX7300 is not set
# CONFIG_GPIO_MAX732X is not set
# CONFIG_GPIO_PCA953X is not set
# CONFIG_GPIO_PCA9570 is not set
# CONFIG_GPIO_PCF857X is not set
# CONFIG_GPIO_TPIC2810 is not set
# end of I2C GPIO expanders
#
# MFD GPIO expanders
#
# end of MFD GPIO expanders
#
# Auxiliary Bus GPIO drivers
#
# end of Auxiliary Bus GPIO drivers
#
# PCI GPIO expanders
#
# CONFIG_GPIO_AMD8111 is not set
# CONFIG_GPIO_BT8XX is not set
# CONFIG_GPIO_ML_IOH is not set
# CONFIG_GPIO_PCI_IDIO_16 is not set
# CONFIG_GPIO_PCIE_IDIO_24 is not set
# CONFIG_GPIO_RDC321X is not set
# end of PCI GPIO expanders
#
# SPI GPIO expanders
#
# CONFIG_GPIO_74X164 is not set
# CONFIG_GPIO_MAX3191X is not set
# CONFIG_GPIO_MAX7301 is not set
# CONFIG_GPIO_MC33880 is not set
# CONFIG_GPIO_PISOSR is not set
# CONFIG_GPIO_XRA1403 is not set
# end of SPI GPIO expanders
#
# USB GPIO expanders
#
# CONFIG_GPIO_MPSSE is not set
# end of USB GPIO expanders
#
# Virtual GPIO drivers
#
CONFIG_GPIO_AGGREGATOR=m
# CONFIG_GPIO_LATCH is not set
# CONFIG_GPIO_MOCKUP is not set
# CONFIG_GPIO_VIRTIO is not set
# CONFIG_GPIO_SIM is not set
# end of Virtual GPIO drivers
#
# GPIO Debugging utilities
#
# CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER is not set
# CONFIG_GPIO_VIRTUSER is not set
# end of GPIO Debugging utilities
# CONFIG_W1 is not set
CONFIG_POWER_RESET=y
# CONFIG_POWER_RESET_RESTART is not set
# CONFIG_POWER_RESET_QEMU_VIRT_CTRL is not set
# CONFIG_POWER_SEQUENCING is not set
CONFIG_POWER_SUPPLY=y
# CONFIG_POWER_SUPPLY_DEBUG is not set
CONFIG_POWER_SUPPLY_HWMON=y
# CONFIG_IP5XXX_POWER is not set
# CONFIG_TEST_POWER is not set
# CONFIG_CHARGER_ADP5061 is not set
# CONFIG_BATTERY_CHAGALL is not set
# CONFIG_BATTERY_CW2015 is not set
# CONFIG_BATTERY_DS2780 is not set
# CONFIG_BATTERY_DS2781 is not set
# CONFIG_BATTERY_DS2782 is not set
# CONFIG_BATTERY_SAMSUNG_SDI is not set
# CONFIG_BATTERY_S2MU005 is not set
# CONFIG_BATTERY_SBS is not set
# CONFIG_CHARGER_SBS is not set
# CONFIG_MANAGER_SBS is not set
# CONFIG_BATTERY_BQ27XXX is not set
# CONFIG_BATTERY_MAX17042 is not set
# CONFIG_BATTERY_MAX1720X is not set
# CONFIG_CHARGER_MAX8903 is not set
# CONFIG_CHARGER_LP8727 is not set
# CONFIG_CHARGER_GPIO is not set
# CONFIG_CHARGER_LT3651 is not set
# CONFIG_CHARGER_LTC4162L is not set
# CONFIG_CHARGER_MAX77976 is not set
# CONFIG_CHARGER_MAX8971 is not set
# CONFIG_CHARGER_BQ2415X is not set
# CONFIG_CHARGER_BQ24257 is not set
# CONFIG_CHARGER_BQ24735 is not set
# CONFIG_CHARGER_BQ2515X is not set
# CONFIG_CHARGER_BQ25890 is not set
# CONFIG_CHARGER_BQ25980 is not set
# CONFIG_CHARGER_BQ25630 is not set
# CONFIG_CHARGER_BQ256XX is not set
# CONFIG_BATTERY_GAUGE_LTC2941 is not set
# CONFIG_BATTERY_GOLDFISH is not set
# CONFIG_BATTERY_RT5033 is not set
# CONFIG_CHARGER_RT9455 is not set
# CONFIG_CHARGER_RT9756 is not set
# CONFIG_FUEL_GAUGE_STC3117 is not set
# CONFIG_CHARGER_BD99954 is not set
# CONFIG_BATTERY_UG3105 is not set
# CONFIG_BATTERY_CHARGER_SURFACE_RT is not set
# CONFIG_FUEL_GAUGE_MM8013 is not set
CONFIG_HWMON=y
CONFIG_HWMON_VID=y
# CONFIG_HWMON_DEBUG_CHIP is not set
#
# Native drivers
#
# CONFIG_SENSORS_ABITUGURU is not set
# CONFIG_SENSORS_ABITUGURU3 is not set
# CONFIG_SENSORS_AD7314 is not set
# CONFIG_SENSORS_AD7414 is not set
# CONFIG_SENSORS_AD7418 is not set
# CONFIG_SENSORS_ADM1025 is not set
# CONFIG_SENSORS_ADM1026 is not set
# CONFIG_SENSORS_ADM1029 is not set
# CONFIG_SENSORS_ADM1031 is not set
# CONFIG_SENSORS_ADM1177 is not set
# CONFIG_SENSORS_ADM9240 is not set
# CONFIG_SENSORS_ADT7310 is not set
# CONFIG_SENSORS_ADT7410 is not set
# CONFIG_SENSORS_ADT7411 is not set
# CONFIG_SENSORS_ADT7462 is not set
# CONFIG_SENSORS_ADT7470 is not set
# CONFIG_SENSORS_ADT7475 is not set
# CONFIG_SENSORS_AHT10 is not set
# CONFIG_SENSORS_AQUACOMPUTER_D5NEXT is not set
# CONFIG_SENSORS_AS370 is not set
# CONFIG_SENSORS_ASC7621 is not set
# CONFIG_SENSORS_ASUS_ROG_RYUJIN is not set
# CONFIG_SENSORS_AXI_FAN_CONTROL is not set
# CONFIG_SENSORS_K8TEMP is not set
# CONFIG_SENSORS_KB9002 is not set
# CONFIG_SENSORS_APPLESMC is not set
# CONFIG_SENSORS_ARCTIC_FAN_CONTROLLER is not set
# CONFIG_SENSORS_ASB100 is not set
# CONFIG_SENSORS_ATXP1 is not set
# CONFIG_SENSORS_CHIPCAP2 is not set
# CONFIG_SENSORS_CORSAIR_CPRO is not set
# CONFIG_SENSORS_CORSAIR_PSU is not set
CONFIG_SENSORS_DRIVETEMP=y
# CONFIG_SENSORS_DS620 is not set
# CONFIG_SENSORS_DS1621 is not set
# CONFIG_SENSORS_DELL_SMM is not set
# CONFIG_SENSORS_I5K_AMB is not set
# CONFIG_SENSORS_F71805F is not set
# CONFIG_SENSORS_F71882FG is not set
# CONFIG_SENSORS_F75375S is not set
# CONFIG_SENSORS_FSCHMD is not set
# CONFIG_SENSORS_GIGABYTE_WATERFORCE is not set
# CONFIG_SENSORS_GL518SM is not set
# CONFIG_SENSORS_GL520SM is not set
# CONFIG_SENSORS_GPD is not set
# CONFIG_SENSORS_G760A is not set
# CONFIG_SENSORS_G762 is not set
# CONFIG_SENSORS_GPIO_FAN is not set
# CONFIG_SENSORS_HIH6130 is not set
# CONFIG_SENSORS_HS3001 is not set
# CONFIG_SENSORS_HTU31 is not set
# CONFIG_SENSORS_I5500 is not set
CONFIG_SENSORS_CORETEMP=y
# CONFIG_SENSORS_ISL28022 is not set
# CONFIG_SENSORS_IT87 is not set
CONFIG_SENSORS_JC42=y
# CONFIG_SENSORS_POWERZ is not set
# CONFIG_SENSORS_POWR1220 is not set
# CONFIG_SENSORS_PROM21_XHCI is not set
# CONFIG_SENSORS_LATTEPANDA_SIGMA_EC is not set
# CONFIG_SENSORS_LENOVO_EC is not set
# CONFIG_SENSORS_LINEAGE is not set
# CONFIG_SENSORS_LTC2945 is not set
# CONFIG_SENSORS_LTC2947_I2C is not set
# CONFIG_SENSORS_LTC2947_SPI is not set
# CONFIG_SENSORS_LTC2990 is not set
# CONFIG_SENSORS_LTC2991 is not set
# CONFIG_SENSORS_LTC2992 is not set
# CONFIG_SENSORS_LTC4151 is not set
# CONFIG_SENSORS_LTC4215 is not set
# CONFIG_SENSORS_LTC4222 is not set
# CONFIG_SENSORS_LTC4245 is not set
# CONFIG_SENSORS_LTC4260 is not set
# CONFIG_SENSORS_LTC4261 is not set
# CONFIG_SENSORS_LTC4282 is not set
# CONFIG_SENSORS_LTC4283 is not set
# CONFIG_SENSORS_MAX1111 is not set
# CONFIG_SENSORS_MAX127 is not set
# CONFIG_SENSORS_MAX16065 is not set
# CONFIG_SENSORS_MAX1619 is not set
# CONFIG_SENSORS_MAX1668 is not set
# CONFIG_SENSORS_MAX197 is not set
# CONFIG_SENSORS_MAX31722 is not set
# CONFIG_SENSORS_MAX31730 is not set
# CONFIG_SENSORS_MAX31760 is not set
# CONFIG_MAX31827 is not set
# CONFIG_SENSORS_MAX6620 is not set
# CONFIG_SENSORS_MAX6621 is not set
# CONFIG_SENSORS_MAX6639 is not set
# CONFIG_SENSORS_MAX6650 is not set
# CONFIG_SENSORS_MAX6697 is not set
# CONFIG_SENSORS_MAX31790 is not set
# CONFIG_SENSORS_MC34VR500 is not set
# CONFIG_SENSORS_MCP3021 is not set
# CONFIG_SENSORS_MCP9982 is not set
# CONFIG_SENSORS_TC654 is not set
# CONFIG_SENSORS_TPS23861 is not set
# CONFIG_SENSORS_MR75203 is not set
# CONFIG_SENSORS_ADCXX is not set
# CONFIG_SENSORS_LM63 is not set
# CONFIG_SENSORS_LM70 is not set
# CONFIG_SENSORS_LM73 is not set
# CONFIG_SENSORS_LM75 is not set
# CONFIG_SENSORS_LM77 is not set
# CONFIG_SENSORS_LM78 is not set
# CONFIG_SENSORS_LM80 is not set
# CONFIG_SENSORS_LM83 is not set
# CONFIG_SENSORS_LM85 is not set
# CONFIG_SENSORS_LM87 is not set
# CONFIG_SENSORS_LM90 is not set
# CONFIG_SENSORS_LM92 is not set
# CONFIG_SENSORS_LM93 is not set
# CONFIG_SENSORS_LM95234 is not set
# CONFIG_SENSORS_LM95241 is not set
# CONFIG_SENSORS_LM95245 is not set
# CONFIG_SENSORS_PC87360 is not set
# CONFIG_SENSORS_PC87427 is not set
# CONFIG_SENSORS_NCT6683 is not set
CONFIG_SENSORS_NCT6775_CORE=y
CONFIG_SENSORS_NCT6775=y
# CONFIG_SENSORS_NCT6775_I2C is not set
# CONFIG_SENSORS_NCT7363 is not set
# CONFIG_SENSORS_NCT7802 is not set
# CONFIG_SENSORS_NPCM7XX is not set
# CONFIG_SENSORS_NZXT_KRAKEN2 is not set
# CONFIG_SENSORS_NZXT_KRAKEN3 is not set
# CONFIG_SENSORS_NZXT_SMART2 is not set
# CONFIG_SENSORS_OCC_P8_I2C is not set
# CONFIG_SENSORS_PCF8591 is not set
# CONFIG_PMBUS is not set
# CONFIG_SENSORS_PT5161L is not set
CONFIG_SENSORS_PWM_FAN=m
# CONFIG_SENSORS_SHT15 is not set
# CONFIG_SENSORS_SHT21 is not set
# CONFIG_SENSORS_SHT3x is not set
# CONFIG_SENSORS_SHT4x is not set
# CONFIG_SENSORS_SHTC1 is not set
# CONFIG_SENSORS_SIS5595 is not set
# CONFIG_SENSORS_DME1737 is not set
# CONFIG_SENSORS_EMC1403 is not set
# CONFIG_SENSORS_EMC1812 is not set
# CONFIG_SENSORS_EMC2103 is not set
# CONFIG_SENSORS_EMC2305 is not set
# CONFIG_SENSORS_EMC6W201 is not set
# CONFIG_SENSORS_SMSC47M1 is not set
# CONFIG_SENSORS_SMSC47M192 is not set
# CONFIG_SENSORS_SMSC47B397 is not set
# CONFIG_SENSORS_STTS751 is not set
# CONFIG_SENSORS_ADC128D818 is not set
# CONFIG_SENSORS_ADS7828 is not set
# CONFIG_SENSORS_ADS7871 is not set
# CONFIG_SENSORS_AMC6821 is not set
# CONFIG_SENSORS_INA209 is not set
# CONFIG_SENSORS_INA2XX is not set
# CONFIG_SENSORS_INA238 is not set
# CONFIG_SENSORS_INA3221 is not set
# CONFIG_SENSORS_SPD5118 is not set
# CONFIG_SENSORS_TC74 is not set
# CONFIG_SENSORS_THMC50 is not set
# CONFIG_SENSORS_TMP102 is not set
# CONFIG_SENSORS_TMP103 is not set
# CONFIG_SENSORS_TMP108 is not set
# CONFIG_SENSORS_TMP401 is not set
# CONFIG_SENSORS_TMP421 is not set
# CONFIG_SENSORS_TMP464 is not set
# CONFIG_SENSORS_TMP513 is not set
# CONFIG_SENSORS_TSC1641 is not set
# CONFIG_SENSORS_VIA_CPUTEMP is not set
# CONFIG_SENSORS_VIA686A is not set
# CONFIG_SENSORS_VT1211 is not set
# CONFIG_SENSORS_VT8231 is not set
# CONFIG_SENSORS_W83773G is not set
# CONFIG_SENSORS_W83781D is not set
# CONFIG_SENSORS_W83791D is not set
# CONFIG_SENSORS_W83792D is not set
# CONFIG_SENSORS_W83793 is not set
# CONFIG_SENSORS_W83795 is not set
# CONFIG_SENSORS_W83L785TS is not set
# CONFIG_SENSORS_W83L786NG is not set
# CONFIG_SENSORS_W83627HF is not set
# CONFIG_SENSORS_W83627EHF is not set
# CONFIG_SENSORS_XGENE is not set
# CONFIG_SENSORS_YOGAFAN is not set
#
# ACPI drivers
#
CONFIG_SENSORS_ACPI_POWER=m
CONFIG_SENSORS_ATK0110=m
# CONFIG_SENSORS_ASUS_WMI is not set
CONFIG_SENSORS_ASUS_EC=m
# CONFIG_SENSORS_HP_WMI is not set
CONFIG_THERMAL=y
CONFIG_THERMAL_NETLINK=y
# CONFIG_THERMAL_STATISTICS is not set
# CONFIG_THERMAL_DEBUGFS is not set
# CONFIG_THERMAL_CORE_TESTING is not set
CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
CONFIG_THERMAL_HWMON=y
CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
# CONFIG_THERMAL_DEFAULT_GOV_BANG_BANG is not set
CONFIG_THERMAL_GOV_FAIR_SHARE=y
CONFIG_THERMAL_GOV_STEP_WISE=y
CONFIG_THERMAL_GOV_BANG_BANG=y
CONFIG_THERMAL_GOV_USER_SPACE=y
# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set
# CONFIG_DEVFREQ_THERMAL is not set
CONFIG_PCIE_THERMAL=y
# CONFIG_THERMAL_EMULATION is not set
#
# Intel thermal drivers
#
CONFIG_INTEL_POWERCLAMP=y
CONFIG_X86_THERMAL_VECTOR=y
CONFIG_INTEL_TCC=y
CONFIG_X86_PKG_TEMP_THERMAL=y
CONFIG_INTEL_SOC_DTS_IOSF_CORE=m
# CONFIG_INTEL_SOC_DTS_THERMAL is not set
#
# ACPI INT340X thermal drivers
#
CONFIG_INT340X_THERMAL=m
CONFIG_ACPI_THERMAL_REL=m
CONFIG_INT3406_THERMAL=m
CONFIG_PROC_THERMAL_MMIO_RAPL=m
# end of ACPI INT340X thermal drivers
CONFIG_INTEL_PCH_THERMAL=y
CONFIG_INTEL_TCC_COOLING=y
CONFIG_INTEL_HFI_THERMAL=y
# end of Intel thermal drivers
# CONFIG_WATCHDOG is not set
CONFIG_SSB_POSSIBLE=y
# CONFIG_SSB is not set
CONFIG_BCMA_POSSIBLE=y
# CONFIG_BCMA is not set
#
# Multifunction device drivers
#
CONFIG_MFD_CORE=y
# CONFIG_MFD_AS3711 is not set
# CONFIG_MFD_SMPRO is not set
# CONFIG_PMIC_ADP5520 is not set
# CONFIG_MFD_AAT2870_CORE is not set
# CONFIG_MFD_BCM590XX is not set
# CONFIG_MFD_BD9571MWV is not set
# CONFIG_MFD_AXP20X_I2C is not set
# CONFIG_MFD_CGBC is not set
# CONFIG_MFD_CS40L50_I2C is not set
# CONFIG_MFD_CS40L50_SPI is not set
# CONFIG_MFD_CS42L43_I2C is not set
# CONFIG_MFD_MADERA is not set
# CONFIG_PMIC_DA903X is not set
# CONFIG_MFD_DA9052_SPI is not set
# CONFIG_MFD_DA9052_I2C is not set
# CONFIG_MFD_DA9055 is not set
# CONFIG_MFD_DA9062 is not set
# CONFIG_MFD_DA9063 is not set
# CONFIG_MFD_DA9150 is not set
# CONFIG_MFD_DLN2 is not set
# CONFIG_MFD_MC13XXX_SPI is not set
# CONFIG_MFD_MC13XXX_I2C is not set
# CONFIG_MFD_MP2629 is not set
# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set
# CONFIG_LPC_ICH is not set
# CONFIG_LPC_SCH is not set
CONFIG_MFD_INTEL_LPSS=y
CONFIG_MFD_INTEL_LPSS_ACPI=y
CONFIG_MFD_INTEL_LPSS_PCI=y
# CONFIG_MFD_INTEL_PMC_BXT is not set
# CONFIG_MFD_IQS62X is not set
# CONFIG_MFD_JANZ_CMODIO is not set
# CONFIG_MFD_KEMPLD is not set
# CONFIG_MFD_88PM800 is not set
# CONFIG_MFD_88PM805 is not set
# CONFIG_MFD_88PM860X is not set
# CONFIG_MFD_MAX5970 is not set
# CONFIG_MFD_MAX14577 is not set
# CONFIG_MFD_MAX77541 is not set
# CONFIG_MFD_MAX77693 is not set
# CONFIG_MFD_MAX77705 is not set
# CONFIG_MFD_MAX77843 is not set
# CONFIG_MFD_MAX8907 is not set
# CONFIG_MFD_MAX8925 is not set
# CONFIG_MFD_MAX8997 is not set
# CONFIG_MFD_MAX8998 is not set
# CONFIG_MFD_MT6360 is not set
# CONFIG_MFD_MT6370 is not set
# CONFIG_MFD_MT6397 is not set
# CONFIG_MFD_MENF21BMC is not set
# CONFIG_MFD_NCT6694 is not set
# CONFIG_MFD_OCELOT is not set
# CONFIG_MFD_VIPERBOARD is not set
# CONFIG_MFD_RETU is not set
# CONFIG_MFD_SY7636A is not set
# CONFIG_MFD_RDC321X is not set
# CONFIG_MFD_RT4831 is not set
# CONFIG_MFD_RT5033 is not set
# CONFIG_MFD_RT5120 is not set
# CONFIG_MFD_RC5T583 is not set
# CONFIG_MFD_SI476X_CORE is not set
# CONFIG_MFD_SM501 is not set
# CONFIG_MFD_SKY81452 is not set
CONFIG_MFD_SYSCON=y
# CONFIG_MFD_LP3943 is not set
# CONFIG_MFD_LP8788 is not set
# CONFIG_MFD_TI_LMU is not set
# CONFIG_MFD_BQ257XX is not set
# CONFIG_MFD_PALMAS is not set
# CONFIG_TPS6105X is not set
# CONFIG_TPS65010 is not set
# CONFIG_TPS6507X is not set
# CONFIG_MFD_TPS65086 is not set
# CONFIG_MFD_TPS65090 is not set
# CONFIG_MFD_TI_LP873X is not set
# CONFIG_MFD_TPS6586X is not set
# CONFIG_MFD_TPS65910 is not set
# CONFIG_MFD_TPS65912_I2C is not set
# CONFIG_MFD_TPS65912_SPI is not set
# CONFIG_MFD_TPS6594_I2C is not set
# CONFIG_MFD_TPS6594_SPI is not set
# CONFIG_TWL4030_CORE is not set
# CONFIG_TWL6040_CORE is not set
# CONFIG_MFD_LM3533 is not set
# CONFIG_MFD_TQMX86 is not set
# CONFIG_MFD_VX855 is not set
# CONFIG_MFD_ARIZONA_I2C is not set
# CONFIG_MFD_ARIZONA_SPI is not set
# CONFIG_MFD_WM8400 is not set
# CONFIG_MFD_WM831X_I2C is not set
# CONFIG_MFD_WM831X_SPI is not set
# CONFIG_MFD_WM8350_I2C is not set
# CONFIG_MFD_WM8994 is not set
# CONFIG_MFD_ATC260X_I2C is not set
# CONFIG_RAVE_SP_CORE is not set
# CONFIG_MFD_INTEL_M10_BMC_SPI is not set
# CONFIG_MFD_QNAP_MCU is not set
# CONFIG_MFD_UPBOARD_FPGA is not set
# CONFIG_MFD_MAX7360 is not set
# end of Multifunction device drivers
# CONFIG_REGULATOR is not set
# CONFIG_RC_CORE is not set
#
# CEC support
#
# CONFIG_MEDIA_CEC_SUPPORT is not set
# end of CEC support
# CONFIG_MEDIA_SUPPORT is not set
#
# Graphics support
#
CONFIG_APERTURE_HELPERS=y
CONFIG_SCREEN_INFO=y
CONFIG_VIDEO=y
# CONFIG_AUXDISPLAY is not set
CONFIG_AGP=y
CONFIG_AGP_INTEL=y
# CONFIG_AGP_SIS is not set
# CONFIG_AGP_VIA is not set
CONFIG_INTEL_GTT=y
# CONFIG_VGA_SWITCHEROO is not set
CONFIG_GPU_BUDDY=y
CONFIG_DRM=y
#
# DRM debugging options
#
# CONFIG_DRM_DEBUG_MM is not set
# end of DRM debugging options
CONFIG_DRM_MIPI_DSI=y
CONFIG_DRM_KMS_HELPER=y
CONFIG_DRM_DRAW=y
CONFIG_DRM_PANIC=y
CONFIG_DRM_PANIC_FOREGROUND_COLOR=0xffffff
CONFIG_DRM_PANIC_BACKGROUND_COLOR=0x000000
# CONFIG_DRM_PANIC_DEBUG is not set
CONFIG_DRM_PANIC_SCREEN="user"
# CONFIG_DRM_RAS is not set
# CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
# CONFIG_DRM_DEBUG_MODESET_LOCK is not set
CONFIG_DRM_CLIENT=y
CONFIG_DRM_CLIENT_LIB=y
CONFIG_DRM_CLIENT_SELECTION=y
CONFIG_DRM_CLIENT_SETUP=y
#
# Supported DRM clients
#
CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_FBDEV_OVERALLOC=100
# CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM is not set
# CONFIG_DRM_CLIENT_LOG is not set
CONFIG_DRM_CLIENT_DEFAULT_FBDEV=y
CONFIG_DRM_CLIENT_DEFAULT="fbdev"
# end of Supported DRM clients
CONFIG_DRM_LOAD_EDID_FIRMWARE=y
CONFIG_DRM_DISPLAY_HELPER=m
# CONFIG_DRM_DISPLAY_DP_AUX_CEC is not set
# CONFIG_DRM_DISPLAY_DP_AUX_CHARDEV is not set
CONFIG_DRM_DISPLAY_DP_HELPER=y
CONFIG_DRM_DISPLAY_DP_TUNNEL=y
CONFIG_DRM_DISPLAY_DSC_HELPER=y
CONFIG_DRM_DISPLAY_HDCP_HELPER=y
CONFIG_DRM_DISPLAY_HDMI_HELPER=y
CONFIG_DRM_TTM=m
CONFIG_DRM_BUDDY=m
CONFIG_DRM_GEM_SHMEM_HELPER=y
# CONFIG_DRM_AMDGPU is not set
#
# ARM devices
#
# end of ARM devices
# CONFIG_DRM_AST is not set
CONFIG_DRM_BRIDGE=y
CONFIG_DRM_PANEL_BRIDGE=y
#
# Display Interface Bridges
#
# CONFIG_DRM_I2C_NXP_TDA998X is not set
# end of Display Interface Bridges
# CONFIG_DRM_ETNAVIV is not set
# CONFIG_DRM_GMA500 is not set
# CONFIG_DRM_GUD is not set
# CONFIG_DRM_HISI_HIBMC is not set
CONFIG_DRM_I915=m
CONFIG_DRM_I915_FORCE_PROBE=""
CONFIG_DRM_I915_CAPTURE_ERROR=y
CONFIG_DRM_I915_COMPRESS_ERROR=y
CONFIG_DRM_I915_USERPTR=y
CONFIG_DRM_I915_PXP=y
CONFIG_DRM_I915_DP_TUNNEL=y
#
# drm/i915 Debugging
#
# CONFIG_DRM_I915_WERROR is not set
# CONFIG_DRM_I915_REPLAY_GPU_HANGS_API is not set
# CONFIG_DRM_I915_DEBUG is not set
# CONFIG_DRM_I915_DEBUG_MMIO is not set
# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
# CONFIG_DRM_I915_DEBUG_GUC is not set
# CONFIG_DRM_I915_SELFTEST is not set
# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
# CONFIG_DRM_I915_DEBUG_WAKEREF is not set
# end of drm/i915 Debugging
#
# drm/i915 Profile Guided Optimisation
#
CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
CONFIG_DRM_I915_FENCE_TIMEOUT=10000
CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500
CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
CONFIG_DRM_I915_STOP_TIMEOUT=100
CONFIG_DRM_I915_TIMESLICE_DURATION=1
# end of drm/i915 Profile Guided Optimisation
# CONFIG_DRM_MGAG200 is not set
# CONFIG_DRM_NOUVEAU is not set
CONFIG_DRM_PANEL=y
#
# Display Panels
#
# CONFIG_DRM_PANEL_AUO_A030JTN01 is not set
# CONFIG_DRM_PANEL_FOCALTECH_OTA7290B is not set
# CONFIG_DRM_PANEL_ILITEK_ILI9341 is not set
# CONFIG_DRM_PANEL_ORISETECH_OTA5601A is not set
# CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN is not set
# CONFIG_DRM_PANEL_WIDECHIPS_WS2401 is not set
# end of Display Panels
# CONFIG_DRM_QXL is not set
# CONFIG_DRM_RADEON is not set
# CONFIG_DRM_ST7571 is not set
# CONFIG_DRM_ST7586 is not set
# CONFIG_DRM_ST7735R is not set
# CONFIG_DRM_ST7920 is not set
# CONFIG_DRM_SSD130X is not set
#
# Drivers for system framebuffers
#
CONFIG_DRM_SYSFB_HELPER=y
CONFIG_DRM_SIMPLEDRM=y
# end of Drivers for system framebuffers
# CONFIG_DRM_APPLETBDRM is not set
# CONFIG_DRM_BOCHS is not set
# CONFIG_DRM_CIRRUS_QEMU is not set
# CONFIG_DRM_GM12U320 is not set
# CONFIG_DRM_PANEL_MIPI_DBI is not set
# CONFIG_DRM_PIXPAPER is not set
# CONFIG_TINYDRM_HX8357D is not set
# CONFIG_TINYDRM_ILI9163 is not set
# CONFIG_TINYDRM_ILI9225 is not set
# CONFIG_TINYDRM_ILI9341 is not set
# CONFIG_TINYDRM_ILI9486 is not set
# CONFIG_TINYDRM_MI0283QT is not set
# CONFIG_TINYDRM_REPAPER is not set
# CONFIG_TINYDRM_SHARP_MEMORY is not set
# CONFIG_DRM_UDL is not set
# CONFIG_DRM_VBOXVIDEO is not set
CONFIG_DRM_VGEM=m
CONFIG_DRM_VIRTIO_GPU=m
CONFIG_DRM_VIRTIO_GPU_KMS=y
CONFIG_DRM_VKMS=m
# CONFIG_DRM_XE is not set
CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
#
# Frame buffer Devices
#
CONFIG_FB=y
# CONFIG_FB_CIRRUS is not set
# CONFIG_FB_PM2 is not set
# CONFIG_FB_CYBER2000 is not set
# CONFIG_FB_ARC is not set
# CONFIG_FB_ASILIANT is not set
# CONFIG_FB_IMSTT is not set
# CONFIG_FB_VGA16 is not set
# CONFIG_FB_UVESA is not set
CONFIG_FB_VESA=y
CONFIG_FB_EFI=y
# CONFIG_FB_N411 is not set
# CONFIG_FB_OPENCORES is not set
# CONFIG_FB_S1D13XXX is not set
# CONFIG_FB_NVIDIA is not set
# CONFIG_FB_RIVA is not set
# CONFIG_FB_I740 is not set
# CONFIG_FB_RADEON is not set
# CONFIG_FB_ATY128 is not set
# CONFIG_FB_ATY is not set
# CONFIG_FB_SAVAGE is not set
# CONFIG_FB_SIS is not set
# CONFIG_FB_VIA is not set
# CONFIG_FB_NEOMAGIC is not set
# CONFIG_FB_KYRO is not set
# CONFIG_FB_3DFX is not set
# CONFIG_FB_VOODOO1 is not set
# CONFIG_FB_TRIDENT is not set
# CONFIG_FB_PM3 is not set
# CONFIG_FB_CARMINE is not set
# CONFIG_FB_SMSCUFX is not set
# CONFIG_FB_IBM_GXT4500 is not set
# CONFIG_FB_VIRTUAL is not set
# CONFIG_FB_METRONOME is not set
# CONFIG_FB_MB862XX is not set
# CONFIG_FB_SSD1307 is not set
# CONFIG_FB_SM712 is not set
CONFIG_FB_CORE=y
CONFIG_FB_NOTIFY=y
# CONFIG_FB_DEVICE is not set
CONFIG_FB_CFB_FILLRECT=y
CONFIG_FB_CFB_COPYAREA=y
CONFIG_FB_CFB_IMAGEBLIT=y
CONFIG_FB_SYS_FILLRECT=y
CONFIG_FB_SYS_COPYAREA=y
CONFIG_FB_SYS_IMAGEBLIT=y
# CONFIG_FB_FOREIGN_ENDIAN is not set
CONFIG_FB_SYSMEM_FOPS=y
CONFIG_FB_DEFERRED_IO=y
CONFIG_FB_IOMEM_FOPS=y
CONFIG_FB_IOMEM_HELPERS=y
CONFIG_FB_SYSMEM_HELPERS=y
CONFIG_FB_SYSMEM_HELPERS_DEFERRED=y
# CONFIG_FB_TILEBLITTING is not set
# end of Frame buffer Devices
#
# Backlight & LCD device support
#
CONFIG_LCD_CLASS_DEVICE=y
# CONFIG_LCD_L4F00242T03 is not set
# CONFIG_LCD_LMS283GF05 is not set
# CONFIG_LCD_LTV350QV is not set
# CONFIG_LCD_ILI922X is not set
# CONFIG_LCD_ILI9320 is not set
# CONFIG_LCD_TDO24M is not set
# CONFIG_LCD_VGG2432A4 is not set
# CONFIG_LCD_PLATFORM is not set
# CONFIG_LCD_AMS369FG06 is not set
# CONFIG_LCD_LMS501KF03 is not set
# CONFIG_LCD_HX8357 is not set
# CONFIG_LCD_OTM3225A is not set
CONFIG_BACKLIGHT_CLASS_DEVICE=y
# CONFIG_BACKLIGHT_AW99706 is not set
# CONFIG_BACKLIGHT_KTD253 is not set
# CONFIG_BACKLIGHT_KTD2801 is not set
# CONFIG_BACKLIGHT_KTZ8866 is not set
# CONFIG_BACKLIGHT_SY7758 is not set
# CONFIG_BACKLIGHT_PWM is not set
# CONFIG_BACKLIGHT_MAX25014 is not set
# CONFIG_BACKLIGHT_APPLE is not set
# CONFIG_BACKLIGHT_QCOM_WLED is not set
# CONFIG_BACKLIGHT_SAHARA is not set
# CONFIG_BACKLIGHT_ADP8860 is not set
# CONFIG_BACKLIGHT_ADP8870 is not set
# CONFIG_BACKLIGHT_LM3509 is not set
# CONFIG_BACKLIGHT_LM3630A is not set
# CONFIG_BACKLIGHT_LM3639 is not set
# CONFIG_BACKLIGHT_LP855X is not set
# CONFIG_BACKLIGHT_MP3309C is not set
# CONFIG_BACKLIGHT_GPIO is not set
# CONFIG_BACKLIGHT_LV5207LP is not set
# CONFIG_BACKLIGHT_BD6107 is not set
# CONFIG_BACKLIGHT_ARCXCNN is not set
# end of Backlight & LCD device support
CONFIG_HDMI=y
# CONFIG_FIRMWARE_EDID is not set
#
# Console display driver support
#
CONFIG_VGA_CONSOLE=y
CONFIG_DUMMY_CONSOLE=y
CONFIG_DUMMY_CONSOLE_COLUMNS=80
CONFIG_DUMMY_CONSOLE_ROWS=25
CONFIG_FRAMEBUFFER_CONSOLE=y
# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER=y
# end of Console display driver support
CONFIG_LOGO=y
# CONFIG_LOGO_LINUX_MONO is not set
# CONFIG_LOGO_LINUX_VGA16 is not set
CONFIG_LOGO_LINUX_CLUT224=y
CONFIG_LOGO_LINUX_CLUT224_FILE="drivers/video/logo/logo_linux_clut224.ppm"
# CONFIG_TRACE_GPU_MEM is not set
# end of Graphics support
# CONFIG_DRM_ACCEL is not set
CONFIG_SOUND=y
CONFIG_SOUND_OSS_CORE=y
CONFIG_SOUND_OSS_CORE_PRECLAIM=y
CONFIG_SND=y
CONFIG_SND_TIMER=y
CONFIG_SND_PCM=y
CONFIG_SND_HWDEP=y
CONFIG_SND_RAWMIDI=y
CONFIG_SND_UMP=y
# CONFIG_SND_UMP_LEGACY_RAWMIDI is not set
CONFIG_SND_OSSEMUL=y
CONFIG_SND_MIXER_OSS=y
CONFIG_SND_PCM_OSS=y
CONFIG_SND_PCM_OSS_PLUGINS=y
# CONFIG_SND_PCM_TIMER is not set
CONFIG_SND_HRTIMER=y
CONFIG_SND_DYNAMIC_MINORS=y
CONFIG_SND_MAX_CARDS=32
# CONFIG_SND_SUPPORT_OLD_API is not set
CONFIG_SND_PROC_FS=y
CONFIG_SND_VERBOSE_PROCFS=y
# CONFIG_SND_CTL_FAST_LOOKUP is not set
# CONFIG_SND_DEBUG is not set
# CONFIG_SND_CTL_INPUT_VALIDATION is not set
CONFIG_SND_UTIMER=y
CONFIG_SND_DMA_SGBUF=y
# CONFIG_SND_SEQUENCER is not set
# CONFIG_SND_DRIVERS is not set
# CONFIG_SND_PCI is not set
#
# HD-Audio
#
# CONFIG_SND_HDA_INTEL is not set
# CONFIG_SND_HDA_ACPI is not set
# end of HD-Audio
# CONFIG_SND_SPI is not set
CONFIG_SND_USB=y
CONFIG_SND_USB_AUDIO=y
CONFIG_SND_USB_AUDIO_MIDI_V2=y
# CONFIG_SND_USB_UA101 is not set
# CONFIG_SND_USB_USX2Y is not set
# CONFIG_SND_USB_CAIAQ is not set
# CONFIG_SND_USB_US122L is not set
# CONFIG_SND_USB_US144MKII is not set
# CONFIG_SND_USB_6FIRE is not set
# CONFIG_SND_USB_HIFACE is not set
# CONFIG_SND_BCD2000 is not set
# CONFIG_SND_USB_POD is not set
# CONFIG_SND_USB_PODHD is not set
# CONFIG_SND_USB_TONEPORT is not set
# CONFIG_SND_USB_VARIAX is not set
# CONFIG_SND_SOC is not set
# CONFIG_SND_X86 is not set
# CONFIG_SND_VIRTIO is not set
CONFIG_HID_SUPPORT=y
CONFIG_HID=y
CONFIG_HID_BATTERY_STRENGTH=y
CONFIG_HIDRAW=y
# CONFIG_UHID is not set
CONFIG_HID_GENERIC=y
# CONFIG_HID_HAPTIC is not set
#
# Special HID drivers
#
# CONFIG_HID_A4TECH is not set
# CONFIG_HID_ACCUTOUCH is not set
# CONFIG_HID_ACRUX is not set
# CONFIG_HID_APPLE is not set
# CONFIG_HID_APPLEIR is not set
# CONFIG_HID_APPLETB_BL is not set
# CONFIG_HID_APPLETB_KBD is not set
# CONFIG_HID_ASUS is not set
# CONFIG_HID_AUREAL is not set
# CONFIG_HID_BELKIN is not set
# CONFIG_HID_BETOP_FF is not set
# CONFIG_HID_BIGBEN_FF is not set
# CONFIG_HID_CHERRY is not set
# CONFIG_HID_CHICONY is not set
# CONFIG_HID_CORSAIR is not set
# CONFIG_HID_COUGAR is not set
# CONFIG_HID_MACALLY is not set
# CONFIG_HID_PRODIKEYS is not set
# CONFIG_HID_CMEDIA is not set
# CONFIG_HID_CP2112 is not set
# CONFIG_HID_CREATIVE_SB0540 is not set
# CONFIG_HID_CYPRESS is not set
# CONFIG_HID_DRAGONRISE is not set
# CONFIG_HID_EMS_FF is not set
# CONFIG_HID_ELAN is not set
# CONFIG_HID_ELECOM is not set
# CONFIG_HID_ELO is not set
# CONFIG_HID_EVISION is not set
# CONFIG_HID_EZKEY is not set
# CONFIG_HID_FT260 is not set
# CONFIG_HID_GEMBIRD is not set
# CONFIG_HID_GFRM is not set
# CONFIG_HID_GLORIOUS is not set
# CONFIG_HID_HOLTEK is not set
# CONFIG_HID_HYPERX is not set
# CONFIG_HID_GOODIX_SPI is not set
# CONFIG_HID_GOOGLE_STADIA_FF is not set
# CONFIG_HID_VIVALDI is not set
# CONFIG_HID_GT683R is not set
# CONFIG_HID_MSI is not set
# CONFIG_HID_KEYTOUCH is not set
# CONFIG_HID_KYE is not set
# CONFIG_HID_KYSONA is not set
# CONFIG_HID_UCLOGIC is not set
# CONFIG_HID_WALTOP is not set
# CONFIG_HID_VIEWSONIC is not set
# CONFIG_HID_VRC2 is not set
# CONFIG_HID_XIAOMI is not set
# CONFIG_HID_GYRATION is not set
# CONFIG_HID_ICADE is not set
# CONFIG_HID_ITE is not set
# CONFIG_HID_JABRA is not set
# CONFIG_HID_TWINHAN is not set
# CONFIG_HID_KENSINGTON is not set
# CONFIG_HID_LCPOWER is not set
# CONFIG_HID_LED is not set
# CONFIG_HID_LENOVO is not set
# CONFIG_HID_LETSKETCH is not set
# CONFIG_HID_MAGICMOUSE is not set
# CONFIG_HID_MALTRON is not set
# CONFIG_HID_MAYFLASH is not set
# CONFIG_HID_MEGAWORLD_FF is not set
# CONFIG_HID_RAKK is not set
# CONFIG_HID_REDRAGON is not set
# CONFIG_HID_MICROSOFT is not set
# CONFIG_HID_MONTEREY is not set
# CONFIG_HID_MULTITOUCH is not set
# CONFIG_HID_NINTENDO is not set
# CONFIG_HID_NTI is not set
# CONFIG_HID_NTRIG is not set
# CONFIG_HID_NVIDIA_SHIELD is not set
# CONFIG_HID_ORTEK is not set
# CONFIG_HID_PANTHERLORD is not set
# CONFIG_HID_PENMOUNT is not set
# CONFIG_HID_PETALYNX is not set
# CONFIG_HID_PICOLCD is not set
# CONFIG_HID_PLANTRONICS is not set
# CONFIG_HID_PXRC is not set
# CONFIG_HID_RAPOO is not set
# CONFIG_HID_RAZER is not set
# CONFIG_HID_PRIMAX is not set
# CONFIG_HID_RETRODE is not set
# CONFIG_HID_ROCCAT is not set
# CONFIG_HID_SAITEK is not set
# CONFIG_HID_SAMSUNG is not set
# CONFIG_HID_SEMITEK is not set
# CONFIG_HID_SIGMAMICRO is not set
# CONFIG_HID_SONY is not set
# CONFIG_HID_SPEEDLINK is not set
# CONFIG_HID_STEAM is not set
# CONFIG_HID_STEELSERIES is not set
# CONFIG_HID_SUNPLUS is not set
# CONFIG_HID_RMI is not set
# CONFIG_HID_GREENASIA is not set
# CONFIG_HID_SMARTJOYPLUS is not set
# CONFIG_HID_TIVO is not set
# CONFIG_HID_TOPSEED is not set
# CONFIG_HID_TOPRE is not set
# CONFIG_HID_THINGM is not set
# CONFIG_HID_THRUSTMASTER is not set
# CONFIG_HID_UDRAW_PS3 is not set
# CONFIG_HID_U2FZERO is not set
# CONFIG_HID_UNIVERSAL_PIDFF is not set
# CONFIG_HID_WACOM is not set
# CONFIG_HID_WIIMOTE is not set
# CONFIG_HID_WINWING is not set
# CONFIG_HID_XINMO is not set
# CONFIG_HID_ZEROPLUS is not set
# CONFIG_HID_ZYDACRON is not set
# CONFIG_HID_SENSOR_HUB is not set
# CONFIG_HID_ALPS is not set
# CONFIG_HID_MCP2200 is not set
# CONFIG_HID_MCP2221 is not set
# CONFIG_HID_HUAWEI is not set
# end of Special HID drivers
#
# HID-BPF support
#
CONFIG_HID_BPF=y
# end of HID-BPF support
# CONFIG_I2C_HID is not set
#
# Intel ISH HID support
#
# CONFIG_INTEL_ISH_HID is not set
# end of Intel ISH HID support
#
# AMD SFH HID Support
#
# CONFIG_AMD_SFH_HID is not set
# end of AMD SFH HID Support
#
# Intel THC HID Support
#
# CONFIG_INTEL_THC_HID is not set
# end of Intel THC HID Support
#
# USB HID support
#
CONFIG_USB_HID=y
CONFIG_HID_PID=y
CONFIG_USB_HIDDEV=y
# end of USB HID support
CONFIG_USB_OHCI_LITTLE_ENDIAN=y
CONFIG_USB_SUPPORT=y
CONFIG_USB_COMMON=y
CONFIG_USB_LED_TRIG=y
# CONFIG_USB_ULPI_BUS is not set
# CONFIG_USB_CONN_GPIO is not set
CONFIG_USB_ARCH_HAS_HCD=y
CONFIG_USB=y
CONFIG_USB_PCI=y
# CONFIG_USB_PCI_AMD is not set
CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
#
# Miscellaneous USB options
#
CONFIG_USB_DEFAULT_PERSIST=y
# CONFIG_USB_FEW_INIT_RETRIES is not set
# CONFIG_USB_DYNAMIC_MINORS is not set
# CONFIG_USB_OTG is not set
# CONFIG_USB_OTG_PRODUCTLIST is not set
# CONFIG_USB_OTG_DISABLE_EXTERNAL_HUB is not set
# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set
CONFIG_USB_AUTOSUSPEND_DELAY=2
CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
# CONFIG_USB_MON is not set
#
# USB Host Controller Drivers
#
# CONFIG_USB_C67X00_HCD is not set
CONFIG_USB_XHCI_HCD=y
# CONFIG_USB_XHCI_DBGCAP is not set
CONFIG_USB_XHCI_PCI=y
# CONFIG_USB_XHCI_PCI_RENESAS is not set
# CONFIG_USB_XHCI_PLATFORM is not set
# CONFIG_USB_XHCI_SIDEBAND is not set
# CONFIG_USB_EHCI_HCD is not set
# CONFIG_USB_OXU210HP_HCD is not set
# CONFIG_USB_ISP116X_HCD is not set
# CONFIG_USB_MAX3421_HCD is not set
# CONFIG_USB_OHCI_HCD is not set
# CONFIG_USB_UHCI_HCD is not set
# CONFIG_USB_SL811_HCD is not set
# CONFIG_USB_R8A66597_HCD is not set
# CONFIG_USB_HCD_TEST_MODE is not set
#
# USB Device Class drivers
#
# CONFIG_USB_ACM is not set
CONFIG_USB_PRINTER=y
# CONFIG_USB_WDM is not set
# CONFIG_USB_TMC is not set
#
# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
see USB_STORAGE Help for more info
#
CONFIG_USB_STORAGE=y
# CONFIG_USB_STORAGE_DEBUG is not set
# CONFIG_USB_STORAGE_REALTEK is not set
# CONFIG_USB_STORAGE_DATAFAB is not set
# CONFIG_USB_STORAGE_FREECOM is not set
# CONFIG_USB_STORAGE_ISD200 is not set
# CONFIG_USB_STORAGE_USBAT is not set
# CONFIG_USB_STORAGE_SDDR09 is not set
# CONFIG_USB_STORAGE_SDDR55 is not set
# CONFIG_USB_STORAGE_JUMPSHOT is not set
# CONFIG_USB_STORAGE_ALAUDA is not set
# CONFIG_USB_STORAGE_ONETOUCH is not set
# CONFIG_USB_STORAGE_KARMA is not set
# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
# CONFIG_USB_STORAGE_ENE_UB6250 is not set
CONFIG_USB_UAS=y
#
# USB Imaging devices
#
# CONFIG_USB_MDC800 is not set
# CONFIG_USB_MICROTEK is not set
# CONFIG_USBIP_CORE is not set
#
# USB dual-mode controller drivers
#
# CONFIG_USB_CDNS_SUPPORT is not set
# CONFIG_USB_MUSB_HDRC is not set
# CONFIG_USB_DWC3 is not set
# CONFIG_USB_DWC2 is not set
# CONFIG_USB_ISP1760 is not set
#
# USB port drivers
#
# CONFIG_USB_SERIAL is not set
#
# USB Miscellaneous drivers
#
# CONFIG_USB_EMI62 is not set
# CONFIG_USB_EMI26 is not set
# CONFIG_USB_ADUTUX is not set
# CONFIG_USB_SEVSEG is not set
# CONFIG_USB_LEGOTOWER is not set
# CONFIG_USB_LCD is not set
# CONFIG_USB_CYPRESS_CY7C63 is not set
# CONFIG_USB_CYTHERM is not set
# CONFIG_USB_IDMOUSE is not set
# CONFIG_USB_APPLEDISPLAY is not set
# CONFIG_APPLE_MFI_FASTCHARGE is not set
# CONFIG_USB_LJCA is not set
# CONFIG_USB_USBIO is not set
# CONFIG_USB_LD is not set
# CONFIG_USB_TRANCEVIBRATOR is not set
# CONFIG_USB_IOWARRIOR is not set
# CONFIG_USB_TEST is not set
# CONFIG_USB_EHSET_TEST_FIXTURE is not set
# CONFIG_USB_ISIGHTFW is not set
# CONFIG_USB_YUREX is not set
# CONFIG_USB_EZUSB_FX2 is not set
# CONFIG_USB_HUB_USB251XB is not set
# CONFIG_USB_HSIC_USB3503 is not set
# CONFIG_USB_HSIC_USB4604 is not set
# CONFIG_USB_LINK_LAYER_TEST is not set
# CONFIG_USB_CHAOSKEY is not set
#
# USB Physical Layer drivers
#
# CONFIG_NOP_USB_XCEIV is not set
# CONFIG_USB_GPIO_VBUS is not set
# CONFIG_USB_ISP1301 is not set
# end of USB Physical Layer drivers
# CONFIG_USB_GADGET is not set
CONFIG_TYPEC=y
CONFIG_TYPEC_TCPM=m
CONFIG_TYPEC_TCPCI=m
# CONFIG_TYPEC_RT1711H is not set
# CONFIG_TYPEC_TCPCI_MAXIM is not set
# CONFIG_TYPEC_FUSB302 is not set
CONFIG_TYPEC_UCSI=m
# CONFIG_UCSI_CCG is not set
# CONFIG_UCSI_ACPI is not set
# CONFIG_UCSI_STM32G0 is not set
# CONFIG_TYPEC_TPS6598X is not set
# CONFIG_TYPEC_ANX7411 is not set
# CONFIG_TYPEC_RT1719 is not set
# CONFIG_TYPEC_HD3SS3220 is not set
# CONFIG_TYPEC_STUSB160X is not set
# CONFIG_TYPEC_WUSB3801 is not set
#
# USB Type-C Multiplexer/DeMultiplexer Switch support
#
# CONFIG_TYPEC_MUX_FSA4480 is not set
# CONFIG_TYPEC_MUX_GPIO_SBU is not set
# CONFIG_TYPEC_MUX_PI3USB30532 is not set
# CONFIG_TYPEC_MUX_IT5205 is not set
# CONFIG_TYPEC_MUX_NB7VPQ904M is not set
# CONFIG_TYPEC_MUX_PS883X is not set
# CONFIG_TYPEC_MUX_PTN36502 is not set
# CONFIG_TYPEC_MUX_TUSB1046 is not set
# CONFIG_TYPEC_MUX_WCD939X_USBSS is not set
# end of USB Type-C Multiplexer/DeMultiplexer Switch support
#
# USB Type-C Alternate Mode drivers
#
CONFIG_TYPEC_DP_ALTMODE=m
# CONFIG_TYPEC_NVIDIA_ALTMODE is not set
# CONFIG_TYPEC_TBT_ALTMODE is not set
# end of USB Type-C Alternate Mode drivers
CONFIG_USB_ROLE_SWITCH=y
CONFIG_USB_ROLES_INTEL_XHCI=m
# CONFIG_MMC is not set
# CONFIG_SCSI_UFSHCD is not set
# CONFIG_MEMSTICK is not set
CONFIG_NEW_LEDS=y
CONFIG_LEDS_CLASS=y
# CONFIG_LEDS_CLASS_FLASH is not set
# CONFIG_LEDS_CLASS_MULTICOLOR is not set
# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
#
# LED drivers
#
# CONFIG_LEDS_APU is not set
# CONFIG_LEDS_OSRAM_AMS_AS3668 is not set
# CONFIG_LEDS_AW200XX is not set
# CONFIG_LEDS_LM3530 is not set
# CONFIG_LEDS_LM3532 is not set
# CONFIG_LEDS_LM3642 is not set
# CONFIG_LEDS_PCA9532 is not set
# CONFIG_LEDS_GPIO is not set
# CONFIG_LEDS_LP3944 is not set
# CONFIG_LEDS_LP3952 is not set
# CONFIG_LEDS_PCA955X is not set
# CONFIG_LEDS_PCA963X is not set
# CONFIG_LEDS_PCA995X is not set
# CONFIG_LEDS_DAC124S085 is not set
# CONFIG_LEDS_PWM is not set
# CONFIG_LEDS_BD2606MVV is not set
# CONFIG_LEDS_BD2802 is not set
# CONFIG_LEDS_INTEL_SS4200 is not set
# CONFIG_LEDS_LT3593 is not set
# CONFIG_LEDS_TCA6507 is not set
# CONFIG_LEDS_TLC591XX is not set
# CONFIG_LEDS_LM355x is not set
# CONFIG_LEDS_IS31FL319X is not set
#
# LED driver for blink(1) USB RGB LED is under Special HID drivers
(HID_THINGM)
#
# CONFIG_LEDS_BLINKM is not set
# CONFIG_LEDS_MLXCPLD is not set
# CONFIG_LEDS_MLXREG is not set
# CONFIG_LEDS_USER is not set
# CONFIG_LEDS_NIC78BX is not set
# CONFIG_LEDS_SPI_BYTE is not set
# CONFIG_LEDS_LTC3220 is not set
#
# Flash and Torch LED drivers
#
#
# RGB LED drivers
#
#
# LED Triggers
#
CONFIG_LEDS_TRIGGERS=y
# CONFIG_LEDS_TRIGGER_TIMER is not set
# CONFIG_LEDS_TRIGGER_ONESHOT is not set
# CONFIG_LEDS_TRIGGER_DISK is not set
# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
# CONFIG_LEDS_TRIGGER_CPU is not set
# CONFIG_LEDS_TRIGGER_ACTIVITY is not set
# CONFIG_LEDS_TRIGGER_GPIO is not set
# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
#
# iptables trigger is under Netfilter config (LED target)
#
# CONFIG_LEDS_TRIGGER_TRANSIENT is not set
# CONFIG_LEDS_TRIGGER_CAMERA is not set
# CONFIG_LEDS_TRIGGER_PANIC is not set
# CONFIG_LEDS_TRIGGER_NETDEV is not set
# CONFIG_LEDS_TRIGGER_PATTERN is not set
# CONFIG_LEDS_TRIGGER_TTY is not set
# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
#
# Simatic LED drivers
#
# CONFIG_ACCESSIBILITY is not set
# CONFIG_INFINIBAND is not set
CONFIG_EDAC_ATOMIC_SCRUB=y
CONFIG_EDAC_SUPPORT=y
CONFIG_EDAC=y
# CONFIG_EDAC_DEBUG is not set
# CONFIG_EDAC_GHES is not set
CONFIG_EDAC_SCRUB=y
CONFIG_EDAC_ECS=y
CONFIG_EDAC_MEM_REPAIR=y
# CONFIG_EDAC_E752X is not set
# CONFIG_EDAC_I82975X is not set
# CONFIG_EDAC_I3000 is not set
# CONFIG_EDAC_I3200 is not set
# CONFIG_EDAC_IE31200 is not set
# CONFIG_EDAC_X38 is not set
# CONFIG_EDAC_I5400 is not set
# CONFIG_EDAC_I7CORE is not set
# CONFIG_EDAC_I5100 is not set
# CONFIG_EDAC_I7300 is not set
# CONFIG_EDAC_SBRIDGE is not set
# CONFIG_EDAC_SKX is not set
# CONFIG_EDAC_I10NM is not set
# CONFIG_EDAC_IMH is not set
# CONFIG_EDAC_PND2 is not set
# CONFIG_EDAC_IGEN6 is not set
CONFIG_RTC_LIB=y
CONFIG_RTC_MC146818_LIB=y
CONFIG_RTC_CLASS=y
CONFIG_RTC_HCTOSYS=y
CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
CONFIG_RTC_SYSTOHC=y
CONFIG_RTC_SYSTOHC_DEVICE="rtc0"
# CONFIG_RTC_DEBUG is not set
CONFIG_RTC_NVMEM=y
#
# RTC interfaces
#
CONFIG_RTC_INTF_SYSFS=y
CONFIG_RTC_INTF_PROC=y
CONFIG_RTC_INTF_DEV=y
# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
# CONFIG_RTC_DRV_TEST is not set
#
# I2C RTC drivers
#
# CONFIG_RTC_DRV_ABB5ZES3 is not set
# CONFIG_RTC_DRV_ABEOZ9 is not set
# CONFIG_RTC_DRV_ABX80X is not set
# CONFIG_RTC_DRV_DS1307 is not set
# CONFIG_RTC_DRV_DS1374 is not set
# CONFIG_RTC_DRV_DS1672 is not set
# CONFIG_RTC_DRV_MAX6900 is not set
# CONFIG_RTC_DRV_MAX31335 is not set
# CONFIG_RTC_DRV_RS5C372 is not set
# CONFIG_RTC_DRV_ISL1208 is not set
# CONFIG_RTC_DRV_ISL12022 is not set
# CONFIG_RTC_DRV_X1205 is not set
# CONFIG_RTC_DRV_PCF8523 is not set
# CONFIG_RTC_DRV_PCF85363 is not set
# CONFIG_RTC_DRV_PCF8563 is not set
# CONFIG_RTC_DRV_PCF8583 is not set
# CONFIG_RTC_DRV_M41T80 is not set
# CONFIG_RTC_DRV_BQ32K is not set
# CONFIG_RTC_DRV_S35390A is not set
# CONFIG_RTC_DRV_FM3130 is not set
# CONFIG_RTC_DRV_RX8010 is not set
# CONFIG_RTC_DRV_RX8111 is not set
# CONFIG_RTC_DRV_RX8581 is not set
# CONFIG_RTC_DRV_RX8025 is not set
# CONFIG_RTC_DRV_EM3027 is not set
# CONFIG_RTC_DRV_RV3028 is not set
# CONFIG_RTC_DRV_RV3032 is not set
# CONFIG_RTC_DRV_RV8803 is not set
# CONFIG_RTC_DRV_SD2405AL is not set
# CONFIG_RTC_DRV_SD3078 is not set
#
# SPI RTC drivers
#
# CONFIG_RTC_DRV_M41T93 is not set
# CONFIG_RTC_DRV_M41T94 is not set
# CONFIG_RTC_DRV_DS1302 is not set
# CONFIG_RTC_DRV_DS1305 is not set
# CONFIG_RTC_DRV_DS1343 is not set
# CONFIG_RTC_DRV_DS1347 is not set
# CONFIG_RTC_DRV_DS1390 is not set
# CONFIG_RTC_DRV_MAX6916 is not set
# CONFIG_RTC_DRV_R9701 is not set
# CONFIG_RTC_DRV_RX4581 is not set
# CONFIG_RTC_DRV_RS5C348 is not set
# CONFIG_RTC_DRV_MAX6902 is not set
# CONFIG_RTC_DRV_PCF2123 is not set
# CONFIG_RTC_DRV_MCP795 is not set
CONFIG_RTC_I2C_AND_SPI=y
#
# SPI and I2C RTC drivers
#
# CONFIG_RTC_DRV_DS3232 is not set
# CONFIG_RTC_DRV_PCF2127 is not set
# CONFIG_RTC_DRV_PCF85063 is not set
# CONFIG_RTC_DRV_RV3029C2 is not set
# CONFIG_RTC_DRV_RX6110 is not set
#
# Platform RTC drivers
#
CONFIG_RTC_DRV_CMOS=y
# CONFIG_RTC_DRV_DS1286 is not set
# CONFIG_RTC_DRV_DS1511 is not set
# CONFIG_RTC_DRV_DS1553 is not set
# CONFIG_RTC_DRV_DS1685_FAMILY is not set
# CONFIG_RTC_DRV_DS1742 is not set
# CONFIG_RTC_DRV_DS2404 is not set
# CONFIG_RTC_DRV_STK17TA8 is not set
# CONFIG_RTC_DRV_M48T86 is not set
# CONFIG_RTC_DRV_M48T35 is not set
# CONFIG_RTC_DRV_M48T59 is not set
# CONFIG_RTC_DRV_MSM6242 is not set
# CONFIG_RTC_DRV_RP5C01 is not set
#
# on-CPU RTC drivers
#
# CONFIG_RTC_DRV_FTRTC010 is not set
# CONFIG_RTC_DRV_GOLDFISH is not set
#
# HID Sensor RTC drivers
#
CONFIG_DMADEVICES=y
# CONFIG_DMADEVICES_DEBUG is not set
#
# DMA Devices
#
CONFIG_DMA_ENGINE=y
CONFIG_DMA_VIRTUAL_CHANNELS=y
CONFIG_DMA_ACPI=y
# CONFIG_ALTERA_MSGDMA is not set
CONFIG_INTEL_IDMA64=y
# CONFIG_INTEL_IDXD is not set
# CONFIG_INTEL_IDXD_COMPAT is not set
# CONFIG_INTEL_IOATDMA is not set
# CONFIG_PLX_DMA is not set
# CONFIG_SWITCHTEC_DMA is not set
# CONFIG_XILINX_DMA is not set
# CONFIG_XILINX_XDMA is not set
# CONFIG_AMD_PTDMA is not set
# CONFIG_AMD_QDMA is not set
# CONFIG_QCOM_HIDMA_MGMT is not set
# CONFIG_QCOM_HIDMA is not set
# CONFIG_DW_DMAC is not set
# CONFIG_DW_DMAC_PCI is not set
# CONFIG_DW_EDMA is not set
# CONFIG_SF_PDMA is not set
# CONFIG_INTEL_LDMA is not set
#
# DMA Clients
#
CONFIG_ASYNC_TX_DMA=y
# CONFIG_DMATEST is not set
#
# DMABUF options
#
CONFIG_SYNC_FILE=y
# CONFIG_SW_SYNC is not set
# CONFIG_UDMABUF is not set
# CONFIG_DMABUF_DEBUG is not set
CONFIG_DMABUF_HEAPS=y
CONFIG_DMABUF_HEAPS_SYSTEM=y
# CONFIG_DMABUF_HEAPS_SYSTEM_CC_SHARED is not set
CONFIG_DMABUF_HEAPS_CMA=y
# end of DMABUF options
# CONFIG_UIO is not set
# CONFIG_VFIO is not set
CONFIG_IRQ_BYPASS_MANAGER=m
CONFIG_VIRT_DRIVERS=y
CONFIG_VMGENID=y
# CONFIG_VBOXGUEST is not set
# CONFIG_NITRO_ENCLAVES is not set
CONFIG_EFI_SECRET=m
CONFIG_VIRTIO_ANCHOR=y
CONFIG_VIRTIO=y
CONFIG_VIRTIO_PCI_LIB=m
CONFIG_VIRTIO_MENU=y
CONFIG_VIRTIO_PCI=m
CONFIG_VIRTIO_PCI_ADMIN_LEGACY=y
# CONFIG_VIRTIO_PCI_LEGACY is not set
CONFIG_VIRTIO_PMEM=m
CONFIG_VIRTIO_BALLOON=m
CONFIG_VIRTIO_INPUT=m
# CONFIG_VIRTIO_MMIO is not set
CONFIG_VIRTIO_DMA_SHARED_BUFFER=m
# CONFIG_VIRTIO_DEBUG is not set
CONFIG_VIRTIO_RTC=m
CONFIG_VIRTIO_RTC_PTP=y
CONFIG_VIRTIO_RTC_CLASS=y
# CONFIG_VDPA is not set
CONFIG_VHOST_IOTLB=m
CONFIG_VHOST_TASK=y
CONFIG_VHOST=m
CONFIG_VHOST_MENU=y
CONFIG_VHOST_NET=m
CONFIG_VHOST_VSOCK=m
# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y
#
# Microsoft Hyper-V guest support
#
# end of Microsoft Hyper-V guest support
# CONFIG_GREYBUS is not set
# CONFIG_COMEDI is not set
# CONFIG_GPIB is not set
# CONFIG_STAGING is not set
# CONFIG_GOLDFISH is not set
# CONFIG_CHROME_PLATFORMS is not set
# CONFIG_MELLANOX_PLATFORM is not set
# CONFIG_SURFACE_PLATFORMS is not set
CONFIG_X86_PLATFORM_DEVICES=y
CONFIG_WMI_BMOF=m
# CONFIG_HUAWEI_WMI is not set
# CONFIG_X86_PLATFORM_DRIVERS_UNIWILL is not set
# CONFIG_MXM_WMI is not set
# CONFIG_NVIDIA_WMI_EC_BACKLIGHT is not set
# CONFIG_XIAOMI_WMI is not set
# CONFIG_REDMI_WMI is not set
# CONFIG_GIGABYTE_WMI is not set
# CONFIG_BITLAND_MIFS_WMI is not set
# CONFIG_ACERHDF is not set
# CONFIG_ACER_WIRELESS is not set
# CONFIG_ACER_WMI is not set
# CONFIG_AMD_3D_VCACHE is not set
# CONFIG_AMD_WBRF is not set
# CONFIG_AMD_ISP_PLATFORM is not set
# CONFIG_ADV_SWBUTTON is not set
# CONFIG_APPLE_GMUX is not set
# CONFIG_ASUS_LAPTOP is not set
# CONFIG_ASUS_WIRELESS is not set
# CONFIG_ASUS_WMI is not set
# CONFIG_ASUS_TF103C_DOCK is not set
# CONFIG_AYANEO_EC is not set
# CONFIG_EEEPC_LAPTOP is not set
# CONFIG_X86_PLATFORM_DRIVERS_DELL is not set
# CONFIG_AMILO_RFKILL is not set
# CONFIG_FUJITSU_LAPTOP is not set
# CONFIG_FUJITSU_TABLET is not set
# CONFIG_GPD_POCKET_FAN is not set
# CONFIG_X86_PLATFORM_DRIVERS_HP is not set
# CONFIG_WIRELESS_HOTKEY is not set
# CONFIG_IBM_RTL is not set
# CONFIG_SENSORS_HDAPS is not set
# CONFIG_INTEL_ATOMISP2_PM is not set
# CONFIG_INTEL_IFS is not set
# CONFIG_INTEL_SAR_INT1092 is not set
# CONFIG_INTEL_PMC_CORE is not set
CONFIG_INTEL_PMT_CLASS=m
CONFIG_INTEL_PMT_TELEMETRY=m
CONFIG_INTEL_PMT_CRASHLOG=m
CONFIG_INTEL_PMT_DISCOVERY=m
#
# Intel Speed Select Technology interface support
#
# CONFIG_INTEL_SPEED_SELECT_INTERFACE is not set
# end of Intel Speed Select Technology interface support
CONFIG_INTEL_WMI=y
CONFIG_INTEL_WMI_SBL_FW_UPDATE=m
CONFIG_INTEL_WMI_THUNDERBOLT=m
#
# Intel Uncore Frequency Control
#
CONFIG_INTEL_UNCORE_FREQ_CONTROL=y
# end of Intel Uncore Frequency Control
# CONFIG_INTEL_HID_EVENT is not set
# CONFIG_INTEL_VBTN is not set
# CONFIG_INTEL_EHL_PSE_IO is not set
# CONFIG_INTEL_INT0002_VGPIO is not set
# CONFIG_INTEL_OAKTRAIL is not set
# CONFIG_INTEL_PUNIT_IPC is not set
CONFIG_INTEL_RST=y
# CONFIG_INTEL_SDSI is not set
CONFIG_INTEL_SMARTCONNECT=y
# CONFIG_INTEL_TPMI is not set
CONFIG_INTEL_TURBO_MAX_3=y
CONFIG_INTEL_VSEC=m
# CONFIG_IDEAPAD_LAPTOP is not set
# CONFIG_LENOVO_WMI_HOTKEY_UTILITIES is not set
# CONFIG_LENOVO_WMI_CAMERA is not set
# CONFIG_LENOVO_YB9_KBDOCK is not set
# CONFIG_THINKPAD_ACPI is not set
# CONFIG_THINKPAD_LMI is not set
# CONFIG_YOGABOOK is not set
# CONFIG_LENOVO_WMI_GAMEZONE is not set
# CONFIG_LENOVO_WMI_TUNING is not set
# CONFIG_ACPI_QUICKSTART is not set
# CONFIG_MEEGOPAD_ANX7428 is not set
# CONFIG_MSI_EC is not set
# CONFIG_MSI_LAPTOP is not set
# CONFIG_MSI_WMI is not set
# CONFIG_MSI_WMI_PLATFORM is not set
# CONFIG_PCENGINES_APU2 is not set
# CONFIG_BARCO_P50_GPIO is not set
# CONFIG_SAMSUNG_GALAXYBOOK is not set
# CONFIG_SAMSUNG_LAPTOP is not set
# CONFIG_SAMSUNG_Q10 is not set
# CONFIG_TOSHIBA_BT_RFKILL is not set
# CONFIG_TOSHIBA_HAPS is not set
# CONFIG_TOSHIBA_WMI is not set
# CONFIG_ACPI_CMPC is not set
# CONFIG_COMPAL_LAPTOP is not set
# CONFIG_LG_LAPTOP is not set
# CONFIG_PANASONIC_LAPTOP is not set
# CONFIG_SONY_LAPTOP is not set
# CONFIG_SYSTEM76_ACPI is not set
# CONFIG_TOPSTAR_LAPTOP is not set
# CONFIG_SERIAL_MULTI_INSTANTIATE is not set
# CONFIG_INSPUR_PLATFORM_PROFILE is not set
# CONFIG_DASHARO_ACPI is not set
# CONFIG_X86_ANDROID_TABLETS is not set
CONFIG_INTEL_IPS=y
# CONFIG_INTEL_SCU_PCI is not set
# CONFIG_INTEL_SCU_PLATFORM is not set
# CONFIG_SIEMENS_SIMATIC_IPC is not set
# CONFIG_WINMATE_FM07_KEYS is not set
# CONFIG_OXP_EC is not set
# CONFIG_TUXEDO_NB04_WMI_AB is not set
CONFIG_P2SB=y
CONFIG_ACPI_WMI=m
# CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set
CONFIG_HAVE_CLK=y
CONFIG_HAVE_CLK_PREPARE=y
CONFIG_COMMON_CLK=y
# CONFIG_LMK04832 is not set
# CONFIG_COMMON_CLK_MAX9485 is not set
# CONFIG_COMMON_CLK_SI5341 is not set
# CONFIG_COMMON_CLK_SI5351 is not set
# CONFIG_COMMON_CLK_SI544 is not set
# CONFIG_COMMON_CLK_CDCE706 is not set
# CONFIG_COMMON_CLK_CS2000_CP is not set
# CONFIG_COMMON_CLK_PWM is not set
#
# Cixtech Audio Subsystem Clock Driver
#
# end of Cixtech Audio Subsystem Clock Driver
# CONFIG_XILINX_VCU is not set
CONFIG_HWSPINLOCK=y
#
# Clock Source drivers
#
CONFIG_CLKEVT_I8253=y
CONFIG_I8253_LOCK=y
CONFIG_CLKBLD_I8253=y
# end of Clock Source drivers
CONFIG_MAILBOX=y
CONFIG_PCC=y
# CONFIG_ALTERA_MBOX is not set
CONFIG_IOMMU_IOVA=y
CONFIG_IOMMU_API=y
CONFIG_IOMMUFD_DRIVER=y
CONFIG_IOMMU_SUPPORT=y
#
# Generic IOMMU Pagetable Support
#
# end of Generic IOMMU Pagetable Support
# CONFIG_IOMMU_DEBUGFS is not set
# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set
CONFIG_IOMMU_DEFAULT_DMA_LAZY=y
# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
CONFIG_IOMMU_DMA=y
CONFIG_IOMMU_SVA=y
CONFIG_IOMMU_IOPF=y
# CONFIG_AMD_IOMMU is not set
CONFIG_DMAR_TABLE=y
CONFIG_INTEL_IOMMU=y
CONFIG_INTEL_IOMMU_SVM=y
# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set
CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON=y
CONFIG_INTEL_IOMMU_PERF_EVENTS=y
CONFIG_IOMMUFD_DRIVER_CORE=y
CONFIG_IOMMUFD=m
CONFIG_IRQ_REMAP=y
CONFIG_VIRTIO_IOMMU=y
CONFIG_GENERIC_PT=y
# CONFIG_DEBUG_GENERIC_PT is not set
CONFIG_IOMMU_PT=y
# CONFIG_IOMMU_PT_AMDV1 is not set
CONFIG_IOMMU_PT_VTDSS=y
# CONFIG_IOMMU_PT_RISCV64 is not set
CONFIG_IOMMU_PT_X86_64=y
#
# Remoteproc drivers
#
CONFIG_REMOTEPROC=y
# CONFIG_REMOTEPROC_CDEV is not set
# end of Remoteproc drivers
#
# Rpmsg drivers
#
# CONFIG_RPMSG_QCOM_GLINK_RPM is not set
# CONFIG_RPMSG_VIRTIO is not set
# end of Rpmsg drivers
#
# SOC (System On Chip) specific Drivers
#
#
# Amlogic SoC drivers
#
# end of Amlogic SoC drivers
#
# Broadcom SoC drivers
#
# end of Broadcom SoC drivers
#
# NXP/Freescale QorIQ SoC drivers
#
# end of NXP/Freescale QorIQ SoC drivers
#
# fujitsu SoC drivers
#
# end of fujitsu SoC drivers
#
# i.MX SoC drivers
#
# end of i.MX SoC drivers
#
# Enable LiteX SoC Builder specific drivers
#
# end of Enable LiteX SoC Builder specific drivers
# CONFIG_WPCM450_SOC is not set
# CONFIG_SOC_TI is not set
#
# Xilinx SoC drivers
#
# end of Xilinx SoC drivers
# end of SOC (System On Chip) specific Drivers
#
# PM Domains
#
#
# Amlogic PM Domains
#
# end of Amlogic PM Domains
#
# Broadcom PM Domains
#
# end of Broadcom PM Domains
#
# i.MX PM Domains
#
# end of i.MX PM Domains
#
# Qualcomm PM Domains
#
# end of Qualcomm PM Domains
# end of PM Domains
CONFIG_PM_DEVFREQ=y
#
# DEVFREQ Governors
#
CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVFREQ_GOV_PASSIVE is not set
#
# DEVFREQ Drivers
#
# CONFIG_PM_DEVFREQ_EVENT is not set
# CONFIG_EXTCON is not set
# CONFIG_MEMORY is not set
# CONFIG_IIO is not set
# CONFIG_NTB is not set
CONFIG_PWM=y
# CONFIG_PWM_DEBUG is not set
# CONFIG_PWM_PROVIDE_GPIO is not set
# CONFIG_PWM_CLK is not set
# CONFIG_PWM_DWC is not set
CONFIG_PWM_GPIO=m
CONFIG_PWM_LPSS=m
CONFIG_PWM_LPSS_PCI=m
CONFIG_PWM_LPSS_PLATFORM=m
# CONFIG_PWM_PCA9685 is not set
#
# IRQ chip support
#
CONFIG_IRQ_MSI_LIB=y
# end of IRQ chip support
# CONFIG_IPACK_BUS is not set
# CONFIG_RESET_CONTROLLER is not set
#
# PHY Subsystem
#
CONFIG_GENERIC_PHY=y
# CONFIG_PHY_CAN_TRANSCEIVER is not set
# CONFIG_PHY_GOOGLE_USB is not set
# CONFIG_USB_LGM_PHY is not set
# CONFIG_PHY_NXP_TJA1145 is not set
#
# PHY drivers for Broadcom platforms
#
# CONFIG_BCM_KONA_USB2_PHY is not set
# end of PHY drivers for Broadcom platforms
# CONFIG_PHY_INTEL_LGM_EMMC is not set
# CONFIG_PHY_PXA_28NM_HSIC is not set
# CONFIG_PHY_PXA_28NM_USB2 is not set
# end of PHY Subsystem
CONFIG_POWERCAP=y
CONFIG_INTEL_RAPL_CORE=y
CONFIG_INTEL_RAPL=y
CONFIG_IDLE_INJECT=y
# CONFIG_MCB is not set
#
# Performance monitor support
#
# CONFIG_DWC_PCIE_PMU is not set
# end of Performance monitor support
CONFIG_RAS=y
CONFIG_RAS_CEC=y
# CONFIG_RAS_CEC_DEBUG is not set
CONFIG_USB4=m
CONFIG_USB4_CONFIGFS=m
# CONFIG_USB4_DEBUGFS_WRITE is not set
# CONFIG_USB4_DMA_TEST is not set
# CONFIG_USB4_STREAM is not set
#
# Android
#
# CONFIG_ANDROID_BINDER_IPC is not set
# end of Android
CONFIG_LIBNVDIMM=y
CONFIG_BLK_DEV_PMEM=y
# CONFIG_BTT is not set
CONFIG_RAMDAX=y
CONFIG_NVDIMM_KEYS=y
# CONFIG_NVDIMM_SECURITY_TEST is not set
CONFIG_DAX=y
CONFIG_DEV_DAX=m
CONFIG_DEV_DAX_HMEM=m
CONFIG_DEV_DAX_HMEM_DEVICES=y
CONFIG_NVMEM=y
CONFIG_NVMEM_SYSFS=y
# CONFIG_NVMEM_LAYOUTS is not set
CONFIG_EEPROM_AT24=y
# CONFIG_EEPROM_AT25 is not set
# CONFIG_EEPROM_93XX46 is not set
CONFIG_EEPROM_EE1004=y
# CONFIG_EEPROM_M24LR is not set
CONFIG_NVMEM_RMEM=y
#
# HW tracing support
#
# CONFIG_STM is not set
# CONFIG_INTEL_TH is not set
# end of HW tracing support
# CONFIG_FPGA is not set
CONFIG_MULTIPLEXER=y
# CONFIG_MUX_CORE is not set
#
# Multiplexer drivers
#
# CONFIG_MUX_ADG792A is not set
# CONFIG_MUX_ADGS1408 is not set
CONFIG_MUX_GPIO=y
# end of Multiplexer drivers
CONFIG_PM_OPP=y
# CONFIG_SIOX is not set
# CONFIG_SLIMBUS is not set
# CONFIG_INTERCONNECT is not set
# CONFIG_COUNTER is not set
# CONFIG_MOST is not set
# CONFIG_PECI is not set
# CONFIG_HTE is not set
# end of Device Drivers
#
# File systems
#
CONFIG_DCACHE_WORD_ACCESS=y
CONFIG_VALIDATE_FS_PARSER=y
CONFIG_FS_IOMAP=y
CONFIG_FS_STACK=y
CONFIG_BUFFER_HEAD=y
CONFIG_LEGACY_DIRECT_IO=y
# CONFIG_EXT2_FS is not set
CONFIG_EXT4_FS=y
CONFIG_EXT4_USE_FOR_EXT2=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_EXT4_FS_SECURITY=y
# CONFIG_EXT4_DEBUG is not set
CONFIG_JBD2=y
# CONFIG_JBD2_DEBUG is not set
CONFIG_FS_MBCACHE=y
# CONFIG_JFS_FS is not set
# CONFIG_XFS_FS is not set
# CONFIG_GFS2_FS is not set
# CONFIG_OCFS2_FS is not set
CONFIG_BTRFS_FS=y
CONFIG_BTRFS_FS_POSIX_ACL=y
# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
# CONFIG_BTRFS_DEBUG is not set
# CONFIG_BTRFS_ASSERT is not set
# CONFIG_BTRFS_EXPERIMENTAL is not set
# CONFIG_NILFS2_FS is not set
# CONFIG_F2FS_FS is not set
# CONFIG_ZONEFS_FS is not set
CONFIG_FS_POSIX_ACL=y
CONFIG_EXPORTFS=y
CONFIG_EXPORTFS_BLOCK_OPS=y
CONFIG_FILE_LOCKING=y
CONFIG_FS_ENCRYPTION=y
CONFIG_FS_ENCRYPTION_ALGS=y
CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y
CONFIG_FS_VERITY=y
# CONFIG_FS_VERITY_BUILTIN_SIGNATURES is not set
CONFIG_FSNOTIFY=y
CONFIG_DNOTIFY=y
CONFIG_INOTIFY_USER=y
CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
CONFIG_QUOTA=y
CONFIG_QUOTA_NETLINK_INTERFACE=y
# CONFIG_QUOTA_DEBUG is not set
CONFIG_QUOTA_TREE=y
# CONFIG_QFMT_V1 is not set
CONFIG_QFMT_V2=y
CONFIG_QUOTACTL=y
CONFIG_AUTOFS_FS=y
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
CONFIG_VIRTIO_FS=m
CONFIG_FUSE_PASSTHROUGH=y
CONFIG_FUSE_IO_URING=y
CONFIG_OVERLAY_FS=y
# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set
CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y
# CONFIG_OVERLAY_FS_INDEX is not set
# CONFIG_OVERLAY_FS_XINO_AUTO is not set
# CONFIG_OVERLAY_FS_METACOPY is not set
# CONFIG_OVERLAY_FS_DEBUG is not set
#
# Caches
#
CONFIG_NETFS_SUPPORT=y
CONFIG_NETFS_STATS=y
# CONFIG_NETFS_DEBUG is not set
CONFIG_FSCACHE=y
CONFIG_FSCACHE_STATS=y
CONFIG_CACHEFILES=y
# CONFIG_CACHEFILES_DEBUG is not set
# CONFIG_CACHEFILES_ERROR_INJECTION is not set
# end of Caches
#
# CD-ROM/DVD Filesystems
#
CONFIG_ISO9660_FS=y
CONFIG_JOLIET=y
CONFIG_ZISOFS=y
CONFIG_UDF_FS=y
# end of CD-ROM/DVD Filesystems
#
# DOS/FAT/EXFAT/NT Filesystems
#
CONFIG_FAT_FS=y
CONFIG_MSDOS_FS=y
CONFIG_VFAT_FS=y
CONFIG_FAT_DEFAULT_CODEPAGE=437
CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
# CONFIG_FAT_DEFAULT_UTF8 is not set
CONFIG_EXFAT_FS=y
CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8"
# CONFIG_NTFS_FS is not set
CONFIG_NTFS3_FS=y
# CONFIG_NTFS3_64BIT_CLUSTER is not set
CONFIG_NTFS3_LZX_XPRESS=y
CONFIG_NTFS3_FS_POSIX_ACL=y
# end of DOS/FAT/EXFAT/NT Filesystems
#
# Pseudo filesystems
#
CONFIG_PROC_FS=y
CONFIG_PROC_KCORE=y
CONFIG_PROC_VMCORE=y
CONFIG_PROC_VMCORE_DEVICE_DUMP=y
CONFIG_SYSCTL=y
CONFIG_PROC_PAGE_MONITOR=y
CONFIG_PROC_CHILDREN=y
CONFIG_PROC_PID_ARCH_STATUS=y
CONFIG_PROC_CPU_RESCTRL=y
CONFIG_KERNFS=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_TMPFS_XATTR=y
CONFIG_TMPFS_INODE64=y
CONFIG_TMPFS_QUOTA=y
CONFIG_ARCH_SUPPORTS_HUGETLBFS=y
CONFIG_HUGETLBFS=y
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y
CONFIG_HUGETLB_PAGE=y
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING=y
CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
CONFIG_CONFIGFS_FS=y
CONFIG_EFIVAR_FS=y
# end of Pseudo filesystems
CONFIG_MISC_FILESYSTEMS=y
# CONFIG_ORANGEFS_FS is not set
# CONFIG_ADFS_FS is not set
# CONFIG_AFFS_FS is not set
CONFIG_ECRYPT_FS=y
# CONFIG_ECRYPT_FS_MESSAGING is not set
# CONFIG_HFS_FS is not set
# CONFIG_HFSPLUS_FS is not set
# CONFIG_BEFS_FS is not set
# CONFIG_BFS_FS is not set
# CONFIG_CRAMFS is not set
CONFIG_SQUASHFS=y
# CONFIG_SQUASHFS_FILE_CACHE is not set
CONFIG_SQUASHFS_FILE_DIRECT=y
CONFIG_SQUASHFS_DECOMP_SINGLE=y
# CONFIG_SQUASHFS_CHOICE_DECOMP_BY_MOUNT is not set
CONFIG_SQUASHFS_COMPILE_DECOMP_SINGLE=y
# CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI is not set
# CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU is not set
CONFIG_SQUASHFS_XATTR=y
# CONFIG_SQUASHFS_COMP_CACHE_FULL is not set
CONFIG_SQUASHFS_ZLIB=y
CONFIG_SQUASHFS_LZ4=y
CONFIG_SQUASHFS_LZO=y
CONFIG_SQUASHFS_XZ=y
CONFIG_SQUASHFS_ZSTD=y
# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
# CONFIG_SQUASHFS_EMBEDDED is not set
CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
# CONFIG_MINIX_FS is not set
# CONFIG_OMFS_FS is not set
# CONFIG_HPFS_FS is not set
# CONFIG_QNX4FS_FS is not set
# CONFIG_QNX6FS_FS is not set
CONFIG_RESCTRL_FS=y
CONFIG_RESCTRL_FS_PSEUDO_LOCK=y
# CONFIG_ROMFS_FS is not set
CONFIG_PSTORE=y
CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240
CONFIG_PSTORE_COMPRESS=y
# CONFIG_PSTORE_CONSOLE is not set
# CONFIG_PSTORE_PMSG is not set
# CONFIG_PSTORE_FTRACE is not set
# CONFIG_PSTORE_RAM is not set
# CONFIG_PSTORE_BLK is not set
# CONFIG_UFS_FS is not set
# CONFIG_EROFS_FS is not set
CONFIG_NETWORK_FILESYSTEMS=y
CONFIG_NFS_FS=y
# CONFIG_NFS_V2 is not set
CONFIG_NFS_V3=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFS_V4=y
CONFIG_NFS_SWAP=y
CONFIG_NFS_V4_0=y
CONFIG_NFS_V4_2=y
CONFIG_PNFS_FILE_LAYOUT=y
CONFIG_PNFS_BLOCK=y
CONFIG_PNFS_FLEXFILE_LAYOUT=y
CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org"
# CONFIG_NFS_V4_1_MIGRATION is not set
CONFIG_NFS_V4_SECURITY_LABEL=y
CONFIG_NFS_FSCACHE=y
# CONFIG_NFS_USE_LEGACY_DNS is not set
CONFIG_NFS_USE_KERNEL_DNS=y
CONFIG_NFS_DEBUG=y
CONFIG_NFS_DISABLE_UDP_SUPPORT=y
# CONFIG_NFS_V4_2_READ_PLUS is not set
CONFIG_NFSD=y
# CONFIG_NFSD_V2 is not set
CONFIG_NFSD_V3_ACL=y
CONFIG_NFSD_V4=y
CONFIG_NFSD_PNFS=y
CONFIG_NFSD_BLOCKLAYOUT=y
CONFIG_NFSD_SCSILAYOUT=y
CONFIG_NFSD_FLEXFILELAYOUT=y
CONFIG_NFSD_V4_2_INTER_SSC=y
CONFIG_NFSD_V4_SECURITY_LABEL=y
# CONFIG_NFSD_LEGACY_CLIENT_TRACKING is not set
CONFIG_NFSD_V4_POSIX_ACLS=y
CONFIG_GRACE_PERIOD=y
CONFIG_LOCKD=y
CONFIG_LOCKD_V4=y
CONFIG_NFS_ACL_SUPPORT=y
CONFIG_NFS_COMMON=y
CONFIG_NFS_COMMON_LOCALIO_SUPPORT=y
CONFIG_NFS_LOCALIO=y
CONFIG_NFS_V4_2_SSC_HELPER=y
CONFIG_SUNRPC=y
CONFIG_SUNRPC_GSS=y
CONFIG_SUNRPC_BACKCHANNEL=y
CONFIG_SUNRPC_SWAP=y
CONFIG_RPCSEC_GSS_KRB5=y
CONFIG_SUNRPC_DEBUG=y
# CONFIG_SUNRPC_DEBUG_TRACE is not set
# CONFIG_CEPH_FS is not set
CONFIG_CIFS=y
# CONFIG_CIFS_STATS2 is not set
CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
CONFIG_CIFS_UPCALL=y
CONFIG_CIFS_XATTR=y
CONFIG_CIFS_POSIX=y
CONFIG_CIFS_DEBUG=y
# CONFIG_CIFS_DEBUG2 is not set
# CONFIG_CIFS_DEBUG_DUMP_KEYS is not set
CONFIG_CIFS_DFS_UPCALL=y
CONFIG_CIFS_SWN_UPCALL=y
CONFIG_CIFS_FSCACHE=y
# CONFIG_CIFS_COMPRESSION is not set
# CONFIG_SMB_SERVER is not set
CONFIG_SMBFS=y
# CONFIG_CODA_FS is not set
# CONFIG_AFS_FS is not set
CONFIG_NLS=y
CONFIG_NLS_DEFAULT="utf8"
CONFIG_NLS_CODEPAGE_437=y
# CONFIG_NLS_CODEPAGE_737 is not set
# CONFIG_NLS_CODEPAGE_775 is not set
CONFIG_NLS_CODEPAGE_850=y
CONFIG_NLS_CODEPAGE_852=y
# CONFIG_NLS_CODEPAGE_855 is not set
# CONFIG_NLS_CODEPAGE_857 is not set
# CONFIG_NLS_CODEPAGE_860 is not set
# CONFIG_NLS_CODEPAGE_861 is not set
# CONFIG_NLS_CODEPAGE_862 is not set
# CONFIG_NLS_CODEPAGE_863 is not set
# CONFIG_NLS_CODEPAGE_864 is not set
# CONFIG_NLS_CODEPAGE_865 is not set
# CONFIG_NLS_CODEPAGE_866 is not set
# CONFIG_NLS_CODEPAGE_869 is not set
# CONFIG_NLS_CODEPAGE_936 is not set
# CONFIG_NLS_CODEPAGE_950 is not set
# CONFIG_NLS_CODEPAGE_932 is not set
# CONFIG_NLS_CODEPAGE_949 is not set
# CONFIG_NLS_CODEPAGE_874 is not set
# CONFIG_NLS_ISO8859_8 is not set
CONFIG_NLS_CODEPAGE_1250=y
# CONFIG_NLS_CODEPAGE_1251 is not set
CONFIG_NLS_ASCII=y
CONFIG_NLS_ISO8859_1=y
CONFIG_NLS_ISO8859_2=y
# CONFIG_NLS_ISO8859_3 is not set
# CONFIG_NLS_ISO8859_4 is not set
# CONFIG_NLS_ISO8859_5 is not set
# CONFIG_NLS_ISO8859_6 is not set
# CONFIG_NLS_ISO8859_7 is not set
# CONFIG_NLS_ISO8859_9 is not set
CONFIG_NLS_ISO8859_13=y
# CONFIG_NLS_ISO8859_14 is not set
CONFIG_NLS_ISO8859_15=y
# CONFIG_NLS_KOI8_R is not set
# CONFIG_NLS_KOI8_U is not set
CONFIG_NLS_MAC_ROMAN=y
# CONFIG_NLS_MAC_CELTIC is not set
# CONFIG_NLS_MAC_CENTEURO is not set
# CONFIG_NLS_MAC_CROATIAN is not set
# CONFIG_NLS_MAC_CYRILLIC is not set
# CONFIG_NLS_MAC_GAELIC is not set
# CONFIG_NLS_MAC_GREEK is not set
# CONFIG_NLS_MAC_ICELAND is not set
# CONFIG_NLS_MAC_INUIT is not set
# CONFIG_NLS_MAC_ROMANIAN is not set
# CONFIG_NLS_MAC_TURKISH is not set
CONFIG_NLS_UTF8=y
CONFIG_NLS_UCS2_UTILS=y
CONFIG_DLM=m
CONFIG_DLM_DEBUG=y
CONFIG_UNICODE=y
CONFIG_IO_WQ=y
# end of File systems
#
# Security options
#
CONFIG_KEYS=y
CONFIG_KEYS_REQUEST_CACHE=y
CONFIG_PERSISTENT_KEYRINGS=y
CONFIG_BIG_KEYS=y
CONFIG_TRUSTED_KEYS=y
CONFIG_HAVE_TRUSTED_KEYS=y
CONFIG_HAVE_TRUSTED_KEYS_DEBUG=y
# CONFIG_TRUSTED_KEYS_DEBUG is not set
CONFIG_TRUSTED_KEYS_TPM=y
CONFIG_ENCRYPTED_KEYS=y
# CONFIG_USER_DECRYPTED_DATA is not set
CONFIG_KEY_DH_OPERATIONS=y
CONFIG_KEY_NOTIFICATIONS=y
CONFIG_SECURITY_DMESG_RESTRICT=y
# CONFIG_PROC_MEM_ALWAYS_FORCE is not set
CONFIG_PROC_MEM_FORCE_PTRACE=y
# CONFIG_PROC_MEM_NO_FORCE is not set
CONFIG_SECURITY=y
CONFIG_HAS_SECURITY_AUDIT=y
CONFIG_SECURITYFS=y
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_NETWORK_XFRM=y
CONFIG_SECURITY_PATH=y
CONFIG_INTEL_TXT=y
CONFIG_LSM_MMAP_MIN_ADDR=65535
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9
# CONFIG_SECURITY_SELINUX_DEBUG is not set
# CONFIG_SECURITY_SMACK is not set
CONFIG_SECURITY_TOMOYO=y
CONFIG_SECURITY_TOMOYO_MAX_ACCEPT_ENTRY=2048
CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024
# CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER is not set
CONFIG_SECURITY_TOMOYO_POLICY_LOADER="/sbin/tomoyo-init"
CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER="/usr/lib/systemd/systemd"
# CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING is not set
# CONFIG_SECURITY_APPARMOR is not set
# CONFIG_SECURITY_LOADPIN is not set
CONFIG_SECURITY_YAMA=y
# CONFIG_SECURITY_SAFESETID is not set
CONFIG_SECURITY_LOCKDOWN_LSM=y
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
CONFIG_SECURITY_LANDLOCK=y
CONFIG_SECURITY_LANDLOCK_LOG=y
CONFIG_SECURITY_IPE=y
CONFIG_IPE_BOOT_POLICY=""
CONFIG_IPE_POLICY_SIG_SECONDARY_KEYRING=y
CONFIG_IPE_POLICY_SIG_PLATFORM_KEYRING=y
#
# IPE Trust Providers
#
CONFIG_IPE_PROP_FS_VERITY=y
# end of IPE Trust Providers
CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y
CONFIG_INTEGRITY_CA_MACHINE_KEYRING=y
CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y
CONFIG_LOAD_UEFI_KEYS=y
CONFIG_INTEGRITY_AUDIT=y
CONFIG_IMA=y
CONFIG_IMA_KEXEC=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_LSM_RULES=y
CONFIG_IMA_NG_TEMPLATE=y
# CONFIG_IMA_SIG_TEMPLATE is not set
CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
# CONFIG_IMA_DEFAULT_HASH_SHA1 is not set
CONFIG_IMA_DEFAULT_HASH_SHA256=y
# CONFIG_IMA_DEFAULT_HASH_SHA512 is not set
# CONFIG_IMA_DEFAULT_HASH_WP512 is not set
CONFIG_IMA_DEFAULT_HASH="sha256"
CONFIG_IMA_WRITE_POLICY=y
CONFIG_IMA_READ_POLICY=y
CONFIG_IMA_APPRAISE=y
CONFIG_IMA_ARCH_POLICY=y
# CONFIG_IMA_APPRAISE_BUILD_POLICY is not set
CONFIG_IMA_APPRAISE_BOOTPARAM=y
CONFIG_IMA_APPRAISE_MODSIG=y
CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y
# CONFIG_IMA_BLACKLIST_KEYRING is not set
# CONFIG_IMA_LOAD_X509 is not set
CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y
CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y
# CONFIG_IMA_DISABLE_HTABLE is not set
CONFIG_IMA_KEXEC_EXTRA_MEMORY_KB=0
# CONFIG_IMA_STAGING is not set
# CONFIG_IMA_INIT_LATE_SYNC is not set
CONFIG_EVM=y
CONFIG_EVM_ATTR_FSUUID=y
# CONFIG_EVM_ADD_XATTRS is not set
# CONFIG_EVM_LOAD_X509 is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,integrity,selinux,bpf,landlock,ipe"
#
# Kernel hardening options
#
#
# Memory initialization
#
CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
# CONFIG_INIT_STACK_NONE is not set
# CONFIG_INIT_STACK_ALL_PATTERN is not set
CONFIG_INIT_STACK_ALL_ZERO=y
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
# CONFIG_ZERO_CALL_USED_REGS is not set
# end of Memory initialization
#
# Bounds checking
#
CONFIG_FORTIFY_SOURCE=y
CONFIG_HARDENED_USERCOPY=y
CONFIG_HARDENED_USERCOPY_DEFAULT_ON=y
# end of Bounds checking
#
# Hardening of kernel data structures
#
CONFIG_LIST_HARDENED=y
CONFIG_BUG_ON_DATA_CORRUPTION=y
# end of Hardening of kernel data structures
CONFIG_RANDSTRUCT_NONE=y
# end of Kernel hardening options
# end of Security options
CONFIG_CRYPTO=y
#
# Crypto core or helper
#
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
CONFIG_CRYPTO_AEAD2=y
CONFIG_CRYPTO_SIG=y
CONFIG_CRYPTO_SIG2=y
CONFIG_CRYPTO_SKCIPHER=y
CONFIG_CRYPTO_SKCIPHER2=y
CONFIG_CRYPTO_HASH=y
CONFIG_CRYPTO_HASH2=y
CONFIG_CRYPTO_RNG=y
CONFIG_CRYPTO_RNG2=y
CONFIG_CRYPTO_AKCIPHER2=y
CONFIG_CRYPTO_AKCIPHER=y
CONFIG_CRYPTO_KPP2=y
CONFIG_CRYPTO_KPP=y
CONFIG_CRYPTO_ACOMP2=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
CONFIG_CRYPTO_USER=y
# CONFIG_CRYPTO_SELFTESTS is not set
# CONFIG_CRYPTO_NULL is not set
CONFIG_CRYPTO_PCRYPT=y
# CONFIG_CRYPTO_CRYPTD is not set
CONFIG_CRYPTO_AUTHENC=y
CONFIG_CRYPTO_KRB5ENC=y
# CONFIG_CRYPTO_BENCHMARK is not set
# end of Crypto core or helper
#
# Public-key cryptography
#
CONFIG_CRYPTO_RSA=y
CONFIG_CRYPTO_DH=y
CONFIG_CRYPTO_DH_RFC7919_GROUPS=y
CONFIG_CRYPTO_ECC=y
CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECDSA=y
CONFIG_CRYPTO_ECRDSA=y
# CONFIG_CRYPTO_MLDSA is not set
# end of Public-key cryptography
#
# Block ciphers
#
CONFIG_CRYPTO_AES=y
# CONFIG_CRYPTO_ARIA is not set
CONFIG_CRYPTO_BLOWFISH=y
CONFIG_CRYPTO_BLOWFISH_COMMON=y
CONFIG_CRYPTO_CAMELLIA=y
CONFIG_CRYPTO_CAST_COMMON=y
CONFIG_CRYPTO_CAST5=y
CONFIG_CRYPTO_CAST6=y
CONFIG_CRYPTO_DES=y
CONFIG_CRYPTO_SERPENT=y
# CONFIG_CRYPTO_SM4_GENERIC is not set
CONFIG_CRYPTO_TWOFISH=y
CONFIG_CRYPTO_TWOFISH_COMMON=y
# end of Block ciphers
#
# Length-preserving ciphers and modes
#
CONFIG_CRYPTO_ADIANTUM=y
CONFIG_CRYPTO_CHACHA20=y
CONFIG_CRYPTO_CBC=y
CONFIG_CRYPTO_CTR=y
CONFIG_CRYPTO_CTS=y
CONFIG_CRYPTO_ECB=y
CONFIG_CRYPTO_HCTR2=y
CONFIG_CRYPTO_LRW=y
CONFIG_CRYPTO_XCTR=y
CONFIG_CRYPTO_XTS=y
# end of Length-preserving ciphers and modes
#
# AEAD (authenticated encryption with associated data) ciphers
#
CONFIG_CRYPTO_AEGIS128=y
CONFIG_CRYPTO_CHACHA20POLY1305=y
CONFIG_CRYPTO_CCM=y
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GENIV=y
CONFIG_CRYPTO_SEQIV=y
CONFIG_CRYPTO_ECHAINIV=y
CONFIG_CRYPTO_ESSIV=y
# end of AEAD (authenticated encryption with associated data) ciphers
#
# Hashes, digests, and MACs
#
# CONFIG_CRYPTO_BLAKE2B is not set
CONFIG_CRYPTO_CMAC=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_MD4=y
# CONFIG_CRYPTO_MD5 is not set
CONFIG_CRYPTO_RMD160=y
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_SHA512=y
# CONFIG_CRYPTO_SHA3 is not set
# CONFIG_CRYPTO_SM3 is not set
CONFIG_CRYPTO_STREEBOG=y
CONFIG_CRYPTO_WP512=y
CONFIG_CRYPTO_XCBC=y
# CONFIG_CRYPTO_XXHASH is not set
# end of Hashes, digests, and MACs
#
# CRCs (cyclic redundancy checks)
#
# CONFIG_CRYPTO_CRC32C is not set
CONFIG_CRYPTO_CRC32=m
# end of CRCs (cyclic redundancy checks)
#
# Compression
#
CONFIG_CRYPTO_DEFLATE=y
CONFIG_CRYPTO_LZO=y
CONFIG_CRYPTO_842=y
CONFIG_CRYPTO_LZ4=y
CONFIG_CRYPTO_LZ4HC=y
CONFIG_CRYPTO_ZSTD=y
# end of Compression
#
# Random number generation
#
# CONFIG_CRYPTO_DRBG is not set
# CONFIG_CRYPTO_JITTERENTROPY is not set
CONFIG_CRYPTO_KDF800108_CTR=y
# end of Random number generation
#
# Userspace interface (deprecated)
#
CONFIG_CRYPTO_USER_API=y
CONFIG_CRYPTO_USER_API_HASH=y
CONFIG_CRYPTO_USER_API_SKCIPHER=y
CONFIG_CRYPTO_USER_API_RNG=y
CONFIG_CRYPTO_USER_API_AEAD=y
# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
# end of Userspace interface (deprecated)
#
# Accelerated Cryptographic Algorithms for CPU (x86)
#
CONFIG_CRYPTO_AES_NI_INTEL=y
CONFIG_CRYPTO_BLOWFISH_X86_64=y
CONFIG_CRYPTO_CAMELLIA_X86_64=y
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64=y
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=y
CONFIG_CRYPTO_CAST5_AVX_X86_64=y
CONFIG_CRYPTO_CAST6_AVX_X86_64=y
CONFIG_CRYPTO_SERPENT_SSE2_X86_64=y
CONFIG_CRYPTO_SERPENT_AVX_X86_64=y
CONFIG_CRYPTO_SERPENT_AVX2_X86_64=y
# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set
# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set
CONFIG_CRYPTO_TWOFISH_X86_64=y
CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y
CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y
# CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set
# CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64 is not set
# CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64 is not set
CONFIG_CRYPTO_AEGIS128_AESNI_SSE2=y
# end of Accelerated Cryptographic Algorithms for CPU (x86)
# CONFIG_CRYPTO_HW is not set
CONFIG_ASYMMETRIC_KEY_TYPE=y
CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
CONFIG_X509_CERTIFICATE_PARSER=y
CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
CONFIG_PKCS7_MESSAGE_PARSER=y
# CONFIG_PKCS7_TEST_KEY is not set
CONFIG_SIGNED_PE_FILE_VERIFICATION=y
# CONFIG_FIPS_SIGNATURE_SELFTEST is not set
#
# Certificates for signature checking
#
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set
# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set
# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set
# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set
CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SYSTEM_TRUSTED_KEYS=""
CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
CONFIG_SECONDARY_TRUSTED_KEYRING=y
# CONFIG_SECONDARY_TRUSTED_KEYRING_SIGNED_BY_BUILTIN is not set
CONFIG_SYSTEM_BLACKLIST_KEYRING=y
CONFIG_SYSTEM_BLACKLIST_HASH_LIST=""
# CONFIG_SYSTEM_REVOCATION_LIST is not set
CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE=y
CONFIG_OPENSSL_SUPPORTS_ML_DSA=y
# end of Certificates for signature checking
CONFIG_CRYPTO_KRB5=y
# CONFIG_CRYPTO_KRB5_SELFTESTS is not set
CONFIG_BINARY_PRINTF=y
#
# Library routines
#
CONFIG_PACKING=y
CONFIG_BITREVERSE=y
CONFIG_GENERIC_BITREVERSE=y
CONFIG_GENERIC_STRNCPY_FROM_USER=y
CONFIG_GENERIC_STRNLEN_USER=y
CONFIG_GENERIC_NET_UTILS=y
CONFIG_CORDIC=y
# CONFIG_PRIME_NUMBERS is not set
CONFIG_RATIONAL=y
CONFIG_GENERIC_IOMAP=y
CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
CONFIG_ARCH_HAS_FAST_MULTIPLIER=y
CONFIG_ARCH_USE_SYM_ANNOTATIONS=y
CONFIG_CRC8=m
CONFIG_CRC16=y
CONFIG_CRC_CCITT=y
CONFIG_CRC_ITU_T=y
CONFIG_CRC_T10DIF=y
CONFIG_CRC_T10DIF_ARCH=y
CONFIG_CRC32=y
CONFIG_CRC32_ARCH=y
CONFIG_CRC64=y
CONFIG_CRC64_ARCH=y
CONFIG_CRC_OPTIMIZATIONS=y
CONFIG_CRYPTO_HASH_INFO=y
CONFIG_CRYPTO_LIB_UTILS=y
CONFIG_CRYPTO_LIB_AES=y
CONFIG_CRYPTO_LIB_AES_ARCH=y
CONFIG_CRYPTO_LIB_AES_CBC=y
CONFIG_CRYPTO_LIB_AES_CBC_MACS=y
CONFIG_CRYPTO_LIB_AES_CCM=y
CONFIG_CRYPTO_LIB_AES_CTR=y
CONFIG_CRYPTO_LIB_AES_ECB=y
CONFIG_CRYPTO_LIB_AES_GCM=y
CONFIG_CRYPTO_LIB_AES_XTS=y
CONFIG_CRYPTO_LIB_ARC4=y
CONFIG_CRYPTO_LIB_GF128MUL=y
CONFIG_CRYPTO_LIB_BLAKE2B=y
CONFIG_CRYPTO_LIB_BLAKE2S_ARCH=y
CONFIG_CRYPTO_LIB_CHACHA=y
CONFIG_CRYPTO_LIB_CHACHA_ARCH=y
CONFIG_CRYPTO_LIB_CURVE25519=m
CONFIG_CRYPTO_LIB_CURVE25519_ARCH=y
CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=y
CONFIG_CRYPTO_LIB_DES=y
CONFIG_CRYPTO_LIB_GF128HASH=y
CONFIG_CRYPTO_LIB_GF128HASH_ARCH=y
CONFIG_CRYPTO_LIB_MD5=y
CONFIG_CRYPTO_LIB_NH=y
CONFIG_CRYPTO_LIB_NH_ARCH=y
CONFIG_CRYPTO_LIB_POLY1305=y
CONFIG_CRYPTO_LIB_POLY1305_ARCH=y
CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y
CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
CONFIG_CRYPTO_LIB_CHACHA20POLY1305=y
CONFIG_CRYPTO_LIB_SHA1=y
CONFIG_CRYPTO_LIB_SHA1_ARCH=y
CONFIG_CRYPTO_LIB_SHA256=y
CONFIG_CRYPTO_LIB_SHA256_ARCH=y
CONFIG_CRYPTO_LIB_SHA512=y
CONFIG_CRYPTO_LIB_SHA512_ARCH=y
CONFIG_XOR_BLOCKS=y
CONFIG_XOR_BLOCKS_ARCH=y
CONFIG_RAID6_PQ=y
CONFIG_RAID6_PQ_ARCH=y
CONFIG_RAID6_PQ_BENCHMARK=y
CONFIG_XXHASH=y
CONFIG_842_COMPRESS=y
CONFIG_842_DECOMPRESS=y
CONFIG_ZLIB_INFLATE=y
CONFIG_ZLIB_DEFLATE=y
CONFIG_LZO_COMPRESS=y
CONFIG_LZO_DECOMPRESS=y
CONFIG_LZ4_COMPRESS=y
CONFIG_LZ4HC_COMPRESS=y
CONFIG_LZ4_DECOMPRESS=y
CONFIG_ZSTD_COMMON=y
CONFIG_ZSTD_COMPRESS=y
CONFIG_ZSTD_DECOMPRESS=y
CONFIG_XZ_DEC=y
CONFIG_XZ_DEC_X86=y
CONFIG_XZ_DEC_POWERPC=y
CONFIG_XZ_DEC_ARM=y
CONFIG_XZ_DEC_ARMTHUMB=y
CONFIG_XZ_DEC_ARM64=y
CONFIG_XZ_DEC_SPARC=y
CONFIG_XZ_DEC_RISCV=y
CONFIG_XZ_DEC_MICROLZMA=y
CONFIG_XZ_DEC_BCJ=y
# CONFIG_XZ_DEC_TEST is not set
CONFIG_DECOMPRESS_GZIP=y
CONFIG_DECOMPRESS_BZIP2=y
CONFIG_DECOMPRESS_LZMA=y
CONFIG_DECOMPRESS_XZ=y
CONFIG_DECOMPRESS_LZO=y
CONFIG_DECOMPRESS_LZ4=y
CONFIG_DECOMPRESS_ZSTD=y
CONFIG_GENERIC_ALLOCATOR=y
CONFIG_TEXTSEARCH=y
CONFIG_TEXTSEARCH_KMP=m
CONFIG_TEXTSEARCH_BM=m
CONFIG_TEXTSEARCH_FSM=m
CONFIG_INTERVAL_TREE=y
CONFIG_INTERVAL_TREE_SPAN_ITER=y
CONFIG_XARRAY_MULTI=y
CONFIG_ASSOCIATIVE_ARRAY=y
CONFIG_HAS_IOMEM=y
CONFIG_HAS_IOPORT=y
CONFIG_HAS_IOPORT_MAP=y
CONFIG_HAS_DMA=y
CONFIG_DMA_OPS_HELPERS=y
CONFIG_NEED_SG_DMA_FLAGS=y
CONFIG_NEED_SG_DMA_LENGTH=y
CONFIG_NEED_DMA_MAP_STATE=y
CONFIG_ARCH_DMA_ADDR_T_64BIT=y
CONFIG_SWIOTLB=y
CONFIG_SWIOTLB_DEFAULT_SIZE_MB=64
# CONFIG_SWIOTLB_DYNAMIC is not set
CONFIG_DMA_NEED_SYNC=y
CONFIG_DMA_CMA=y
CONFIG_DMA_NUMA_CMA=y
CONFIG_CMA_SIZE_PERNUMA=y
#
# Default contiguous memory area size:
#
CONFIG_CMA_SIZE_MBYTES=0
CONFIG_CMA_SIZE_SEL_MBYTES=y
# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
# CONFIG_CMA_SIZE_SEL_MIN is not set
# CONFIG_CMA_SIZE_SEL_MAX is not set
CONFIG_CMA_ALIGNMENT=8
# CONFIG_DMA_API_DEBUG is not set
# CONFIG_DMA_MAP_BENCHMARK is not set
CONFIG_SGL_ALLOC=y
CONFIG_CHECK_SIGNATURE=y
CONFIG_CPUMASK_OFFSTACK=y
CONFIG_CPU_RMAP=y
CONFIG_DQL=y
CONFIG_GLOB=y
CONFIG_NLATTR=y
CONFIG_CLZ_TAB=y
CONFIG_IRQ_POLL=y
CONFIG_MPILIB=y
CONFIG_SIGNATURE=y
CONFIG_DIMLIB=y
CONFIG_LIBFDT=y
CONFIG_OID_REGISTRY=y
CONFIG_UCS2_STRING=y
CONFIG_VDSO_DATASTORE=y
CONFIG_GENERIC_GETTIMEOFDAY=y
CONFIG_GENERIC_VDSO_OVERFLOW_PROTECT=y
CONFIG_VDSO_GETRANDOM=y
CONFIG_FONT_SUPPORT=y
# CONFIG_FONTS is not set
CONFIG_FONT_8x8=y
CONFIG_FONT_8x16=y
CONFIG_SG_POOL=y
CONFIG_ARCH_HAS_PMEM_API=y
CONFIG_MEMREGION=y
CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y
CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y
CONFIG_ARCH_HAS_COPY_MC=y
CONFIG_ARCH_STACKWALK=y
CONFIG_STACKDEPOT=y
CONFIG_STACKDEPOT_MAX_FRAMES=64
CONFIG_SBITMAP=y
# CONFIG_LWQ_TEST is not set
# end of Library routines
CONFIG_ASN1_ENCODER=y
CONFIG_FIRMWARE_TABLE=y
CONFIG_UNION_FIND=y
#
# Kernel hacking
#
#
# printk and dmesg options
#
CONFIG_PRINTK_TIME=y
# CONFIG_PRINTK_CALLER is not set
CONFIG_PRINTK_EXECUTION_CTX=y
# CONFIG_STACKTRACE_BUILD_ID is not set
CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
CONFIG_CONSOLE_LOGLEVEL_QUIET=3
CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
CONFIG_BOOT_PRINTK_DELAY=y
CONFIG_DYNAMIC_DEBUG=y
CONFIG_DYNAMIC_DEBUG_CORE=y
CONFIG_SYMBOLIC_ERRNAME=y
CONFIG_DEBUG_BUGVERBOSE=y
# CONFIG_DEBUG_BUGVERBOSE_DETAILED is not set
# end of printk and dmesg options
CONFIG_DEBUG_KERNEL=y
# CONFIG_DEBUG_MISC is not set
#
# Compile-time checks and compiler options
#
CONFIG_DEBUG_INFO=y
CONFIG_AS_HAS_NON_CONST_ULEB128=y
# CONFIG_DEBUG_INFO_NONE is not set
CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
# CONFIG_DEBUG_INFO_DWARF4 is not set
# CONFIG_DEBUG_INFO_DWARF5 is not set
# CONFIG_DEBUG_INFO_REDUCED is not set
CONFIG_DEBUG_INFO_COMPRESSED_NONE=y
# CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set
# CONFIG_DEBUG_INFO_COMPRESSED_ZSTD is not set
# CONFIG_DEBUG_INFO_SPLIT is not set
CONFIG_DEBUG_INFO_BTF=y
CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
CONFIG_DEBUG_INFO_BTF_MODULES=y
# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set
# CONFIG_GDB_SCRIPTS is not set
CONFIG_FRAME_WARN=2048
CONFIG_STRIP_ASM_SYMS=y
# CONFIG_READABLE_ASM is not set
CONFIG_HEADERS_INSTALL=y
# CONFIG_DEBUG_SECTION_MISMATCH is not set
CONFIG_SECTION_MISMATCH_WARN_ONLY=y
# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
CONFIG_OBJTOOL=y
# CONFIG_OBJTOOL_WERROR is not set
# CONFIG_VMLINUX_MAP is not set
# end of Compile-time checks and compiler options
#
# Generic Kernel Debugging Instruments
#
CONFIG_MAGIC_SYSRQ=y
CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x0
CONFIG_MAGIC_SYSRQ_SERIAL=y
CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_FS_ALLOW_ALL=y
# CONFIG_DEBUG_FS_ALLOW_NONE is not set
CONFIG_HAVE_ARCH_KGDB=y
CONFIG_KGDB=y
CONFIG_KGDB_HONOUR_BLOCKLIST=y
CONFIG_KGDB_SERIAL_CONSOLE=y
CONFIG_KGDB_TESTS=y
# CONFIG_KGDB_TESTS_ON_BOOT is not set
CONFIG_KGDB_LOW_LEVEL_TRAP=y
# CONFIG_KGDB_KDB is not set
CONFIG_ARCH_HAS_EARLY_DEBUG=y
CONFIG_ARCH_HAS_UBSAN=y
CONFIG_UBSAN=y
# CONFIG_UBSAN_TRAP is not set
CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y
CONFIG_UBSAN_BOUNDS=y
CONFIG_UBSAN_BOUNDS_STRICT=y
CONFIG_UBSAN_SHIFT=y
# CONFIG_UBSAN_DIV_ZERO is not set
# CONFIG_UBSAN_BOOL is not set
# CONFIG_UBSAN_ENUM is not set
# CONFIG_UBSAN_ALIGNMENT is not set
# CONFIG_TEST_UBSAN is not set
CONFIG_HAVE_ARCH_KCSAN=y
CONFIG_HAVE_KCSAN_COMPILER=y
# CONFIG_KCSAN is not set
# end of Generic Kernel Debugging Instruments
#
# Networking Debugging
#
# CONFIG_NET_DEV_REFCNT_TRACKER is not set
# CONFIG_NET_NS_REFCNT_TRACKER is not set
# CONFIG_DEBUG_NET is not set
# CONFIG_DEBUG_NET_SMALL_RTNL is not set
# end of Networking Debugging
#
# Memory Debugging
#
CONFIG_PAGE_EXTENSION=y
# CONFIG_DEBUG_PAGEALLOC is not set
CONFIG_SLUB_DEBUG=y
# CONFIG_SLUB_DEBUG_ON is not set
CONFIG_PAGE_OWNER=y
# CONFIG_PAGE_TABLE_CHECK is not set
# CONFIG_PAGE_POISONING is not set
# CONFIG_DEBUG_PAGE_REF is not set
# CONFIG_DEBUG_RODATA_TEST is not set
CONFIG_ARCH_HAS_DEBUG_WX=y
CONFIG_DEBUG_WX=y
CONFIG_ARCH_HAS_PTDUMP=y
CONFIG_PTDUMP=y
# CONFIG_PTDUMP_DEBUGFS is not set
CONFIG_HAVE_DEBUG_KMEMLEAK=y
# CONFIG_DEBUG_KMEMLEAK is not set
# CONFIG_PER_VMA_LOCK_STATS is not set
# CONFIG_MEM_ALLOC_PROFILING is not set
# CONFIG_DEBUG_OBJECTS is not set
# CONFIG_SHRINKER_DEBUG is not set
# CONFIG_DEBUG_STACK_USAGE is not set
CONFIG_SCHED_STACK_END_CHECK=y
CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y
# CONFIG_DEBUG_VFS is not set
# CONFIG_DEBUG_VM is not set
# CONFIG_DEBUG_VM_PGTABLE is not set
CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y
# CONFIG_DEBUG_VIRTUAL is not set
CONFIG_DEBUG_MEMORY_INIT=y
# CONFIG_DEBUG_PER_CPU_MAPS is not set
CONFIG_HAVE_ARCH_KASAN=y
CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
CONFIG_CC_HAS_KASAN_GENERIC=y
CONFIG_CC_HAS_KASAN_SW_TAGS=y
CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
# CONFIG_KASAN is not set
CONFIG_HAVE_ARCH_KFENCE=y
CONFIG_KFENCE=y
CONFIG_KFENCE_SAMPLE_INTERVAL=100
CONFIG_KFENCE_NUM_OBJECTS=255
# CONFIG_KFENCE_DEFERRABLE is not set
# CONFIG_KFENCE_STATIC_KEYS is not set
CONFIG_KFENCE_STRESS_TEST_FAULTS=0
CONFIG_HAVE_ARCH_KMSAN=y
# end of Memory Debugging
CONFIG_DEBUG_SHIRQ=y
#
# Debug Oops, Lockups and Hangs
#
# CONFIG_PANIC_ON_OOPS is not set
CONFIG_PANIC_TIMEOUT=0
CONFIG_LOCKUP_DETECTOR=y
CONFIG_SOFTLOCKUP_DETECTOR=y
CONFIG_SOFTLOCKUP_DETECTOR_INTR_STORM=y
CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=0
CONFIG_HAVE_HARDLOCKUP_DETECTOR_BUDDY=y
CONFIG_HARDLOCKUP_DETECTOR=y
# CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY is not set
CONFIG_HARDLOCKUP_DETECTOR_PERF=y
# CONFIG_HARDLOCKUP_DETECTOR_BUDDY is not set
# CONFIG_HARDLOCKUP_DETECTOR_ARCH is not set
CONFIG_HARDLOCKUP_DETECTOR_COUNTS_HRTIMER=y
CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set
# CONFIG_DETECT_HUNG_TASK is not set
# CONFIG_WQ_WATCHDOG is not set
# CONFIG_WQ_CPU_INTENSIVE_REPORT is not set
# CONFIG_TEST_LOCKUP is not set
# end of Debug Oops, Lockups and Hangs
#
# Scheduler Debugging
#
CONFIG_SCHED_INFO=y
CONFIG_SCHEDSTATS=y
# end of Scheduler Debugging
# CONFIG_DEBUG_PREEMPT is not set
# CONFIG_DEBUG_ATOMIC is not set
#
# Lock Debugging (spinlocks, mutexes, etc...)
#
CONFIG_LOCK_DEBUGGING_SUPPORT=y
# CONFIG_PROVE_LOCKING is not set
# CONFIG_LOCK_STAT is not set
# CONFIG_DEBUG_RT_MUTEXES is not set
# CONFIG_DEBUG_SPINLOCK is not set
# CONFIG_DEBUG_MUTEXES is not set
# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
# CONFIG_DEBUG_RWSEMS is not set
# CONFIG_DEBUG_LOCK_ALLOC is not set
# CONFIG_DEBUG_ATOMIC_SLEEP is not set
# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
# CONFIG_LOCK_TORTURE_TEST is not set
# CONFIG_WW_MUTEX_SELFTEST is not set
# CONFIG_SCF_TORTURE_TEST is not set
# CONFIG_CSD_LOCK_WAIT_DEBUG is not set
# end of Lock Debugging (spinlocks, mutexes, etc...)
# CONFIG_NMI_CHECK_CPU is not set
# CONFIG_DEBUG_IRQFLAGS is not set
CONFIG_STACKTRACE=y
# CONFIG_DEBUG_KOBJECT is not set
#
# Debug kernel data structures
#
# CONFIG_DEBUG_LIST is not set
# CONFIG_DEBUG_PLIST is not set
# CONFIG_DEBUG_SG is not set
# CONFIG_DEBUG_NOTIFIERS is not set
# CONFIG_DEBUG_MAPLE_TREE is not set
# end of Debug kernel data structures
#
# RCU Debugging
#
# CONFIG_RCU_SCALE_TEST is not set
# CONFIG_RCU_TORTURE_TEST is not set
# CONFIG_RCU_REF_SCALE_TEST is not set
CONFIG_RCU_CPU_STALL_TIMEOUT=60
CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0
# CONFIG_RCU_CPU_STALL_CPUTIME is not set
# CONFIG_RCU_TRACE is not set
# CONFIG_RCU_EQS_DEBUG is not set
# end of RCU Debugging
# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set
# CONFIG_LATENCYTOP is not set
# CONFIG_DEBUG_CGROUP_REF is not set
CONFIG_USER_STACKTRACE_SUPPORT=y
CONFIG_NOP_TRACER=y
CONFIG_HAVE_RETHOOK=y
CONFIG_RETHOOK=y
CONFIG_HAVE_FUNCTION_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_FREGS=y
CONFIG_HAVE_FTRACE_GRAPH_FUNC=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y
CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS=y
CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_JMP=y
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
CONFIG_HAVE_FENTRY=y
CONFIG_HAVE_OBJTOOL_MCOUNT=y
CONFIG_HAVE_OBJTOOL_NOP_MCOUNT=y
CONFIG_HAVE_C_RECORDMCOUNT=y
CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y
CONFIG_BUILDTIME_MCOUNT_SORT=y
CONFIG_TRACER_MAX_TRACE=y
CONFIG_TRACE_CLOCK=y
CONFIG_RING_BUFFER=y
CONFIG_EVENT_TRACING=y
CONFIG_CONTEXT_SWITCH_TRACER=y
CONFIG_TRACING=y
CONFIG_GENERIC_TRACER=y
CONFIG_TRACING_SUPPORT=y
CONFIG_FTRACE=y
CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED=y
CONFIG_BOOTTIME_TRACING=y
CONFIG_FUNCTION_TRACER=y
CONFIG_FUNCTION_GRAPH_TRACER=y
CONFIG_FUNCTION_GRAPH_RETVAL=y
# CONFIG_FUNCTION_GRAPH_RETADDR is not set
CONFIG_FUNCTION_TRACE_ARGS=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y
CONFIG_DYNAMIC_FTRACE_WITH_JMP=y
# CONFIG_FUNCTION_SELF_TRACING is not set
# CONFIG_FPROBE is not set
# CONFIG_FUNCTION_PROFILER is not set
CONFIG_STACK_TRACER=y
# CONFIG_IRQSOFF_TRACER is not set
# CONFIG_PREEMPT_TRACER is not set
CONFIG_SCHED_TRACER=y
CONFIG_HWLAT_TRACER=y
CONFIG_OSNOISE_TRACER=y
CONFIG_TIMERLAT_TRACER=y
# CONFIG_MMIOTRACE is not set
CONFIG_FTRACE_SYSCALLS=y
CONFIG_TRACE_SYSCALL_BUF_SIZE_DEFAULT=63
CONFIG_TRACER_SNAPSHOT=y
# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
CONFIG_BRANCH_PROFILE_NONE=y
# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
# CONFIG_BLK_DEV_IO_TRACE is not set
CONFIG_PROBE_EVENTS_BTF_ARGS=y
# CONFIG_PROBE_EVENTS_DUMP_FETCHARG is not set
CONFIG_KPROBE_EVENTS=y
# CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set
CONFIG_UPROBE_EVENTS=y
CONFIG_EPROBE_EVENTS=y
CONFIG_BPF_EVENTS=y
CONFIG_DYNAMIC_EVENTS=y
CONFIG_PROBE_EVENTS=y
CONFIG_FTRACE_MCOUNT_USE_CC=y
CONFIG_SYNTH_EVENTS=y
# CONFIG_USER_EVENTS is not set
# CONFIG_HIST_TRIGGERS is not set
# CONFIG_TRACE_EVENT_INJECT is not set
# CONFIG_TRACEPOINT_BENCHMARK is not set
# CONFIG_RING_BUFFER_BENCHMARK is not set
# CONFIG_TRACE_EVAL_MAP_FILE is not set
# CONFIG_FTRACE_RECORD_RECURSION is not set
# CONFIG_FTRACE_VALIDATE_RCU_IS_WATCHING is not set
# CONFIG_FTRACE_STARTUP_TEST is not set
# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
# CONFIG_RING_BUFFER_STARTUP_TEST is not set
# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set
# CONFIG_RING_BUFFER_PERSISTENT_INJECT is not set
# CONFIG_PREEMPTIRQ_DELAY_TEST is not set
# CONFIG_SYNTH_EVENT_GEN_TEST is not set
# CONFIG_KPROBE_EVENT_GEN_TEST is not set
CONFIG_RV_MON_EVENTS=y
CONFIG_RV_MON_MAINTENANCE_EVENTS=y
CONFIG_DA_MON_EVENTS_ID=y
CONFIG_RV=y
CONFIG_RV_PER_TASK_MONITORS=2
CONFIG_RV_MON_WWNR=y
# CONFIG_RV_MON_STALL is not set
# CONFIG_RV_MON_DEADLINE is not set
CONFIG_RV_REACTORS=y
CONFIG_RV_REACT_PRINTK=y
CONFIG_RV_REACT_PANIC=y
# CONFIG_TRACE_REMOTE_TEST is not set
# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
# CONFIG_SAMPLES is not set
CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y
CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y
CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y
#
# x86 Debugging
#
CONFIG_EARLY_PRINTK_USB=y
# CONFIG_X86_VERBOSE_BOOTUP is not set
CONFIG_EARLY_PRINTK=y
CONFIG_EARLY_PRINTK_DBGP=y
CONFIG_EARLY_PRINTK_USB_XDBC=y
# CONFIG_EFI_PGT_DUMP is not set
# CONFIG_DEBUG_TLBFLUSH is not set
CONFIG_HAVE_MMIOTRACE_SUPPORT=y
# CONFIG_X86_DECODER_SELFTEST is not set
CONFIG_IO_DELAY_0X80=y
# CONFIG_IO_DELAY_0XED is not set
# CONFIG_IO_DELAY_UDELAY is not set
# CONFIG_IO_DELAY_NONE is not set
CONFIG_DEBUG_BOOT_PARAMS=y
# CONFIG_CPA_DEBUG is not set
# CONFIG_DEBUG_ENTRY is not set
# CONFIG_DEBUG_NMI_SELFTEST is not set
# CONFIG_X86_DEBUG_FPU is not set
# CONFIG_PUNIT_ATOM_DEBUG is not set
CONFIG_UNWINDER_ORC=y
# CONFIG_UNWINDER_FRAME_POINTER is not set
# end of x86 Debugging
#
# Kernel Testing and Coverage
#
# CONFIG_KUNIT is not set
# CONFIG_NOTIFIER_ERROR_INJECTION is not set
# CONFIG_FUNCTION_ERROR_INJECTION is not set
# CONFIG_FAULT_INJECTION is not set
CONFIG_ARCH_HAS_KCOV=y
# CONFIG_KCOV is not set
CONFIG_RUNTIME_TESTING_MENU=y
# CONFIG_TEST_DHRY is not set
# CONFIG_LKDTM is not set
# CONFIG_TEST_DIV64 is not set
# CONFIG_TEST_MULDIV64 is not set
# CONFIG_BACKTRACE_SELF_TEST is not set
# CONFIG_TEST_REF_TRACKER is not set
# CONFIG_RBTREE_TEST is not set
# CONFIG_REED_SOLOMON_TEST is not set
# CONFIG_INTERVAL_TREE_TEST is not set
# CONFIG_PERCPU_TEST is not set
# CONFIG_ATOMIC64_SELFTEST is not set
# CONFIG_TEST_HEXDUMP is not set
CONFIG_TEST_KSTRTOX=y
# CONFIG_TEST_BITMAP is not set
# CONFIG_TEST_XARRAY is not set
# CONFIG_TEST_MAPLE_TREE is not set
# CONFIG_TEST_RHASHTABLE is not set
# CONFIG_TEST_IDA is not set
# CONFIG_TEST_LKM is not set
# CONFIG_TEST_BITOPS is not set
# CONFIG_TEST_VMALLOC is not set
# CONFIG_TEST_WORKQUEUE is not set
# CONFIG_TEST_BPF is not set
# CONFIG_FIND_BIT_BENCHMARK is not set
# CONFIG_REGION_ALLOC_BENCHMARK is not set
# CONFIG_TEST_FIRMWARE is not set
# CONFIG_TEST_SYSCTL is not set
# CONFIG_CONTEXT_ANALYSIS_TEST is not set
# CONFIG_TEST_UDELAY is not set
# CONFIG_TEST_STATIC_KEYS is not set
# CONFIG_TEST_DYNAMIC_DEBUG is not set
# CONFIG_TEST_KMOD is not set
# CONFIG_TEST_KALLSYMS is not set
# CONFIG_TEST_MEMCAT_P is not set
# CONFIG_TEST_MEMINIT is not set
# CONFIG_TEST_FREE_PAGES is not set
# CONFIG_TEST_FPU is not set
# CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set
# CONFIG_TEST_OBJPOOL is not set
# CONFIG_TEST_KEXEC_HANDOVER is not set
CONFIG_ARCH_USE_MEMTEST=y
CONFIG_MEMTEST=y
# end of Kernel Testing and Coverage
#
# Rust hacking
#
# end of Rust hacking
# end of Kernel hacking
CONFIG_IO_URING_ZCRX=y
CONFIG_IO_URING_BPF=y
CONFIG_IO_URING_BPF_OPS=y
=========================
dmesg:
[ 0.000000] Linux version 7.3.2-rc1_MY-g75eaee7a6465 (ron@obelix)
(gcc (GCC) 16.2.1 20261029 (Red Hat 16.2.1-3), GNU ld version
2.47.20260726) #1 SMP PREEMPT_DYNAMIC Wed Nov 4 23:56:00 CET 2026
[ 0.000000] Command line:
BOOT_IMAGE=(hd1,gpt1)/vmlinuz-7.3.2-rc1_MY-g75eaee7a6465
root=UUID=2ab6e75b-4e3c-4a9d-a329-431178fdd0e7 ro rootflags=subvol=ROOT
i915.enable_guc=3 rhgb quiet
[ 0.000000] KERNEL supported cpus:
[ 0.000000] Intel GenuineIntel
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009dfff]
System RAM
[ 0.000000] BIOS-e820: [mem 0x000000000009e000-0x000000000009efff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x000000000009f000-0x000000000009ffff]
System RAM
[ 0.000000] BIOS-e820: [mem 0x00000000000a0000-0x00000000000fffff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x0000000077945fff]
System RAM
[ 0.000000] BIOS-e820: [mem 0x0000000077946000-0x0000000077946fff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000077947000-0x0000000077983fff]
System RAM
[ 0.000000] BIOS-e820: [mem 0x0000000077984000-0x0000000077984fff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000077985000-0x0000000087deefff]
System RAM
[ 0.000000] BIOS-e820: [mem 0x0000000087def000-0x000000008a2eefff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x000000008a2ef000-0x000000008a56efff]
ACPI data
[ 0.000000] BIOS-e820: [mem 0x000000008a56f000-0x000000008a6fefff]
ACPI NVS
[ 0.000000] BIOS-e820: [mem 0x000000008a6ff000-0x000000008bffefff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x000000008bfff000-0x000000008bffffff]
System RAM
[ 0.000000] BIOS-e820: [mem 0x000000008c000000-0x000000008dffffff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x000000008e000000-0x000000008e5fffff]
[ 0.000000] BIOS-e820: [mem 0x000000008e600000-0x000000008e7fffff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x000000008e800000-0x000000008effffff]
[ 0.000000] BIOS-e820: [mem 0x000000008f000000-0x00000000a07fffff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000a0800000-0x00000000dfffffff]
[ 0.000000] BIOS-e820: [mem 0x00000000e0000000-0x00000000efffffff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000f0000000-0x00000000fdffffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fe000000-0x00000000fe010fff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fe011000-0x00000000febfffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fec01000-0x00000000fecfffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fed00000-0x00000000fed00fff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fed01000-0x00000000fed1ffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fed20000-0x00000000fed7ffff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fed80000-0x00000000fedfffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff]
device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fee01000-0x00000000feffffff]
[ 0.000000] BIOS-e820: [mem 0x00000000ff000000-0x00000000ffffffff]
device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000045f7fffff]
System RAM
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] APIC: Static calls initialized
[ 0.000000] efi: EFI v2.7 by American Megatrends
[ 0.000000] efi: ACPI=0x8a56e000 ACPI 2.0=0x8a56e014
TPMFinalLog=0x8a66c000 SMBIOS=0x8bd61000 SMBIOS 3.0=0x8bd60000
MEMATTR=0x85899418 ESRT=0x85e80698 MOKvar=0x8ba59000 RNG=0x8a4ffc18
TPMEventLog=0x8a4e5018
[ 0.000000] random: crng init done
[ 0.000000] efi: Remove mem83: MMIO range=[0xe0000000-0xefffffff]
(256MB) from e820 map
[ 0.000000] e820: remove [mem 0xe0000000-0xefffffff] device reserved
[ 0.000000] efi: Not removing mem84: MMIO
range=[0xfe000000-0xfe010fff] (68KB) from e820 map
[ 0.000000] efi: Not removing mem85: MMIO
range=[0xfec00000-0xfec00fff] (4KB) from e820 map
[ 0.000000] efi: Not removing mem86: MMIO
range=[0xfed00000-0xfed00fff] (4KB) from e820 map
[ 0.000000] efi: Not removing mem88: MMIO
range=[0xfee00000-0xfee00fff] (4KB) from e820 map
[ 0.000000] efi: Remove mem89: MMIO range=[0xff000000-0xffffffff]
(16MB) from e820 map
[ 0.000000] e820: remove [mem 0xff000000-0xffffffff] device reserved
[ 0.000000] DMI: SMBIOS 3.3.0 present.
[ 0.000000] DMI: ASUS System Product Name/ROG STRIX B560-G GAMING
WIFI, BIOS 2501 05/22/2026
[ 0.000000] DMI: Memory slots populated: 2/4
[ 0.000000] tsc: Detected 2600.000 MHz processor
[ 0.000000] tsc: Detected 2592.000 MHz TSC
[ 0.000633] e820: update [mem 0x00000000-0x00000fff] System RAM ==>
device reserved
[ 0.000635] e820: remove [mem 0x000a0000-0x000fffff] System RAM
[ 0.000643] last_pfn = 0x45f800 max_arch_pfn = 0x400000000
[ 0.000646] MTRR map: 5 entries (3 fixed + 2 variable; max 23), built
from 10 variable MTRRs
[ 0.000647] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC-
WT
[ 0.000915] last_pfn = 0x8c000 max_arch_pfn = 0x400000000
[ 0.008080] esrt: Reserving ESRT space from 0x0000000085e80698 to
0x0000000085e806d0.
[ 0.008085] e820: update [mem 0x85e80000-0x85e80fff] System RAM ==>
device reserved
[ 0.008102] Using GB pages for direct mapping
[ 0.008571] Secure boot disabled
[ 0.008571] RAMDISK: [mem 0x7297b000-0x77945fff]
[ 0.008575] ACPI: Early table checksum verification disabled
[ 0.008576] ACPI: RSDP 0x000000008A56E014 000024 (v02 ALASKA)
[ 0.008579] ACPI: XSDT 0x000000008A56D728 0000DC (v01 ALASKA A M I
01072009 AMI 01000013)
[ 0.008583] ACPI: FACP 0x000000008A56B000 000114 (v06 ALASKA A M I
01072009 AMI 01000013)
[ 0.008587] ACPI: DSDT 0x000000008A514000 0567A3 (v02 ALASKA A M I
01072009 INTL 20180209)
[ 0.008589] ACPI: FACS 0x000000008A6FE000 000040
[ 0.008591] ACPI: MCFG 0x000000008A56C000 00003C (v01 ALASKA A M I
01072009 MSFT 00000097)
[ 0.008593] ACPI: FIDT 0x000000008A513000 00009C (v01 ALASKA A M I
01072009 AMI 00010013)
[ 0.008595] ACPI: SSDT 0x000000008A50F000 0025EB (v02 CpuRef CpuSsdt
00003000 INTL 20180209)
[ 0.008597] ACPI: SSDT 0x000000008A50A000 004476 (v02 SaSsdt SaSsdt
00003000 INTL 20180209)
[ 0.008599] ACPI: SSDT 0x000000008A506000 0032CD (v02 INTEL IgfxSsdt
00003000 INTL 20180209)
[ 0.008600] ACPI: HPET 0x000000008A505000 000038 (v01 ALASKA A M I
01072009 AMI 01000013)
[ 0.008602] ACPI: APIC 0x000000008A504000 000164 (v04 ALASKA A M I
01072009 AMI 01000013)
[ 0.008604] ACPI: SSDT 0x000000008A503000 000E66 (v02 ALASKA Ther_Rvp
00001000 INTL 20180209)
[ 0.008606] ACPI: SSDT 0x000000008A501000 0017E5 (v02 INTEL xh_rksu4
00000000 INTL 20180209)
[ 0.008608] ACPI: NHLT 0x000000008A500000 00002D (v00 ALASKA A M I
01072009 AMI 01000013)
[ 0.008610] ACPI: LPIT 0x000000008A4FE000 0000CC (v01 ALASKA A M I
01072009 AMI 01000013)
[ 0.008612] ACPI: SSDT 0x000000008A4FC000 000DC6 (v02 ALASKA TbtTypeC
00000000 INTL 20180209)
[ 0.008614] ACPI: SSDT 0x000000008A4F9000 002720 (v02 ALASKA PtidDevc
00001000 INTL 20180209)
[ 0.008616] ACPI: DBGP 0x000000008A4F8000 000034 (v01 ALASKA A M I
01072009 AMI 01000013)
[ 0.008617] ACPI: DBG2 0x000000008A4F7000 000054 (v00 ALASKA A M I
01072009 AMI 01000013)
[ 0.008619] ACPI: SSDT 0x000000008A4F6000 0006E3 (v02 ALASKA UsbCTabl
00001000 INTL 20180209)
[ 0.008622] ACPI: DMAR 0x000000008A4F5000 000088 (v02 INTEL EDK2
00000002 01000013)
[ 0.008624] ACPI: SSDT 0x000000008A4F4000 000144 (v02 Intel ADebTabl
00001000 INTL 20180209)
[ 0.008625] ACPI: TPM2 0x000000008A4F3000 00004C (v04 ALASKA A M I
00000001 AMI 00000000)
[ 0.008627] ACPI: PTDT 0x000000008A4F2000 000CF0 (v00 ALASKA A M I
00000005 MSFT 0100000D)
[ 0.008629] ACPI: WSMT 0x000000008A4FD000 000028 (v01 ALASKA A M I
01072009 AMI 00010013)
[ 0.008631] ACPI: FPDT 0x000000008A4F1000 000044 (v01 ALASKA RKL
01072009 AMI 01000013)
[ 0.008633] ACPI: Reserving FACP table memory at [mem
0x8a56b000-0x8a56b113]
[ 0.008634] ACPI: Reserving DSDT table memory at [mem
0x8a514000-0x8a56a7a2]
[ 0.008634] ACPI: Reserving FACS table memory at [mem
0x8a6fe000-0x8a6fe03f]
[ 0.008635] ACPI: Reserving MCFG table memory at [mem
0x8a56c000-0x8a56c03b]
[ 0.008635] ACPI: Reserving FIDT table memory at [mem
0x8a513000-0x8a51309b]
[ 0.008636] ACPI: Reserving SSDT table memory at [mem
0x8a50f000-0x8a5115ea]
[ 0.008636] ACPI: Reserving SSDT table memory at [mem
0x8a50a000-0x8a50e475]
[ 0.008636] ACPI: Reserving SSDT table memory at [mem
0x8a506000-0x8a5092cc]
[ 0.008637] ACPI: Reserving HPET table memory at [mem
0x8a505000-0x8a505037]
[ 0.008637] ACPI: Reserving APIC table memory at [mem
0x8a504000-0x8a504163]
[ 0.008638] ACPI: Reserving SSDT table memory at [mem
0x8a503000-0x8a503e65]
[ 0.008638] ACPI: Reserving SSDT table memory at [mem
0x8a501000-0x8a5027e4]
[ 0.008639] ACPI: Reserving NHLT table memory at [mem
0x8a500000-0x8a50002c]
[ 0.008639] ACPI: Reserving LPIT table memory at [mem
0x8a4fe000-0x8a4fe0cb]
[ 0.008639] ACPI: Reserving SSDT table memory at [mem
0x8a4fc000-0x8a4fcdc5]
[ 0.008640] ACPI: Reserving SSDT table memory at [mem
0x8a4f9000-0x8a4fb71f]
[ 0.008640] ACPI: Reserving DBGP table memory at [mem
0x8a4f8000-0x8a4f8033]
[ 0.008641] ACPI: Reserving DBG2 table memory at [mem
0x8a4f7000-0x8a4f7053]
[ 0.008641] ACPI: Reserving SSDT table memory at [mem
0x8a4f6000-0x8a4f66e2]
[ 0.008641] ACPI: Reserving DMAR table memory at [mem
0x8a4f5000-0x8a4f5087]
[ 0.008642] ACPI: Reserving SSDT table memory at [mem
0x8a4f4000-0x8a4f4143]
[ 0.008642] ACPI: Reserving TPM2 table memory at [mem
0x8a4f3000-0x8a4f304b]
[ 0.008643] ACPI: Reserving PTDT table memory at [mem
0x8a4f2000-0x8a4f2cef]
[ 0.008643] ACPI: Reserving WSMT table memory at [mem
0x8a4fd000-0x8a4fd027]
[ 0.008644] ACPI: Reserving FPDT table memory at [mem
0x8a4f1000-0x8a4f1043]
[ 0.008705] No NUMA configuration found
[ 0.008706] Faking a node at [mem 0x0000000000000000-0x000000045f7fffff]
[ 0.008710] NODE_DATA(0) allocated [mem 0x45f7dd780-0x45f7fffff]
[ 0.008853] Reserving Intel graphics memory at [mem
0x90800000-0xa07fffff]
[ 0.010205] ACPI: PM-Timer IO Port: 0x1808
[ 0.010211] ACPI: LAPIC_NMI (acpi_id[0x01] high edge lint[0x1])
[ 0.010212] ACPI: LAPIC_NMI (acpi_id[0x02] high edge lint[0x1])
[ 0.010212] ACPI: LAPIC_NMI (acpi_id[0x03] high edge lint[0x1])
[ 0.010213] ACPI: LAPIC_NMI (acpi_id[0x04] high edge lint[0x1])
[ 0.010213] ACPI: LAPIC_NMI (acpi_id[0x05] high edge lint[0x1])
[ 0.010213] ACPI: LAPIC_NMI (acpi_id[0x06] high edge lint[0x1])
[ 0.010214] ACPI: LAPIC_NMI (acpi_id[0x07] high edge lint[0x1])
[ 0.010214] ACPI: LAPIC_NMI (acpi_id[0x08] high edge lint[0x1])
[ 0.010214] ACPI: LAPIC_NMI (acpi_id[0x09] high edge lint[0x1])
[ 0.010215] ACPI: LAPIC_NMI (acpi_id[0x0a] high edge lint[0x1])
[ 0.010215] ACPI: LAPIC_NMI (acpi_id[0x0b] high edge lint[0x1])
[ 0.010216] ACPI: LAPIC_NMI (acpi_id[0x0c] high edge lint[0x1])
[ 0.010216] ACPI: LAPIC_NMI (acpi_id[0x0d] high edge lint[0x1])
[ 0.010216] ACPI: LAPIC_NMI (acpi_id[0x0e] high edge lint[0x1])
[ 0.010217] ACPI: LAPIC_NMI (acpi_id[0x0f] high edge lint[0x1])
[ 0.010217] ACPI: LAPIC_NMI (acpi_id[0x10] high edge lint[0x1])
[ 0.010217] ACPI: LAPIC_NMI (acpi_id[0x11] high edge lint[0x1])
[ 0.010218] ACPI: LAPIC_NMI (acpi_id[0x12] high edge lint[0x1])
[ 0.010218] ACPI: LAPIC_NMI (acpi_id[0x13] high edge lint[0x1])
[ 0.010219] ACPI: LAPIC_NMI (acpi_id[0x14] high edge lint[0x1])
[ 0.010254] IOAPIC[0]: apic_id 2, version 32, address 0xfec00000, GSI
0-119
[ 0.010257] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[ 0.010258] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[ 0.010261] ACPI: Using ACPI (MADT) for SMP configuration information
[ 0.010262] ACPI: HPET id: 0x8086a201 base: 0xfed00000
[ 0.010264] TSC deadline timer available
[ 0.010265] CPU topo: Max. logical packages: 1
[ 0.010266] CPU topo: Max. logical nodes: 1
[ 0.010266] CPU topo: Num. nodes per package: 1
[ 0.010268] CPU topo: Max. logical dies: 1
[ 0.010268] CPU topo: Max. dies per package: 1
[ 0.010270] CPU topo: Max. threads per core: 2
[ 0.010270] CPU topo: Num. cores per package: 6
[ 0.010271] CPU topo: Num. threads per package: 12
[ 0.010271] CPU topo: Allowing 12 present CPUs plus 0 hotplug CPUs
[ 0.010284] PM: hibernation: Registered nosave memory: [mem
0x00000000-0x00000fff]
[ 0.010285] PM: hibernation: Registered nosave memory: [mem
0x0009e000-0x0009efff]
[ 0.010286] PM: hibernation: Registered nosave memory: [mem
0x000a0000-0x000fffff]
[ 0.010287] PM: hibernation: Registered nosave memory: [mem
0x77946000-0x77946fff]
[ 0.010288] PM: hibernation: Registered nosave memory: [mem
0x77984000-0x77984fff]
[ 0.010289] PM: hibernation: Registered nosave memory: [mem
0x85e80000-0x85e80fff]
[ 0.010290] PM: hibernation: Registered nosave memory: [mem
0x87def000-0x8bffefff]
[ 0.010291] PM: hibernation: Registered nosave memory: [mem
0x8c000000-0xffffffff]
[ 0.010292] [gap 0xa0800000-0xfdffffff] available for PCI devices
[ 0.010293] clocksource: refined-jiffies: mask: 0xffffffff
max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns
[ 0.016742] Zone ranges:
[ 0.016743] DMA [mem 0x0000000000001000-0x0000000000ffffff]
[ 0.016745] DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
[ 0.016746] Normal [mem 0x0000000100000000-0x000000045f7fffff]
[ 0.016746] Movable zone start for each node
[ 0.016748] Early memory node ranges
[ 0.016748] node 0: [mem 0x0000000000001000-0x000000000009dfff]
[ 0.016749] node 0: [mem 0x000000000009f000-0x000000000009ffff]
[ 0.016749] node 0: [mem 0x0000000000100000-0x0000000077945fff]
[ 0.016750] node 0: [mem 0x0000000077947000-0x0000000077983fff]
[ 0.016750] node 0: [mem 0x0000000077985000-0x0000000087deefff]
[ 0.016751] node 0: [mem 0x000000008bfff000-0x000000008bffffff]
[ 0.016751] node 0: [mem 0x0000000100000000-0x000000045f7fffff]
[ 0.016752] Initmem setup node 0 [mem
0x0000000000001000-0x000000045f7fffff]
[ 0.016852] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.016853] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.016870] On node 0, zone DMA: 96 pages in unavailable ranges
[ 0.019180] On node 0, zone DMA32: 1 pages in unavailable ranges
[ 0.019515] On node 0, zone DMA32: 1 pages in unavailable ranges
[ 0.019610] On node 0, zone DMA32: 16912 pages in unavailable ranges
[ 0.036600] On node 0, zone Normal: 16384 pages in unavailable ranges
[ 0.036611] On node 0, zone Normal: 2048 pages in unavailable ranges
[ 0.036619] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:12
nr_cpu_ids:12 nr_node_ids:1
[ 0.037145] percpu: Embedded 78 pages/cpu s195664 r8192 d115632 u524288
[ 0.037151] pcpu-alloc: s195664 r8192 d115632 u524288 alloc=1*2097152
[ 0.037153] pcpu-alloc: [0] 00 01 02 03 [0] 04 05 06 07
[ 0.037156] pcpu-alloc: [0] 08 09 10 11
[ 0.037168] Kernel command line:
BOOT_IMAGE=(hd1,gpt1)/vmlinuz-7.3.2-rc1_MY-g75eaee7a6465
root=UUID=2ab6e75b-4e3c-4a9d-a329-431178fdd0e7 ro rootflags=subvol=ROOT
i915.enable_guc=3 rhgb quiet
[ 0.037229] Unknown kernel command line parameters "rhgb", will be
passed to user space.
[ 0.037237] printk: log buffer data + meta data: 262144 + 1114112 =
1376256 bytes
[ 0.038384] Dentry cache hash table entries: 2097152 (order: 12,
16777216 bytes, linear)
[ 0.038973] Inode-cache hash table entries: 1048576 (order: 11,
8388608 bytes, linear)
[ 0.039096] software IO TLB: area num 16.
[ 0.048522] Fallback order for Node 0: 0
[ 0.048525] Built 1 zonelists, mobility grouping on. Total pages:
4093324
[ 0.048526] Policy zone: Normal
[ 0.048698] mem auto-init: stack:all(zero), heap alloc:on, heap free:off
[ 0.072516] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=12, Nodes=1
[ 0.081314] ftrace: allocating 69225 entries in 272 pages
[ 0.081316] ftrace: allocated 272 pages with 2 groups
[ 0.081884] Dynamic Preempt: lazy
[ 0.081937] rcu: Preemptible hierarchical RCU implementation.
[ 0.081938] rcu: RCU restricting CPUs from NR_CPUS=8192 to
nr_cpu_ids=12.
[ 0.081939] Trampoline variant of Tasks RCU enabled.
[ 0.081939] Rude variant of Tasks RCU enabled.
[ 0.081940] Tracing variant of Tasks RCU enabled.
[ 0.081940] rcu: RCU calculated value of scheduler-enlistment delay
is 100 jiffies.
[ 0.081940] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=12
[ 0.081949] RCU Tasks: Setting shift to 4 and lim to 1
rcu_task_cb_adjust=1 rcu_task_cpu_ids=12.
[ 0.081951] RCU Tasks Rude: Setting shift to 4 and lim to 1
rcu_task_cb_adjust=1 rcu_task_cpu_ids=12.
[ 0.093671] NR_IRQS: 524544, nr_irqs: 2152, preallocated irqs: 16
[ 0.094015] rcu: srcu_init: Setting srcu_struct sizes based on
contention.
[ 0.094215] clocksource: jiffies: mask: 0xffffffff max_cycles:
0xffffffff, max_idle_ns: 1911260446275000 ns
[ 0.094298] kfence: initialized - using 2097152 bytes for 255 objects
at 0x(____ptrval____)-0x(____ptrval____)
[ 0.094337] Console: colour dummy device 80x25
[ 0.094339] printk: legacy console [tty0] enabled
[ 0.094372] ACPI: Core revision 20260408
[ 0.094752] clocksource: hpet: mask: 0xffffffff max_cycles:
0xffffffff, max_idle_ns: 79635855245 ns
[ 0.094850] APIC: Switch to symmetric I/O mode setup
[ 0.094852] DMAR: Host address width 39
[ 0.094853] DMAR: DRHD base: 0x000000fed90000 flags: 0x0
[ 0.094859] DMAR: dmar0: reg_base_addr fed90000 ver 4:0 cap
1c0000c40660462 ecap 29a00f0505e
[ 0.094861] DMAR: DRHD base: 0x000000fed91000 flags: 0x1
[ 0.094865] DMAR: dmar1: reg_base_addr fed91000 ver 1:0 cap
d2008c40660462 ecap f050da
[ 0.094866] DMAR: RMRR base: 0x00000090000000 end: 0x000000a07fffff
[ 0.094868] DMAR-IR: IOAPIC id 2 under DRHD base 0xfed91000 IOMMU 1
[ 0.094869] DMAR-IR: HPET id 0 under DRHD base 0xfed91000
[ 0.094870] DMAR-IR: Queued invalidation will be enabled to support
x2apic and Intr-remapping.
[ 0.096548] DMAR-IR: Enabled IRQ remapping in x2apic mode
[ 0.096549] x2apic enabled
[ 0.096604] APIC: Switched APIC routing to: cluster x2apic
[ 0.100969] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[ 0.105848] clocksource: tsc-early: mask: 0xffffffffffffffff
max_cycles: 0x255cb6cc5db, max_idle_ns: 440795203504 ns
[ 0.105851] Calibrating delay loop (skipped), value calculated using
timer frequency.. 5184.00 BogoMIPS (lpj=2592000)
[ 0.105878] CPU0: Thermal monitoring enabled (TM1)
[ 0.105879] x86/cpu: User Mode Instruction Prevention (UMIP) activated
[ 0.105938] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
[ 0.105939] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
[ 0.105945] process: using mwait in idle threads
[ 0.105947] mitigations: Enabled attack vectors: user_kernel,
user_user, guest_host, guest_guest, SMT mitigations: auto
[ 0.105951] Speculative Store Bypass: Mitigation: Speculative Store
Bypass disabled via prctl
[ 0.105952] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.105952] RETBleed: Mitigation: Enhanced IBRS
[ 0.105953] ITS: Mitigation: Aligned branch/return thunks
[ 0.105953] MMIO Stale Data: Mitigation: Clear CPU buffers
[ 0.105954] Spectre V1 : Mitigation: usercopy/swapgs barriers and
__user pointer sanitization
[ 0.105955] Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single
CALL on VMEXIT
[ 0.105957] Spectre V2 : Enabling IBPB for BPF
[ 0.105958] Spectre V2 : mitigation: Enabling conditional Indirect
Branch Prediction Barrier
[ 0.105963] GDS: Mitigation: Microcode
[ 0.105963] active return thunk: its_return_thunk
[ 0.105966] Spectre V2 : Spectre BHI mitigation: SW BHB clearing on
syscall and VM exit
[ 0.105971] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating
point registers'
[ 0.105972] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.105973] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.105973] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds
registers'
[ 0.105974] x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
[ 0.105974] x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
[ 0.105975] x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
[ 0.105975] x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
[ 0.105976] x86/fpu: Supporting XSAVE feature 0x200: 'Protection Keys
User registers'
[ 0.105977] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
[ 0.105978] x86/fpu: xstate_offset[3]: 832, xstate_sizes[3]: 64
[ 0.105978] x86/fpu: xstate_offset[4]: 896, xstate_sizes[4]: 64
[ 0.105979] x86/fpu: xstate_offset[5]: 960, xstate_sizes[5]: 64
[ 0.105979] x86/fpu: xstate_offset[6]: 1024, xstate_sizes[6]: 512
[ 0.105980] x86/fpu: xstate_offset[7]: 1536, xstate_sizes[7]: 1024
[ 0.105981] x86/fpu: xstate_offset[9]: 2560, xstate_sizes[9]: 8
[ 0.105981] x86/fpu: Enabled xstate features 0x2ff, context size is
2568 bytes, using 'compacted' format.
[ 0.108036] ------------[ cut here ]------------
[ 0.108037] CPA detected W^X violation: 8000000000000123 ->
0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 101000
[ 0.108039] WARNING: arch/x86/mm/pat/set_memory.c:722 at
__change_page_attr_set_clr+0xc4c/0x11f0, CPU#0: swapper/0/0
[ 0.108043] Modules linked in:
[ 0.108045] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
7.3.2-rc1_MY-g75eaee7a6465 #1 PREEMPT(lazy)
[ 0.108047] Hardware name: ASUS System Product Name/ROG STRIX B560-G
GAMING WIFI, BIOS 2501 05/22/2026
[ 0.108048] RIP: 0010:__change_page_attr_set_clr+0xc65/0x11f0
[ 0.108050] Code: 7c 24 4c 00 0f 85 e9 03 00 00 48 8d 3d a4 78 01 03
48 8b 34 24 4d 89 e9 4d 8d 84 24 ff 0f 00 00 4c 89 e1 48 89 c2 48 89 04
24 <67> 48 0f b9 3a 48 8b 04 24 48 ba 00 f0 ff ff ff ff 0f 00 48 21 d3
[ 0.108052] RSP: 0000:ffffffff85203c40 EFLAGS: 00010246
[ 0.108053] RAX: 0000000000000123 RBX: 8000000101000123 RCX:
ffffffffc0400000
[ 0.108054] RDX: 0000000000000123 RSI: 8000000000000123 RDI:
ffffffff857c8f70
[ 0.108055] RBP: 8000000101000123 R08: ffffffffc0400fff R09:
0000000000101000
[ 0.108056] R10: 0000000000000123 R11: 0000000000000000 R12:
ffffffffc0400000
[ 0.108056] R13: 0000000000101000 R14: 000ffffffffff000 R15:
ffffffff85203d40
[ 0.108057] FS: 0000000000000000(0000) GS:ffff97940910f000(0000)
knlGS:0000000000000000
[ 0.108058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.108059] CR2: ffff979067570000 CR3: 0000000126238001 CR4:
0000000000770ef0
[ 0.108060] PKRU: 55555554
[ 0.108061] Call Trace:
[ 0.108062] <TASK>
[ 0.108064] ? _vm_unmap_aliases+0x229/0x2a0
[ 0.108067] change_page_attr_set_clr+0x154/0x5a0
[ 0.108070] ? perf_get_hw_event_config+0x28/0x30
[ 0.108072] set_memory_x+0x39/0x50
[ 0.108073] apply_retpolines+0x695/0x710
[ 0.108077] ? perf_get_hw_event_config+0x28/0x30
[ 0.108078] ? __pfx_x86_pmu_filter+0x7/0x10
[ 0.108080] ? perf_get_hw_event_config+0x2d/0x30
[ 0.108081] alternative_instructions+0x37/0xc0
[ 0.108086] arch_cpu_finalize_init+0x11b/0x170
[ 0.108087] start_kernel+0x9ae/0xa50
[ 0.108089] x86_64_start_reservations+0x24/0x30
[ 0.108091] x86_64_start_kernel+0x121/0x130
[ 0.108092] common_startup_64+0x13e/0x158
[ 0.108095] </TASK>
[ 0.108095] ---[ end trace 0000000000000000 ]---
[ 0.125517] pid_max: default: 32768 minimum: 301
[ 0.125585] Yama: becoming mindful.
[ 0.125589] SELinux: Initializing.
[ 0.125820] LSM support for eBPF active
[ 0.125835] landlock: Up and running.
[ 0.125884] Mount-cache hash table entries: 32768 (order: 6, 262144
bytes, linear)
[ 0.125893] Mountpoint-cache hash table entries: 32768 (order: 6,
262144 bytes, linear)
[ 0.125956] VFS: Finished mounting rootfs on nullfs
[ 0.126543] smpboot: CPU0: 11th Gen Intel(R) Core(TM) i5-11400 @
2.60GHz (family: 0x6, model: 0xa7, stepping: 0x1)
[ 0.126658] Performance Events: PEBS fmt4+-baseline, Icelake events,
AnyThread deprecated, 32-deep LBR, full-width counters, Intel PMU driver.
[ 0.126683] ... version: 5
[ 0.126684] ... bit width: 48
[ 0.126684] ... generic counters: 8
[ 0.126684] ... generic bitmap: 00000000000000ff
[ 0.126685] ... fixed-purpose counters: 4
[ 0.126685] ... fixed-purpose bitmap: 000000000000000f
[ 0.126686] ... value mask: 0000ffffffffffff
[ 0.126686] ... max period: 00007fffffffffff
[ 0.126687] ... global_ctrl mask: 0001000f000000ff
[ 0.126807] signal: max sigframe size: 3632
[ 0.126817] Estimated ratio of average max frequency by base
frequency (times 1024): 1693
[ 0.126849] rcu: Hierarchical SRCU implementation.
[ 0.126850] rcu: Max phase no-delay instances is 400.
[ 0.126850] Timer migration: 2 hierarchy levels; 8 children per
group; 2 crossnode level
[ 0.128398] NMI watchdog: Enabled. Permanently consumes one hw-PMU
counter.
[ 0.128459] smp: Bringing up secondary CPUs ...
[ 0.128517] smpboot: x86: Booting SMP configuration:
[ 0.128518] .... node #0, CPUs: #1 #2 #3 #4 #5 #6 #7
#8 #9 #10 #11
[ 0.131508] MMIO Stale Data CPU bug present and SMT on, data leak
possible. See
https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
for more details.
[ 0.131907] smp: Brought up 1 node, 12 CPUs
[ 0.131907] smpboot: Total of 12 processors activated (62208.00 BogoMIPS)
[ 0.132921] Memory: 15747668K/16373296K available (27824K kernel
code, 5914K rwdata, 17616K rodata, 5236K init, 2356K bss, 594316K
reserved, 0K cma-reserved)
[ 0.133206] devtmpfs: initialized
[ 0.133206] ACPI: PM: Registering ACPI NVS region [mem
0x8a56f000-0x8a6fefff] (1638400 bytes)
[ 0.133206] posixtimers hash table entries: 8192 (order: 5, 131072
bytes, linear)
[ 0.133206] futex hash table entries: 4096 (262144 bytes on 1 NUMA
nodes, total 256 KiB, linear).
[ 0.133206] xor: automatically using best checksumming function avx
[ 0.134063] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.134172] audit: initializing netlink subsys (disabled)
[ 0.134181] audit: type=2000 audit(1793833083.035:1):
state=initialized audit_enabled=0 res=1
[ 0.143357] thermal_sys: Registered thermal governor 'fair_share'
[ 0.143359] thermal_sys: Registered thermal governor 'bang_bang'
[ 0.143360] thermal_sys: Registered thermal governor 'step_wise'
[ 0.143361] thermal_sys: Registered thermal governor 'user_space'
[ 0.143368] cpuidle: using governor ladder
[ 0.143368] cpuidle: using governor menu
[ 0.145399] efi: Freeing EFI boot services memory: 89504K
[ 0.145499] PCI: ECAM [mem 0xe0000000-0xefffffff] (base 0xe0000000)
for domain 0000 [bus 00-ff]
[ 0.145512] PCI: Using configuration type 1 for base access
[ 0.145570] kprobes: kprobe jump-optimization is enabled. All kprobes
are optimized if possible.
[ 0.145570] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[ 0.145570] HugeTLB: 16380 KiB vmemmap can be freed for a 1.00 GiB page
[ 0.145570] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.145570] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.146313] raid6: using avx512x2 recovery algorithm
[ 0.146408] ACPI: Added _OSI(Module Device)
[ 0.146408] ACPI: Added _OSI(Processor Device)
[ 0.146409] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.195784] ACPI: 10 ACPI AML tables successfully acquired and loaded
[ 0.201865] ACPI: \_SB_: platform _OSC: OS support mask [006e7eff]
[ 0.201947] ACPI: \_SB_: platform _OSC: OS control mask [006e7efb]
[ 0.202154] ACPI: Dynamic OEM Table Load:
[ 0.202161] ACPI: SSDT 0xFFFF979042248800 000394 (v02 PmRef Cpu0Cst
00003001 INTL 20180209)
[ 0.202972] ACPI: Dynamic OEM Table Load:
[ 0.202977] ACPI: SSDT 0xFFFF97904208A800 000581 (v02 PmRef Cpu0Ist
00003000 INTL 20180209)
[ 0.203721] ACPI: Dynamic OEM Table Load:
[ 0.203725] ACPI: SSDT 0xFFFF9790420BB200 0001CB (v02 PmRef Cpu0Psd
00003000 INTL 20180209)
[ 0.204408] ACPI: Dynamic OEM Table Load:
[ 0.204411] ACPI: SSDT 0xFFFF97904224B000 0002F4 (v02 PmRef Cpu0Hwp
00003000 INTL 20180209)
[ 0.205281] ACPI: Dynamic OEM Table Load:
[ 0.205288] ACPI: SSDT 0xFFFF979042328000 0008E7 (v02 PmRef ApIst
00003000 INTL 20180209)
[ 0.206115] ACPI: Dynamic OEM Table Load:
[ 0.206118] ACPI: SSDT 0xFFFF97904208D800 00048A (v02 PmRef ApHwp
00003000 INTL 20180209)
[ 0.206879] ACPI: Dynamic OEM Table Load:
[ 0.206883] ACPI: SSDT 0xFFFF97904208D000 0004D4 (v02 PmRef ApPsd
00003000 INTL 20180209)
[ 0.207632] ACPI: Dynamic OEM Table Load:
[ 0.207636] ACPI: SSDT 0xFFFF97904208F800 00048A (v02 PmRef ApCst
00003000 INTL 20180209)
[ 0.213647] ACPI: Interpreter enabled
[ 0.213688] ACPI: PM: (supports S0 S3 S4 S5)
[ 0.213689] ACPI: Using IOAPIC for interrupt routing
[ 0.214590] PCI: Using host bridge windows from ACPI; if necessary,
use "pci=nocrs" and report a bug
[ 0.214591] PCI: Ignoring E820 reservations for host bridge windows
[ 0.215973] ACPI: Enabled 6 GPEs in block 00 to 7F
[ 0.228798] ACPI: \_SB_.PC00.XHCI.RHUB.HS14.BTRT: New power resource
[ 0.237267] ACPI: \_SB_.PC00.CNVW.WRST: New power resource
[ 0.237434] ACPI: \_SB_.PC00.SAT0.VOL0.V0PR: New power resource
[ 0.237520] ACPI: \_SB_.PC00.SAT0.VOL1.V1PR: New power resource
[ 0.237600] ACPI: \_SB_.PC00.SAT0.VOL2.V2PR: New power resource
[ 0.248380] ACPI: \_TZ_.FN00: New power resource
[ 0.248419] ACPI: \_TZ_.FN01: New power resource
[ 0.248457] ACPI: \_TZ_.FN02: New power resource
[ 0.248493] ACPI: \_TZ_.FN03: New power resource
[ 0.248531] ACPI: \_TZ_.FN04: New power resource
[ 0.248940] ACPI: \PIN_: New power resource
[ 0.249184] ACPI: PCI Root Bridge [PC00] (domain 0000 [bus 00-fe])
[ 0.249189] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM
ClockPM Segments MSI EDR HPX-Type3]
[ 0.251843] acpi PNP0A08:00: _OSC: OS now controls [PCIeHotplug PME
AER PCIeCapability LTR DPC]
[ 0.252385] PCI host bridge to bus 0000:00
[ 0.252388] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 0.252389] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 0.252390] pci_bus 0000:00: root bus resource [mem
0x000a0000-0x000bffff window]
[ 0.252391] pci_bus 0000:00: root bus resource [mem
0x000e0000-0x000effff window]
[ 0.252392] pci_bus 0000:00: root bus resource [mem
0xa0800000-0xdfffffff window]
[ 0.252393] pci_bus 0000:00: root bus resource [mem
0x4000000000-0x7fffffffff window]
[ 0.252394] pci_bus 0000:00: root bus resource [bus 00-fe]
[ 0.252587] pci 0000:00:00.0: [8086:4c53] type 00 class 0x060000
conventional PCI endpoint
[ 0.252741] pci 0000:00:02.0: [8086:4c8b] type 00 class 0x030000 PCIe
Root Complex Integrated Endpoint
[ 0.252756] pci 0000:00:02.0: BAR 0 [mem 0x6000000000-0x6000ffffff 64bit]
[ 0.252758] pci 0000:00:02.0: BAR 2 [mem 0x4000000000-0x400fffffff
64bit pref]
[ 0.252759] pci 0000:00:02.0: BAR 4 [io 0x5000-0x503f]
[ 0.252768] pci 0000:00:02.0: DMAR: Skip IOMMU disabling for graphics
[ 0.252770] pci 0000:00:02.0: Video device with shadowed ROM at [mem
0x000c0000-0x000dffff]
[ 0.252957] pci 0000:00:06.0: [8086:4c09] type 01 class 0x060400 PCIe
Root Port
[ 0.252978] pci 0000:00:06.0: PCI bridge to [bus 01]
[ 0.252986] pci 0000:00:06.0: bridge window [mem 0xa1e00000-0xa1efffff]
[ 0.253061] pci 0000:00:06.0: PME# supported from D0 D3hot D3cold
[ 0.253672] pci 0000:00:08.0: [8086:4c11] type 00 class 0x088000
conventional PCI endpoint
[ 0.253690] pci 0000:00:08.0: BAR 0 [mem 0x600101e000-0x600101efff 64bit]
[ 0.253830] pci 0000:00:14.0: [8086:43ed] type 00 class 0x0c0330
conventional PCI endpoint
[ 0.253869] pci 0000:00:14.0: BAR 0 [mem 0x6001000000-0x600100ffff 64bit]
[ 0.253912] pci 0000:00:14.0: PME# supported from D3hot D3cold
[ 0.255519] pci 0000:00:14.2: [8086:43ef] type 00 class 0x050000
conventional PCI endpoint
[ 0.255565] pci 0000:00:14.2: BAR 0 [mem 0x6001014000-0x6001017fff 64bit]
[ 0.255569] pci 0000:00:14.2: BAR 2 [mem 0x600101d000-0x600101dfff 64bit]
[ 0.255743] pci 0000:00:14.3: [8086:43f0] type 00 class 0x028000 PCIe
Root Complex Integrated Endpoint
[ 0.255807] pci 0000:00:14.3: BAR 0 [mem 0x6001010000-0x6001013fff 64bit]
[ 0.255901] pci 0000:00:14.3: PME# supported from D0 D3hot D3cold
[ 0.256790] pci 0000:00:15.0: [8086:43e8] type 00 class 0x0c8000
conventional PCI endpoint
[ 0.258974] pci 0000:00:15.0: BAR 0 [mem 0x00000000-0x00000fff 64bit]
[ 0.271134] pci 0000:00:15.1: [8086:43e9] type 00 class 0x0c8000
conventional PCI endpoint
[ 0.271197] pci 0000:00:15.1: BAR 0 [mem 0x00000000-0x00000fff 64bit]
[ 0.281125] pci 0000:00:15.2: [8086:43ea] type 00 class 0x0c8000
conventional PCI endpoint
[ 0.281177] pci 0000:00:15.2: BAR 0 [mem 0x00000000-0x00000fff 64bit]
[ 0.291135] pci 0000:00:16.0: [8086:43e0] type 00 class 0x078000
conventional PCI endpoint
[ 0.291185] pci 0000:00:16.0: BAR 0 [mem 0x6001019000-0x6001019fff 64bit]
[ 0.291239] pci 0000:00:16.0: PME# supported from D3hot
[ 0.291717] pci 0000:00:17.0: [8086:43d2] type 00 class 0x010601
conventional PCI endpoint
[ 0.291755] pci 0000:00:17.0: BAR 0 [mem 0xa1f00000-0xa1f01fff]
[ 0.291757] pci 0000:00:17.0: BAR 1 [mem 0xa1f03000-0xa1f030ff]
[ 0.291759] pci 0000:00:17.0: BAR 2 [io 0x5090-0x5097]
[ 0.291760] pci 0000:00:17.0: BAR 3 [io 0x5080-0x5083]
[ 0.291762] pci 0000:00:17.0: BAR 4 [io 0x5060-0x507f]
[ 0.291764] pci 0000:00:17.0: BAR 5 [mem 0xa1f02000-0xa1f027ff]
[ 0.291799] pci 0000:00:17.0: PME# supported from D3hot
[ 0.292325] pci 0000:00:1c.0: [8086:43bc] type 01 class 0x060400 PCIe
Root Port
[ 0.292351] pci 0000:00:1c.0: PCI bridge to [bus 02]
[ 0.292354] pci 0000:00:1c.0: bridge window [io 0x4000-0x4fff]
[ 0.292357] pci 0000:00:1c.0: bridge window [mem 0xa1200000-0xa1bfffff]
[ 0.292427] pci 0000:00:1c.0: PME# supported from D0 D3hot D3cold
[ 0.293063] pci 0000:00:1c.6: [8086:43be] type 01 class 0x060400 PCIe
Root Port
[ 0.293089] pci 0000:00:1c.6: PCI bridge to [bus 03]
[ 0.293095] pci 0000:00:1c.6: bridge window [mem 0xa1c00000-0xa1dfffff]
[ 0.293187] pci 0000:00:1c.6: PME# supported from D0 D3hot D3cold
[ 0.293868] pci 0000:00:1d.0: [8086:43b0] type 01 class 0x060400 PCIe
Root Port
[ 0.293893] pci 0000:00:1d.0: PCI bridge to [bus 04]
[ 0.293897] pci 0000:00:1d.0: bridge window [io 0x3000-0x3fff]
[ 0.293900] pci 0000:00:1d.0: bridge window [mem 0xa0800000-0xa11fffff]
[ 0.293970] pci 0000:00:1d.0: PME# supported from D0 D3hot D3cold
[ 0.294594] pci 0000:00:1f.0: [8086:4387] type 00 class 0x060100
conventional PCI endpoint
[ 0.294952] pci 0000:00:1f.4: [8086:43a3] type 00 class 0x0c0500
conventional PCI endpoint
[ 0.295002] pci 0000:00:1f.4: BAR 0 [mem 0x6001018000-0x60010180ff 64bit]
[ 0.295009] pci 0000:00:1f.4: BAR 4 [io 0xefa0-0xefbf]
[ 0.295275] pci 0000:00:1f.5: [8086:43a4] type 00 class 0x0c8000
conventional PCI endpoint
[ 0.295329] pci 0000:00:1f.5: BAR 0 [mem 0xfe010000-0xfe010fff]
[ 0.295736] pci 0000:01:00.0: [144d:a80a] type 00 class 0x010802 PCIe
Endpoint
[ 0.295770] pci 0000:01:00.0: BAR 0 [mem 0xa1e00000-0xa1e03fff 64bit]
[ 0.296019] pci 0000:00:06.0: PCI bridge to [bus 01]
[ 0.296101] pci 0000:00:1c.0: PCI bridge to [bus 02]
[ 0.296267] pci 0000:03:00.0: [8086:15f3] type 00 class 0x020000 PCIe
Endpoint
[ 0.296325] pci 0000:03:00.0: BAR 0 [mem 0xa1c00000-0xa1cfffff]
[ 0.296330] pci 0000:03:00.0: BAR 3 [mem 0xa1d00000-0xa1d03fff]
[ 0.296449] pci 0000:03:00.0: PME# supported from D0 D3hot D3cold
[ 0.296679] pci 0000:00:1c.6: PCI bridge to [bus 03]
[ 0.296723] pci 0000:00:1d.0: PCI bridge to [bus 04]
[ 0.299229] ACPI: PCI: Interrupt link LNKA configured for IRQ 0
[ 0.299315] ACPI: PCI: Interrupt link LNKB configured for IRQ 1
[ 0.299398] ACPI: PCI: Interrupt link LNKC configured for IRQ 0
[ 0.299482] ACPI: PCI: Interrupt link LNKD configured for IRQ 0
[ 0.299565] ACPI: PCI: Interrupt link LNKE configured for IRQ 0
[ 0.299647] ACPI: PCI: Interrupt link LNKF configured for IRQ 0
[ 0.299731] ACPI: PCI: Interrupt link LNKG configured for IRQ 0
[ 0.299814] ACPI: PCI: Interrupt link LNKH configured for IRQ 0
[ 0.306862] iommu: Default domain type: Translated
[ 0.306862] iommu: DMA domain TLB invalidation policy: lazy mode
[ 0.306932] SCSI subsystem initialized
[ 0.306937] libata version 3.00 loaded.
[ 0.306948] ACPI: bus type USB registered
[ 0.306956] usbcore: registered new interface driver usbfs
[ 0.306960] usbcore: registered new interface driver hub
[ 0.306965] usbcore: registered new device driver usb
[ 0.306978] pps_core: LinuxPPS API ver. 1 registered
[ 0.306979] pps_core: Software ver. 5.3.6 - Copyright 2005-2007
Rodolfo Giometti <giometti@linux.it>
[ 0.306981] PTP clock support registered
[ 0.306986] EDAC MC: Ver: 3.0.0
[ 0.307938] efivars: Registered efivars operations
[ 0.307938] Advanced Linux Sound Architecture Driver Initialized.
[ 0.307968] NetLabel: Initializing
[ 0.307969] NetLabel: domain hash size = 128
[ 0.307969] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 0.307980] NetLabel: unlabeled traffic allowed by default
[ 0.307988] mctp: management component transport protocol core
[ 0.307988] NET: Registered PF_MCTP protocol family
[ 0.307988] PCI: Using ACPI for IRQ routing
[ 0.330339] PCI: pci_cache_line_size set to 64 bytes
[ 0.330792] pci 0000:00:1f.5: BAR 0 [mem 0xfe010000-0xfe010fff]:
can't claim; no compatible bridge window
[ 0.330996] e820: register RAM buffer resource [mem
0x0009e000-0x0009ffff]
[ 0.330997] e820: register RAM buffer resource [mem
0x77946000-0x77ffffff]
[ 0.330998] e820: register RAM buffer resource [mem
0x77984000-0x77ffffff]
[ 0.330998] e820: register RAM buffer resource [mem
0x85e80000-0x87ffffff]
[ 0.330999] e820: register RAM buffer resource [mem
0x87def000-0x87ffffff]
[ 0.331000] e820: register RAM buffer resource [mem
0x45f800000-0x45fffffff]
[ 0.331023] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[ 0.331023] pci 0000:00:02.0: vgaarb: bridge control possible
[ 0.331023] pci 0000:00:02.0: vgaarb: VGA device added:
decodes=io+mem,owns=io+mem,locks=none
[ 0.331023] vgaarb: loaded
[ 0.331851] Monitor-Mwait will be used to enter C-1 state
[ 0.331853] Monitor-Mwait will be used to enter C-2 state
[ 0.331853] Monitor-Mwait will be used to enter C-3 state
[ 0.331937] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0, 0, 0, 0, 0, 0
[ 0.331942] hpet0: 8 comparators, 64-bit 24.000000 MHz counter
[ 0.333876] clocksource: Switched to clocksource tsc-early
[ 0.334013] VFS: Disk quotas dquot_6.6.0
[ 0.334020] VFS: Dquot-cache hash table entries: 512 (4096 bytes)
[ 0.334079] netfs: FS-Cache loaded
[ 0.334110] CacheFiles: Loaded
[ 0.334205] acpi PNP0C02:00: Reserved [io 0x0290-0x029f]
[ 0.334211] acpi PNP0C02:01: Skipped [io 0x002e-0x002f]
[ 0.334211] acpi PNP0C02:01: Skipped [io 0x004e-0x004f]
[ 0.334212] acpi PNP0C02:01: Skipped [io 0x0061]
[ 0.334213] acpi PNP0C02:01: Skipped [io 0x0063]
[ 0.334213] acpi PNP0C02:01: Skipped [io 0x0065]
[ 0.334214] acpi PNP0C02:01: Skipped [io 0x0067]
[ 0.334214] acpi PNP0C02:01: Skipped [io 0x0070]
[ 0.334215] acpi PNP0C02:01: Skipped [io 0x0080]
[ 0.334216] acpi PNP0C02:01: Skipped [io 0x0092]
[ 0.334216] acpi PNP0C02:01: Skipped [io 0x00b2-0x00b3]
[ 0.334217] acpi PNP0C02:01: Reserved [io 0x0680-0x069f]
[ 0.334218] acpi PNP0C02:01: Reserved [io 0x164e-0x164f]
[ 0.334285] acpi PNP0C02:02: Reserved [mem 0xfed10000-0xfed17fff]
[ 0.334287] acpi PNP0C02:02: Reserved [mem 0xfeda0000-0xfeda0fff]
[ 0.334288] acpi PNP0C02:02: Reserved [mem 0xfeda1000-0xfeda1fff]
[ 0.334289] acpi PNP0C02:02: Reserved [mem 0xe0000000-0xefffffff]
[ 0.334290] acpi PNP0C02:02: Could not reserve [mem
0xfed20000-0xfed7ffff]
[ 0.334290] acpi PNP0C02:02: Could not reserve [mem
0xfed90000-0xfed93fff]
[ 0.334291] acpi PNP0C02:02: Could not reserve [mem
0xfed45000-0xfed8ffff]
[ 0.334292] acpi PNP0C02:02: Could not reserve [mem
0xfee00000-0xfeefffff]
[ 0.334484] acpi PNP0C02:03: Could not reserve [mem
0xfe000000-0xfe01ffff]
[ 0.334485] acpi PNP0C02:03: Reserved [mem 0xfe04c000-0xfe04ffff]
[ 0.334486] acpi PNP0C02:03: Reserved [mem 0xfe050000-0xfe0affff]
[ 0.334487] acpi PNP0C02:03: Reserved [mem 0xfe0d0000-0xfe0fffff]
[ 0.334488] acpi PNP0C02:03: Reserved [mem 0xfe200000-0xfe7fffff]
[ 0.334489] acpi PNP0C02:03: Reserved [mem 0xff000000-0xffffffff]
[ 0.334490] acpi PNP0C02:03: Could not reserve [io 0x1800-0x18fe]
[ 0.334491] acpi PNP0C02:03: Reserved [mem 0xfd000000-0xfd68ffff]
[ 0.334491] acpi PNP0C02:03: Reserved [mem 0xfd6c0000-0xfd6cffff]
[ 0.334492] acpi PNP0C02:03: Reserved [mem 0xfd6f0000-0xfdffffff]
[ 0.334712] acpi PNP0C02:04: Reserved [io 0x2000-0x20fe]
[ 0.335015] pnp: PnP ACPI init
[ 0.335509] pnp 00:00: [dma 0 disabled]
[ 0.336570] pnp: PnP ACPI: found 1 devices
[ 0.341825] clocksource: acpi_pm: mask: 0xffffff max_cycles:
0xffffff, max_idle_ns: 2085701024 ns
[ 0.341871] NET: Registered PF_INET protocol family
[ 0.341957] IP idents hash table entries: 262144 (order: 9, 2097152
bytes, linear)
[ 0.343875] tcp_listen_portaddr_hash hash table entries: 8192 (order:
5, 131072 bytes, linear)
[ 0.343891] Table-perturb hash table entries: 65536 (order: 6, 262144
bytes, linear)
[ 0.343933] TCP established hash table entries: 131072 (order: 8,
1048576 bytes, linear)
[ 0.344071] TCP bind hash table entries: 65536 (order: 9, 2097152
bytes, linear)
[ 0.344181] TCP: Hash tables configured (established 131072 bind 65536)
[ 0.344231] MPTCP token hash table entries: 16384 (order: 7, 393216
bytes, linear)
[ 0.344270] UDP hash table entries: 8192 (order: 7, 524288 bytes, linear)
[ 0.344324] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.344465] RPC: Registered named UNIX socket transport module.
[ 0.344466] RPC: Registered udp transport module.
[ 0.344467] RPC: Registered tcp transport module.
[ 0.344467] RPC: Registered tcp-with-tls transport module.
[ 0.344468] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.344469] NET: Registered PF_XDP protocol family
[ 0.344477] pci 0000:00:1c.0: bridge window [mem
0x00100000-0x000fffff 64bit pref] to [bus 02] add_size 200000 add_align
100000
[ 0.344480] pci 0000:00:1d.0: bridge window [mem
0x00100000-0x000fffff 64bit pref] to [bus 04] add_size 200000 add_align
100000
[ 0.344487] pci 0000:00:1c.0: bridge window [mem
0x4010000000-0x40101fffff 64bit pref]: assigned
[ 0.344489] pci 0000:00:1d.0: bridge window [mem
0x4010200000-0x40103fffff 64bit pref]: assigned
[ 0.344490] pci 0000:00:15.0: BAR 0 [mem 0x4010400000-0x4010400fff
64bit]: assigned
[ 0.344529] pci 0000:00:15.1: BAR 0 [mem 0x4010401000-0x4010401fff
64bit]: assigned
[ 0.344544] pci 0000:00:15.2: BAR 0 [mem 0x4010402000-0x4010402fff
64bit]: assigned
[ 0.344564] pci 0000:00:1f.5: BAR 0 [mem 0xa1f04000-0xa1f04fff]: assigned
[ 0.344575] pci 0000:00:06.0: PCI bridge to [bus 01]
[ 0.344582] pci 0000:00:06.0: bridge window [mem 0xa1e00000-0xa1efffff]
[ 0.344587] pci 0000:00:1c.0: PCI bridge to [bus 02]
[ 0.344593] pci 0000:00:1c.0: bridge window [io 0x4000-0x4fff]
[ 0.344597] pci 0000:00:1c.0: bridge window [mem 0xa1200000-0xa1bfffff]
[ 0.344600] pci 0000:00:1c.0: bridge window [mem
0x4010000000-0x40101fffff 64bit pref]
[ 0.344605] pci 0000:00:1c.6: PCI bridge to [bus 03]
[ 0.344608] pci 0000:00:1c.6: bridge window [mem 0xa1c00000-0xa1dfffff]
[ 0.344615] pci 0000:00:1d.0: PCI bridge to [bus 04]
[ 0.344617] pci 0000:00:1d.0: bridge window [io 0x3000-0x3fff]
[ 0.344620] pci 0000:00:1d.0: bridge window [mem 0xa0800000-0xa11fffff]
[ 0.344623] pci 0000:00:1d.0: bridge window [mem
0x4010200000-0x40103fffff 64bit pref]
[ 0.344628] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 0.344629] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 0.344630] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff
window]
[ 0.344631] pci_bus 0000:00: resource 7 [mem 0x000e0000-0x000effff
window]
[ 0.344632] pci_bus 0000:00: resource 8 [mem 0xa0800000-0xdfffffff
window]
[ 0.344632] pci_bus 0000:00: resource 9 [mem
0x4000000000-0x7fffffffff window]
[ 0.344633] pci_bus 0000:01: resource 1 [mem 0xa1e00000-0xa1efffff]
[ 0.344634] pci_bus 0000:02: resource 0 [io 0x4000-0x4fff]
[ 0.344647] pci_bus 0000:02: resource 1 [mem 0xa1200000-0xa1bfffff]
[ 0.344648] pci_bus 0000:02: resource 2 [mem
0x4010000000-0x40101fffff 64bit pref]
[ 0.344649] pci_bus 0000:03: resource 1 [mem 0xa1c00000-0xa1dfffff]
[ 0.344650] pci_bus 0000:04: resource 0 [io 0x3000-0x3fff]
[ 0.344651] pci_bus 0000:04: resource 1 [mem 0xa0800000-0xa11fffff]
[ 0.344652] pci_bus 0000:04: resource 2 [mem
0x4010200000-0x40103fffff 64bit pref]
[ 0.345525] PCI: CLS 64 bytes, default 64
[ 0.345558] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 0.345559] software IO TLB: mapped [mem
0x000000007f431000-0x0000000083431000] (64MB)
[ 0.345602] Trying to unpack rootfs image as initramfs...
[ 0.348844] clocksource: tsc: mask: 0xffffffffffffffff max_cycles:
0x255cb6cc5db, max_idle_ns: 440795203504 ns
[ 0.348888] clocksource: Switched to clocksource tsc
[ 0.348907] platform rtc_cmos: registered fallback platform RTC device
[ 0.354302] Initialise system trusted keyrings
[ 0.354321] Key type blacklist registered
[ 0.354375] workingset: timestamp_bits=36 (anon: 31) max_order=22
bucket_order=0 (anon: 0)
[ 0.354619] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.354757] NFS: Registering the id_resolver key type
[ 0.354764] Key type id_resolver registered
[ 0.354764] Key type id_legacy registered
[ 0.354770] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 0.354775] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver
Registering...
[ 0.355069] Key type cifs.spnego registered
[ 0.355075] Key type cifs.idmap registered
[ 0.355119] ntfs3: Enabled Linux POSIX ACLs support
[ 0.355120] ntfs3: Read-only LZX/Xpress compression included
[ 0.355169] fuse: init (API version 7.46)
[ 0.355422] integrity: Platform Keyring initialized
[ 0.355426] integrity: Machine keyring initialized
[ 0.355582] NET: Registered PF_ALG protocol family
[ 0.355587] Key type asymmetric registered
[ 0.355588] Asymmetric key parser 'x509' registered
[ 0.355601] Block layer SCSI generic (bsg) driver version 0.4 loaded
(major 243)
[ 0.355628] io scheduler mq-deadline registered
[ 0.355629] io scheduler kyber registered
[ 0.355642] io scheduler bfq registered
[ 0.356453] raid6: avx2x1 gen() 34971 MB/s
[ 0.357046] raid6: avx2x2 gen() 44317 MB/s
[ 0.357593] raid6: avx2x4 gen() 48136 MB/s
[ 0.358065] raid6: avx512x1 gen() 55668 MB/s
[ 0.358479] raid6: avx512x2 gen() 63444 MB/s
[ 0.358888] raid6: avx512x4 gen() 64238 MB/s
[ 0.358892] raid6: using algorithm avx512x4 gen() 64238 MB/s
[ 0.359363] raid6: .... xor() 27882 MB/s, rmw enabled
[ 0.362054] pcieport 0000:00:06.0: PME: Signaling with IRQ 120
[ 0.362126] pcieport 0000:00:06.0: AER: enabled with IRQ 120
[ 0.362157] pcieport 0000:00:06.0: DPC: enabled with IRQ 120
[ 0.362157] pcieport 0000:00:06.0: DPC: error containment
capabilities: Int Msg #0, RPExt+ PoisonedTLP+ SwTrigger+ RP PIO Log 4,
DL_ActiveErr+
[ 0.362312] pcieport 0000:00:1c.0: PME: Signaling with IRQ 121
[ 0.362327] pcieport 0000:00:1c.0: pciehp: Slot #0 AttnBtn- PwrCtrl-
MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis-
LLActRep+
[ 0.362575] pcieport 0000:00:1c.6: PME: Signaling with IRQ 122
[ 0.362641] pcieport 0000:00:1c.6: AER: enabled with IRQ 122
[ 0.362695] pcieport 0000:00:1c.6: DPC: enabled with IRQ 122
[ 0.362696] pcieport 0000:00:1c.6: DPC: error containment
capabilities: Int Msg #0, RPExt+ PoisonedTLP+ SwTrigger+ RP PIO Log 4,
DL_ActiveErr+
[ 0.362827] pcieport 0000:00:1d.0: PME: Signaling with IRQ 123
[ 0.362841] pcieport 0000:00:1d.0: pciehp: Slot #0 AttnBtn- PwrCtrl-
MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis-
LLActRep+
[ 0.363090] input: Sleep Button as
/devices/platform/PNP0C0E:00/input/input0
[ 0.363101] ACPI: button: Sleep Button [SLPB]
[ 0.363121] input: Power Button as
/devices/platform/PNP0C0C:00/input/input1
[ 0.363129] ACPI: button: Power Button [PWRB]
[ 0.363143] input: Power Button as
/devices/platform/LNXPWRBN:00/input/input2
[ 0.363185] ACPI: button: Power Button [PWRF]
[ 0.364249] acpi-tad ACPI000E:00: registered as rtc0
[ 0.364537] acpi-tad ACPI000E:00: setting system clock to
2026-11-04T22:58:03 UTC (1793833083)
[ 0.366793] acpi LNXTHERM:00: registered as thermal_zone0
[ 0.366795] ACPI: thermal: Thermal Zone [TZ00] (28 C)
[ 0.366951] Serial: 8250/16550 driver, 32 ports, IRQ sharing disabled
[ 0.367080] 00:00: ttyS0 I/O:0x3f8 (irq = 4, base_baud = 115200) is a
16550A
[ 0.369600] Non-volatile memory driver v1.3
[ 0.376210] ACPI: bus type drm_connector registered
[ 0.378343] brd: module loaded
[ 0.378355] loop: module loaded
[ 0.378402] zram: Added device: zram0
[ 0.378456] intel-lpss 0000:00:15.0: enabling device (0004 -> 0006)
[ 0.378700] idma64 idma64.0: Found Intel integrated DMA 64-bit
[ 0.378737] intel-lpss 0000:00:15.1: enabling device (0004 -> 0006)
[ 0.378878] idma64 idma64.1: Found Intel integrated DMA 64-bit
[ 0.378926] intel-lpss 0000:00:15.2: enabling device (0004 -> 0006)
[ 0.379055] idma64 idma64.2: Found Intel integrated DMA 64-bit
[ 0.379255] nvme 0000:01:00.0: platform quirk: setting simple suspend
[ 0.379296] nvme nvme0: pci function 0000:01:00.0
[ 0.380190] ahci 0000:00:17.0: AHCI vers 0001.0301, 32 command slots,
6 Gbps, SATA mode
[ 0.380193] ahci 0000:00:17.0: 6/6 ports implemented (port mask 0x3f)
[ 0.380194] ahci 0000:00:17.0: flags: 64bit ncq sntf pm clo only pio
slum part ems deso sadm sds
[ 0.389918] scsi host0: ahci
[ 0.389995] scsi host1: ahci
[ 0.390046] scsi host2: ahci
[ 0.390091] scsi host3: ahci
[ 0.390139] scsi host4: ahci
[ 0.390189] scsi host5: ahci
[ 0.390235] ata1: SATA max UDMA/133 abar m2048@0xa1f02000 port
0xa1f02100 irq 125 lpm-pol 3
[ 0.390237] ata2: SATA max UDMA/133 abar m2048@0xa1f02000 port
0xa1f02180 irq 125 lpm-pol 3
[ 0.390239] ata3: SATA max UDMA/133 abar m2048@0xa1f02000 port
0xa1f02200 irq 125 lpm-pol 3
[ 0.390240] ata4: SATA max UDMA/133 abar m2048@0xa1f02000 port
0xa1f02280 irq 125 lpm-pol 3
[ 0.390242] ata5: SATA max UDMA/133 abar m2048@0xa1f02000 port
0xa1f02300 irq 125 lpm-pol 3
[ 0.390243] ata6: SATA max UDMA/133 abar m2048@0xa1f02000 port
0xa1f02380 irq 125 lpm-pol 3
[ 0.390449] MACsec IEEE 802.1AE
[ 0.390480] Intel(R) 2.5G Ethernet Linux Driver
[ 0.390481] Copyright(c) 2018 Intel Corporation.
[ 0.390733] igc 0000:03:00.0: enabling device (0000 -> 0002)
[ 0.391123] nvme nvme0: D3 entry latency set to 10 seconds
[ 0.391294] pcieport 0000:00:1c.6: PTM enabled (root), 4ns granularity
[ 0.391491] igc 0000:03:00.0: PTM enabled, 4ns granularity
[ 0.392816] nvme nvme0: passthrough uses implicit buffer lengths
[ 0.395207] nvme nvme0: 12/0/0 default/read/poll queues
[ 0.397156] nvme0n1: p1 p2 p3
[ 0.441286] igc 0000:03:00.0 (unnamed net_device) (uninitialized):
PHC added
[ 0.469913] igc 0000:03:00.0: 4.000 Gb/s available PCIe bandwidth
(5.0 GT/s PCIe x1 link)
[ 0.469917] igc 0000:03:00.0 eth0: MAC: XX:XX:XX:XX:XX:XX
[ 0.470146] xhci_hcd 0000:00:14.0: xHCI Host Controller
[ 0.470150] xhci_hcd 0000:00:14.0: new USB bus registered, assigned
bus number 1
[ 0.471286] xhci_hcd 0000:00:14.0: hcc params 0x20007fc1 hci version
0x120 quirks 0x0000000200009810
[ 0.471650] xhci_hcd 0000:00:14.0: xHCI Host Controller
[ 0.471653] xhci_hcd 0000:00:14.0: new USB bus registered, assigned
bus number 2
[ 0.471654] xhci_hcd 0000:00:14.0: Host supports USB 3.2 Enhanced
SuperSpeed
[ 0.471678] usb usb1: New USB device found, idVendor=1d6b,
idProduct=0002, bcdDevice= 7.03
[ 0.471695] usb usb1: New USB device strings: Mfr=3, Product=2,
SerialNumber=1
[ 0.471696] usb usb1: Product: xHCI Host Controller
[ 0.471697] usb usb1: Manufacturer: Linux 7.3.2-rc1_MY-g75eaee7a6465
xhci-hcd
[ 0.471698] usb usb1: SerialNumber: 0000:00:14.0
[ 0.471814] hub 1-0:1.0: USB hub found
[ 0.471863] hub 1-0:1.0: 16 ports detected
[ 0.474440] usb usb2: New USB device found, idVendor=1d6b,
idProduct=0003, bcdDevice= 7.03
[ 0.474459] usb usb2: New USB device strings: Mfr=3, Product=2,
SerialNumber=1
[ 0.474460] usb usb2: Product: xHCI Host Controller
[ 0.474461] usb usb2: Manufacturer: Linux 7.3.2-rc1_MY-g75eaee7a6465
xhci-hcd
[ 0.474462] usb usb2: SerialNumber: 0000:00:14.0
[ 0.474511] hub 2-0:1.0: USB hub found
[ 0.474549] hub 2-0:1.0: 5 ports detected
[ 0.475748] usbcore: registered new interface driver usblp
[ 0.475809] usbcore: registered new interface driver uas
[ 0.475816] usbcore: registered new interface driver usb-storage
[ 0.475832] i8042: PNP: No PS/2 controller found.
[ 0.475861] mousedev: PS/2 mouse device common for all mice
[ 0.475920] rtc_cmos rtc_cmos: RTC can wake from S4
[ 0.476817] rtc_cmos rtc_cmos: registered as rtc1
[ 0.476864] rtc_cmos rtc_cmos: alarms up to one month, y3k, 114 bytes
nvram, hpet irqs
[ 0.476876] i2c_dev: i2c /dev entries driver
[ 0.477118] i801_smbus 0000:00:1f.4: SPD Write Disable is set
[ 0.477135] i801_smbus 0000:00:1f.4: SMBus using PCI interrupt
[ 0.478722] i2c i2c-0: Successfully instantiated SPD at 0x51
[ 0.479632] i2c i2c-0: Successfully instantiated SPD at 0x53
[ 0.481085] nct6775: Found NCT6798D/NCT5585D or compatible chip at
0x2e:0x290
[ 0.528730] device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is
disabled. Duplicate IMA measurements will not be recorded in the IMA log.
[ 0.528739] device-mapper: uevent: version 1.0.3
[ 0.528780] device-mapper: ioctl: 4.50.0-ioctl (2025-04-28)
initialised: dm-devel@lists.linux.dev
[ 0.528784] intel_pstate: HWP enabled by BIOS
[ 0.528785] intel_pstate: Intel P-state driver initializing
[ 0.529212] intel_pstate: HWP enabled
[ 0.529578] simple-framebuffer simple-framebuffer.0: [drm] Registered
1 planes with drm panic
[ 0.529588] [drm] Initialized simpledrm 1.0.0 for
simple-framebuffer.0 on minor 0
[ 0.530059] fbcon: Deferring console take-over
[ 0.530061] simple-framebuffer simple-framebuffer.0: [drm] fb0:
simpledrmdrmfb frame buffer device
[ 0.530089] pstore: Using crash dump compression: deflate
[ 0.530090] pstore: Registered efi_pstore as persistent store backend
[ 0.530099] hid: raw HID events driver (C) Jiri Kosina
[ 0.530113] usbcore: registered new interface driver usbhid
[ 0.530114] usbhid: USB HID core driver
[ 0.530777] intel_rapl_common: Found RAPL domain package
[ 0.530780] intel_rapl_common: Found RAPL domain core
[ 0.533631] ee1004 0-0051: 512 byte EE1004-compliant SPD EEPROM,
read-only
[ 0.535176] ee1004 0-0053: 512 byte EE1004-compliant SPD EEPROM,
read-only
[ 0.535259] usbcore: registered new interface driver snd-usb-audio
[ 0.535268] drop_monitor: Initializing network drop monitor service
[ 0.535366] Initializing XFRM netlink socket
[ 0.535383] NET: Registered PF_INET6 protocol family
[ 0.535544] Segment Routing with IPv6
[ 0.535545] RPL Segment Routing with IPv6
[ 0.535550] In-situ OAM (IOAM) with IPv6
[ 0.535562] mip6: Mobile IPv6
[ 0.535564] NET: Registered PF_PACKET protocol family
[ 0.535572] bridge: filtering via arp/ip/ip6tables is no longer
available by default. Update your scripts to load br_netfilter if you
need this.
[ 0.535602] NET: Registered PF_RXRPC protocol family
[ 0.535604] Key type rxrpc registered
[ 0.535604] Key type rxrpc_s registered
[ 0.535624] NET: Registered PF_KCM protocol family
[ 0.535692] NET: Registered PF_RDS protocol family
[ 0.535710] Registered RDS/tcp transport
[ 0.535730] Key type dns_resolver registered
[ 0.535732] Key type ceph registered
[ 0.535768] libceph: loaded (mon/osd proto 15/24)
[ 0.535787] NET: Registered PF_VSOCK protocol family
[ 0.537001] ENERGY_PERF_BIAS: Set to 'normal', was 'performance'
[ 0.537792] microcode: Current revision: 0x00000065
[ 0.538761] IPI shorthand broadcast: enabled
[ 0.540247] sched_clock: Marking stable (535001101,
4635085)->(544842601, -5206415)
[ 0.540454] registered taskstats version 1
[ 0.541849] Loading compiled-in X.509 certificates
[ 0.542209] Loaded X.509 cert 'Build time autogenerated kernel key:
2459d2907a16424fd634f6d91423079f301221fa'
[ 0.545305] Demotion targets for Node 0: null
[ 0.545312] page_owner is disabled
[ 0.545325] Key type .fscrypt registered
[ 0.545325] Key type fscrypt-provisioning registered
[ 0.545571] Btrfs loaded, zoned=yes, fsverity=yes
[ 0.545592] Key type big_key registered
[ 0.545593] Key type trusted registered
[ 0.545786] Key type encrypted registered
[ 0.545790] Loading compiled-in module X.509 certificates
[ 0.546117] Loaded X.509 cert 'Build time autogenerated kernel key:
2459d2907a16424fd634f6d91423079f301221fa'
[ 0.546119] ima: Allocated hash algorithm: sha256
[ 0.563945] ima: No architecture policies found
[ 0.563957] evm: Initialising EVM extended attributes:
[ 0.563957] evm: security.selinux
[ 0.563958] evm: security.SMACK64 (disabled)
[ 0.563958] evm: security.SMACK64EXEC (disabled)
[ 0.563959] evm: security.SMACK64TRANSMUTE (disabled)
[ 0.563959] evm: security.SMACK64MMAP (disabled)
[ 0.563959] evm: security.apparmor (disabled)
[ 0.563960] evm: security.ima
[ 0.563960] evm: security.capability
[ 0.563961] evm: HMAC attrs: 0x1
[ 0.564246] integrity: Loading X.509 certificate: UEFI:db
[ 0.564436] integrity: Loaded X.509 cert 'ASUSTeK MotherBoard SW Key
Certificate: da83b990422ebc8c441f8d8b039a65a2'
[ 0.564437] integrity: Loading X.509 certificate: UEFI:db
[ 0.564527] integrity: Loaded X.509 cert 'ASUSTeK Notebook SW Key
Certificate: b8e581e4df77a5bb4282d5ccfc00c071'
[ 0.564527] integrity: Loading X.509 certificate: UEFI:db
[ 0.564535] integrity: Loaded X.509 cert 'Microsoft Corporation UEFI
CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4'
[ 0.564536] integrity: Loading X.509 certificate: UEFI:db
[ 0.564543] integrity: Loaded X.509 cert 'Microsoft Windows
Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53'
[ 0.564543] integrity: Loading X.509 certificate: UEFI:db
[ 0.564551] integrity: Loaded X.509 cert 'Microsoft Option ROM UEFI
CA 2023: 514fbf937fa46fb57bf07af8bed84b3b864b1711'
[ 0.564552] integrity: Loading X.509 certificate: UEFI:db
[ 0.564561] integrity: Loaded X.509 cert 'Microsoft UEFI CA 2023:
81aa6b3244c935bce0d6628af39827421e32497d'
[ 0.564562] integrity: Loading X.509 certificate: UEFI:db
[ 0.564568] integrity: Loaded X.509 cert 'Microsoft Corporation:
Windows UEFI CA 2023: aefc5fbbbe055d8f8daa585473499417ab5a5272'
[ 0.565420] netconsole: network logging started
[ 0.565489] RAS: Correctable Errors collector initialized.
[ 0.565623] clk: Disabling unused clocks
[ 0.565625] ALSA device list:
[ 0.565626] No soundcards found.
[ 0.661704] Freeing initrd memory: 81708K
[ 0.697173] ata3: SATA link down (SStatus 4 SControl 300)
[ 0.697215] ata1: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
[ 0.697541] ata5: SATA link down (SStatus 4 SControl 300)
[ 0.697582] ata4: SATA link down (SStatus 4 SControl 300)
[ 0.697634] ata6: SATA link down (SStatus 4 SControl 300)
[ 0.697688] ata2: SATA link down (SStatus 4 SControl 300)
[ 0.707505] ata1.00: Model 'INTEL SSDSC2CT120A3', rev '300i',
applying quirks: zeroaftertrim
[ 0.707891] ata1.00: ATA-9: INTEL SSDSC2CT120A3, 300i, max UDMA/133
[ 0.708325] ata1.00: 234441648 sectors, multi 16: LBA48 NCQ (depth
32), AA
[ 0.708338] ata1.00: Features: HIPM DIPM
[ 0.715791] usb 1-2: new full-speed USB device number 2 using xhci_hcd
[ 0.718288] ata1.00: configured for UDMA/133
[ 0.719414] scsi 0:0:0:0: Direct-Access ATA INTEL SSDSC2CT12
300i PQ: 0 ANSI: 5
[ 0.720034] sd 0:0:0:0: Attached scsi generic sg0 type 0
[ 0.720127] sd 0:0:0:0: [sda] 234441648 512-byte logical blocks: (120
GB/112 GiB)
[ 0.720147] sd 0:0:0:0: [sda] Write Protect is off
[ 0.720152] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
[ 0.720178] sd 0:0:0:0: [sda] Write cache: enabled, read cache:
enabled, doesn't support DPO or FUA
[ 0.720226] sd 0:0:0:0: [sda] Preferred minimum I/O size 512 bytes
[ 0.757199] sda: sda1 sda2 sda3 sda4 sda5 sda6
[ 0.758192] sd 0:0:0:0: [sda] Attached SCSI disk
[ 0.774216] Freeing unused kernel image (initmem) memory: 5236K
[ 0.774239] Write protecting the kernel read-only data: 47104k
[ 0.774680] Freeing unused kernel image (text/rodata gap) memory: 844K
[ 0.774931] Freeing unused kernel image (rodata/data gap) memory: 816K
[ 0.781072] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 0.781078] Run /init as init process
[ 0.781079] with arguments:
[ 0.781080] /init
[ 0.781081] rhgb
[ 0.781081] with environment:
[ 0.781082] HOME=/
[ 0.781082] TERM=linux
[ 0.815482] systemd[1]: Successfully made /usr/ read-only.
[ 0.815594] systemd[1]: systemd 262.1-1.fc45 running in system mode
(+PAM +AUDIT +SELINUX -APPARMOR +IMA +IPE +SMACK +SECCOMP +GNUTLS
+OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP
+LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE
+TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP
+LIBARCHIVE)
[ 0.815597] systemd[1]: Detected architecture x86-64.
[ 0.815598] systemd[1]: Running in initrd.
[ 0.815740] systemd[1]: Hostname set to <obelix>.
[ 0.840010] usb 1-2: New USB device found, idVendor=0b05,
idProduct=19af, bcdDevice= 1.00
[ 0.842952] usb 1-2: config 1 has an invalid interface number: 2 but
max is 1
[ 0.842955] usb 1-2: config 1 has no interface number 1
[ 0.843937] usb 1-2: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[ 0.843939] usb 1-2: Product: AURA LED Controller
[ 0.843940] usb 1-2: Manufacturer: AsusTek Computer Inc.
[ 0.843941] usb 1-2: SerialNumber: 9876543210
[ 0.845920] hid-generic 0003:0B05:19AF.0001: hiddev96,hidraw0: USB
HID v1.11 Device [AsusTek Computer Inc. AURA LED Controller] on
usb-0000:00:14.0-2/input2
[ 0.856679] systemd[1]: bpf-restrict-fs: LSM BPF program attached
[ 0.884769] systemd[1]: Queued start job for default target
initrd.target.
[ 0.898271] systemd[1]: Expecting device
dev-disk-by\x2duuid-2ab6e75b\x2d4e3c\x2d4a9d\x2da329\x2d431178fdd0e7.device
- /dev/disk/by-uuid/2ab6e75b-4e3c-4a9d-a329-431178fdd0e7...
[ 0.898334] systemd[1]: Reached target initrd-usr-fs.target - Initrd
/usr File System.
[ 0.898385] systemd[1]: Reached target slices.target - Slice Units.
[ 0.898408] systemd[1]: Reached target swap.target - Swaps.
[ 0.898429] systemd[1]: Reached target timers.target - Timer Units.
[ 0.898545] systemd[1]: Listening on systemd-journald-dev-log.socket
- Journal Socket (/dev/log).
[ 0.898662] systemd[1]: Listening on systemd-journald.socket -
Journal Sockets.
[ 0.898751] systemd[1]: Listening on systemd-udevd-kernel.socket -
udev Kernel Socket.
[ 0.898890] systemd[1]: Listening on systemd-udevd-varlink.socket -
udev Varlink Socket.
[ 0.898917] systemd[1]: Reached target sockets.target - Socket Units.
[ 0.899018] systemd[1]: kmod-static-nodes.service - Create List of
Static Device Nodes skipped, unmet condition check
ConditionFileNotEmpty=/lib/modules/7.3.2-rc1_MY-g75eaee7a6465/modules.devname
[ 0.899077] systemd[1]: memstrack.service - Memstrack Anylazing
Service skipped, no trigger condition checks were met.
[ 0.901821] systemd[1]: Starting systemd-journald.service - Journal
Service...
[ 0.902523] systemd[1]: Starting systemd-modules-load.service - Load
Kernel Modules...
[ 0.902571] systemd[1]: systemd-pcrphase-initrd.service - TPM PCR
Barrier (initrd) skipped, unmet condition check
ConditionSecurity=measured-os
[ 0.903145] systemd[1]: Starting
systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in
/dev gracefully...
[ 0.903733] systemd[1]: Starting systemd-vconsole-setup.service -
Virtual Console Setup...
[ 0.907890] systemd[1]: Finished systemd-modules-load.service - Load
Kernel Modules.
[ 0.908431] systemd[1]: Starting systemd-sysctl.service - Apply
Kernel Variables...
[ 0.908621] systemd[1]: Finished
systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in
/dev gracefully.
[ 0.909075] systemd[1]: Starting systemd-tmpfiles-setup-dev.service -
Create Static Device Nodes in /dev...
[ 0.912025] systemd[1]: Finished systemd-sysctl.service - Apply
Kernel Variables.
[ 0.912512] systemd-journald[229]: Collecting audit messages is disabled.
[ 0.912749] systemd[1]: Finished systemd-tmpfiles-setup-dev.service -
Create Static Device Nodes in /dev.
[ 0.912845] systemd[1]: Reached target local-fs-pre.target -
Preparation for Local File Systems.
[ 0.912860] systemd[1]: Reached target local-fs.target - Local File
Systems.
[ 0.924829] systemd[1]: Finished systemd-vconsole-setup.service -
Virtual Console Setup.
[ 0.924909] systemd[1]: dracut-cmdline-ask.service - dracut ask for
additional cmdline parameters skipped, no trigger condition checks were met.
[ 0.925391] systemd[1]: Starting dracut-cmdline.service - dracut
cmdline hook...
[ 0.934979] systemd[1]: Started systemd-journald.service - Journal
Service.
[ 0.958653] usb 1-9: new high-speed USB device number 3 using xhci_hcd
[ 1.082966] usb 1-9: New USB device found, idVendor=05e3,
idProduct=0610, bcdDevice=60.60
[ 1.084272] usb 1-9: New USB device strings: Mfr=0, Product=1,
SerialNumber=0
[ 1.084274] usb 1-9: Product: USB2.0 Hub
[ 1.085593] hub 1-9:1.0: USB hub found
[ 1.085984] hub 1-9:1.0: 4 ports detected
[ 1.201658] usb 1-10: new high-speed USB device number 4 using xhci_hcd
[ 1.327976] usb 1-10: New USB device found, idVendor=05e3,
idProduct=0610, bcdDevice=60.60
[ 1.329160] usb 1-10: New USB device strings: Mfr=0, Product=1,
SerialNumber=0
[ 1.329172] usb 1-10: Product: USB2.0 Hub
[ 1.330467] hub 1-10:1.0: USB hub found
[ 1.330793] hub 1-10:1.0: 4 ports detected
[ 1.446684] usb 1-14: new full-speed USB device number 5 using xhci_hcd
[ 1.570647] usb 1-14: New USB device found, idVendor=8087,
idProduct=0026, bcdDevice= 0.02
[ 1.571237] usb 1-14: New USB device strings: Mfr=0, Product=0,
SerialNumber=0
[ 1.642697] usb 1-10.1: new full-speed USB device number 6 using xhci_hcd
[ 1.727832] usb 1-10.1: New USB device found, idVendor=046d,
idProduct=c548, bcdDevice= 5.01
[ 1.729865] usb 1-10.1: New USB device strings: Mfr=1, Product=2,
SerialNumber=0
[ 1.729867] usb 1-10.1: Product: USB Receiver
[ 1.729868] usb 1-10.1: Manufacturer: Logitech
[ 1.738766] input: Logitech USB Receiver as
/devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.0/0003:046D:C548.0002/input/input3
[ 1.837713] Setting dangerous option enable_guc - tainting kernel
[ 1.839193] i915 0000:00:02.0: [drm] Found rocketlake (device ID
4c8b) integrated display version 12.00 stepping C0
[ 1.851963] hid-generic 0003:046D:C548.0002: input,hidraw1: USB HID
v1.11 Keyboard [Logitech USB Receiver] on usb-0000:00:14.0-10.1/input0
[ 1.853084] input: Logitech USB Receiver Mouse as
/devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.1/0003:046D:C548.0003/input/input4
[ 1.853214] input: Logitech USB Receiver Consumer Control as
/devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.1/0003:046D:C548.0003/input/input5
[ 1.853275] input: Logitech USB Receiver System Control as
/devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.1/0003:046D:C548.0003/input/input6
[ 1.853400] hid-generic 0003:046D:C548.0003: input,hidraw2: USB HID
v1.11 Mouse [Logitech USB Receiver] on usb-0000:00:14.0-10.1/input1
[ 1.854465] hid-generic 0003:046D:C548.0004: hiddev97,hidraw3: USB
HID v1.11 Device [Logitech USB Receiver] on usb-0000:00:14.0-10.1/input2
[ 1.855912] i915 0000:00:02.0: vgaarb: deactivate vga console
[ 1.855975] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[ 1.857765] i915 0000:00:02.0: [drm] Finished loading DMC firmware
i915/rkl_dmc_ver2_03.bin (v2.3)
[ 1.858426] i915 0000:00:02.0: vgaarb: VGA decodes changed:
olddecodes=io+mem,decodes=io:owns=io+mem
[ 1.875766] i915 0000:00:02.0: [drm] GT0: GuC firmware
i915/tgl_guc_70.1.1.bin version 70.1.1
[ 1.875770] i915 0000:00:02.0: [drm] GT0: HuC firmware
i915/tgl_huc_7.9.3.bin version 7.9.3
[ 1.879531] i915 0000:00:02.0: [drm] GT0: HuC: authenticated for all
workloads
[ 1.880250] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
[ 1.880251] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
[ 1.880560] i915 0000:00:02.0: [drm] GT0: GUC: RC enabled
[ 1.880859] i915 0000:00:02.0: [drm] Protected Xe Path (PXP)
protected content support initialized
[ 1.898633] i915 0000:00:02.0: [drm] Registered 3 planes with drm panic
[ 1.903857] [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 1
[ 1.906121] ACPI: video: Video Device [GFX0] (multi-head: yes rom:
no post: no)
[ 1.907211] input: Video Bus as
/devices/pci0000:00/acpi.video_bus.0/input/input7
[ 1.928729] usb 1-10.4: new full-speed USB device number 7 using xhci_hcd
[ 1.951131] fbcon: i915drmfb (fb0) is primary device
[ 1.951133] fbcon: Deferring console take-over
[ 1.951134] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
[ 2.002865] usb 1-10.4: New USB device found, idVendor=08bb,
idProduct=2900, bcdDevice= 1.00
[ 2.007632] usb 1-10.4: New USB device strings: Mfr=1, Product=2,
SerialNumber=0
[ 2.007635] usb 1-10.4: Product: USB Audio CODEC
[ 2.007639] usb 1-10.4: Manufacturer: Burr-Brown from TI
[ 2.035153] input: Burr-Brown from TI USB Audio CODEC
as
/devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.4/1-10.4:1.3/0003:08BB:2900.0005/input/input8
[ 2.086265] hid-generic 0003:08BB:2900.0005: input,hidraw4: USB HID
v1.00 Device [Burr-Brown from TI USB Audio CODEC ] on
usb-0000:00:14.0-10.4/input3
[ 2.181759] BTRFS: device fsid 2ab6e75b-4e3c-4a9d-a329-431178fdd0e7
devid 1 transid 380259 /dev/nvme0n1p3 (259:3) scanned by mount (417)
[ 2.182287] BTRFS info (device nvme0n1p3): first mount of filesystem
2ab6e75b-4e3c-4a9d-a329-431178fdd0e7
[ 2.182304] BTRFS info (device nvme0n1p3): using crc32c checksum
algorithm
[ 2.202248] BTRFS info (device nvme0n1p3): enabling ssd optimizations
[ 2.202250] BTRFS info (device nvme0n1p3): turning on async discard
[ 2.202251] BTRFS info (device nvme0n1p3): enabling free space tree
[ 2.349447] systemd-journald[229]: Received SIGTERM from PID 1 (systemd).
[ 2.367391] audit: type=1404 audit(1793833085.501:2): enforcing=1
old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1
lsm=selinux res=1
[ 2.385156] SELinux: Permission firmware_load in class system not
defined in policy.
[ 2.385160] SELinux: Permission kexec_image_load in class system not
defined in policy.
[ 2.385161] SELinux: Permission kexec_initramfs_load in class system
not defined in policy.
[ 2.385161] SELinux: Permission policy_load in class system not
defined in policy.
[ 2.385162] SELinux: Permission x509_certificate_load in class
system not defined in policy.
[ 2.385195] SELinux: Permission map_create_as in class bpf not
defined in policy.
[ 2.385195] SELinux: Permission prog_load_as in class bpf not
defined in policy.
[ 2.385197] SELinux: Permission allowed in class io_uring not
defined in policy.
[ 2.385198] SELinux: Class memfd_file not defined in policy.
[ 2.385198] SELinux: the above unknown classes and permissions will
be allowed
[ 2.386661] SELinux: policy capability network_peer_controls=1
[ 2.386663] SELinux: policy capability open_perms=1
[ 2.386663] SELinux: policy capability extended_socket_class=1
[ 2.386664] SELinux: policy capability always_check_network=0
[ 2.386664] SELinux: policy capability cgroup_seclabel=1
[ 2.386665] SELinux: policy capability nnp_nosuid_transition=1
[ 2.386665] SELinux: policy capability genfs_seclabel_symlinks=1
[ 2.386666] SELinux: policy capability ioctl_skip_cloexec=0
[ 2.386666] SELinux: policy capability userspace_initial_context=0
[ 2.386667] SELinux: policy capability netlink_xperm=0
[ 2.386667] SELinux: policy capability netif_wildcard=0
[ 2.386668] SELinux: policy capability genfs_seclabel_wildcard=0
[ 2.386669] SELinux: policy capability functionfs_seclabel=0
[ 2.386669] SELinux: policy capability memfd_class=0
[ 2.386670] SELinux: policy capability bpf_token_perms=0
[ 2.415277] audit: type=1403 audit(1793833085.549:3): auid=4294967295
ses=4294967295 lsm=selinux res=1
[ 2.415813] systemd[1]: Successfully loaded SELinux policy in 48.560ms.
[ 2.426245] systemd[1]: Relabeled /dev/, /dev/shm/, /run/ in 7.407ms.
[ 2.427414] systemd[1]: systemd 262.1-1.fc45 running in system mode
(+PAM +AUDIT +SELINUX -APPARMOR +IMA +IPE +SMACK +SECCOMP +GNUTLS
+OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP
+LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE
+TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP
+LIBARCHIVE)
[ 2.427418] systemd[1]: Detected architecture x86-64.
[ 2.481302] systemd[1]: bpf-restrict-fs: LSM BPF program attached
[ 2.659008] systemd[1]: initrd-switch-root.service: Deactivated
successfully.
[ 2.659104] systemd[1]: Stopped initrd-switch-root.service - Switch Root.
[ 2.659738] systemd[1]: systemd-journald.service: Scheduled restart
job, restart counter is at 1.
[ 2.660062] systemd[1]: Created slice system-getty.slice - Slice
/system/getty.
[ 2.660304] systemd[1]: Created slice system-kmsconvt.slice - Slice
/system/kmsconvt.
[ 2.660533] systemd[1]: Created slice system-sshd\x2dkeygen.slice -
Slice /system/sshd-keygen.
[ 2.660782] systemd[1]: Created slice system-systemd\x2dfsck.slice -
Slice /system/systemd-fsck.
[ 2.661047] systemd[1]: Created slice
system-systemd\x2dzram\x2dsetup.slice - Slice /system/systemd-zram-setup.
[ 2.661199] systemd[1]: Created slice user.slice - User and Session
Slice.
[ 2.661232] systemd[1]: systemd-ask-password-console.path - Dispatch
Password Requests to Console Directory Watch skipped, unmet condition
check ConditionPathExists=!/run/plymouth/pid
[ 2.661280] systemd[1]: Started systemd-ask-password-wall.path -
Forward Password Requests to Wall Directory Watch.
[ 2.661469] systemd[1]: Set up automount
proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats
File System Automount Point.
[ 2.661495] systemd[1]: Expecting device
dev-disk-by\x2duuid-2ab6e75b\x2d4e3c\x2d4a9d\x2da329\x2d431178fdd0e7.device
- /dev/disk/by-uuid/2ab6e75b-4e3c-4a9d-a329-431178fdd0e7...
[ 2.661508] systemd[1]: Expecting device
dev-disk-by\x2duuid-385484bb\x2d0f27\x2d4dae\x2d8577\x2d7d1866d9e9bc.device
- /dev/disk/by-uuid/385484bb-0f27-4dae-8577-7d1866d9e9bc...
[ 2.661520] systemd[1]: Expecting device
dev-disk-by\x2duuid-4D03\x2d2603.device - /dev/disk/by-uuid/4D03-2603...
[ 2.661529] systemd[1]: Expecting device
dev-disk-by\x2duuid-80ce69a9\x2d95d2\x2d4182\x2da493\x2db0a5c7618748.device
- /dev/disk/by-uuid/80ce69a9-95d2-4182-a493-b0a5c7618748...
[ 2.661540] systemd[1]: Expecting device dev-zram0.device - /dev/zram0...
[ 2.661554] systemd[1]: Reached target clonesetup.target - Local
dm-clone Devices.
[ 2.661574] systemd[1]: Reached target getty.target - Login Prompts.
[ 2.661590] systemd[1]: Reached target imports.target - Image Downloads.
[ 2.661610] systemd[1]: Stopped target initrd-switch-root.target -
Switch Root.
[ 2.661628] systemd[1]: Stopped target initrd-fs.target - Initrd File
Systems.
[ 2.661647] systemd[1]: Stopped target initrd-root-fs.target - Initrd
Root File System.
[ 2.661664] systemd[1]: Reached target integritysetup.target - Local
Integrity Protected Volumes.
[ 2.661713] systemd[1]: Reached target slices.target - Slice Units.
[ 2.661743] systemd[1]: Reached target veritysetup.target - Local
Verity Protected Volumes.
[ 2.670635] systemd[1]: Listening on rpcbind.socket - RPCbind Server
Activation Socket.
[ 2.670683] systemd[1]: Reached target rpcbind.target - RPC Port Mapper.
[ 2.671332] systemd[1]: Listening on systemd-ask-password.socket -
Query the User Interactively for a Password.
[ 2.672062] systemd[1]: Listening on systemd-coredump.socket -
Process Core Dump Socket.
[ 2.672447] systemd[1]: Listening on systemd-creds.socket -
Credential Encryption/Decryption.
[ 2.672877] systemd[1]: Listening on systemd-cryptenroll.socket -
Disk Encryption Enrollment Service Socket.
[ 2.673361] systemd[1]: Listening on systemd-factory-reset.socket -
Factory Reset Management.
[ 2.673501] systemd[1]: Listening on systemd-hostnamed.socket -
Hostname Service Socket.
[ 2.673785] systemd[1]: Listening on systemd-journald-audit.socket -
Journal Audit Socket.
[ 2.674269] systemd[1]: Listening on systemd-mute-console.socket -
Console Output Muting Service Socket.
[ 2.674462] systemd[1]: Listening on systemd-oomd.socket - Userspace
Out-Of-Memory (OOM) Killer Socket.
[ 2.674508] systemd[1]: systemd-pcrextend.socket - TPM PCR
Measurements skipped, unmet condition check ConditionSecurity=measured-os
[ 2.674520] systemd[1]: systemd-pcrlock.socket - Make TPM PCR Policy
skipped, unmet condition check ConditionSecurity=measured-uki
[ 2.674976] systemd[1]: Listening on systemd-repart.socket - Disk
Repartitioning Service Socket.
[ 2.675154] systemd[1]: Listening on systemd-resolved-monitor.socket
- Resolve Monitor Varlink Socket.
[ 2.675242] systemd[1]: Listening on systemd-resolved-varlink.socket
- Resolve Service Varlink Socket.
[ 2.675840] systemd[1]: Listening on systemd-storage-block.socket -
Simple Block Device Backed Storage Provider.
[ 2.676328] systemd[1]: Listening on systemd-storage-fs.socket -
Simple File System Backed Storage Provider.
[ 2.676775] systemd[1]: Listening on systemd-sysinstall.socket -
System Install Tool.
[ 2.677411] systemd[1]: Listening on systemd-sysupdate.socket -
System Updates.
[ 2.677987] systemd[1]: Listening on systemd-udevd-varlink.socket -
udev Varlink Socket.
[ 2.678207] systemd[1]: Listening on systemd-userdbd.socket - User
Database Manager Socket.
[ 2.679054] systemd[1]: Mounting dev-hugepages.mount - Huge Pages
File System...
[ 2.679549] systemd[1]: Mounting dev-mqueue.mount - POSIX Message
Queue File System...
[ 2.680079] systemd[1]: Mounting sys-kernel-debug.mount - Kernel
Debug File System...
[ 2.680520] systemd[1]: Mounting sys-kernel-tracing.mount - Kernel
Trace File System...
[ 2.680597] systemd[1]: auth-rpcgss-module.service - Kernel Module
supporting RPCSEC_GSS skipped, unmet condition check
ConditionPathExists=/etc/krb5.keytab
[ 2.680653] systemd[1]: fips-crypto-policy-overlay.service -
Bind-mount FIPS crypto-policy in FIPS mode skipped, unmet condition
check ConditionKernelCommandLine=fips=1
[ 2.681593] systemd[1]: Starting kmod-static-nodes.service - Create
List of Static Device Nodes...
[ 2.681631] systemd[1]: modprobe@configfs.service - Load Kernel
Module configfs skipped, unmet condition check
ConditionKernelModuleLoaded=!configfs
[ 2.681658] systemd[1]: modprobe@drm.service - Load Kernel Module drm
skipped, unmet condition check ConditionKernelModuleLoaded=!drm
[ 2.681675] systemd[1]: modprobe@fuse.service - Load Kernel Module
fuse skipped, unmet condition check ConditionKernelModuleLoaded=!fuse
[ 2.682184] systemd[1]: Mounting sys-fs-fuse-connections.mount - FUSE
Control File System...
[ 2.682218] systemd[1]: plymouth-switch-root.service: Deactivated
successfully.
[ 2.682237] systemd[1]: Stopped plymouth-switch-root.service -
Plymouth switch root service.
[ 2.682395] systemd[1]: systemd-boot-clear-sysfail.service - Clear
SysFail Entry If The Boot Is Successful skipped, unmet condition check
ConditionPathExists=/sys/firmware/efi/efivars/LoaderEntrySysFail-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
[ 2.682425] systemd[1]: systemd-fsck-root.service: Deactivated
successfully.
[ 2.682443] systemd[1]: Stopped systemd-fsck-root.service - File
System Check on Root Device.
[ 2.682497] systemd[1]: systemd-hibernate-clear.service - Clear Stale
Hibernate Storage Info skipped, unmet condition check
ConditionPathExists=/sys/firmware/efi/efivars/HibernateLocation-8cf2644b-4b0b-428f-9387-6d876050dc67
[ 2.684097] systemd[1]: Starting systemd-journald.service - Journal
Service...
[ 2.685366] systemd[1]: Starting systemd-modules-load.service - Load
Kernel Modules...
[ 2.686176] systemd[1]: Starting systemd-network-generator.service -
Generate Network Units from Kernel Command Line...
[ 2.686224] systemd[1]: systemd-pcrmachine.service - TPM PCR Machine
ID Measurement skipped, unmet condition check ConditionSecurity=measured-os
[ 2.686260] systemd[1]: systemd-pcrosseparator.service - TPM PCR OS
Separator skipped, unmet condition check ConditionSecurity=measured-os
[ 2.687023] systemd[1]: Starting systemd-remount-fs.service - Remount
Root and Kernel File Systems...
[ 2.687078] systemd[1]: systemd-tpm2-setup-early.service - Early TPM
SRK Setup skipped, unmet condition check ConditionSecurity=measured-os
[ 2.687098] systemd[1]: systemd-pcrnvdone.service - TPM PCR NvPCR
Initialization Separator skipped, unmet condition check
ConditionPathExists=/etc/initrd-release
[ 2.687110] systemd[1]: Reached target cryptsetup.target - Local
Encrypted Volumes.
[ 2.687131] systemd[1]: systemd-pcrproduct.service - TPM NvPCR
Product ID Measurement skipped, unmet condition check
ConditionSecurity=measured-os
[ 2.687709] systemd[1]: Starting
systemd-udev-load-credentials.service - Load udev Rules from Credentials...
[ 2.688300] systemd[1]: Starting systemd-udev-trigger.service -
Coldplug All udev Devices...
[ 2.691198] systemd[1]: Mounted dev-hugepages.mount - Huge Pages File
System.
[ 2.691307] systemd[1]: Mounted dev-mqueue.mount - POSIX Message
Queue File System.
[ 2.691376] systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug
File System.
[ 2.691442] systemd[1]: Mounted sys-kernel-tracing.mount - Kernel
Trace File System.
[ 2.691675] systemd[1]: Finished kmod-static-nodes.service - Create
List of Static Device Nodes.
[ 2.691823] systemd[1]: Mounted sys-fs-fuse-connections.mount - FUSE
Control File System.
[ 2.692316] BTRFS info (device nvme0n1p3 state M): use zstd
compression, level 1
[ 2.692698] systemd[1]: Starting
systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in
/dev gracefully...
[ 2.693540] systemd[1]: Finished systemd-modules-load.service - Load
Kernel Modules.
[ 2.693842] systemd[1]: Finished systemd-network-generator.service -
Generate Network Units from Kernel Command Line.
[ 2.694254] systemd[1]: Finished systemd-remount-fs.service - Remount
Root and Kernel File Systems.
[ 2.694537] systemd[1]: systemd-hwdb-update.service - Rebuild
Hardware Database skipped, unmet condition check ConditionNeedsUpdate=/etc
[ 2.695224] systemd[1]: Starting systemd-random-seed.service -
Load/Save OS Random Seed...
[ 2.695840] systemd[1]: Starting systemd-sysctl.service - Apply
Kernel Variables...
[ 2.695861] systemd[1]: systemd-tpm2-setup.service - TPM SRK Setup
skipped, unmet condition check ConditionSecurity=measured-os
[ 2.696083] systemd[1]: Finished
systemd-udev-load-credentials.service - Load udev Rules from Credentials.
[ 2.719355] systemd-journald[517]: Collecting audit messages is enabled.
[ 2.722282] systemd[1]: Finished systemd-sysctl.service - Apply
Kernel Variables.
[ 2.722341] audit: type=1130 audit(1793833085.856:4): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=systemd-sysctl comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'
[ 2.722487] systemd[1]: Started systemd-journald.service - Journal
Service.
[ 2.722538] audit: type=1130 audit(1793833085.856:5): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=systemd-journald comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'
[ 2.724950] audit: type=1130 audit(1793833085.859:6): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=systemd-tmpfiles-setup-dev-early comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 2.733930] audit: type=1334 audit(1793833085.868:7): prog-id=48 op=LOAD
[ 2.735279] audit: type=1130 audit(1793833085.869:8): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=systemd-random-seed comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 2.735708] systemd-journald[517]: Received client request to flush
runtime journal.
[ 2.737808] audit: type=1334 audit(1793833085.872:9): prog-id=49 op=LOAD
[ 2.737878] audit: type=1334 audit(1793833085.872:10): prog-id=50 op=LOAD
[ 2.826331] zram0: detected capacity change from 0 to 16777216
[ 2.831998] igc 0000:03:00.0 enp3s0: renamed from eth0
[ 2.903074] Adding 8388604k swap on /dev/zram0. Priority:100
extents:1 across:8388604k SSDsc
[ 2.920926] mei_me 0000:00:16.0: enabling device (0000 -> 0002)
[ 2.960172] mei_pxp
0000:00:16.0-fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1: bound 0000:00:02.0
(ops 0xffffffffc064ca10)
[ 2.960534] mei_hdcp
0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0
(ops 0xffffffffc062d750)
[ 2.974907] Bluetooth: Core ver 2.22
[ 2.974925] NET: Registered PF_BLUETOOTH protocol family
[ 2.974926] Bluetooth: HCI device and connection manager initialized
[ 2.974934] Bluetooth: HCI socket layer initialized
[ 2.974935] Bluetooth: L2CAP socket layer initialized
[ 2.974938] Bluetooth: SCO socket layer initialized
[ 2.994783] cfg80211: Loading compiled-in X.509 certificates for
regulatory database
[ 2.995084] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 2.995185] Loaded X.509 cert 'wens:
61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 3.030014] usbcore: registered new interface driver btusb
[ 3.031267] Bluetooth: hci0: Bootloader revision 0.4 build 0 week 30 2018
[ 3.032260] Bluetooth: hci0: Device revision is 2
[ 3.032271] Bluetooth: hci0: Secure boot is enabled
[ 3.032286] Bluetooth: hci0: OTP lock is enabled
[ 3.032288] Bluetooth: hci0: API lock is enabled
[ 3.032289] Bluetooth: hci0: Debug lock is disabled
[ 3.032290] Bluetooth: hci0: Minimum firmware build 1 week 10 2014
[ 3.045227] iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
[ 3.047230] iwlwifi 0000:00:14.3: Detected crf-id 0x3617, cnv-id
0x20000302 wfpm id 0x80000000
[ 3.047251] iwlwifi 0000:00:14.3: PCI dev 43f0/0074, rev=0x351,
rfid=0x10a100
[ 3.047253] iwlwifi 0000:00:14.3: Detected Intel(R) Wi-Fi 6 AX201 160MHz
[ 3.061823] Bluetooth: hci0: Found device firmware: intel/ibt-19-0-4.sfi
[ 3.061870] Bluetooth: hci0: Boot Address: 0x24800
[ 3.061871] Bluetooth: hci0: Firmware Version: 83-7.26
[ 3.076665] iwlwifi 0000:00:14.3: loaded firmware version
77.563a6e92.0 QuZ-a0-hr-b0-77.ucode op_mode iwlmvm
[ 3.404799] iwlwifi 0000:00:14.3: Detected RF HR B3, rfid=0x10a100
[ 3.471782] iwlwifi 0000:00:14.3: base HW address: XX:XX:XX:XX:XX:XX
[ 3.489427] iwlwifi 0000:00:14.3 wlo1: renamed from wlan0
[ 3.697931] EXT4-fs (nvme0n1p1): mounted filesystem
385484bb-0f27-4dae-8577-7d1866d9e9bc r/w with ordered data mode. Quota
mode: none.
[ 3.718751] BTRFS: device label DEVEL devid 1 transid 25373 /dev/sda6
(8:6) scanned by mount (715)
[ 3.719010] BTRFS info (device sda6): first mount of filesystem
80ce69a9-95d2-4182-a493-b0a5c7618748
[ 3.719013] BTRFS info (device sda6): using crc32c checksum algorithm
[ 3.724464] BTRFS info (device sda6): enabling ssd optimizations
[ 3.724466] BTRFS info (device sda6): turning on async discard
[ 3.724467] BTRFS info (device sda6): enabling free space tree
[ 3.724468] BTRFS info (device sda6): use zstd compression, level 1
[ 3.872782] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 3.872788] Bluetooth: BNEP filters: protocol multicast
[ 3.872792] Bluetooth: BNEP socket layer initialized
[ 4.935455] Bluetooth: hci0: Waiting for firmware download to complete
[ 4.936254] Bluetooth: hci0: Firmware loaded in 1830483 usecs
[ 4.936329] Bluetooth: hci0: Waiting for device to boot
[ 4.951290] Bluetooth: hci0: Device booted in 14662 usecs
[ 4.951966] Bluetooth: hci0: Found Intel DDC parameters:
intel/ibt-19-0-4.ddc
[ 4.954333] Bluetooth: hci0: Applying Intel DDC parameters completed
[ 4.955326] Bluetooth: hci0: Firmware revision 0.4 build 83 week 7 2026
[ 4.957339] Bluetooth: hci0: HCI LE Coded PHY feature bit is set, but
its usage is not supported.
[ 5.040748] Bluetooth: MGMT ver 1.23
[ 5.050932] Bluetooth: RFCOMM TTY layer initialized
[ 5.050941] Bluetooth: RFCOMM socket layer initialized
[ 5.050946] Bluetooth: RFCOMM ver 1.11
[ 5.227715] rfkill: input handler disabled
[ 7.069795] igc 0000:03:00.0 enp3s0: NIC Link is Up 2500 Mbps Full
Duplex, Flow Control: RX
[ 83.797498] rfkill: input handler enabled
[ 84.670254] rfkill: input handler disabled
=====================================================
searching the web I also found the bug, *one* was with VMware though:
https://bugzilla.kernel.org/show_bug.cgi?id=217096
======================================================
could I've done something wrong setting up my git tree here, while
trying to get is small ?
a)
git clone --depth 1 -b linux-7.3.y -o remote_stable
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
b)
cd ./linux
c)
git remote add -t linux-7.3.y remote_stable-rc
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
d)
git fetch --shallow-since=2026-10-17 --all --multiple --progress -v
e)
and subsequent: git remote -v update when you provide new stable/stable-RC's
regards
Ronald
[-- Attachment #2: config --]
[-- Type: text/plain, Size: 167303 bytes --]
#
# Automatically generated file; DO NOT EDIT.
# Linux/x86 7.3.2-rc1 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20261029 (Red Hat 16.2.1-3)"
CONFIG_CC_IS_GCC=y
CONFIG_GCC_VERSION=160201
CONFIG_CLANG_VERSION=0
CONFIG_AS_IS_GNU=y
CONFIG_AS_VERSION=20285426
CONFIG_LD_IS_BFD=y
CONFIG_LD_VERSION=20285426
CONFIG_LLD_VERSION=0
CONFIG_RUSTC_VERSION=0
CONFIG_RUSTC_LLVM_VERSION=0
CONFIG_RUSTC_LLVM_MAJOR_VERSION=0
CONFIG_CC_CAN_LINK=y
CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
CONFIG_TOOLS_SUPPORT_RELR=y
CONFIG_CC_HAS_ASM_INLINE=y
CONFIG_CC_HAS_ASSUME=y
CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
CONFIG_CC_HAS_COUNTED_BY=y
CONFIG_CC_HAS_COUNTED_BY_PTR=y
CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
CONFIG_CC_OPT_INLINE_MEMSET="-finline-stringops=memset"
CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
CONFIG_PAHOLE_VERSION=132
CONFIG_IRQ_WORK=y
CONFIG_BUILDTIME_TABLE_SORT=y
CONFIG_THREAD_INFO_IN_TASK=y
#
# General setup
#
CONFIG_INIT_ENV_ARG_LIMIT=32
# CONFIG_COMPILE_TEST is not set
CONFIG_WERROR=y
# CONFIG_UAPI_HEADER_TEST is not set
CONFIG_LOCALVERSION="_MY"
CONFIG_LOCALVERSION_AUTO=y
CONFIG_BUILD_SALT=""
CONFIG_HAVE_KERNEL_GZIP=y
CONFIG_HAVE_KERNEL_BZIP2=y
CONFIG_HAVE_KERNEL_LZMA=y
CONFIG_HAVE_KERNEL_XZ=y
CONFIG_HAVE_KERNEL_LZO=y
CONFIG_HAVE_KERNEL_LZ4=y
CONFIG_HAVE_KERNEL_ZSTD=y
# CONFIG_KERNEL_GZIP is not set
# CONFIG_KERNEL_BZIP2 is not set
# CONFIG_KERNEL_LZMA is not set
# CONFIG_KERNEL_XZ is not set
# CONFIG_KERNEL_LZO is not set
# CONFIG_KERNEL_LZ4 is not set
CONFIG_KERNEL_ZSTD=y
CONFIG_DEFAULT_INIT=""
CONFIG_DEFAULT_HOSTNAME="(none)"
CONFIG_SYSVIPC=y
CONFIG_SYSVIPC_SYSCTL=y
CONFIG_SYSVIPC_COMPAT=y
CONFIG_POSIX_MQUEUE=y
CONFIG_POSIX_MQUEUE_SYSCTL=y
CONFIG_WATCH_QUEUE=y
CONFIG_CROSS_MEMORY_ATTACH=y
CONFIG_AUDIT=y
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
CONFIG_AUDITSYSCALL=y
#
# IRQ subsystem
#
CONFIG_GENERIC_IRQ_PROBE=y
CONFIG_GENERIC_IRQ_SHOW=y
CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
CONFIG_GENERIC_PENDING_IRQ=y
CONFIG_GENERIC_IRQ_MIGRATION=y
CONFIG_GENERIC_IRQ_INJECTION=y
CONFIG_HARDIRQS_SW_RESEND=y
CONFIG_IRQ_DOMAIN=y
CONFIG_IRQ_DOMAIN_HIERARCHY=y
CONFIG_GENERIC_MSI_IRQ=y
CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y
CONFIG_GENERIC_IRQ_RESERVATION_MODE=y
CONFIG_GENERIC_IRQ_STAT_SNAPSHOT=y
CONFIG_IRQ_FORCED_THREADING=y
CONFIG_SPARSE_IRQ=y
# CONFIG_GENERIC_IRQ_DEBUGFS is not set
# end of IRQ subsystem
CONFIG_CLOCKSOURCE_WATCHDOG=y
CONFIG_ARCH_CLOCKSOURCE_INIT=y
CONFIG_ARCH_WANTS_CLOCKSOURCE_READ_INLINE=y
CONFIG_GENERIC_CLOCKEVENTS=y
CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y
CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
CONFIG_GENERIC_CLOCKEVENTS_COUPLED=y
CONFIG_GENERIC_CLOCKEVENTS_COUPLED_INLINE=y
CONFIG_GENERIC_CMOS_UPDATE=y
CONFIG_HRTIMER_REARM_DEFERRED=y
CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y
CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
CONFIG_CONTEXT_TRACKING=y
CONFIG_CONTEXT_TRACKING_IDLE=y
#
# Timers subsystem
#
CONFIG_TICK_ONESHOT=y
CONFIG_NO_HZ_COMMON=y
# CONFIG_HZ_PERIODIC is not set
# CONFIG_NO_HZ_IDLE is not set
CONFIG_NO_HZ_FULL=y
CONFIG_CONTEXT_TRACKING_USER=y
# CONFIG_CONTEXT_TRACKING_USER_FORCE is not set
# CONFIG_NO_HZ is not set
CONFIG_HIGH_RES_TIMERS=y
# CONFIG_POSIX_AUX_CLOCKS is not set
# end of Timers subsystem
CONFIG_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y
#
# BPF subsystem
#
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_JIT_DEFAULT_ON=y
CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
CONFIG_BPF_PRELOAD=y
CONFIG_BPF_PRELOAD_UMD=m
CONFIG_BPF_LSM=y
# end of BPF subsystem
CONFIG_PREEMPT_BUILD=y
CONFIG_ARCH_HAS_PREEMPT_LAZY=y
# CONFIG_PREEMPT is not set
CONFIG_PREEMPT_LAZY=y
# CONFIG_PREEMPT_RT is not set
CONFIG_PREEMPT_COUNT=y
CONFIG_HAS_SEPARATE_PREEMPT_RESCHED_BITS=y
CONFIG_PREEMPTION=y
CONFIG_PREEMPT_DYNAMIC=y
CONFIG_SCHED_CORE=y
CONFIG_SCHED_CLASS_EXT=y
#
# CPU/Task time and stats accounting
#
CONFIG_VIRT_CPU_ACCOUNTING=y
CONFIG_VIRT_CPU_ACCOUNTING_GEN=y
CONFIG_IRQ_TIME_ACCOUNTING=y
CONFIG_HAVE_SCHED_AVG_IRQ=y
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_XACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
CONFIG_PSI=y
# CONFIG_PSI_DEFAULT_DISABLED is not set
# end of CPU/Task time and stats accounting
CONFIG_CPU_ISOLATION=y
#
# RCU Subsystem
#
CONFIG_TREE_RCU=y
CONFIG_PREEMPT_RCU=y
# CONFIG_RCU_EXPERT is not set
CONFIG_TREE_SRCU=y
CONFIG_TASKS_RCU_GENERIC=y
CONFIG_NEED_TASKS_RCU=y
CONFIG_TASKS_RCU=y
CONFIG_TASKS_RUDE_RCU=y
CONFIG_TASKS_TRACE_RCU=y
CONFIG_RCU_STALL_COMMON=y
CONFIG_RCU_NEED_SEGCBLIST=y
CONFIG_RCU_NOCB_CPU=y
# CONFIG_RCU_NOCB_CPU_DEFAULT_ALL is not set
# CONFIG_RCU_LAZY is not set
# end of RCU Subsystem
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
# CONFIG_IKHEADERS is not set
CONFIG_LOG_BUF_SHIFT=18
CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
CONFIG_PRINTK_INDEX=y
CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
#
# Scheduler features
#
CONFIG_UCLAMP_TASK=y
CONFIG_UCLAMP_BUCKETS_COUNT=5
# end of Scheduler features
CONFIG_ARCH_HAS_PTE_PROTNONE=y
CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y
CONFIG_CC_HAS_INT128=y
CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
CONFIG_CC_MS_EXTENSIONS="-fms-extensions"
CONFIG_GCC10_NO_ARRAY_BOUNDS=y
CONFIG_CC_NO_ARRAY_BOUNDS=y
CONFIG_GCC_NO_STRINGOP_OVERFLOW=y
CONFIG_CC_NO_STRINGOP_OVERFLOW=y
CONFIG_ARCH_SUPPORTS_INT128=y
CONFIG_NUMA_BALANCING=y
CONFIG_SCHED_CACHE=y
CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y
CONFIG_SLAB_OBJ_EXT=y
CONFIG_CGROUPS=y
CONFIG_PAGE_COUNTER=y
# CONFIG_CGROUP_FAVOR_DYNMODS is not set
CONFIG_MEMCG=y
CONFIG_MEMCG_V1=y
CONFIG_BLK_CGROUP=y
CONFIG_CGROUP_WRITEBACK=y
CONFIG_CGROUP_SCHED=y
CONFIG_GROUP_SCHED_WEIGHT=y
CONFIG_GROUP_SCHED_BANDWIDTH=y
CONFIG_FAIR_GROUP_SCHED=y
CONFIG_CFS_BANDWIDTH=y
# CONFIG_RT_GROUP_SCHED is not set
CONFIG_EXT_GROUP_SCHED=y
CONFIG_EXT_SUB_SCHED=y
CONFIG_SCHED_MM_CID=y
CONFIG_UCLAMP_TASK_GROUP=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_RDMA=y
CONFIG_CGROUP_DMEM=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_HUGETLB=y
CONFIG_CPUSETS=y
# CONFIG_CPUSETS_V1 is not set
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PERF=y
CONFIG_CGROUP_BPF=y
CONFIG_CGROUP_MISC=y
# CONFIG_CGROUP_DEBUG is not set
CONFIG_SOCK_CGROUP_DATA=y
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_TIME_NS=y
CONFIG_TIME_NS_VDSO=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y
CONFIG_CHECKPOINT_RESTORE=y
CONFIG_SCHED_AUTOGROUP=y
CONFIG_RELAY=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE=""
CONFIG_RD_GZIP=y
CONFIG_RD_BZIP2=y
CONFIG_RD_LZMA=y
CONFIG_RD_XZ=y
CONFIG_RD_LZO=y
CONFIG_RD_LZ4=y
CONFIG_RD_ZSTD=y
CONFIG_BOOT_CONFIG=y
# CONFIG_BOOT_CONFIG_FORCE is not set
# CONFIG_BOOT_CONFIG_EMBED is not set
CONFIG_ARCH_SUPPORTS_CMDLINE_FROM_BOOTCONFIG=y
CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=1021
# CONFIG_INITRAMFS_PRESERVE_MTIME is not set
CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_LD_ORPHAN_WARN=y
CONFIG_LD_ORPHAN_WARN_LEVEL="error"
CONFIG_HAVE_UID16=y
CONFIG_SYSCTL_EXCEPTION_TRACE=y
# CONFIG_SYSFS_SYSCALL is not set
CONFIG_HAVE_PCSPKR_PLATFORM=y
CONFIG_EXPERT=y
CONFIG_UID16=y
CONFIG_MULTIUSER=y
CONFIG_SGETMASK_SYSCALL=y
CONFIG_FHANDLE=y
CONFIG_POSIX_TIMERS=y
CONFIG_PRINTK=y
CONFIG_BUG=y
CONFIG_ELF_CORE=y
CONFIG_PCSPKR_PLATFORM=y
# CONFIG_BASE_SMALL is not set
CONFIG_FUTEX=y
CONFIG_FUTEX_PI=y
CONFIG_FUTEX_PRIVATE_HASH=y
CONFIG_FUTEX_MPOL=y
CONFIG_HAVE_FUTEX_ROBUST_UNLOCK=y
CONFIG_FUTEX_ROBUST_UNLOCK=y
CONFIG_EPOLL=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EVENTFD=y
CONFIG_SHMEM=y
CONFIG_AIO=y
CONFIG_IO_URING=y
# CONFIG_IO_URING_MOCK_FILE is not set
CONFIG_ADVISE_SYSCALLS=y
CONFIG_MEMBARRIER=y
CONFIG_KCMP=y
CONFIG_RSEQ=y
# CONFIG_RSEQ_SLICE_EXTENSION is not set
# CONFIG_RSEQ_STATS is not set
# CONFIG_RSEQ_DEBUG_DEFAULT_ENABLE is not set
CONFIG_CACHESTAT_SYSCALL=y
CONFIG_KALLSYMS=y
# CONFIG_KALLSYMS_SELFTEST is not set
# CONFIG_KALLSYMS_ALL is not set
CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS=y
CONFIG_HAVE_PERF_EVENTS=y
CONFIG_GUEST_PERF_EVENTS=y
CONFIG_PERF_GUEST_MEDIATED_PMU=y
#
# Kernel Performance Events And Counters
#
CONFIG_PERF_EVENTS=y
# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
# end of Kernel Performance Events And Counters
CONFIG_SYSTEM_DATA_VERIFICATION=y
# CONFIG_PROFILING is not set
CONFIG_TRACEPOINTS=y
#
# Kexec and crash features
#
CONFIG_CRASH_RESERVE=y
CONFIG_VMCORE_INFO=y
CONFIG_KEXEC_CORE=y
CONFIG_HAVE_IMA_KEXEC=y
CONFIG_KEXEC=y
CONFIG_KEXEC_FILE=y
CONFIG_KEXEC_SIG=y
# CONFIG_KEXEC_SIG_FORCE is not set
CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y
CONFIG_KEXEC_JUMP=y
CONFIG_CRASH_DUMP=y
CONFIG_CRASH_HOTPLUG=y
CONFIG_CRASH_MAX_MEMORY_RANGES=8192
# end of Kexec and crash features
#
# Live Update and Kexec HandOver
#
CONFIG_KEXEC_HANDOVER=y
# CONFIG_KEXEC_HANDOVER_DEBUG is not set
CONFIG_KEXEC_HANDOVER_DEBUGFS=y
# CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT is not set
# CONFIG_LIVEUPDATE is not set
# end of Live Update and Kexec HandOver
# end of General setup
CONFIG_64BIT=y
CONFIG_X86_64=y
CONFIG_X86=y
CONFIG_INSTRUCTION_DECODER=y
CONFIG_OUTPUT_FORMAT="elf64-x86-64"
CONFIG_LOCKDEP_SUPPORT=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_MMU=y
CONFIG_ARCH_MMAP_RND_BITS_MIN=28
CONFIG_ARCH_MMAP_RND_BITS_MAX=32
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
CONFIG_GENERIC_ISA_DMA=y
CONFIG_GENERIC_BUG=y
CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
CONFIG_ARCH_MAY_HAVE_PC_FDC=y
CONFIG_GENERIC_CALIBRATE_DELAY=y
CONFIG_ARCH_HAS_CPU_RELAX=y
CONFIG_ARCH_HIBERNATION_POSSIBLE=y
CONFIG_ARCH_SUSPEND_POSSIBLE=y
CONFIG_AUDIT_ARCH=y
CONFIG_HAVE_INTEL_TXT=y
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_FIX_EARLYCON_MEM=y
CONFIG_PGTABLE_LEVELS=5
#
# Processor type and features
#
CONFIG_SMP=y
CONFIG_X86_X2APIC=y
CONFIG_X86_POSTED_MSI=y
CONFIG_X86_MPPARSE=y
CONFIG_X86_CPU_RESCTRL=y
CONFIG_X86_FRED=y
# CONFIG_X86_EXTENDED_PLATFORM is not set
CONFIG_X86_INTEL_LPSS=y
# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
CONFIG_IOSF_MBI=y
# CONFIG_IOSF_MBI_DEBUG is not set
CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y
CONFIG_SCHED_OMIT_FRAME_POINTER=y
# CONFIG_HYPERVISOR_GUEST is not set
CONFIG_CC_HAS_MARCH_NATIVE=y
CONFIG_X86_NATIVE_CPU=y
CONFIG_X86_INTERNODE_CACHE_SHIFT=6
CONFIG_X86_L1_CACHE_SHIFT=6
CONFIG_X86_TSC=y
CONFIG_X86_HAVE_PAE=y
CONFIG_X86_CX8=y
CONFIG_X86_CMOV=y
CONFIG_X86_MINIMUM_CPU_FAMILY=64
CONFIG_X86_DEBUGCTLMSR=y
CONFIG_IA32_FEAT_CTL=y
CONFIG_X86_VMX_FEATURE_NAMES=y
CONFIG_PROCESSOR_SELECT=y
CONFIG_CPU_SUP_INTEL=y
# CONFIG_CPU_SUP_AMD is not set
# CONFIG_CPU_SUP_HYGON is not set
# CONFIG_CPU_SUP_CENTAUR is not set
# CONFIG_CPU_SUP_ZHAOXIN is not set
CONFIG_HPET_TIMER=y
CONFIG_HPET_EMULATE_RTC=y
CONFIG_DMI=y
CONFIG_BOOT_VESA_SUPPORT=y
CONFIG_MAXSMP=y
CONFIG_NR_CPUS_RANGE_BEGIN=8192
CONFIG_NR_CPUS_RANGE_END=8192
CONFIG_NR_CPUS_DEFAULT=8192
CONFIG_NR_CPUS=8192
CONFIG_SCHED_MC_PRIO=y
CONFIG_X86_LOCAL_APIC=y
CONFIG_ACPI_MADT_WAKEUP=y
CONFIG_X86_IO_APIC=y
CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
CONFIG_X86_MCE=y
CONFIG_X86_MCELOG_LEGACY=y
CONFIG_X86_MCE_INTEL=y
# CONFIG_X86_MCE_AMD is not set
CONFIG_X86_MCE_THRESHOLD=y
# CONFIG_X86_MCE_INJECT is not set
#
# Performance monitoring
#
CONFIG_PERF_EVENTS_INTEL_UNCORE=y
CONFIG_PERF_EVENTS_INTEL_RAPL=y
CONFIG_PERF_EVENTS_INTEL_CSTATE=y
# end of Performance monitoring
CONFIG_X86_16BIT=y
CONFIG_X86_ESPFIX64=y
CONFIG_X86_VSYSCALL_EMULATION=y
CONFIG_X86_IOPL_IOPERM=y
CONFIG_MICROCODE=y
# CONFIG_MICROCODE_LATE_LOADING is not set
# CONFIG_MICROCODE_DBG is not set
CONFIG_X86_MSR=y
CONFIG_X86_CPUID=y
CONFIG_X86_DIRECT_GBPAGES=y
CONFIG_X86_CPA_STATISTICS=y
CONFIG_NUMA=y
# CONFIG_AMD_NUMA is not set
CONFIG_X86_64_ACPI_NUMA=y
CONFIG_NODES_SHIFT=10
CONFIG_ARCH_SPARSEMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_DEFAULT=y
CONFIG_ARCH_PROC_KCORE_TEXT=y
CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
CONFIG_X86_PMEM_LEGACY_DEVICE=y
CONFIG_X86_PMEM_LEGACY=y
CONFIG_X86_CHECK_BIOS_CORRUPTION=y
# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set
CONFIG_MTRR=y
CONFIG_MTRR_SANITIZER=y
CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1
CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
CONFIG_X86_PAT=y
CONFIG_X86_UMIP=y
CONFIG_CC_HAS_IBT=y
CONFIG_X86_CET=y
CONFIG_X86_KERNEL_IBT=y
CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
CONFIG_ARCH_PKEY_BITS=4
# CONFIG_X86_INTEL_TSX_MODE_OFF is not set
# CONFIG_X86_INTEL_TSX_MODE_ON is not set
CONFIG_X86_INTEL_TSX_MODE_AUTO=y
CONFIG_X86_SGX=y
CONFIG_X86_USER_SHADOW_STACK=y
# CONFIG_INTEL_TDX_HOST is not set
CONFIG_EFI=y
CONFIG_EFI_STUB=y
CONFIG_EFI_HANDOVER_PROTOCOL=y
CONFIG_EFI_MIXED=y
CONFIG_EFI_RUNTIME_MAP=y
# CONFIG_HZ_100 is not set
# CONFIG_HZ_250 is not set
# CONFIG_HZ_300 is not set
CONFIG_HZ_1000=y
CONFIG_HZ=1000
CONFIG_SCHED_HRTICK=y
CONFIG_ARCH_SUPPORTS_KEXEC=y
CONFIG_ARCH_SUPPORTS_KEXEC_FILE=y
CONFIG_ARCH_SELECTS_KEXEC_FILE=y
CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY=y
CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y
CONFIG_ARCH_SUPPORTS_KEXEC_SIG_FORCE=y
CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y
CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y
CONFIG_ARCH_SUPPORTS_KEXEC_HANDOVER=y
CONFIG_ARCH_SUPPORTS_CRASH_DUMP=y
CONFIG_ARCH_DEFAULT_CRASH_DUMP=y
CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG=y
CONFIG_ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION=y
CONFIG_PHYSICAL_START=0x1000000
CONFIG_RELOCATABLE=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_X86_NEED_RELOCS=y
CONFIG_PHYSICAL_ALIGN=0x200000
CONFIG_RANDOMIZE_MEMORY=y
CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa
CONFIG_HOTPLUG_CPU=y
# CONFIG_COMPAT_VDSO is not set
CONFIG_LEGACY_VSYSCALL_XONLY=y
# CONFIG_LEGACY_VSYSCALL_NONE is not set
# CONFIG_CMDLINE_BOOL is not set
CONFIG_MODIFY_LDT_SYSCALL=y
# CONFIG_STRICT_SIGALTSTACK_SIZE is not set
CONFIG_HAVE_LIVEPATCH=y
CONFIG_HAVE_KLP_BUILD=y
CONFIG_X86_BUS_LOCK_DETECT=y
# end of Processor type and features
CONFIG_CC_HAS_NAMED_AS=y
CONFIG_CC_HAS_NAMED_AS_FIXED_SANITIZERS=y
CONFIG_USE_X86_SEG_SUPPORT=y
CONFIG_CC_HAS_SLS=y
CONFIG_CC_HAS_RETURN_THUNK=y
CONFIG_CC_HAS_ENTRY_PADDING=y
CONFIG_FUNCTION_PADDING_CFI=11
CONFIG_FUNCTION_PADDING_BYTES=16
CONFIG_CALL_PADDING=y
CONFIG_HAVE_CALL_THUNKS=y
CONFIG_CALL_THUNKS=y
CONFIG_CPU_MITIGATIONS=y
CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y
CONFIG_MITIGATION_RETPOLINE=y
CONFIG_MITIGATION_RETHUNK=y
CONFIG_MITIGATION_CALL_DEPTH_TRACKING=y
# CONFIG_CALL_THUNKS_DEBUG is not set
CONFIG_MITIGATION_IBRS_ENTRY=y
CONFIG_MITIGATION_SLS=y
CONFIG_MITIGATION_GDS=y
CONFIG_MITIGATION_RFDS=y
CONFIG_MITIGATION_SPECTRE_BHI=y
CONFIG_MITIGATION_MDS=y
CONFIG_MITIGATION_TAA=y
CONFIG_MITIGATION_MMIO_STALE_DATA=y
CONFIG_MITIGATION_L1TF=y
CONFIG_MITIGATION_RETBLEED=y
CONFIG_MITIGATION_SPECTRE_V1=y
CONFIG_MITIGATION_SPECTRE_V2=y
CONFIG_MITIGATION_SRBDS=y
CONFIG_MITIGATION_SSB=y
CONFIG_MITIGATION_ITS=y
CONFIG_MITIGATION_VMSCAPE=y
CONFIG_ARCH_HAS_ADD_PAGES=y
#
# Power management and ACPI options
#
CONFIG_ARCH_HIBERNATION_HEADER=y
CONFIG_SUSPEND=y
CONFIG_SUSPEND_FREEZER=y
# CONFIG_SUSPEND_SKIP_SYNC is not set
CONFIG_HIBERNATE_CALLBACKS=y
CONFIG_HIBERNATION=y
CONFIG_HIBERNATION_SNAPSHOT_DEV=y
CONFIG_HIBERNATION_COMP_LZO=y
# CONFIG_HIBERNATION_COMP_LZ4 is not set
CONFIG_HIBERNATION_DEF_COMP="lzo"
CONFIG_PM_STD_PARTITION=""
CONFIG_PM_SLEEP=y
CONFIG_PM_SLEEP_SMP=y
# CONFIG_PM_AUTOSLEEP is not set
# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
# CONFIG_PM_WAKELOCKS is not set
# CONFIG_PM_QOS_CPU_SYSTEM_WAKEUP is not set
CONFIG_PM=y
CONFIG_PM_DEBUG=y
# CONFIG_PM_ADVANCED_DEBUG is not set
# CONFIG_PM_TEST_SUSPEND is not set
CONFIG_PM_SLEEP_DEBUG=y
# CONFIG_DPM_WATCHDOG is not set
# CONFIG_PM_TRACE_RTC is not set
CONFIG_PM_CLK=y
# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
CONFIG_ENERGY_MODEL=y
CONFIG_ARCH_SUPPORTS_ACPI=y
CONFIG_ACPI=y
CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
CONFIG_ACPI_THERMAL_LIB=y
# CONFIG_ACPI_DEBUGGER is not set
CONFIG_ACPI_SPCR_TABLE=y
CONFIG_ACPI_FPDT=y
CONFIG_ACPI_LPIT=y
CONFIG_ACPI_SLEEP=y
CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
CONFIG_ACPI_EC=y
# CONFIG_ACPI_EC_DEBUGFS is not set
CONFIG_ACPI_AC=y
CONFIG_ACPI_BATTERY=y
CONFIG_ACPI_BUTTON=y
CONFIG_ACPI_VIDEO=m
CONFIG_ACPI_FAN=y
CONFIG_ACPI_TAD=y
# CONFIG_ACPI_DOCK is not set
CONFIG_ACPI_CPU_FREQ_PSS=y
CONFIG_ACPI_PROCESSOR_CSTATE=y
CONFIG_ACPI_PROCESSOR_IDLE=y
CONFIG_ACPI_CPPC_LIB=y
CONFIG_ACPI_PROCESSOR=y
CONFIG_ACPI_HOTPLUG_CPU=y
CONFIG_ACPI_PROCESSOR_AGGREGATOR=y
CONFIG_ACPI_THERMAL=y
CONFIG_ACPI_PLATFORM_PROFILE=m
CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_DEBUG=y
CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_CONTAINER=y
CONFIG_ACPI_HOTPLUG_IOAPIC=y
CONFIG_ACPI_SBS=m
CONFIG_ACPI_HED=y
CONFIG_ACPI_BGRT=y
# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
CONFIG_ACPI_NFIT=y
# CONFIG_NFIT_SECURITY_DEBUG is not set
CONFIG_ACPI_NUMA=y
CONFIG_ACPI_HMAT=y
CONFIG_HAVE_ACPI_APEI=y
CONFIG_HAVE_ACPI_APEI_NMI=y
CONFIG_ACPI_APEI=y
CONFIG_ACPI_APEI_GHES=y
# CONFIG_ACPI_APEI_PCIEAER is not set
CONFIG_ACPI_APEI_MEMORY_FAILURE=y
# CONFIG_ACPI_APEI_EINJ is not set
# CONFIG_ACPI_APEI_GHES_NVIDIA is not set
# CONFIG_ACPI_APEI_ERST_DEBUG is not set
CONFIG_ACPI_DPTF=y
CONFIG_DPTF_POWER=m
CONFIG_DPTF_PCH_FIVR=m
CONFIG_ACPI_EXTLOG=m
# CONFIG_ACPI_CONFIGFS is not set
# CONFIG_ACPI_PFRUT is not set
CONFIG_ACPI_PCC=y
CONFIG_ACPI_FFH=y
CONFIG_ACPI_MRRM=y
CONFIG_PMIC_OPREGION=y
CONFIG_ACPI_VIOT=y
CONFIG_ACPI_PRMT=y
CONFIG_X86_PM_TIMER=y
#
# CPU Frequency scaling
#
CONFIG_CPU_FREQ=y
CONFIG_CPU_FREQ_GOV_ATTR_SET=y
CONFIG_CPU_FREQ_GOV_COMMON=y
CONFIG_CPU_FREQ_STAT=y
# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
CONFIG_CPU_FREQ_GOV_POWERSAVE=y
CONFIG_CPU_FREQ_GOV_USERSPACE=y
CONFIG_CPU_FREQ_GOV_ONDEMAND=y
CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
#
# CPU frequency scaling drivers
#
CONFIG_X86_INTEL_PSTATE=y
# CONFIG_X86_PCC_CPUFREQ is not set
# CONFIG_X86_AMD_PSTATE is not set
# CONFIG_X86_ACPI_CPUFREQ is not set
# CONFIG_X86_SPEEDSTEP_CENTRINO is not set
# CONFIG_X86_P4_CLOCKMOD is not set
#
# shared options
#
CONFIG_CPUFREQ_ARCH_CUR_FREQ=y
# end of CPU Frequency scaling
#
# CPU Idle
#
CONFIG_CPU_IDLE=y
CONFIG_CPU_IDLE_GOV_LADDER=y
CONFIG_CPU_IDLE_GOV_MENU=y
# CONFIG_CPU_IDLE_GOV_TEO is not set
# end of CPU Idle
CONFIG_INTEL_IDLE=y
# end of Power management and ACPI options
#
# Bus options (PCI etc.)
#
CONFIG_PCI_DIRECT=y
CONFIG_PCI_MMCONFIG=y
CONFIG_MMCONF_FAM10H=y
# CONFIG_ISA_BUS is not set
CONFIG_ISA_DMA_API=y
# end of Bus options (PCI etc.)
#
# Binary Emulations
#
CONFIG_IA32_EMULATION=y
# CONFIG_IA32_EMULATION_DEFAULT_DISABLED is not set
# CONFIG_X86_X32_ABI is not set
CONFIG_COMPAT_32=y
CONFIG_COMPAT=y
CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
# end of Binary Emulations
CONFIG_KVM_COMMON=y
CONFIG_HAVE_KVM_PFNCACHE=y
CONFIG_HAVE_KVM_IRQCHIP=y
CONFIG_HAVE_KVM_IRQ_ROUTING=y
CONFIG_HAVE_KVM_DIRTY_RING=y
CONFIG_HAVE_KVM_DIRTY_RING_TSO=y
CONFIG_HAVE_KVM_DIRTY_RING_ACQ_REL=y
CONFIG_KVM_MMIO=y
CONFIG_KVM_ASYNC_PF=y
CONFIG_HAVE_KVM_MSI=y
CONFIG_HAVE_KVM_READONLY_MEM=y
CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y
CONFIG_KVM_VFIO=y
CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y
CONFIG_KVM_GENERIC_PRE_FAULT_MEMORY=y
CONFIG_KVM_COMPAT=y
CONFIG_HAVE_KVM_IRQ_BYPASS=m
CONFIG_HAVE_KVM_NO_POLL=y
CONFIG_VIRT_XFER_TO_GUEST_WORK=y
CONFIG_HAVE_KVM_PM_NOTIFIER=y
CONFIG_KVM_GENERIC_HARDWARE_ENABLING=y
CONFIG_KVM_ELIDE_TLB_FLUSH_IF_YOUNG=y
CONFIG_KVM_MMU_LOCKLESS_AGING=y
CONFIG_KVM_GUEST_MEMFD=y
CONFIG_VIRTUALIZATION=y
CONFIG_KVM_X86=m
CONFIG_KVM=m
CONFIG_KVM_WERROR=y
# CONFIG_KVM_SW_PROTECTED_VM is not set
CONFIG_KVM_INTEL=m
# CONFIG_KVM_INTEL_PROVE_VE is not set
CONFIG_X86_SGX_KVM=y
CONFIG_KVM_IOAPIC=y
CONFIG_KVM_SMM=y
CONFIG_KVM_HYPERV=y
# CONFIG_KVM_XEN is not set
# CONFIG_KVM_PROVE_MMU is not set
CONFIG_KVM_MAX_NR_VCPUS=4096
CONFIG_X86_REQUIRED_FEATURE_ALWAYS=y
CONFIG_X86_REQUIRED_FEATURE_NOPL=y
CONFIG_X86_REQUIRED_FEATURE_CX8=y
CONFIG_X86_REQUIRED_FEATURE_CMOV=y
CONFIG_X86_REQUIRED_FEATURE_CPUID=y
CONFIG_X86_REQUIRED_FEATURE_FPU=y
CONFIG_X86_REQUIRED_FEATURE_PAE=y
CONFIG_X86_REQUIRED_FEATURE_PSE=y
CONFIG_X86_REQUIRED_FEATURE_PGE=y
CONFIG_X86_REQUIRED_FEATURE_MSR=y
CONFIG_X86_REQUIRED_FEATURE_FXSR=y
CONFIG_X86_REQUIRED_FEATURE_XMM=y
CONFIG_X86_REQUIRED_FEATURE_XMM2=y
CONFIG_X86_REQUIRED_FEATURE_LM=y
CONFIG_X86_DISABLED_FEATURE_VME=y
CONFIG_X86_DISABLED_FEATURE_K6_MTRR=y
CONFIG_X86_DISABLED_FEATURE_CYRIX_ARR=y
CONFIG_X86_DISABLED_FEATURE_CENTAUR_MCR=y
CONFIG_X86_DISABLED_FEATURE_UNRET=y
CONFIG_X86_DISABLED_FEATURE_LAM=y
CONFIG_X86_DISABLED_FEATURE_XENPV=y
CONFIG_X86_DISABLED_FEATURE_TDX_GUEST=y
CONFIG_X86_DISABLED_FEATURE_SEV_SNP=y
CONFIG_X86_DISABLED_FEATURE_INVLPGB=y
CONFIG_AS_WRUSS=y
CONFIG_ARCH_CONFIGURES_CPU_MITIGATIONS=y
#
# General architecture-dependent options
#
CONFIG_HOTPLUG_SMT=y
CONFIG_ARCH_SUPPORTS_SCHED_SMT=y
CONFIG_ARCH_SUPPORTS_SCHED_CLUSTER=y
CONFIG_ARCH_SUPPORTS_SCHED_MC=y
CONFIG_SCHED_SMT=y
CONFIG_SCHED_CLUSTER=y
CONFIG_SCHED_MC=y
CONFIG_HOTPLUG_CORE_SYNC=y
CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
CONFIG_HOTPLUG_CORE_SYNC_FULL=y
CONFIG_HOTPLUG_SPLIT_STARTUP=y
CONFIG_HOTPLUG_PARALLEL=y
CONFIG_GENERIC_IRQ_ENTRY=y
CONFIG_GENERIC_SYSCALL=y
CONFIG_GENERIC_ENTRY=y
CONFIG_ARCH_SUPPORTS_SYSCALL_USER_DISPATCH=y
CONFIG_SYSCALL_USER_DISPATCH=y
CONFIG_KPROBES=y
CONFIG_JUMP_LABEL=y
# CONFIG_STATIC_KEYS_SELFTEST is not set
# CONFIG_STATIC_CALL_SELFTEST is not set
CONFIG_OPTPROBES=y
CONFIG_KPROBES_ON_FTRACE=y
CONFIG_UPROBES=y
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
CONFIG_ARCH_USE_BUILTIN_BSWAP=y
CONFIG_KRETPROBES=y
CONFIG_KRETPROBE_ON_RETHOOK=y
CONFIG_USER_RETURN_NOTIFIER=y
CONFIG_HAVE_IOREMAP_PROT=y
CONFIG_HAVE_KPROBES=y
CONFIG_HAVE_KRETPROBES=y
CONFIG_HAVE_OPTPROBES=y
CONFIG_HAVE_KPROBES_ON_FTRACE=y
CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y
CONFIG_HAVE_NMI=y
CONFIG_TRACE_IRQFLAGS_SUPPORT=y
CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
CONFIG_HAVE_ARCH_TRACEHOOK=y
CONFIG_HAVE_DMA_CONTIGUOUS=y
CONFIG_GENERIC_SMP_IDLE_THREAD=y
CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
CONFIG_ARCH_HAS_SET_MEMORY=y
CONFIG_ARCH_HAS_SET_DIRECT_MAP=y
CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y
CONFIG_ARCH_HAS_DELAY_TIMER=y
CONFIG_ARCH_HAS_CPU_PASID=y
CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
CONFIG_ARCH_WANTS_NO_INSTR=y
CONFIG_ARCH_MEMORY_ORDER_TSO=y
CONFIG_HAVE_ASM_MODVERSIONS=y
CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
CONFIG_HAVE_RSEQ=y
CONFIG_HAVE_RUST=y
CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y
CONFIG_HAVE_HW_BREAKPOINT=y
CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y
CONFIG_HAVE_USER_RETURN_NOTIFIER=y
CONFIG_HAVE_PERF_EVENTS_NMI=y
CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y
CONFIG_UNWIND_USER=y
CONFIG_HAVE_UNWIND_USER_FP=y
CONFIG_HAVE_PERF_REGS=y
CONFIG_HAVE_PERF_USER_STACK_DUMP=y
CONFIG_HAVE_ARCH_JUMP_LABEL=y
CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y
CONFIG_MMU_GATHER_TABLE_FREE=y
CONFIG_MMU_GATHER_RCU_TABLE_FREE=y
CONFIG_MMU_GATHER_MERGE_VMAS=y
CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM=y
CONFIG_MMU_LAZY_TLB_REFCOUNT=y
CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
CONFIG_ARCH_HAVE_EXTRA_ELF_NOTES=y
CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS=y
CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
CONFIG_HAVE_CMPXCHG_LOCAL=y
CONFIG_HAVE_CMPXCHG_DOUBLE=y
CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y
CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y
CONFIG_HAVE_ARCH_SECCOMP=y
CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
# CONFIG_SECCOMP_CACHE_DEBUG is not set
CONFIG_HAVE_ARCH_KSTACK_ERASE=y
CONFIG_HAVE_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR_STRONG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
CONFIG_LTO_NONE=y
CONFIG_ARCH_SUPPORTS_CFI=y
CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
CONFIG_HAVE_CONTEXT_TRACKING_USER=y
CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y
CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
CONFIG_HAVE_MOVE_PUD=y
CONFIG_HAVE_MOVE_PMD=y
CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y
CONFIG_HAVE_ARCH_HUGE_VMAP=y
CONFIG_HAVE_ARCH_HUGE_VMALLOC=y
CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
CONFIG_ARCH_WANT_PMD_MKWRITE=y
CONFIG_HAVE_ARCH_SOFT_DIRTY=y
CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
CONFIG_MODULES_USE_ELF_RELA=y
CONFIG_ARCH_HAS_EXECMEM_ROX=y
CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y
CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y
CONFIG_SOFTIRQ_ON_OWN_STACK=y
CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
CONFIG_HAVE_EXIT_THREAD=y
CONFIG_ARCH_MMAP_RND_BITS=28
CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y
CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8
CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES=y
CONFIG_HAVE_PAGE_SIZE_4KB=y
CONFIG_PAGE_SIZE_4KB=y
CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
CONFIG_PAGE_SHIFT=12
CONFIG_HAVE_OBJTOOL=y
CONFIG_HAVE_JUMP_LABEL_HACK=y
CONFIG_HAVE_NOINSTR_HACK=y
CONFIG_HAVE_NOINSTR_VALIDATION=y
CONFIG_HAVE_UACCESS_VALIDATION=y
CONFIG_HAVE_STACK_VALIDATION=y
CONFIG_HAVE_RELIABLE_STACKTRACE=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_COMPAT_OLD_SIGACTION=y
CONFIG_COMPAT_32BIT_TIME=y
CONFIG_ARCH_SUPPORTS_RT=y
CONFIG_HAVE_ARCH_VMAP_STACK=y
CONFIG_VMAP_STACK=y
CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y
CONFIG_RANDOMIZE_KSTACK_OFFSET=y
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
CONFIG_STRICT_KERNEL_RWX=y
CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
CONFIG_STRICT_MODULE_RWX=y
CONFIG_ARCH_HAS_CPU_RESCTRL=y
CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y
CONFIG_ARCH_USE_MEMREMAP_PROT=y
# CONFIG_LOCK_EVENT_COUNTS is not set
CONFIG_ARCH_HAS_MEM_ENCRYPT=y
CONFIG_HAVE_STATIC_CALL=y
CONFIG_HAVE_STATIC_CALL_INLINE=y
CONFIG_HAVE_PREEMPT_DYNAMIC=y
CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y
CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y
CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y
CONFIG_ARCH_HAS_ELFCORE_COMPAT=y
CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y
CONFIG_DYNAMIC_SIGFRAME=y
CONFIG_HAVE_ARCH_NODE_DEV_GROUP=y
CONFIG_ARCH_HAS_HW_PTE_YOUNG=y
CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y
CONFIG_ARCH_HAS_KERNEL_FPU_SUPPORT=y
CONFIG_ARCH_VMLINUX_NEEDS_RELOCS=y
CONFIG_HAVE_GENERIC_TIF_BITS=y
#
# GCOV-based kernel profiling
#
# CONFIG_GCOV_KERNEL is not set
CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
# end of GCOV-based kernel profiling
CONFIG_HAVE_GCC_PLUGINS=y
CONFIG_FUNCTION_ALIGNMENT_4B=y
CONFIG_FUNCTION_ALIGNMENT_16B=y
CONFIG_FUNCTION_ALIGNMENT=16
CONFIG_CC_HAS_MIN_FUNCTION_ALIGNMENT=y
CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y
CONFIG_ARCH_HAS_CPU_ATTACK_VECTORS=y
CONFIG_HAVE_ARCH_GET_SECUREBOOT=y
# end of General architecture-dependent options
CONFIG_RT_MUTEXES=y
CONFIG_MODULE_SIG_FORMAT=y
CONFIG_MODULES=y
CONFIG_MODULE_DEBUGFS=y
# CONFIG_MODULE_DEBUG is not set
# CONFIG_MODULE_FORCE_LOAD is not set
CONFIG_MODULE_UNLOAD=y
# CONFIG_MODULE_FORCE_UNLOAD is not set
CONFIG_MODULE_UNLOAD_TAINT_TRACKING=y
# CONFIG_MODVERSIONS is not set
# CONFIG_MODULE_SRCVERSION_ALL is not set
CONFIG_MODULE_SIG=y
# CONFIG_MODULE_SIG_FORCE is not set
CONFIG_MODULE_SIG_ALL=y
# CONFIG_MODULE_SIG_SHA256 is not set
# CONFIG_MODULE_SIG_SHA384 is not set
CONFIG_MODULE_SIG_SHA512=y
# CONFIG_MODULE_SIG_SHA3_256 is not set
# CONFIG_MODULE_SIG_SHA3_384 is not set
# CONFIG_MODULE_SIG_SHA3_512 is not set
CONFIG_MODULE_SIG_HASH="sha512"
CONFIG_MODULE_COMPRESS=y
# CONFIG_MODULE_COMPRESS_GZIP is not set
CONFIG_MODULE_COMPRESS_XZ=y
# CONFIG_MODULE_COMPRESS_ZSTD is not set
# CONFIG_MODULE_COMPRESS_ALL is not set
CONFIG_MODULE_DECOMPRESS=y
# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
CONFIG_MODPROBE_PATH="/usr/bin/modprobe"
# CONFIG_TRIM_UNUSED_KSYMS is not set
CONFIG_MODULES_TREE_LOOKUP=y
CONFIG_BLOCK=y
CONFIG_BLOCK_LEGACY_AUTOLOAD=y
CONFIG_BLK_RQ_ALLOC_TIME=y
CONFIG_BLK_CGROUP_RWSTAT=y
CONFIG_BLK_CGROUP_PUNT_BIO=y
CONFIG_BLK_DEV_BSG_COMMON=y
CONFIG_BLK_ICQ=y
CONFIG_BLK_DEV_BSGLIB=y
CONFIG_BLK_DEV_INTEGRITY=y
CONFIG_BLK_DEV_WRITE_MOUNTED=y
CONFIG_BLK_DEV_ZONED=y
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_BLK_WBT=y
CONFIG_BLK_WBT_MQ=y
CONFIG_BLK_CGROUP_IOLATENCY=y
CONFIG_BLK_CGROUP_IOCOST=y
CONFIG_BLK_CGROUP_IOPRIO=y
CONFIG_BLK_DEBUG_FS=y
CONFIG_BLK_SED_OPAL=y
CONFIG_BLK_INLINE_ENCRYPTION=y
CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y
#
# Partition Types
#
CONFIG_PARTITION_ADVANCED=y
# CONFIG_ACORN_PARTITION is not set
# CONFIG_AIX_PARTITION is not set
# CONFIG_OSF_PARTITION is not set
# CONFIG_AMIGA_PARTITION is not set
# CONFIG_ATARI_PARTITION is not set
# CONFIG_MAC_PARTITION is not set
CONFIG_MSDOS_PARTITION=y
# CONFIG_BSD_DISKLABEL is not set
# CONFIG_MINIX_SUBPARTITION is not set
# CONFIG_SOLARIS_X86_PARTITION is not set
# CONFIG_UNIXWARE_DISKLABEL is not set
CONFIG_LDM_PARTITION=y
# CONFIG_LDM_DEBUG is not set
# CONFIG_SGI_PARTITION is not set
# CONFIG_ULTRIX_PARTITION is not set
# CONFIG_SUN_PARTITION is not set
# CONFIG_KARMA_PARTITION is not set
CONFIG_EFI_PARTITION=y
# CONFIG_SYSV68_PARTITION is not set
# CONFIG_CMDLINE_PARTITION is not set
# end of Partition Types
CONFIG_BLK_PM=y
CONFIG_BLOCK_HOLDER_DEPRECATED=y
CONFIG_BLK_MQ_STACKING=y
# CONFIG_BLK_ERROR_INJECTION is not set
#
# IO Schedulers
#
CONFIG_MQ_IOSCHED_DEADLINE=y
CONFIG_MQ_IOSCHED_KYBER=y
CONFIG_IOSCHED_BFQ=y
CONFIG_BFQ_GROUP_IOSCHED=y
# CONFIG_BFQ_CGROUP_DEBUG is not set
# end of IO Schedulers
CONFIG_PREEMPT_NOTIFIERS=y
CONFIG_PADATA=y
CONFIG_ASN1=y
CONFIG_UNINLINE_SPIN_UNLOCK=y
CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
CONFIG_MUTEX_SPIN_ON_OWNER=y
CONFIG_RWSEM_SPIN_ON_OWNER=y
CONFIG_LOCK_SPIN_ON_OWNER=y
CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
CONFIG_QUEUED_SPINLOCKS=y
# CONFIG_QUEUED_SPINLOCKS_TRACE_CONTENDED_RELEASE is not set
CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
CONFIG_QUEUED_RWLOCKS=y
CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y
CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y
CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y
CONFIG_FREEZER=y
#
# Executable file formats
#
CONFIG_BINFMT_ELF=y
CONFIG_COMPAT_BINFMT_ELF=y
CONFIG_ELFCORE=y
CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
CONFIG_BINFMT_SCRIPT=y
CONFIG_BINFMT_MISC=m
CONFIG_COREDUMP=y
# end of Executable file formats
#
# Memory Management options
#
CONFIG_SWAP=y
CONFIG_ZSWAP=y
# CONFIG_ZSWAP_DEFAULT_ON is not set
CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_DEFLATE is not set
CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZO=y
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_842 is not set
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4 is not set
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4HC is not set
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD is not set
CONFIG_ZSWAP_COMPRESSOR_DEFAULT="lzo"
CONFIG_ZSMALLOC=y
#
# Zsmalloc allocator options
#
#
# Zsmalloc is a common backend allocator for zswap & zram
#
# CONFIG_ZSMALLOC_STAT is not set
CONFIG_ZSMALLOC_CHAIN_SIZE=8
# end of Zsmalloc allocator options
#
# Slab allocator options
#
CONFIG_SLUB=y
CONFIG_KVFREE_RCU_BATCHED=y
# CONFIG_SLUB_TINY is not set
# CONFIG_SLAB_MERGE_DEFAULT is not set
CONFIG_SLAB_FREELIST_RANDOM=y
CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_SLAB_BUCKETS=y
# CONFIG_SLUB_STATS is not set
CONFIG_KMALLOC_PARTITION_CACHES=y
CONFIG_KMALLOC_PARTITION_RANDOM=y
# end of Slab allocator options
CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
# CONFIG_COMPAT_BRK is not set
CONFIG_SPARSEMEM=y
CONFIG_SPARSEMEM_EXTREME=y
CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
CONFIG_SPARSEMEM_VMEMMAP=y
CONFIG_SPARSEMEM_VMEMMAP_PREINIT=y
CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=y
CONFIG_ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP=y
CONFIG_ARCH_WANT_HUGETLB_VMEMMAP_PREINIT=y
CONFIG_HAVE_GUP_FAST=y
CONFIG_MEMBLOCK_KHO_SCRATCH=y
CONFIG_NUMA_KEEP_MEMINFO=y
CONFIG_MEMORY_ISOLATION=y
CONFIG_EXCLUSIVE_SYSTEM_RAM=y
CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
# CONFIG_MEMORY_HOTPLUG is not set
CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
CONFIG_SPLIT_PTE_PTLOCKS=y
CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y
CONFIG_SPLIT_PMD_PTLOCKS=y
CONFIG_BALLOON=y
CONFIG_BALLOON_MIGRATION=y
CONFIG_COMPACTION=y
CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
CONFIG_PAGE_REPORTING=y
CONFIG_NUMA_MIGRATION=y
CONFIG_MIGRATION=y
CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y
CONFIG_ARCH_HAS_PMD_SOFTLEAVES=y
CONFIG_CONTIG_ALLOC=y
CONFIG_PCP_BATCH_SCALE_MAX=5
CONFIG_PHYS_ADDR_T_64BIT=y
CONFIG_MMU_NOTIFIER=y
CONFIG_KSM=y
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
CONFIG_MEMORY_FAILURE=y
CONFIG_HWPOISON_INJECT=m
CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
CONFIG_ARCH_WANTS_THP_SWAP=y
# CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is not set
CONFIG_MM_ID=y
CONFIG_TRANSPARENT_HUGEPAGE=y
# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set
CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
# CONFIG_TRANSPARENT_HUGEPAGE_NEVER is not set
CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_NEVER=y
# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS is not set
# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_WITHIN_SIZE is not set
# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ADVISE is not set
CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_NEVER=y
# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ALWAYS is not set
# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE is not set
# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE is not set
CONFIG_THP_SWAP=y
# CONFIG_NO_PAGE_MAPCOUNT is not set
CONFIG_PAGE_MAPCOUNT=y
CONFIG_PGTABLE_HAS_HUGE_LEAVES=y
CONFIG_HAVE_GIGANTIC_FOLIOS=y
CONFIG_ASYNC_KERNEL_PGTABLE_FREE=y
CONFIG_ARCH_SUPPORTS_HUGE_PFNMAP=y
CONFIG_ARCH_SUPPORTS_PMD_PFNMAP=y
CONFIG_ARCH_SUPPORTS_PUD_PFNMAP=y
CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
CONFIG_USE_PERCPU_NUMA_NODE_ID=y
CONFIG_HAVE_SETUP_PER_CPU_AREA=y
CONFIG_CMA=y
# CONFIG_CMA_DEBUGFS is not set
CONFIG_CMA_SYSFS=y
CONFIG_CMA_AREAS=7
CONFIG_PAGE_BLOCK_MAX_ORDER=10
CONFIG_MEM_SOFT_DIRTY=y
CONFIG_GENERIC_EARLY_IOREMAP=y
# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
CONFIG_PAGE_IDLE_FLAG=y
CONFIG_IDLE_PAGE_TRACKING=y
CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y
CONFIG_ARCH_HAS_ZONE_DMA_SET=y
CONFIG_ZONE_DMA=y
CONFIG_ZONE_DMA32=y
CONFIG_VMAP_PFN=y
CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
CONFIG_ARCH_HAS_PKEYS=y
CONFIG_ARCH_USES_PG_ARCH_2=y
CONFIG_VM_EVENT_COUNTERS=y
# CONFIG_PERCPU_STATS is not set
# CONFIG_GUP_TEST is not set
# CONFIG_DMAPOOL_TEST is not set
CONFIG_ARCH_HAS_PTE_SPECIAL=y
CONFIG_MEMFD_CREATE=y
CONFIG_SECRETMEM=y
# CONFIG_ANON_VMA_NAME is not set
CONFIG_HAVE_ARCH_USERFAULTFD_WP=y
CONFIG_HAVE_ARCH_USERFAULTFD_MINOR=y
CONFIG_USERFAULTFD_RWP=y
CONFIG_USERFAULTFD=y
CONFIG_PTE_MARKER_UFFD_WP=y
CONFIG_LRU_GEN=y
CONFIG_LRU_GEN_ENABLED=y
# CONFIG_LRU_GEN_STATS is not set
CONFIG_LRU_GEN_WALKS_MMU=y
CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y
CONFIG_PER_VMA_LOCK=y
CONFIG_LOCK_MM_AND_FIND_VMA=y
CONFIG_IOMMU_MM_DATA=y
CONFIG_EXECMEM=y
CONFIG_NUMA_MEMBLKS=y
# CONFIG_NUMA_EMU is not set
CONFIG_ARCH_HAS_USER_SHADOW_STACK=y
CONFIG_PT_RECLAIM=y
#
# Data Access Monitoring
#
CONFIG_DAMON=y
# CONFIG_DAMON_DEBUG_SANITY is not set
CONFIG_DAMON_VADDR=y
CONFIG_DAMON_PADDR=y
CONFIG_DAMON_SYSFS=y
CONFIG_DAMON_RECLAIM=y
# CONFIG_DAMON_LRU_SORT is not set
CONFIG_DAMON_STAT=y
# CONFIG_DAMON_STAT_ENABLED_DEFAULT is not set
# end of Data Access Monitoring
# end of Memory Management options
CONFIG_NET=y
CONFIG_NET_INGRESS=y
CONFIG_NET_EGRESS=y
CONFIG_NET_XGRESS=y
CONFIG_SKB_DECRYPTED=y
CONFIG_SKB_EXTENSIONS=y
CONFIG_NET_DEVMEM=y
CONFIG_NET_CRC32C=y
#
# Networking options
#
CONFIG_PACKET=y
CONFIG_PACKET_DIAG=y
# CONFIG_INET_PSP is not set
CONFIG_UNIX=y
CONFIG_AF_UNIX_OOB=y
CONFIG_UNIX_DIAG=y
CONFIG_TLS=y
CONFIG_TLS_DEVICE=y
CONFIG_XFRM=y
CONFIG_XFRM_OFFLOAD=y
CONFIG_XFRM_ALGO=y
CONFIG_XFRM_USER=y
# CONFIG_XFRM_USER_COMPAT is not set
# CONFIG_XFRM_INTERFACE is not set
CONFIG_XFRM_SUB_POLICY=y
CONFIG_XFRM_MIGRATE=y
# CONFIG_XFRM_STATISTICS is not set
CONFIG_XFRM_AH=m
CONFIG_XFRM_ESP=m
CONFIG_XFRM_IPCOMP=m
# CONFIG_NET_KEY is not set
# CONFIG_XFRM_IPTFS is not set
CONFIG_XFRM_ESPINTCP=y
# CONFIG_DIBS is not set
CONFIG_XDP_SOCKETS=y
CONFIG_XDP_SOCKETS_DIAG=y
CONFIG_NET_HANDSHAKE=y
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_FIB_TRIE_STATS=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_IP_ROUTE_CLASSID=y
# CONFIG_IP_PNP is not set
CONFIG_NET_IPIP=m
CONFIG_NET_IPGRE_DEMUX=m
CONFIG_NET_IP_TUNNEL=m
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE_COMMON=y
CONFIG_IP_MROUTE=y
CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
CONFIG_SYN_COOKIES=y
CONFIG_NET_IPVTI=m
CONFIG_NET_UDP_TUNNEL=m
CONFIG_NET_FOU=m
CONFIG_NET_FOU_IP_TUNNELS=y
CONFIG_INET_AH=m
CONFIG_INET_ESP=m
CONFIG_INET_ESP_OFFLOAD=m
CONFIG_INET_ESPINTCP=y
CONFIG_INET_IPCOMP=m
CONFIG_INET_TABLE_PERTURB_ORDER=16
CONFIG_INET_XFRM_TUNNEL=m
CONFIG_INET_TUNNEL=m
CONFIG_INET_DIAG=y
CONFIG_INET_TCP_DIAG=y
CONFIG_INET_UDP_DIAG=y
CONFIG_INET_RAW_DIAG=y
CONFIG_INET_DIAG_DESTROY=y
# CONFIG_TCP_CONG_ADVANCED is not set
CONFIG_TCP_CONG_CUBIC=y
CONFIG_DEFAULT_TCP_CONG="cubic"
CONFIG_TCP_AO=y
CONFIG_TCP_MD5SIG=y
CONFIG_IPV6=y
CONFIG_IPV6_ROUTER_PREF=y
CONFIG_IPV6_ROUTE_INFO=y
CONFIG_IPV6_OPTIMISTIC_DAD=y
CONFIG_INET6_AH=m
CONFIG_INET6_ESP=m
CONFIG_INET6_ESP_OFFLOAD=m
CONFIG_INET6_ESPINTCP=y
CONFIG_INET6_IPCOMP=m
CONFIG_IPV6_MIP6=y
CONFIG_IPV6_ILA=m
CONFIG_INET6_XFRM_TUNNEL=m
CONFIG_INET6_TUNNEL=m
CONFIG_IPV6_VTI=m
CONFIG_IPV6_SIT=m
CONFIG_IPV6_SIT_6RD=y
CONFIG_IPV6_NDISC_NODETYPE=y
CONFIG_IPV6_TUNNEL=m
CONFIG_IPV6_GRE=m
CONFIG_IPV6_FOU=m
CONFIG_IPV6_FOU_TUNNEL=m
CONFIG_IPV6_MULTIPLE_TABLES=y
CONFIG_IPV6_SUBTREES=y
CONFIG_IPV6_MROUTE=y
CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
CONFIG_IPV6_PIMSM_V2=y
CONFIG_IPV6_SEG6_LWTUNNEL=y
CONFIG_IPV6_SEG6_HMAC=y
CONFIG_IPV6_SEG6_BPF=y
CONFIG_IPV6_RPL_LWTUNNEL=y
CONFIG_IPV6_IOAM6_LWTUNNEL=y
CONFIG_NETLABEL=y
CONFIG_MPTCP=y
CONFIG_INET_MPTCP_DIAG=y
CONFIG_MPTCP_IPV6=y
CONFIG_NETWORK_SECMARK=y
CONFIG_NET_PTP_CLASSIFY=y
CONFIG_NETWORK_PHY_TIMESTAMPING=y
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_BRIDGE_NETFILTER=m
#
# Core Netfilter Configuration
#
CONFIG_NETFILTER_INGRESS=y
CONFIG_NETFILTER_EGRESS=y
CONFIG_NETFILTER_NETLINK=y
CONFIG_NETFILTER_FAMILY_BRIDGE=y
CONFIG_NETFILTER_FAMILY_ARP=y
CONFIG_NETFILTER_BPF_LINK=y
CONFIG_NETFILTER_NETLINK_HOOK=m
CONFIG_NETFILTER_NETLINK_ACCT=m
CONFIG_NETFILTER_NETLINK_QUEUE=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NETFILTER_NETLINK_OSF=m
CONFIG_NF_CONNTRACK=m
CONFIG_NF_LOG_SYSLOG=m
CONFIG_NETFILTER_CONNCOUNT=m
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_SECMARK=y
CONFIG_NF_CONNTRACK_ZONES=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
# CONFIG_NF_CONNTRACK_TIMEOUT is not set
CONFIG_NF_CONNTRACK_TIMESTAMP=y
CONFIG_NF_CONNTRACK_LABELS=y
CONFIG_NF_CT_PROTO_GRE=y
CONFIG_NF_CT_PROTO_SCTP=y
CONFIG_NF_CONNTRACK_AMANDA=m
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_H323=m
CONFIG_NF_CONNTRACK_IRC=m
CONFIG_NF_CONNTRACK_BROADCAST=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
CONFIG_NF_CONNTRACK_SNMP=m
CONFIG_NF_CONNTRACK_PPTP=m
CONFIG_NF_CONNTRACK_SANE=m
CONFIG_NF_CONNTRACK_SIP=m
CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_CT_NETLINK_HELPER=m
CONFIG_NETFILTER_NETLINK_GLUE_CT=y
CONFIG_NF_NAT=m
CONFIG_NF_NAT_AMANDA=m
CONFIG_NF_NAT_FTP=m
CONFIG_NF_NAT_IRC=m
CONFIG_NF_NAT_SIP=m
CONFIG_NF_NAT_TFTP=m
CONFIG_NF_NAT_REDIRECT=y
CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NETFILTER_SYNPROXY=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_CT=m
# CONFIG_NFT_EXTHDR_DCCP is not set
CONFIG_NFT_FLOW_OFFLOAD=m
CONFIG_NFT_CONNLIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_TUNNEL=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_REJECT_INET=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_HASH=m
CONFIG_NFT_FIB=m
CONFIG_NFT_FIB_INET=m
CONFIG_NFT_XFRM=m
CONFIG_NFT_SOCKET=m
# CONFIG_NFT_OSF is not set
CONFIG_NFT_TPROXY=m
CONFIG_NFT_SYNPROXY=m
CONFIG_NF_DUP_NETDEV=m
CONFIG_NFT_DUP_NETDEV=m
CONFIG_NFT_FWD_NETDEV=m
CONFIG_NFT_FIB_NETDEV=m
CONFIG_NFT_REJECT_NETDEV=m
CONFIG_NF_FLOW_TABLE_INET=m
CONFIG_NF_FLOW_TABLE=m
CONFIG_NF_FLOW_TABLE_PROCFS=y
CONFIG_NETFILTER_XTABLES=y
# CONFIG_NETFILTER_XTABLES_COMPAT is not set
CONFIG_NETFILTER_XTABLES_LEGACY=y
#
# Xtables combined modules
#
CONFIG_NETFILTER_XT_MARK=m
CONFIG_NETFILTER_XT_CONNMARK=m
CONFIG_NETFILTER_XT_SET=m
#
# Xtables targets
#
CONFIG_NETFILTER_XT_TARGET_AUDIT=m
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_HL=m
CONFIG_NETFILTER_XT_TARGET_HMARK=m
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
CONFIG_NETFILTER_XT_TARGET_LED=m
CONFIG_NETFILTER_XT_TARGET_LOG=m
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_NAT=m
CONFIG_NETFILTER_XT_TARGET_NETMAP=m
CONFIG_NETFILTER_XT_TARGET_NFLOG=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
CONFIG_NETFILTER_XT_TARGET_RATEEST=m
CONFIG_NETFILTER_XT_TARGET_REDIRECT=m
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
CONFIG_NETFILTER_XT_TARGET_TEE=m
CONFIG_NETFILTER_XT_TARGET_TPROXY=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
#
# Xtables matches
#
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NETFILTER_XT_MATCH_CGROUP=m
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ECN=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_HL=m
CONFIG_NETFILTER_XT_MATCH_IPCOMP=m
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MATCH_L2TP=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_NFACCT=m
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_RATEEST=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_RECENT=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_TIME=m
CONFIG_NETFILTER_XT_MATCH_U32=m
# end of Core Netfilter Configuration
CONFIG_IP_SET=m
CONFIG_IP_SET_MAX=256
CONFIG_IP_SET_BITMAP_IP=m
CONFIG_IP_SET_BITMAP_IPMAC=m
CONFIG_IP_SET_BITMAP_PORT=m
CONFIG_IP_SET_HASH_IP=m
CONFIG_IP_SET_HASH_IPMARK=m
CONFIG_IP_SET_HASH_IPPORT=m
CONFIG_IP_SET_HASH_IPPORTIP=m
CONFIG_IP_SET_HASH_IPPORTNET=m
CONFIG_IP_SET_HASH_IPMAC=m
CONFIG_IP_SET_HASH_MAC=m
CONFIG_IP_SET_HASH_NETPORTNET=m
CONFIG_IP_SET_HASH_NET=m
CONFIG_IP_SET_HASH_NETNET=m
CONFIG_IP_SET_HASH_NETPORT=m
CONFIG_IP_SET_HASH_NETIFACE=m
CONFIG_IP_SET_LIST_SET=m
CONFIG_IP_VS=m
CONFIG_IP_VS_IPV6=y
# CONFIG_IP_VS_DEBUG is not set
CONFIG_IP_VS_TAB_BITS=12
#
# IPVS transport protocol load balancing support
#
CONFIG_IP_VS_PROTO_TCP=y
CONFIG_IP_VS_PROTO_UDP=y
CONFIG_IP_VS_PROTO_AH_ESP=y
CONFIG_IP_VS_PROTO_ESP=y
CONFIG_IP_VS_PROTO_AH=y
CONFIG_IP_VS_PROTO_SCTP=y
#
# IPVS scheduler
#
CONFIG_IP_VS_RR=m
CONFIG_IP_VS_WRR=m
CONFIG_IP_VS_LC=m
CONFIG_IP_VS_WLC=m
CONFIG_IP_VS_FO=m
CONFIG_IP_VS_OVF=m
CONFIG_IP_VS_LBLC=m
CONFIG_IP_VS_LBLCR=m
CONFIG_IP_VS_DH=m
CONFIG_IP_VS_SH=m
CONFIG_IP_VS_MH=m
CONFIG_IP_VS_SED=m
CONFIG_IP_VS_NQ=m
CONFIG_IP_VS_TWOS=m
#
# IPVS SH scheduler
#
CONFIG_IP_VS_SH_TAB_BITS=8
#
# IPVS MH scheduler
#
CONFIG_IP_VS_MH_TAB_INDEX=12
#
# IPVS application helper
#
CONFIG_IP_VS_FTP=m
CONFIG_IP_VS_NFCT=y
CONFIG_IP_VS_PE_SIP=m
#
# IP: Netfilter Configuration
#
CONFIG_NF_DEFRAG_IPV4=m
CONFIG_IP_NF_IPTABLES_LEGACY=m
CONFIG_NF_SOCKET_IPV4=m
CONFIG_NF_TPROXY_IPV4=m
CONFIG_NF_TABLES_IPV4=y
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_DUP_IPV4=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NF_TABLES_ARP=y
CONFIG_NF_DUP_IPV4=m
CONFIG_NF_LOG_ARP=m
CONFIG_NF_LOG_IPV4=m
CONFIG_NF_REJECT_IPV4=m
CONFIG_NF_NAT_SNMP_BASIC=m
CONFIG_NF_NAT_PPTP=m
CONFIG_NF_NAT_H323=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_RPFILTER=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_SYNPROXY=m
# CONFIG_IP_NF_NAT is not set
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_ECN=m
# CONFIG_IP_NF_TARGET_TTL is not set
# CONFIG_IP_NF_RAW is not set
# CONFIG_IP_NF_SECURITY is not set
# CONFIG_IP_NF_ARPTABLES is not set
CONFIG_NFT_COMPAT_ARP=m
# CONFIG_IP_NF_ARPFILTER is not set
CONFIG_IP_NF_ARP_MANGLE=m
# end of IP: Netfilter Configuration
#
# IPv6: Netfilter Configuration
#
CONFIG_IP6_NF_IPTABLES_LEGACY=m
CONFIG_NF_SOCKET_IPV6=m
CONFIG_NF_TPROXY_IPV6=m
CONFIG_NF_TABLES_IPV6=y
CONFIG_NFT_REJECT_IPV6=m
CONFIG_NFT_DUP_IPV6=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NF_DUP_IPV6=m
CONFIG_NF_REJECT_IPV6=m
CONFIG_NF_LOG_IPV6=m
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP6_NF_MATCH_AH=m
CONFIG_IP6_NF_MATCH_EUI64=m
CONFIG_IP6_NF_MATCH_FRAG=m
CONFIG_IP6_NF_MATCH_OPTS=m
CONFIG_IP6_NF_MATCH_HL=m
CONFIG_IP6_NF_MATCH_IPV6HEADER=m
CONFIG_IP6_NF_MATCH_MH=m
CONFIG_IP6_NF_MATCH_RPFILTER=m
CONFIG_IP6_NF_MATCH_RT=m
CONFIG_IP6_NF_MATCH_SRH=m
# CONFIG_IP6_NF_TARGET_HL is not set
CONFIG_IP6_NF_FILTER=m
CONFIG_IP6_NF_TARGET_REJECT=m
CONFIG_IP6_NF_TARGET_SYNPROXY=m
CONFIG_IP6_NF_MANGLE=m
# CONFIG_IP6_NF_RAW is not set
# CONFIG_IP6_NF_SECURITY is not set
# CONFIG_IP6_NF_NAT is not set
CONFIG_IP6_NF_TARGET_NPT=m
# end of IPv6: Netfilter Configuration
CONFIG_NF_DEFRAG_IPV6=m
CONFIG_NF_TABLES_BRIDGE=m
CONFIG_NFT_BRIDGE_META=m
CONFIG_NFT_BRIDGE_REJECT=m
CONFIG_NF_CONNTRACK_BRIDGE=m
# CONFIG_BRIDGE_NF_EBTABLES_LEGACY is not set
CONFIG_BRIDGE_NF_EBTABLES=m
CONFIG_BRIDGE_EBT_802_3=m
CONFIG_BRIDGE_EBT_AMONG=m
CONFIG_BRIDGE_EBT_ARP=m
CONFIG_BRIDGE_EBT_IP=m
CONFIG_BRIDGE_EBT_IP6=m
CONFIG_BRIDGE_EBT_LIMIT=m
CONFIG_BRIDGE_EBT_MARK=m
CONFIG_BRIDGE_EBT_PKTTYPE=m
CONFIG_BRIDGE_EBT_STP=m
CONFIG_BRIDGE_EBT_VLAN=m
CONFIG_BRIDGE_EBT_ARPREPLY=m
CONFIG_BRIDGE_EBT_DNAT=m
CONFIG_BRIDGE_EBT_MARK_T=m
CONFIG_BRIDGE_EBT_REDIRECT=m
CONFIG_BRIDGE_EBT_SNAT=m
CONFIG_BRIDGE_EBT_LOG=m
CONFIG_BRIDGE_EBT_NFLOG=m
# CONFIG_IP_SCTP is not set
CONFIG_RDS=m
CONFIG_RDS_TCP=m
# CONFIG_RDS_DEBUG is not set
# CONFIG_TIPC is not set
# CONFIG_ATM is not set
# CONFIG_L2TP is not set
CONFIG_STP=y
CONFIG_BRIDGE=y
CONFIG_BRIDGE_IGMP_SNOOPING=y
# CONFIG_BRIDGE_VLAN_FILTERING is not set
# CONFIG_BRIDGE_MRP is not set
# CONFIG_BRIDGE_CFM is not set
# CONFIG_NET_DSA is not set
CONFIG_VLAN_8021Q=m
# CONFIG_VLAN_8021Q_GVRP is not set
# CONFIG_VLAN_8021Q_MVRP is not set
CONFIG_LLC=y
# CONFIG_LLC2 is not set
# CONFIG_X25 is not set
# CONFIG_LAPB is not set
# CONFIG_PHONET is not set
CONFIG_6LOWPAN=m
# CONFIG_6LOWPAN_DEBUGFS is not set
# CONFIG_6LOWPAN_NHC is not set
# CONFIG_IEEE802154 is not set
CONFIG_NET_SCHED=y
#
# Queueing/Scheduling
#
CONFIG_NET_SCH_HTB=m
CONFIG_NET_SCH_HFSC=m
CONFIG_NET_SCH_PRIO=m
CONFIG_NET_SCH_MULTIQ=m
CONFIG_NET_SCH_RED=m
CONFIG_NET_SCH_SFB=m
CONFIG_NET_SCH_SFQ=m
CONFIG_NET_SCH_TEQL=m
CONFIG_NET_SCH_TBF=m
CONFIG_NET_SCH_CBS=m
CONFIG_NET_SCH_ETF=m
CONFIG_NET_SCH_MQPRIO_LIB=m
CONFIG_NET_SCH_TAPRIO=m
CONFIG_NET_SCH_GRED=m
CONFIG_NET_SCH_NETEM=m
CONFIG_NET_SCH_DRR=m
CONFIG_NET_SCH_MQPRIO=m
# CONFIG_NET_SCH_SKBPRIO is not set
CONFIG_NET_SCH_CHOKE=m
CONFIG_NET_SCH_QFQ=m
CONFIG_NET_SCH_CODEL=m
CONFIG_NET_SCH_FQ_CODEL=y
CONFIG_NET_SCH_CAKE=m
CONFIG_NET_SCH_FQ=m
CONFIG_NET_SCH_HHF=m
# CONFIG_NET_SCH_PIE is not set
CONFIG_NET_SCH_PLUG=m
CONFIG_NET_SCH_ETS=m
CONFIG_NET_SCH_BPF=y
CONFIG_NET_SCH_DUALPI2=m
# CONFIG_NET_SCH_DEFAULT is not set
#
# Classification
#
CONFIG_NET_CLS=y
CONFIG_NET_CLS_BASIC=m
CONFIG_NET_CLS_ROUTE4=m
CONFIG_NET_CLS_FW=m
CONFIG_NET_CLS_U32=m
CONFIG_CLS_U32_PERF=y
CONFIG_CLS_U32_MARK=y
CONFIG_NET_CLS_FLOW=m
CONFIG_NET_CLS_CGROUP=y
CONFIG_NET_CLS_BPF=m
CONFIG_NET_CLS_FLOWER=m
CONFIG_NET_CLS_MATCHALL=m
CONFIG_NET_EMATCH=y
CONFIG_NET_EMATCH_STACK=32
CONFIG_NET_EMATCH_CMP=m
CONFIG_NET_EMATCH_NBYTE=m
CONFIG_NET_EMATCH_U32=m
CONFIG_NET_EMATCH_META=m
CONFIG_NET_EMATCH_TEXT=m
CONFIG_NET_EMATCH_IPSET=m
CONFIG_NET_EMATCH_IPT=m
# CONFIG_NET_CLS_ACT is not set
CONFIG_NET_SCH_FIFO=y
# CONFIG_DCB is not set
CONFIG_DNS_RESOLVER=y
# CONFIG_BATMAN_ADV is not set
# CONFIG_OPENVSWITCH is not set
CONFIG_VSOCKETS=y
CONFIG_VSOCKETS_DIAG=y
# CONFIG_VSOCKETS_LOOPBACK is not set
# CONFIG_VIRTIO_VSOCKETS is not set
CONFIG_VIRTIO_VSOCKETS_COMMON=m
CONFIG_NETLINK_DIAG=y
CONFIG_MPLS=y
CONFIG_NET_MPLS_GSO=m
CONFIG_MPLS_ROUTING=m
CONFIG_MPLS_IPTUNNEL=m
# CONFIG_NET_NSH is not set
# CONFIG_HSR is not set
CONFIG_NET_SWITCHDEV=y
CONFIG_NET_L3_MASTER_DEV=y
# CONFIG_QRTR is not set
# CONFIG_NET_NCSI is not set
CONFIG_PCPU_DEV_REFCNT=y
CONFIG_MAX_SKB_FRAGS=17
CONFIG_RPS=y
CONFIG_RFS_ACCEL=y
CONFIG_SOCK_RX_QUEUE_MAPPING=y
CONFIG_XPS=y
CONFIG_CGROUP_NET_PRIO=y
CONFIG_CGROUP_NET_CLASSID=y
CONFIG_NET_RX_BUSY_POLL=y
CONFIG_BQL=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_NET_FLOW_LIMIT=y
#
# Network testing
#
# CONFIG_NET_PKTGEN is not set
# CONFIG_NET_DROP_MONITOR is not set
# end of Network testing
# end of Networking options
# CONFIG_CAN is not set
CONFIG_BT=m
CONFIG_BT_BREDR=y
CONFIG_BT_RFCOMM=m
CONFIG_BT_RFCOMM_TTY=y
CONFIG_BT_BNEP=m
CONFIG_BT_BNEP_MC_FILTER=y
CONFIG_BT_BNEP_PROTO_FILTER=y
CONFIG_BT_HIDP=m
CONFIG_BT_LE=y
CONFIG_BT_LE_L2CAP_ECRED=y
CONFIG_BT_6LOWPAN=m
CONFIG_BT_LEDS=y
CONFIG_BT_MSFTEXT=y
# CONFIG_BT_AOSPEXT is not set
# CONFIG_BT_DEBUGFS is not set
# CONFIG_BT_SELFTEST is not set
#
# Bluetooth device drivers
#
CONFIG_BT_INTEL=m
CONFIG_BT_HCIBTUSB=m
CONFIG_BT_HCIBTUSB_AUTOSUSPEND=y
CONFIG_BT_HCIBTUSB_POLL_SYNC=y
# CONFIG_BT_HCIBTUSB_BCM is not set
# CONFIG_BT_HCIBTUSB_MTK is not set
# CONFIG_BT_HCIBTUSB_RTL is not set
CONFIG_BT_HCIUART=m
CONFIG_BT_HCIUART_SERDEV=y
CONFIG_BT_HCIUART_H4=y
# CONFIG_BT_HCIUART_NOKIA is not set
CONFIG_BT_HCIUART_BCSP=y
# CONFIG_BT_HCIUART_ATH3K is not set
# CONFIG_BT_HCIUART_LL is not set
# CONFIG_BT_HCIUART_3WIRE is not set
CONFIG_BT_HCIUART_INTEL=y
# CONFIG_BT_HCIUART_BCM is not set
# CONFIG_BT_HCIUART_RTL is not set
# CONFIG_BT_HCIUART_QCA is not set
CONFIG_BT_HCIUART_AG6XX=y
# CONFIG_BT_HCIUART_MRVL is not set
# CONFIG_BT_HCIUART_AML is not set
# CONFIG_BT_HCIBCM203X is not set
# CONFIG_BT_HCIBCM4377 is not set
# CONFIG_BT_HCIBPA10X is not set
# CONFIG_BT_HCIBFUSB is not set
CONFIG_BT_HCIVHCI=m
# CONFIG_BT_MRVL is not set
# CONFIG_BT_ATH3K is not set
# CONFIG_BT_MTKUART is not set
# CONFIG_BT_VIRTIO is not set
CONFIG_BT_NXPUART=m
CONFIG_BT_INTEL_PCIE=m
# end of Bluetooth device drivers
CONFIG_AF_RXRPC=m
CONFIG_AF_RXRPC_IPV6=y
# CONFIG_AF_RXRPC_INJECT_LOSS is not set
# CONFIG_AF_RXRPC_INJECT_RX_DELAY is not set
CONFIG_AF_RXRPC_DEBUG=y
CONFIG_RXKAD=y
CONFIG_RXGK=y
# CONFIG_RXPERF is not set
CONFIG_AF_KCM=y
CONFIG_STREAM_PARSER=y
CONFIG_MCTP=y
CONFIG_FIB_RULES=y
CONFIG_WIRELESS=y
CONFIG_CFG80211=m
# CONFIG_NL80211_TESTMODE is not set
# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
# CONFIG_CFG80211_CERTIFICATION_ONUS is not set
CONFIG_CFG80211_REQUIRE_SIGNED_REGDB=y
CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS=y
CONFIG_CFG80211_DEFAULT_PS=y
CONFIG_CFG80211_DEBUGFS=y
CONFIG_CFG80211_CRDA_SUPPORT=y
# CONFIG_CFG80211_WEXT is not set
CONFIG_MAC80211=m
CONFIG_MAC80211_HAS_RC=y
CONFIG_MAC80211_RC_MINSTREL=y
CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
CONFIG_MAC80211_RC_DEFAULT="minstrel_ht"
CONFIG_MAC80211_MESH=y
CONFIG_MAC80211_LEDS=y
CONFIG_MAC80211_DEBUGFS=y
# CONFIG_MAC80211_MESSAGE_TRACING is not set
# CONFIG_MAC80211_DEBUG_MENU is not set
CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
CONFIG_RFKILL=y
CONFIG_RFKILL_LEDS=y
CONFIG_RFKILL_INPUT=y
CONFIG_RFKILL_GPIO=y
# CONFIG_NET_9P is not set
CONFIG_CEPH_LIB=y
# CONFIG_CEPH_LIB_PRETTYDEBUG is not set
# CONFIG_CEPH_LIB_USE_DNS_RESOLVER is not set
# CONFIG_NFC is not set
# CONFIG_PSAMPLE is not set
CONFIG_NET_IFE=m
CONFIG_LWTUNNEL=y
CONFIG_LWTUNNEL_BPF=y
CONFIG_DST_CACHE=y
CONFIG_GRO_CELLS=y
CONFIG_SOCK_VALIDATE_XMIT=y
CONFIG_NET_SELFTESTS=y
CONFIG_NET_SOCK_MSG=y
CONFIG_PAGE_POOL=y
# CONFIG_PAGE_POOL_STATS is not set
CONFIG_FAILOVER=y
CONFIG_ETHTOOL_NETLINK=y
#
# Device Drivers
#
CONFIG_HAVE_PCI=y
CONFIG_GENERIC_PCI_IOMAP=y
CONFIG_PCI=y
CONFIG_PCI_DOMAINS=y
CONFIG_PCIEPORTBUS=y
CONFIG_HOTPLUG_PCI_PCIE=y
CONFIG_PCIEAER=y
CONFIG_PCIEAER_INJECT=y
CONFIG_PCIE_ECRC=y
CONFIG_PCIEASPM=y
CONFIG_PCIEASPM_DEFAULT=y
# CONFIG_PCIEASPM_POWERSAVE is not set
# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
# CONFIG_PCIEASPM_PERFORMANCE is not set
CONFIG_PCIE_PME=y
CONFIG_PCIE_DPC=y
CONFIG_PCIE_PTM=y
CONFIG_PCIE_EDR=y
CONFIG_PCI_MSI=y
CONFIG_PCI_QUIRKS=y
# CONFIG_PCI_DEBUG is not set
# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
CONFIG_PCI_STUB=y
CONFIG_PCI_PF_STUB=y
CONFIG_PCI_ATS=y
# CONFIG_PCI_TSM is not set
CONFIG_PCI_DOE=y
CONFIG_PCI_LOCKLESS_CONFIG=y
CONFIG_PCI_IOV=y
CONFIG_PCI_NPEM=y
CONFIG_PCI_PRI=y
CONFIG_PCI_PASID=y
CONFIG_PCIE_TPH=y
CONFIG_PCI_LABEL=y
CONFIG_VGA_ARB=y
CONFIG_VGA_ARB_MAX_GPUS=16
CONFIG_HOTPLUG_PCI=y
# CONFIG_HOTPLUG_PCI_ACPI is not set
# CONFIG_HOTPLUG_PCI_CPCI is not set
# CONFIG_HOTPLUG_PCI_OCTEONEP is not set
# CONFIG_HOTPLUG_PCI_SHPC is not set
#
# PCI controller drivers
#
CONFIG_VMD=m
#
# Cadence-based PCIe controllers
#
# end of Cadence-based PCIe controllers
#
# DesignWare-based PCIe controllers
#
# CONFIG_PCI_MESON is not set
# CONFIG_PCIE_DW_PLAT_HOST is not set
# end of DesignWare-based PCIe controllers
#
# Mobiveil-based PCIe controllers
#
# end of Mobiveil-based PCIe controllers
#
# PLDA-based PCIe controllers
#
# end of PLDA-based PCIe controllers
# end of PCI controller drivers
#
# PCI Endpoint
#
# CONFIG_PCI_ENDPOINT is not set
# end of PCI Endpoint
#
# PCI switch controller drivers
#
# CONFIG_PCI_SW_SWITCHTEC is not set
# end of PCI switch controller drivers
# CONFIG_PCI_PWRCTRL_GENERIC is not set
# CONFIG_PCI_PWRCTRL_TC9563 is not set
# CONFIG_CXL_BUS is not set
# CONFIG_PCCARD is not set
# CONFIG_RAPIDIO is not set
# CONFIG_PC104 is not set
#
# Generic Driver Options
#
CONFIG_AUXILIARY_BUS=y
# CONFIG_UEVENT_HELPER is not set
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS_SAFE=y
CONFIG_DRIVER_DEFERRED_PROBE_TIMEOUT=10
CONFIG_STANDALONE=y
CONFIG_PREVENT_FIRMWARE_BUILD=y
#
# Firmware loader
#
CONFIG_FW_LOADER=y
CONFIG_FW_LOADER_DEBUG=y
CONFIG_FW_LOADER_PAGED_BUF=y
CONFIG_FW_LOADER_SYSFS=y
CONFIG_EXTRA_FIRMWARE=""
# CONFIG_FW_LOADER_USER_HELPER is not set
CONFIG_FW_LOADER_COMPRESS=y
CONFIG_FW_LOADER_COMPRESS_XZ=y
CONFIG_FW_LOADER_COMPRESS_ZSTD=y
CONFIG_FW_CACHE=y
CONFIG_FW_UPLOAD=y
# end of Firmware loader
CONFIG_WANT_DEV_COREDUMP=y
CONFIG_ALLOW_DEV_COREDUMP=y
CONFIG_DEV_COREDUMP=y
# CONFIG_DEBUG_DRIVER is not set
# CONFIG_DEBUG_DEVRES is not set
# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
CONFIG_HMEM_REPORTING=y
# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
CONFIG_GENERIC_CPU_DEVICES=y
CONFIG_GENERIC_CPU_AUTOPROBE=y
CONFIG_GENERIC_CPU_VULNERABILITIES=y
CONFIG_REGMAP=y
CONFIG_REGMAP_I2C=y
CONFIG_REGMAP_MMIO=y
CONFIG_DMA_SHARED_BUFFER=y
# CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set
# end of Generic Driver Options
#
# Bus devices
#
# CONFIG_MHI_BUS is not set
# CONFIG_MHI_BUS_EP is not set
# end of Bus devices
CONFIG_CONNECTOR=y
CONFIG_PROC_EVENTS=y
#
# Firmware Drivers
#
#
# ARM System Control and Management Interface Protocol
#
# end of ARM System Control and Management Interface Protocol
# CONFIG_EDD is not set
CONFIG_FIRMWARE_MEMMAP=y
CONFIG_DMIID=y
CONFIG_DMI_SYSFS=y
CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
# CONFIG_FW_CFG_SYSFS is not set
CONFIG_SYSFB=y
CONFIG_SYSFB_SIMPLEFB=y
# CONFIG_GOOGLE_FIRMWARE is not set
#
# EFI (Extensible Firmware Interface) Support
#
CONFIG_EFI_ESRT=y
CONFIG_EFI_VARS_PSTORE=y
# CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set
CONFIG_EFI_SOFT_RESERVE=y
CONFIG_EFI_DXE_MEM_ATTRIBUTES=y
CONFIG_EFI_RUNTIME_WRAPPERS=y
# CONFIG_EFI_BOOTLOADER_CONTROL is not set
# CONFIG_EFI_CAPSULE_LOADER is not set
# CONFIG_EFI_TEST is not set
CONFIG_EFI_DEV_PATH_PARSER=y
CONFIG_APPLE_PROPERTIES=y
# CONFIG_RESET_ATTACK_MITIGATION is not set
CONFIG_EFI_RCI2_TABLE=y
# CONFIG_EFI_DISABLE_PCI_DMA is not set
CONFIG_EFI_EARLYCON=y
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS=y
# CONFIG_EFI_DISABLE_RUNTIME is not set
CONFIG_EFI_COCO_SECRET=y
CONFIG_OVMF_DEBUG_LOG=y
CONFIG_EFI_SBAT_FILE=""
# end of EFI (Extensible Firmware Interface) Support
CONFIG_UEFI_CPER=y
CONFIG_UEFI_CPER_X86=y
#
# Qualcomm firmware drivers
#
# CONFIG_QCOM_PAS is not set
# CONFIG_QCOM_SCM is not set
# end of Qualcomm firmware drivers
#
# Tegra firmware driver
#
# end of Tegra firmware driver
# end of Firmware Drivers
CONFIG_FWCTL=y
# CONFIG_GNSS is not set
# CONFIG_MTD is not set
# CONFIG_OF is not set
CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
# CONFIG_PARPORT is not set
CONFIG_PNP=y
# CONFIG_PNP_DEBUG_MESSAGES is not set
#
# Protocols
#
CONFIG_PNPACPI=y
CONFIG_BLK_DEV=y
# CONFIG_BLK_DEV_NULL_BLK is not set
# CONFIG_BLK_DEV_FD is not set
CONFIG_CDROM=y
# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
CONFIG_ZRAM=y
CONFIG_ZRAM_BACKEND_LZ4=y
CONFIG_ZRAM_BACKEND_LZ4HC=y
CONFIG_ZRAM_BACKEND_ZSTD=y
CONFIG_ZRAM_BACKEND_DEFLATE=y
CONFIG_ZRAM_BACKEND_842=y
CONFIG_ZRAM_BACKEND_LZO=y
CONFIG_ZRAM_DEF_COMP_LZORLE=y
# CONFIG_ZRAM_DEF_COMP_LZO is not set
# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
# CONFIG_ZRAM_DEF_COMP_DEFLATE is not set
# CONFIG_ZRAM_DEF_COMP_842 is not set
CONFIG_ZRAM_DEF_COMP="lzo-rle"
CONFIG_ZRAM_WRITEBACK=y
# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set
# CONFIG_ZRAM_MEMORY_TRACKING is not set
CONFIG_ZRAM_MULTI_COMP=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_LOOP_MIN_COUNT=0
# CONFIG_BLK_DEV_DRBD is not set
# CONFIG_BLK_DEV_NBD is not set
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_COUNT=16
CONFIG_BLK_DEV_RAM_SIZE=16384
# CONFIG_ATA_OVER_ETH is not set
CONFIG_VIRTIO_BLK=y
# CONFIG_BLK_DEV_RBD is not set
# CONFIG_BLK_DEV_UBLK is not set
# CONFIG_BLK_DEV_ZONED_LOOP is not set
#
# NVME Support
#
CONFIG_NVME_CORE=y
CONFIG_BLK_DEV_NVME=y
CONFIG_NVME_MULTIPATH=y
# CONFIG_NVME_VERBOSE_ERRORS is not set
CONFIG_NVME_HWMON=y
# CONFIG_NVME_FC is not set
# CONFIG_NVME_TCP is not set
# CONFIG_NVME_HOST_AUTH is not set
CONFIG_NVME_TARGET=y
# CONFIG_NVME_TARGET_DEBUGFS is not set
CONFIG_NVME_TARGET_PASSTHRU=y
# CONFIG_NVME_TARGET_LOOP is not set
# CONFIG_NVME_TARGET_FC is not set
# CONFIG_NVME_TARGET_TCP is not set
# CONFIG_NVME_TARGET_AUTH is not set
# end of NVME Support
#
# Misc devices
#
# CONFIG_AD525X_DPOT is not set
# CONFIG_DUMMY_IRQ is not set
# CONFIG_PHANTOM is not set
# CONFIG_RPMB is not set
# CONFIG_TI_FPC202 is not set
# CONFIG_TIFM_CORE is not set
# CONFIG_ICS932S401 is not set
# CONFIG_ENCLOSURE_SERVICES is not set
# CONFIG_HP_ILO is not set
# CONFIG_APDS9802ALS is not set
# CONFIG_ISL29003 is not set
# CONFIG_ISL29020 is not set
# CONFIG_SENSORS_TSL2550 is not set
# CONFIG_SENSORS_BH1770 is not set
# CONFIG_HMC6352 is not set
# CONFIG_DS1682 is not set
# CONFIG_LATTICE_ECP3_CONFIG is not set
# CONFIG_SRAM is not set
# CONFIG_DW_XDATA_PCIE is not set
# CONFIG_PCI_ENDPOINT_TEST is not set
# CONFIG_XILINX_SDFEC is not set
# CONFIG_NTSYNC is not set
# CONFIG_NSM is not set
# CONFIG_C2PORT is not set
#
# EEPROM support
#
# CONFIG_EEPROM_MAX6875 is not set
# CONFIG_EEPROM_93CX6 is not set
# CONFIG_EEPROM_IDT_89HPESX is not set
# end of EEPROM support
# CONFIG_CB710_CORE is not set
# CONFIG_SENSORS_LIS3_I2C is not set
# CONFIG_ALTERA_STAPL is not set
CONFIG_INTEL_MEI=m
CONFIG_INTEL_MEI_ME=m
CONFIG_INTEL_MEI_TXE=m
CONFIG_INTEL_MEI_GSC=m
# CONFIG_INTEL_MEI_CSC is not set
CONFIG_INTEL_MEI_VSC_HW=m
CONFIG_INTEL_MEI_VSC=m
CONFIG_INTEL_MEI_HDCP=m
CONFIG_INTEL_MEI_PXP=m
CONFIG_INTEL_MEI_GSC_PROXY=m
# CONFIG_VMWARE_VMCI is not set
# CONFIG_GENWQE is not set
# CONFIG_BCM_VK is not set
# CONFIG_MISC_ALCOR_PCI is not set
# CONFIG_MISC_RTSX_PCI is not set
# CONFIG_MISC_RTSX_USB is not set
# CONFIG_UACCE is not set
# CONFIG_PVPANIC is not set
# CONFIG_GP_PCI1XXXX is not set
# CONFIG_KEBA_CP500 is not set
# CONFIG_INTEL_SSEI is not set
# end of Misc devices
#
# SCSI device support
#
CONFIG_SCSI_MOD=y
# CONFIG_RAID_ATTRS is not set
CONFIG_SCSI_COMMON=y
CONFIG_SCSI=y
CONFIG_SCSI_DMA=y
CONFIG_SCSI_PROC_FS=y
#
# SCSI support type (disk, tape, CD-ROM)
#
CONFIG_BLK_DEV_SD=y
# CONFIG_CHR_DEV_ST is not set
CONFIG_BLK_DEV_SR=y
CONFIG_CHR_DEV_SG=y
CONFIG_BLK_DEV_BSG=y
# CONFIG_CHR_DEV_SCH is not set
CONFIG_SCSI_CONSTANTS=y
CONFIG_SCSI_LOGGING=y
CONFIG_SCSI_SCAN_ASYNC=y
#
# SCSI Transports
#
# CONFIG_SCSI_SPI_ATTRS is not set
# CONFIG_SCSI_FC_ATTRS is not set
# CONFIG_SCSI_ISCSI_ATTRS is not set
# CONFIG_SCSI_SAS_ATTRS is not set
# CONFIG_SCSI_SAS_LIBSAS is not set
# CONFIG_SCSI_SRP_ATTRS is not set
# end of SCSI Transports
# CONFIG_SCSI_LOWLEVEL is not set
# CONFIG_SCSI_DH is not set
# end of SCSI device support
CONFIG_ATA=y
CONFIG_SATA_HOST=y
CONFIG_PATA_TIMINGS=y
CONFIG_ATA_VERBOSE_ERROR=y
CONFIG_ATA_FORCE=y
CONFIG_ATA_ACPI=y
# CONFIG_SATA_ZPODD is not set
# CONFIG_SATA_PMP is not set
#
# Controllers with non-SFF native interface
#
CONFIG_SATA_AHCI=y
CONFIG_SATA_MOBILE_LPM_POLICY=3
# CONFIG_SATA_AHCI_PLATFORM is not set
# CONFIG_AHCI_DWC is not set
# CONFIG_SATA_INIC162X is not set
# CONFIG_SATA_ACARD_AHCI is not set
# CONFIG_SATA_SIL24 is not set
# CONFIG_ATA_SFF is not set
CONFIG_MD=y
# CONFIG_BLK_DEV_MD is not set
# CONFIG_BCACHE is not set
CONFIG_BLK_DEV_DM_BUILTIN=y
CONFIG_BLK_DEV_DM=y
# CONFIG_DM_DEBUG is not set
# CONFIG_DM_UNSTRIPED is not set
# CONFIG_DM_CRYPT is not set
# CONFIG_DM_INLINECRYPT is not set
# CONFIG_DM_SNAPSHOT is not set
# CONFIG_DM_THIN_PROVISIONING is not set
# CONFIG_DM_CACHE is not set
# CONFIG_DM_WRITECACHE is not set
# CONFIG_DM_EBS is not set
# CONFIG_DM_ERA is not set
# CONFIG_DM_CLONE is not set
# CONFIG_DM_MIRROR is not set
# CONFIG_DM_RAID is not set
# CONFIG_DM_ZERO is not set
# CONFIG_DM_MULTIPATH is not set
# CONFIG_DM_DELAY is not set
# CONFIG_DM_DUST is not set
# CONFIG_DM_INIT is not set
CONFIG_DM_UEVENT=y
# CONFIG_DM_FLAKEY is not set
# CONFIG_DM_VERITY is not set
# CONFIG_DM_SWITCH is not set
# CONFIG_DM_LOG_WRITES is not set
# CONFIG_DM_INTEGRITY is not set
# CONFIG_DM_ZONED is not set
CONFIG_DM_AUDIT=y
# CONFIG_DM_VDO is not set
# CONFIG_DM_PCACHE is not set
# CONFIG_TARGET_CORE is not set
# CONFIG_FUSION is not set
#
# IEEE 1394 (FireWire) support
#
# CONFIG_FIREWIRE is not set
# CONFIG_FIREWIRE_NOSY is not set
# end of IEEE 1394 (FireWire) support
# CONFIG_MACINTOSH_DRIVERS is not set
CONFIG_NETDEVICES=y
CONFIG_NET_CORE=y
# CONFIG_BONDING is not set
# CONFIG_DUMMY is not set
CONFIG_WIREGUARD=m
# CONFIG_WIREGUARD_DEBUG is not set
# CONFIG_OVPN is not set
# CONFIG_EQUALIZER is not set
# CONFIG_NET_FC is not set
# CONFIG_IFB is not set
# CONFIG_NET_TEAM is not set
# CONFIG_MACVLAN is not set
CONFIG_IPVLAN_L3S=y
CONFIG_IPVLAN=m
CONFIG_IPVTAP=m
# CONFIG_VXLAN is not set
# CONFIG_GENEVE is not set
# CONFIG_BAREUDP is not set
# CONFIG_GTP is not set
# CONFIG_PFCP is not set
# CONFIG_AMT is not set
CONFIG_MACSEC=y
CONFIG_NETCONSOLE=y
CONFIG_NETCONSOLE_DYNAMIC=y
# CONFIG_NETCONSOLE_EXTENDED_LOG is not set
CONFIG_NETPOLL=y
CONFIG_NET_POLL_CONTROLLER=y
CONFIG_TUN=m
CONFIG_TAP=m
# CONFIG_TUN_VNET_CROSS_LE is not set
CONFIG_VETH=m
CONFIG_VIRTIO_NET=y
CONFIG_NLMON=y
CONFIG_NETKIT=y
# CONFIG_NET_VRF is not set
# CONFIG_VSOCKMON is not set
# CONFIG_ARCNET is not set
CONFIG_ETHERNET=y
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_NET_VENDOR_ADAPTEC is not set
# CONFIG_NET_VENDOR_AGERE is not set
# CONFIG_NET_VENDOR_ALACRITECH is not set
# CONFIG_NET_VENDOR_ALIBABA is not set
# CONFIG_ALTERA_TSE is not set
# CONFIG_NET_VENDOR_AMAZON is not set
# CONFIG_NET_VENDOR_AMD is not set
# CONFIG_NET_VENDOR_AQUANTIA is not set
# CONFIG_NET_VENDOR_ARC is not set
# CONFIG_NET_VENDOR_ASIX is not set
# CONFIG_NET_VENDOR_ATHEROS is not set
# CONFIG_CX_ECAT is not set
# CONFIG_NET_VENDOR_BROADCOM is not set
# CONFIG_NET_VENDOR_CADENCE is not set
# CONFIG_NET_VENDOR_CAVIUM is not set
# CONFIG_NET_VENDOR_CHELSIO is not set
# CONFIG_NET_VENDOR_CISCO is not set
# CONFIG_NET_VENDOR_CORTINA is not set
# CONFIG_NET_VENDOR_DAVICOM is not set
# CONFIG_NET_VENDOR_DEC is not set
# CONFIG_NET_VENDOR_DLINK is not set
# CONFIG_NET_VENDOR_EMULEX is not set
# CONFIG_NET_VENDOR_ENGLEDER is not set
# CONFIG_NET_VENDOR_EZCHIP is not set
# CONFIG_NET_VENDOR_FUNGIBLE is not set
# CONFIG_NET_VENDOR_GOOGLE is not set
# CONFIG_NET_VENDOR_HISILICON is not set
# CONFIG_NET_VENDOR_HUAWEI is not set
# CONFIG_NET_VENDOR_I825XX is not set
CONFIG_NET_VENDOR_INTEL=y
# CONFIG_E100 is not set
# CONFIG_E1000 is not set
# CONFIG_E1000E is not set
# CONFIG_IGB is not set
# CONFIG_IGBVF is not set
# CONFIG_IXGBE is not set
# CONFIG_IXGBEVF is not set
# CONFIG_I40E is not set
# CONFIG_I40EVF is not set
# CONFIG_ICE is not set
# CONFIG_FM10K is not set
CONFIG_IGC=y
# CONFIG_IDPF is not set
# CONFIG_IXD is not set
# CONFIG_JME is not set
# CONFIG_NET_VENDOR_ADI is not set
# CONFIG_NET_VENDOR_LITEX is not set
# CONFIG_NET_VENDOR_MARVELL is not set
# CONFIG_NET_VENDOR_MELLANOX is not set
# CONFIG_NET_VENDOR_META is not set
# CONFIG_NET_VENDOR_MICREL is not set
# CONFIG_NET_VENDOR_MICROCHIP is not set
# CONFIG_NET_VENDOR_MICROSEMI is not set
# CONFIG_NET_VENDOR_MICROSOFT is not set
# CONFIG_NET_VENDOR_MUCSE is not set
# CONFIG_NET_VENDOR_MYRI is not set
# CONFIG_FEALNX is not set
# CONFIG_NET_VENDOR_NI is not set
# CONFIG_NET_VENDOR_NATSEMI is not set
# CONFIG_NET_VENDOR_NETRONOME is not set
# CONFIG_NET_VENDOR_NVIDIA is not set
# CONFIG_NET_VENDOR_OKI is not set
# CONFIG_ETHOC is not set
# CONFIG_NET_VENDOR_PENSANDO is not set
# CONFIG_NET_VENDOR_QLOGIC is not set
# CONFIG_NET_VENDOR_BROCADE is not set
# CONFIG_NET_VENDOR_QUALCOMM is not set
# CONFIG_NET_VENDOR_RDC is not set
# CONFIG_NET_VENDOR_REALTEK is not set
# CONFIG_NET_VENDOR_RENESAS is not set
# CONFIG_NET_VENDOR_ROCKER is not set
# CONFIG_NET_VENDOR_SAMSUNG is not set
# CONFIG_NET_VENDOR_SEEQ is not set
# CONFIG_NET_VENDOR_SILAN is not set
# CONFIG_NET_VENDOR_SIS is not set
# CONFIG_NET_VENDOR_SOLARFLARE is not set
# CONFIG_NET_VENDOR_SMSC is not set
# CONFIG_NET_VENDOR_SOCIONEXT is not set
# CONFIG_NET_VENDOR_STMICRO is not set
# CONFIG_NET_VENDOR_SUN is not set
# CONFIG_NET_VENDOR_SYNOPSYS is not set
# CONFIG_NET_VENDOR_TEHUTI is not set
# CONFIG_NET_VENDOR_TI is not set
# CONFIG_NET_VENDOR_VERTEXCOM is not set
# CONFIG_NET_VENDOR_VIA is not set
# CONFIG_NET_VENDOR_WANGXUN is not set
# CONFIG_NET_VENDOR_WIZNET is not set
# CONFIG_NET_VENDOR_XILINX is not set
# CONFIG_NET_VENDOR_ZTE is not set
# CONFIG_FDDI is not set
CONFIG_PHYLIB=y
CONFIG_LED_TRIGGER_PHY=y
# CONFIG_FIXED_PHY is not set
#
# MII PHY device drivers
#
# CONFIG_AS21XXX_PHY is not set
# CONFIG_AIR_AN8801_PHY is not set
# CONFIG_AIR_EN8811H_PHY is not set
# CONFIG_AMD_PHY is not set
# CONFIG_ADIN_PHY is not set
# CONFIG_ADIN1100_PHY is not set
# CONFIG_ADIN1140_PHY is not set
# CONFIG_AQUANTIA_PHY is not set
# CONFIG_AX88796B_PHY is not set
# CONFIG_BROADCOM_PHY is not set
# CONFIG_BCM54140_PHY is not set
# CONFIG_BCM7XXX_PHY is not set
# CONFIG_BCM84881_PHY is not set
# CONFIG_BCM87XX_PHY is not set
# CONFIG_CICADA_PHY is not set
# CONFIG_CORTINA_PHY is not set
# CONFIG_DAVICOM_PHY is not set
# CONFIG_ICPLUS_PHY is not set
# CONFIG_LXT_PHY is not set
# CONFIG_INTEL_XWAY_PHY is not set
# CONFIG_LSI_ET1011C_PHY is not set
# CONFIG_MARVELL_PHY is not set
# CONFIG_MARVELL_10G_PHY is not set
# CONFIG_MARVELL_88Q2XXX_PHY is not set
# CONFIG_MARVELL_88X2222_PHY is not set
# CONFIG_MAXLINEAR_GPHY is not set
# CONFIG_MAXLINEAR_86110_PHY is not set
# CONFIG_MEDIATEK_GE_PHY is not set
# CONFIG_MICREL_PHY is not set
# CONFIG_MICROCHIP_T1S_PHY is not set
# CONFIG_MICROCHIP_PHY is not set
# CONFIG_MICROCHIP_T1_PHY is not set
# CONFIG_MICROSEMI_PHY is not set
# CONFIG_MOTORCOMM_PHY is not set
# CONFIG_NATIONAL_PHY is not set
# CONFIG_NXP_CBTX_PHY is not set
# CONFIG_NXP_C45_TJA11XX_PHY is not set
# CONFIG_NXP_TJA11XX_PHY is not set
# CONFIG_NCN26000_PHY is not set
# CONFIG_QCA83XX_PHY is not set
# CONFIG_QCA808X_PHY is not set
# CONFIG_QSEMI_PHY is not set
# CONFIG_REALTEK_PHY is not set
# CONFIG_RENESAS_PHY is not set
# CONFIG_ROCKCHIP_PHY is not set
# CONFIG_SMSC_PHY is not set
# CONFIG_STE10XP is not set
# CONFIG_TERANETICS_PHY is not set
# CONFIG_DP83822_PHY is not set
# CONFIG_DP83TC811_PHY is not set
# CONFIG_DP83848_PHY is not set
# CONFIG_DP83867_PHY is not set
# CONFIG_DP83869_PHY is not set
# CONFIG_DP83TD510_PHY is not set
# CONFIG_DP83TG720_PHY is not set
# CONFIG_VITESSE_PHY is not set
# CONFIG_XILINX_GMII2RGMII is not set
#
# MCTP Device Drivers
#
# CONFIG_MCTP_SERIAL is not set
# CONFIG_MCTP_TRANSPORT_USBLIB is not set
# CONFIG_MCTP_TRANSPORT_USB is not set
# end of MCTP Device Drivers
#
# MDIO controller drivers
#
CONFIG_FWNODE_MDIO=y
CONFIG_ACPI_MDIO=y
# CONFIG_MDIO_BITBANG is not set
# CONFIG_MDIO_BCM_UNIMAC is not set
# CONFIG_MDIO_MVUSB is not set
# CONFIG_MDIO_MSCC_MIIM is not set
# CONFIG_MDIO_THUNDER is not set
#
# MDIO Multiplexers
#
# end of MDIO Multiplexers
# end of MDIO controller drivers
#
# PCS device drivers
#
# CONFIG_PCS_XPCS is not set
# end of PCS device drivers
# CONFIG_PPP is not set
# CONFIG_SLIP is not set
# CONFIG_USB_NET_DRIVERS is not set
CONFIG_WLAN=y
# CONFIG_WLAN_VENDOR_ADMTEK is not set
# CONFIG_WLAN_VENDOR_ATH is not set
# CONFIG_WLAN_VENDOR_ATMEL is not set
# CONFIG_WLAN_VENDOR_BROADCOM is not set
CONFIG_WLAN_VENDOR_INTEL=y
# CONFIG_IPW2100 is not set
# CONFIG_IPW2200 is not set
# CONFIG_IWL4965 is not set
# CONFIG_IWL3945 is not set
CONFIG_IWLWIFI=m
CONFIG_IWLWIFI_LEDS=y
CONFIG_IWLDVM=m
CONFIG_IWLMVM=m
CONFIG_IWLMLD=m
CONFIG_IWLWIFI_OPMODE_MODULAR=y
#
# Debugging Options
#
CONFIG_IWLWIFI_DEBUG=y
CONFIG_IWLWIFI_DEBUGFS=y
# CONFIG_IWLWIFI_DEVICE_TRACING is not set
# end of Debugging Options
# CONFIG_WLAN_VENDOR_INTERSIL is not set
# CONFIG_WLAN_VENDOR_MARVELL is not set
# CONFIG_WLAN_VENDOR_MEDIATEK is not set
# CONFIG_WLAN_VENDOR_MICROCHIP is not set
CONFIG_WLAN_VENDOR_MORSEMICRO=y
# CONFIG_MM81X_USB is not set
CONFIG_WLAN_VENDOR_NXP=y
# CONFIG_WLAN_VENDOR_PURELIFI is not set
# CONFIG_WLAN_VENDOR_RALINK is not set
# CONFIG_WLAN_VENDOR_REALTEK is not set
# CONFIG_WLAN_VENDOR_RSI is not set
# CONFIG_WLAN_VENDOR_SILABS is not set
# CONFIG_WLAN_VENDOR_ST is not set
# CONFIG_WLAN_VENDOR_TI is not set
# CONFIG_WLAN_VENDOR_ZYDAS is not set
# CONFIG_WLAN_VENDOR_QUANTENNA is not set
# CONFIG_MAC80211_HWSIM is not set
# CONFIG_VIRT_WIFI is not set
# CONFIG_WAN is not set
#
# Wireless WAN
#
# CONFIG_WWAN is not set
# end of Wireless WAN
# CONFIG_VMXNET3 is not set
# CONFIG_FUJITSU_ES is not set
# CONFIG_USB4_NET is not set
# CONFIG_NETDEVSIM is not set
CONFIG_NET_FAILOVER=y
#
# Input device support
#
CONFIG_INPUT=y
CONFIG_INPUT_LEDS=y
# CONFIG_INPUT_FF_MEMLESS is not set
# CONFIG_INPUT_SPARSEKMAP is not set
# CONFIG_INPUT_MATRIXKMAP is not set
CONFIG_INPUT_VIVALDIFMAP=y
#
# Userland interfaces
#
CONFIG_INPUT_MOUSEDEV=y
# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
# CONFIG_INPUT_JOYDEV is not set
CONFIG_INPUT_EVDEV=y
#
# Input Device Drivers
#
CONFIG_INPUT_KEYBOARD=y
# CONFIG_KEYBOARD_ADP5588 is not set
# CONFIG_KEYBOARD_APPLESPI is not set
CONFIG_KEYBOARD_ATKBD=y
# CONFIG_KEYBOARD_QT1050 is not set
# CONFIG_KEYBOARD_QT1070 is not set
# CONFIG_KEYBOARD_QT2160 is not set
# CONFIG_KEYBOARD_DLINK_DIR685 is not set
# CONFIG_KEYBOARD_LKKBD is not set
# CONFIG_KEYBOARD_GPIO is not set
# CONFIG_KEYBOARD_GPIO_POLLED is not set
# CONFIG_KEYBOARD_TCA8418 is not set
# CONFIG_KEYBOARD_MATRIX is not set
# CONFIG_KEYBOARD_CHARLIEPLEX is not set
# CONFIG_KEYBOARD_LM8323 is not set
# CONFIG_KEYBOARD_LM8333 is not set
# CONFIG_KEYBOARD_MAX7359 is not set
# CONFIG_KEYBOARD_MPR121 is not set
# CONFIG_KEYBOARD_NEWTON is not set
# CONFIG_KEYBOARD_OPENCORES is not set
# CONFIG_KEYBOARD_SAMSUNG is not set
# CONFIG_KEYBOARD_STOWAWAY is not set
# CONFIG_KEYBOARD_SUNKBD is not set
# CONFIG_KEYBOARD_TM2_TOUCHKEY is not set
# CONFIG_KEYBOARD_XTKBD is not set
# CONFIG_KEYBOARD_CYPRESS_SF is not set
CONFIG_INPUT_MOUSE=y
# CONFIG_MOUSE_PS2 is not set
# CONFIG_MOUSE_SERIAL is not set
# CONFIG_MOUSE_APPLETOUCH is not set
# CONFIG_MOUSE_BCM5974 is not set
# CONFIG_MOUSE_CYAPA is not set
# CONFIG_MOUSE_ELAN_I2C is not set
# CONFIG_MOUSE_VSXXXAA is not set
# CONFIG_MOUSE_GPIO is not set
# CONFIG_MOUSE_SYNAPTICS_I2C is not set
# CONFIG_MOUSE_SYNAPTICS_USB is not set
# CONFIG_INPUT_JOYSTICK is not set
# CONFIG_INPUT_TABLET is not set
# CONFIG_INPUT_TOUCHSCREEN is not set
# CONFIG_INPUT_MISC is not set
# CONFIG_RMI4_CORE is not set
#
# Hardware I/O ports
#
CONFIG_SERIO=y
CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
CONFIG_SERIO_I8042=y
CONFIG_SERIO_SERPORT=y
# CONFIG_SERIO_PCIPS2 is not set
CONFIG_SERIO_LIBPS2=y
# CONFIG_SERIO_RAW is not set
# CONFIG_SERIO_ALTERA_PS2 is not set
# CONFIG_SERIO_PS2MULT is not set
# CONFIG_SERIO_ARC_PS2 is not set
# CONFIG_SERIO_GPIO_PS2 is not set
# CONFIG_USERIO is not set
# CONFIG_GAMEPORT is not set
# end of Hardware I/O ports
# end of Input device support
#
# Character devices
#
CONFIG_TTY=y
CONFIG_VT=y
CONFIG_CONSOLE_TRANSLATIONS=y
CONFIG_VT_CONSOLE=y
CONFIG_VT_CONSOLE_SLEEP=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_UNIX98_PTYS=y
# CONFIG_LEGACY_PTYS is not set
# CONFIG_LEGACY_TIOCSTI is not set
CONFIG_LDISC_AUTOLOAD=y
#
# Serial drivers
#
CONFIG_SERIAL_EARLYCON=y
CONFIG_SERIAL_8250=y
CONFIG_SERIAL_8250_PNP=y
# CONFIG_SERIAL_8250_16550A_VARIANTS is not set
# CONFIG_SERIAL_8250_FINTEK is not set
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_8250_DMA=y
CONFIG_SERIAL_8250_PCILIB=y
CONFIG_SERIAL_8250_PCI=y
# CONFIG_SERIAL_8250_EXAR is not set
CONFIG_SERIAL_8250_MOXA_PCIE=y
CONFIG_SERIAL_8250_NR_UARTS=32
CONFIG_SERIAL_8250_RUNTIME_UARTS=32
# CONFIG_SERIAL_8250_EXTENDED is not set
# CONFIG_SERIAL_8250_PCI1XXXX is not set
# CONFIG_SERIAL_8250_DW is not set
# CONFIG_SERIAL_8250_RT288X is not set
# CONFIG_SERIAL_8250_LPSS is not set
# CONFIG_SERIAL_8250_MID is not set
# CONFIG_SERIAL_8250_PERICOM is not set
# CONFIG_SERIAL_8250_NI is not set
#
# Non-8250 serial port support
#
# CONFIG_SERIAL_MAX3100 is not set
# CONFIG_SERIAL_MAX310X is not set
# CONFIG_SERIAL_UARTLITE is not set
CONFIG_SERIAL_CORE=y
CONFIG_SERIAL_CORE_CONSOLE=y
CONFIG_CONSOLE_POLL=y
# CONFIG_SERIAL_JSM is not set
# CONFIG_SERIAL_LANTIQ is not set
# CONFIG_SERIAL_SCCNXP is not set
# CONFIG_SERIAL_SC16IS7XX is not set
# CONFIG_SERIAL_ALTERA_JTAGUART is not set
# CONFIG_SERIAL_ALTERA_UART is not set
# CONFIG_SERIAL_ARC is not set
# CONFIG_SERIAL_RP2 is not set
# CONFIG_SERIAL_FSL_LPUART is not set
# CONFIG_SERIAL_FSL_LINFLEXUART is not set
# CONFIG_SERIAL_SPRD is not set
# end of Serial drivers
CONFIG_SERIAL_MCTRL_GPIO=y
# CONFIG_SERIAL_NONSTANDARD is not set
# CONFIG_N_GSM is not set
# CONFIG_NOZOMI is not set
# CONFIG_NULL_TTY is not set
CONFIG_HVC_DRIVER=y
CONFIG_SERIAL_DEV_BUS=y
CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
# CONFIG_TTY_PRINTK is not set
CONFIG_VIRTIO_CONSOLE=y
# CONFIG_IPMI_HANDLER is not set
CONFIG_HW_RANDOM=y
CONFIG_HW_RANDOM_TIMERIOMEM=y
CONFIG_HW_RANDOM_INTEL=y
# CONFIG_HW_RANDOM_AMD is not set
# CONFIG_HW_RANDOM_BA431 is not set
# CONFIG_HW_RANDOM_VIA is not set
CONFIG_HW_RANDOM_VIRTIO=y
# CONFIG_HW_RANDOM_XIPHERA is not set
CONFIG_DEVMEM=y
CONFIG_NVRAM=y
CONFIG_DEVPORT=y
CONFIG_HPET=y
# CONFIG_HPET_MMAP is not set
CONFIG_HANGCHECK_TIMER=m
CONFIG_TCG_TPM=y
# CONFIG_TCG_TPM2_HMAC is not set
CONFIG_HW_RANDOM_TPM=y
CONFIG_TCG_TIS_CORE=y
CONFIG_TCG_TIS=y
CONFIG_TCG_TIS_SPI=m
CONFIG_TCG_TIS_SPI_CR50=y
CONFIG_TCG_TIS_I2C=m
CONFIG_TCG_TIS_I2C_CR50=m
# CONFIG_TCG_TIS_I2C_ATMEL is not set
CONFIG_TCG_TIS_I2C_INFINEON=m
CONFIG_TCG_TIS_I2C_NUVOTON=m
CONFIG_TCG_NSC=m
CONFIG_TCG_ATMEL=m
CONFIG_TCG_INFINEON=m
CONFIG_TCG_CRB=y
CONFIG_TCG_VTPM_PROXY=m
# CONFIG_TCG_TIS_ST33ZP24_I2C is not set
# CONFIG_TCG_TIS_ST33ZP24_SPI is not set
# CONFIG_TELCLOCK is not set
# CONFIG_XILLYBUS is not set
# CONFIG_XILLYUSB is not set
# end of Character devices
#
# I2C support
#
CONFIG_I2C=y
CONFIG_ACPI_I2C_OPREGION=y
CONFIG_I2C_BOARDINFO=y
CONFIG_I2C_CHARDEV=y
CONFIG_I2C_MUX=y
#
# Multiplexer I2C Chip support
#
# CONFIG_I2C_MUX_GPIO is not set
# CONFIG_I2C_MUX_LTC4306 is not set
# CONFIG_I2C_MUX_PCA9541 is not set
# CONFIG_I2C_MUX_PCA954x is not set
# CONFIG_I2C_MUX_REG is not set
# CONFIG_I2C_MUX_MLXCPLD is not set
# end of Multiplexer I2C Chip support
CONFIG_I2C_HELPER_AUTO=y
CONFIG_I2C_SMBUS=y
CONFIG_I2C_ALGOBIT=m
#
# I2C Hardware Bus support
#
#
# PC SMBus host controller drivers
#
# CONFIG_I2C_ALI1535 is not set
# CONFIG_I2C_ALI1563 is not set
# CONFIG_I2C_ALI15X3 is not set
# CONFIG_I2C_AMD756 is not set
# CONFIG_I2C_AMD8111 is not set
# CONFIG_I2C_AMD_MP2 is not set
CONFIG_I2C_I801=y
# CONFIG_I2C_ISCH is not set
# CONFIG_I2C_ISMT is not set
# CONFIG_I2C_PIIX4 is not set
# CONFIG_I2C_NFORCE2 is not set
# CONFIG_I2C_NVIDIA_GPU is not set
# CONFIG_I2C_SIS5595 is not set
# CONFIG_I2C_SIS630 is not set
# CONFIG_I2C_SIS96X is not set
# CONFIG_I2C_VIA is not set
# CONFIG_I2C_VIAPRO is not set
# CONFIG_I2C_ZHAOXIN is not set
#
# ACPI drivers
#
# CONFIG_I2C_SCMI is not set
#
# I2C system bus drivers (mostly embedded / system-on-chip)
#
# CONFIG_I2C_CBUS_GPIO is not set
# CONFIG_I2C_DESIGNWARE_CORE is not set
# CONFIG_I2C_EMEV2 is not set
# CONFIG_I2C_GPIO is not set
# CONFIG_I2C_OCORES is not set
# CONFIG_I2C_PCA_PLATFORM is not set
# CONFIG_I2C_SIMTEC is not set
# CONFIG_I2C_XILINX is not set
#
# External I2C/SMBus adapter drivers
#
# CONFIG_I2C_DIOLAN_U2C is not set
# CONFIG_I2C_CP2615 is not set
# CONFIG_I2C_PCI1XXXX is not set
# CONFIG_I2C_ROBOTFUZZ_OSIF is not set
# CONFIG_I2C_TAOS_EVM is not set
# CONFIG_I2C_TINY_USB is not set
#
# Other I2C/SMBus bus drivers
#
# CONFIG_I2C_MLXCPLD is not set
# CONFIG_I2C_VIRTIO is not set
# end of I2C Hardware Bus support
# CONFIG_I2C_STUB is not set
# CONFIG_I2C_SLAVE is not set
# CONFIG_I2C_DEBUG_CORE is not set
# CONFIG_I2C_DEBUG_ALGO is not set
# CONFIG_I2C_DEBUG_BUS is not set
# end of I2C support
# CONFIG_I3C is not set
CONFIG_I3C_OR_I2C=y
CONFIG_SPI=y
# CONFIG_SPI_DEBUG is not set
CONFIG_SPI_MASTER=y
CONFIG_SPI_MEM=y
#
# SPI Master Controller Drivers
#
# CONFIG_SPI_ALTERA is not set
# CONFIG_SPI_AXI_SPI_ENGINE is not set
# CONFIG_SPI_BITBANG is not set
# CONFIG_SPI_CADENCE is not set
# CONFIG_SPI_CH341 is not set
# CONFIG_SPI_DESIGNWARE is not set
# CONFIG_SPI_GPIO is not set
CONFIG_SPI_INTEL=y
CONFIG_SPI_INTEL_PCI=y
# CONFIG_SPI_INTEL_PLATFORM is not set
# CONFIG_SPI_MICROCHIP_CORE_QSPI is not set
# CONFIG_SPI_MICROCHIP_CORE_SPI is not set
# CONFIG_SPI_LANTIQ_SSC is not set
# CONFIG_SPI_OC_TINY is not set
# CONFIG_SPI_PCI1XXXX is not set
# CONFIG_SPI_PXA2XX is not set
# CONFIG_SPI_SC18IS602 is not set
# CONFIG_SPI_SIFIVE is not set
# CONFIG_SPI_MXIC is not set
# CONFIG_SPI_VIRTIO is not set
# CONFIG_SPI_XCOMM is not set
# CONFIG_SPI_XILINX is not set
# CONFIG_SPI_ZYNQMP_GQSPI is not set
# CONFIG_SPI_AMD is not set
#
# SPI Multiplexer support
#
CONFIG_SPI_MUX=y
#
# SPI Protocol Masters
#
CONFIG_SPI_SPIDEV=y
# CONFIG_SPI_LOOPBACK_TEST is not set
# CONFIG_SPI_TLE62X0 is not set
# CONFIG_SPI_SLAVE is not set
CONFIG_SPI_DYNAMIC=y
# CONFIG_SPMI is not set
# CONFIG_HSI is not set
CONFIG_PPS=y
# CONFIG_PPS_DEBUG is not set
#
# PPS clients support
#
# CONFIG_PPS_CLIENT_KTIMER is not set
# CONFIG_PPS_CLIENT_LDISC is not set
# CONFIG_PPS_CLIENT_GPIO is not set
# CONFIG_PPS_GENERATOR is not set
#
# PTP clock support
#
CONFIG_PTP_1588_CLOCK=y
CONFIG_PTP_1588_CLOCK_OPTIONAL=y
# CONFIG_DP83640_PHY is not set
# CONFIG_PTP_1588_CLOCK_INES is not set
CONFIG_PTP_1588_CLOCK_VMCLOCK=m
# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set
# CONFIG_PTP_1588_CLOCK_IDTCM is not set
# CONFIG_PTP_1588_CLOCK_FC3W is not set
# CONFIG_PTP_1588_CLOCK_MOCK is not set
# CONFIG_PTP_NETC_V4_TIMER is not set
# end of PTP clock support
#
# DPLL device support
#
# CONFIG_ZL3073X_I2C is not set
# CONFIG_ZL3073X_SPI is not set
# end of DPLL device support
CONFIG_PINCTRL=y
CONFIG_PINMUX=y
CONFIG_PINCONF=y
CONFIG_GENERIC_PINCONF=y
# CONFIG_DEBUG_PINCTRL is not set
# CONFIG_PINCTRL_AMD is not set
# CONFIG_PINCTRL_CY8C95X0 is not set
# CONFIG_PINCTRL_MCP23S08 is not set
# CONFIG_PINCTRL_SX150X is not set
#
# Intel pinctrl drivers
#
# CONFIG_PINCTRL_BAYTRAIL is not set
# CONFIG_PINCTRL_CHERRYVIEW is not set
# CONFIG_PINCTRL_LYNXPOINT is not set
CONFIG_PINCTRL_INTEL=y
CONFIG_PINCTRL_INTEL_PLATFORM=y
# CONFIG_PINCTRL_ALDERLAKE is not set
# CONFIG_PINCTRL_BROXTON is not set
# CONFIG_PINCTRL_CANNONLAKE is not set
# CONFIG_PINCTRL_CEDARFORK is not set
# CONFIG_PINCTRL_DENVERTON is not set
# CONFIG_PINCTRL_ELKHARTLAKE is not set
# CONFIG_PINCTRL_EMMITSBURG is not set
# CONFIG_PINCTRL_GEMINILAKE is not set
# CONFIG_PINCTRL_ICELAKE is not set
# CONFIG_PINCTRL_JASPERLAKE is not set
# CONFIG_PINCTRL_LAKEFIELD is not set
# CONFIG_PINCTRL_LEWISBURG is not set
# CONFIG_PINCTRL_METEORLAKE is not set
# CONFIG_PINCTRL_METEORPOINT is not set
# CONFIG_PINCTRL_SUNRISEPOINT is not set
CONFIG_PINCTRL_TIGERLAKE=y
# end of Intel pinctrl drivers
#
# Renesas pinctrl drivers
#
# end of Renesas pinctrl drivers
CONFIG_GPIOLIB_LEGACY=y
CONFIG_GPIOLIB=y
CONFIG_GPIOLIB_FASTPATH_LIMIT=512
CONFIG_GPIO_ACPI=y
CONFIG_GPIOLIB_IRQCHIP=y
# CONFIG_DEBUG_GPIO is not set
# CONFIG_GPIO_SYSFS is not set
CONFIG_GPIO_CDEV=y
# CONFIG_GPIO_CDEV_V1 is not set
#
# Memory mapped GPIO drivers
#
# CONFIG_GPIO_ALTERA is not set
# CONFIG_GPIO_AMDPT is not set
# CONFIG_GPIO_BY_PINCTRL is not set
# CONFIG_GPIO_DWAPB is not set
# CONFIG_GPIO_GENERIC_PLATFORM is not set
# CONFIG_GPIO_GRANITERAPIDS is not set
# CONFIG_GPIO_MB86S7X is not set
# CONFIG_GPIO_POLARFIRE_SOC is not set
# CONFIG_GPIO_WAVESHARE_DSI_TOUCH is not set
# CONFIG_GPIO_XILINX is not set
# CONFIG_GPIO_AMD_FCH is not set
# end of Memory mapped GPIO drivers
#
# Port-mapped I/O GPIO drivers
#
# CONFIG_GPIO_VX855 is not set
# CONFIG_GPIO_F7188X is not set
# CONFIG_GPIO_IT87 is not set
# CONFIG_GPIO_NOVALAKE is not set
# CONFIG_GPIO_SCH311X is not set
# CONFIG_GPIO_WINBOND is not set
# CONFIG_GPIO_WS16C48 is not set
# end of Port-mapped I/O GPIO drivers
#
# I2C GPIO expanders
#
# CONFIG_GPIO_FXL6408 is not set
# CONFIG_GPIO_DS4520 is not set
# CONFIG_GPIO_MAX7300 is not set
# CONFIG_GPIO_MAX732X is not set
# CONFIG_GPIO_PCA953X is not set
# CONFIG_GPIO_PCA9570 is not set
# CONFIG_GPIO_PCF857X is not set
# CONFIG_GPIO_TPIC2810 is not set
# end of I2C GPIO expanders
#
# MFD GPIO expanders
#
# end of MFD GPIO expanders
#
# Auxiliary Bus GPIO drivers
#
# end of Auxiliary Bus GPIO drivers
#
# PCI GPIO expanders
#
# CONFIG_GPIO_AMD8111 is not set
# CONFIG_GPIO_BT8XX is not set
# CONFIG_GPIO_ML_IOH is not set
# CONFIG_GPIO_PCI_IDIO_16 is not set
# CONFIG_GPIO_PCIE_IDIO_24 is not set
# CONFIG_GPIO_RDC321X is not set
# end of PCI GPIO expanders
#
# SPI GPIO expanders
#
# CONFIG_GPIO_74X164 is not set
# CONFIG_GPIO_MAX3191X is not set
# CONFIG_GPIO_MAX7301 is not set
# CONFIG_GPIO_MC33880 is not set
# CONFIG_GPIO_PISOSR is not set
# CONFIG_GPIO_XRA1403 is not set
# end of SPI GPIO expanders
#
# USB GPIO expanders
#
# CONFIG_GPIO_MPSSE is not set
# end of USB GPIO expanders
#
# Virtual GPIO drivers
#
CONFIG_GPIO_AGGREGATOR=m
# CONFIG_GPIO_LATCH is not set
# CONFIG_GPIO_MOCKUP is not set
# CONFIG_GPIO_VIRTIO is not set
# CONFIG_GPIO_SIM is not set
# end of Virtual GPIO drivers
#
# GPIO Debugging utilities
#
# CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER is not set
# CONFIG_GPIO_VIRTUSER is not set
# end of GPIO Debugging utilities
# CONFIG_W1 is not set
CONFIG_POWER_RESET=y
# CONFIG_POWER_RESET_RESTART is not set
# CONFIG_POWER_RESET_QEMU_VIRT_CTRL is not set
# CONFIG_POWER_SEQUENCING is not set
CONFIG_POWER_SUPPLY=y
# CONFIG_POWER_SUPPLY_DEBUG is not set
CONFIG_POWER_SUPPLY_HWMON=y
# CONFIG_IP5XXX_POWER is not set
# CONFIG_TEST_POWER is not set
# CONFIG_CHARGER_ADP5061 is not set
# CONFIG_BATTERY_CHAGALL is not set
# CONFIG_BATTERY_CW2015 is not set
# CONFIG_BATTERY_DS2780 is not set
# CONFIG_BATTERY_DS2781 is not set
# CONFIG_BATTERY_DS2782 is not set
# CONFIG_BATTERY_SAMSUNG_SDI is not set
# CONFIG_BATTERY_S2MU005 is not set
# CONFIG_BATTERY_SBS is not set
# CONFIG_CHARGER_SBS is not set
# CONFIG_MANAGER_SBS is not set
# CONFIG_BATTERY_BQ27XXX is not set
# CONFIG_BATTERY_MAX17042 is not set
# CONFIG_BATTERY_MAX1720X is not set
# CONFIG_CHARGER_MAX8903 is not set
# CONFIG_CHARGER_LP8727 is not set
# CONFIG_CHARGER_GPIO is not set
# CONFIG_CHARGER_LT3651 is not set
# CONFIG_CHARGER_LTC4162L is not set
# CONFIG_CHARGER_MAX77976 is not set
# CONFIG_CHARGER_MAX8971 is not set
# CONFIG_CHARGER_BQ2415X is not set
# CONFIG_CHARGER_BQ24257 is not set
# CONFIG_CHARGER_BQ24735 is not set
# CONFIG_CHARGER_BQ2515X is not set
# CONFIG_CHARGER_BQ25890 is not set
# CONFIG_CHARGER_BQ25980 is not set
# CONFIG_CHARGER_BQ25630 is not set
# CONFIG_CHARGER_BQ256XX is not set
# CONFIG_BATTERY_GAUGE_LTC2941 is not set
# CONFIG_BATTERY_GOLDFISH is not set
# CONFIG_BATTERY_RT5033 is not set
# CONFIG_CHARGER_RT9455 is not set
# CONFIG_CHARGER_RT9756 is not set
# CONFIG_FUEL_GAUGE_STC3117 is not set
# CONFIG_CHARGER_BD99954 is not set
# CONFIG_BATTERY_UG3105 is not set
# CONFIG_BATTERY_CHARGER_SURFACE_RT is not set
# CONFIG_FUEL_GAUGE_MM8013 is not set
CONFIG_HWMON=y
CONFIG_HWMON_VID=y
# CONFIG_HWMON_DEBUG_CHIP is not set
#
# Native drivers
#
# CONFIG_SENSORS_ABITUGURU is not set
# CONFIG_SENSORS_ABITUGURU3 is not set
# CONFIG_SENSORS_AD7314 is not set
# CONFIG_SENSORS_AD7414 is not set
# CONFIG_SENSORS_AD7418 is not set
# CONFIG_SENSORS_ADM1025 is not set
# CONFIG_SENSORS_ADM1026 is not set
# CONFIG_SENSORS_ADM1029 is not set
# CONFIG_SENSORS_ADM1031 is not set
# CONFIG_SENSORS_ADM1177 is not set
# CONFIG_SENSORS_ADM9240 is not set
# CONFIG_SENSORS_ADT7310 is not set
# CONFIG_SENSORS_ADT7410 is not set
# CONFIG_SENSORS_ADT7411 is not set
# CONFIG_SENSORS_ADT7462 is not set
# CONFIG_SENSORS_ADT7470 is not set
# CONFIG_SENSORS_ADT7475 is not set
# CONFIG_SENSORS_AHT10 is not set
# CONFIG_SENSORS_AQUACOMPUTER_D5NEXT is not set
# CONFIG_SENSORS_AS370 is not set
# CONFIG_SENSORS_ASC7621 is not set
# CONFIG_SENSORS_ASUS_ROG_RYUJIN is not set
# CONFIG_SENSORS_AXI_FAN_CONTROL is not set
# CONFIG_SENSORS_K8TEMP is not set
# CONFIG_SENSORS_KB9002 is not set
# CONFIG_SENSORS_APPLESMC is not set
# CONFIG_SENSORS_ARCTIC_FAN_CONTROLLER is not set
# CONFIG_SENSORS_ASB100 is not set
# CONFIG_SENSORS_ATXP1 is not set
# CONFIG_SENSORS_CHIPCAP2 is not set
# CONFIG_SENSORS_CORSAIR_CPRO is not set
# CONFIG_SENSORS_CORSAIR_PSU is not set
CONFIG_SENSORS_DRIVETEMP=y
# CONFIG_SENSORS_DS620 is not set
# CONFIG_SENSORS_DS1621 is not set
# CONFIG_SENSORS_DELL_SMM is not set
# CONFIG_SENSORS_I5K_AMB is not set
# CONFIG_SENSORS_F71805F is not set
# CONFIG_SENSORS_F71882FG is not set
# CONFIG_SENSORS_F75375S is not set
# CONFIG_SENSORS_FSCHMD is not set
# CONFIG_SENSORS_GIGABYTE_WATERFORCE is not set
# CONFIG_SENSORS_GL518SM is not set
# CONFIG_SENSORS_GL520SM is not set
# CONFIG_SENSORS_GPD is not set
# CONFIG_SENSORS_G760A is not set
# CONFIG_SENSORS_G762 is not set
# CONFIG_SENSORS_GPIO_FAN is not set
# CONFIG_SENSORS_HIH6130 is not set
# CONFIG_SENSORS_HS3001 is not set
# CONFIG_SENSORS_HTU31 is not set
# CONFIG_SENSORS_I5500 is not set
CONFIG_SENSORS_CORETEMP=y
# CONFIG_SENSORS_ISL28022 is not set
# CONFIG_SENSORS_IT87 is not set
CONFIG_SENSORS_JC42=y
# CONFIG_SENSORS_POWERZ is not set
# CONFIG_SENSORS_POWR1220 is not set
# CONFIG_SENSORS_PROM21_XHCI is not set
# CONFIG_SENSORS_LATTEPANDA_SIGMA_EC is not set
# CONFIG_SENSORS_LENOVO_EC is not set
# CONFIG_SENSORS_LINEAGE is not set
# CONFIG_SENSORS_LTC2945 is not set
# CONFIG_SENSORS_LTC2947_I2C is not set
# CONFIG_SENSORS_LTC2947_SPI is not set
# CONFIG_SENSORS_LTC2990 is not set
# CONFIG_SENSORS_LTC2991 is not set
# CONFIG_SENSORS_LTC2992 is not set
# CONFIG_SENSORS_LTC4151 is not set
# CONFIG_SENSORS_LTC4215 is not set
# CONFIG_SENSORS_LTC4222 is not set
# CONFIG_SENSORS_LTC4245 is not set
# CONFIG_SENSORS_LTC4260 is not set
# CONFIG_SENSORS_LTC4261 is not set
# CONFIG_SENSORS_LTC4282 is not set
# CONFIG_SENSORS_LTC4283 is not set
# CONFIG_SENSORS_MAX1111 is not set
# CONFIG_SENSORS_MAX127 is not set
# CONFIG_SENSORS_MAX16065 is not set
# CONFIG_SENSORS_MAX1619 is not set
# CONFIG_SENSORS_MAX1668 is not set
# CONFIG_SENSORS_MAX197 is not set
# CONFIG_SENSORS_MAX31722 is not set
# CONFIG_SENSORS_MAX31730 is not set
# CONFIG_SENSORS_MAX31760 is not set
# CONFIG_MAX31827 is not set
# CONFIG_SENSORS_MAX6620 is not set
# CONFIG_SENSORS_MAX6621 is not set
# CONFIG_SENSORS_MAX6639 is not set
# CONFIG_SENSORS_MAX6650 is not set
# CONFIG_SENSORS_MAX6697 is not set
# CONFIG_SENSORS_MAX31790 is not set
# CONFIG_SENSORS_MC34VR500 is not set
# CONFIG_SENSORS_MCP3021 is not set
# CONFIG_SENSORS_MCP9982 is not set
# CONFIG_SENSORS_TC654 is not set
# CONFIG_SENSORS_TPS23861 is not set
# CONFIG_SENSORS_MR75203 is not set
# CONFIG_SENSORS_ADCXX is not set
# CONFIG_SENSORS_LM63 is not set
# CONFIG_SENSORS_LM70 is not set
# CONFIG_SENSORS_LM73 is not set
# CONFIG_SENSORS_LM75 is not set
# CONFIG_SENSORS_LM77 is not set
# CONFIG_SENSORS_LM78 is not set
# CONFIG_SENSORS_LM80 is not set
# CONFIG_SENSORS_LM83 is not set
# CONFIG_SENSORS_LM85 is not set
# CONFIG_SENSORS_LM87 is not set
# CONFIG_SENSORS_LM90 is not set
# CONFIG_SENSORS_LM92 is not set
# CONFIG_SENSORS_LM93 is not set
# CONFIG_SENSORS_LM95234 is not set
# CONFIG_SENSORS_LM95241 is not set
# CONFIG_SENSORS_LM95245 is not set
# CONFIG_SENSORS_PC87360 is not set
# CONFIG_SENSORS_PC87427 is not set
# CONFIG_SENSORS_NCT6683 is not set
CONFIG_SENSORS_NCT6775_CORE=y
CONFIG_SENSORS_NCT6775=y
# CONFIG_SENSORS_NCT6775_I2C is not set
# CONFIG_SENSORS_NCT7363 is not set
# CONFIG_SENSORS_NCT7802 is not set
# CONFIG_SENSORS_NPCM7XX is not set
# CONFIG_SENSORS_NZXT_KRAKEN2 is not set
# CONFIG_SENSORS_NZXT_KRAKEN3 is not set
# CONFIG_SENSORS_NZXT_SMART2 is not set
# CONFIG_SENSORS_OCC_P8_I2C is not set
# CONFIG_SENSORS_PCF8591 is not set
# CONFIG_PMBUS is not set
# CONFIG_SENSORS_PT5161L is not set
CONFIG_SENSORS_PWM_FAN=m
# CONFIG_SENSORS_SHT15 is not set
# CONFIG_SENSORS_SHT21 is not set
# CONFIG_SENSORS_SHT3x is not set
# CONFIG_SENSORS_SHT4x is not set
# CONFIG_SENSORS_SHTC1 is not set
# CONFIG_SENSORS_SIS5595 is not set
# CONFIG_SENSORS_DME1737 is not set
# CONFIG_SENSORS_EMC1403 is not set
# CONFIG_SENSORS_EMC1812 is not set
# CONFIG_SENSORS_EMC2103 is not set
# CONFIG_SENSORS_EMC2305 is not set
# CONFIG_SENSORS_EMC6W201 is not set
# CONFIG_SENSORS_SMSC47M1 is not set
# CONFIG_SENSORS_SMSC47M192 is not set
# CONFIG_SENSORS_SMSC47B397 is not set
# CONFIG_SENSORS_STTS751 is not set
# CONFIG_SENSORS_ADC128D818 is not set
# CONFIG_SENSORS_ADS7828 is not set
# CONFIG_SENSORS_ADS7871 is not set
# CONFIG_SENSORS_AMC6821 is not set
# CONFIG_SENSORS_INA209 is not set
# CONFIG_SENSORS_INA2XX is not set
# CONFIG_SENSORS_INA238 is not set
# CONFIG_SENSORS_INA3221 is not set
# CONFIG_SENSORS_SPD5118 is not set
# CONFIG_SENSORS_TC74 is not set
# CONFIG_SENSORS_THMC50 is not set
# CONFIG_SENSORS_TMP102 is not set
# CONFIG_SENSORS_TMP103 is not set
# CONFIG_SENSORS_TMP108 is not set
# CONFIG_SENSORS_TMP401 is not set
# CONFIG_SENSORS_TMP421 is not set
# CONFIG_SENSORS_TMP464 is not set
# CONFIG_SENSORS_TMP513 is not set
# CONFIG_SENSORS_TSC1641 is not set
# CONFIG_SENSORS_VIA_CPUTEMP is not set
# CONFIG_SENSORS_VIA686A is not set
# CONFIG_SENSORS_VT1211 is not set
# CONFIG_SENSORS_VT8231 is not set
# CONFIG_SENSORS_W83773G is not set
# CONFIG_SENSORS_W83781D is not set
# CONFIG_SENSORS_W83791D is not set
# CONFIG_SENSORS_W83792D is not set
# CONFIG_SENSORS_W83793 is not set
# CONFIG_SENSORS_W83795 is not set
# CONFIG_SENSORS_W83L785TS is not set
# CONFIG_SENSORS_W83L786NG is not set
# CONFIG_SENSORS_W83627HF is not set
# CONFIG_SENSORS_W83627EHF is not set
# CONFIG_SENSORS_XGENE is not set
# CONFIG_SENSORS_YOGAFAN is not set
#
# ACPI drivers
#
CONFIG_SENSORS_ACPI_POWER=m
CONFIG_SENSORS_ATK0110=m
# CONFIG_SENSORS_ASUS_WMI is not set
CONFIG_SENSORS_ASUS_EC=m
# CONFIG_SENSORS_HP_WMI is not set
CONFIG_THERMAL=y
CONFIG_THERMAL_NETLINK=y
# CONFIG_THERMAL_STATISTICS is not set
# CONFIG_THERMAL_DEBUGFS is not set
# CONFIG_THERMAL_CORE_TESTING is not set
CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
CONFIG_THERMAL_HWMON=y
CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
# CONFIG_THERMAL_DEFAULT_GOV_BANG_BANG is not set
CONFIG_THERMAL_GOV_FAIR_SHARE=y
CONFIG_THERMAL_GOV_STEP_WISE=y
CONFIG_THERMAL_GOV_BANG_BANG=y
CONFIG_THERMAL_GOV_USER_SPACE=y
# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set
# CONFIG_DEVFREQ_THERMAL is not set
CONFIG_PCIE_THERMAL=y
# CONFIG_THERMAL_EMULATION is not set
#
# Intel thermal drivers
#
CONFIG_INTEL_POWERCLAMP=y
CONFIG_X86_THERMAL_VECTOR=y
CONFIG_INTEL_TCC=y
CONFIG_X86_PKG_TEMP_THERMAL=y
CONFIG_INTEL_SOC_DTS_IOSF_CORE=m
# CONFIG_INTEL_SOC_DTS_THERMAL is not set
#
# ACPI INT340X thermal drivers
#
CONFIG_INT340X_THERMAL=m
CONFIG_ACPI_THERMAL_REL=m
CONFIG_INT3406_THERMAL=m
CONFIG_PROC_THERMAL_MMIO_RAPL=m
# end of ACPI INT340X thermal drivers
CONFIG_INTEL_PCH_THERMAL=y
CONFIG_INTEL_TCC_COOLING=y
CONFIG_INTEL_HFI_THERMAL=y
# end of Intel thermal drivers
# CONFIG_WATCHDOG is not set
CONFIG_SSB_POSSIBLE=y
# CONFIG_SSB is not set
CONFIG_BCMA_POSSIBLE=y
# CONFIG_BCMA is not set
#
# Multifunction device drivers
#
CONFIG_MFD_CORE=y
# CONFIG_MFD_AS3711 is not set
# CONFIG_MFD_SMPRO is not set
# CONFIG_PMIC_ADP5520 is not set
# CONFIG_MFD_AAT2870_CORE is not set
# CONFIG_MFD_BCM590XX is not set
# CONFIG_MFD_BD9571MWV is not set
# CONFIG_MFD_AXP20X_I2C is not set
# CONFIG_MFD_CGBC is not set
# CONFIG_MFD_CS40L50_I2C is not set
# CONFIG_MFD_CS40L50_SPI is not set
# CONFIG_MFD_CS42L43_I2C is not set
# CONFIG_MFD_MADERA is not set
# CONFIG_PMIC_DA903X is not set
# CONFIG_MFD_DA9052_SPI is not set
# CONFIG_MFD_DA9052_I2C is not set
# CONFIG_MFD_DA9055 is not set
# CONFIG_MFD_DA9062 is not set
# CONFIG_MFD_DA9063 is not set
# CONFIG_MFD_DA9150 is not set
# CONFIG_MFD_DLN2 is not set
# CONFIG_MFD_MC13XXX_SPI is not set
# CONFIG_MFD_MC13XXX_I2C is not set
# CONFIG_MFD_MP2629 is not set
# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set
# CONFIG_LPC_ICH is not set
# CONFIG_LPC_SCH is not set
CONFIG_MFD_INTEL_LPSS=y
CONFIG_MFD_INTEL_LPSS_ACPI=y
CONFIG_MFD_INTEL_LPSS_PCI=y
# CONFIG_MFD_INTEL_PMC_BXT is not set
# CONFIG_MFD_IQS62X is not set
# CONFIG_MFD_JANZ_CMODIO is not set
# CONFIG_MFD_KEMPLD is not set
# CONFIG_MFD_88PM800 is not set
# CONFIG_MFD_88PM805 is not set
# CONFIG_MFD_88PM860X is not set
# CONFIG_MFD_MAX5970 is not set
# CONFIG_MFD_MAX14577 is not set
# CONFIG_MFD_MAX77541 is not set
# CONFIG_MFD_MAX77693 is not set
# CONFIG_MFD_MAX77705 is not set
# CONFIG_MFD_MAX77843 is not set
# CONFIG_MFD_MAX8907 is not set
# CONFIG_MFD_MAX8925 is not set
# CONFIG_MFD_MAX8997 is not set
# CONFIG_MFD_MAX8998 is not set
# CONFIG_MFD_MT6360 is not set
# CONFIG_MFD_MT6370 is not set
# CONFIG_MFD_MT6397 is not set
# CONFIG_MFD_MENF21BMC is not set
# CONFIG_MFD_NCT6694 is not set
# CONFIG_MFD_OCELOT is not set
# CONFIG_MFD_VIPERBOARD is not set
# CONFIG_MFD_RETU is not set
# CONFIG_MFD_SY7636A is not set
# CONFIG_MFD_RDC321X is not set
# CONFIG_MFD_RT4831 is not set
# CONFIG_MFD_RT5033 is not set
# CONFIG_MFD_RT5120 is not set
# CONFIG_MFD_RC5T583 is not set
# CONFIG_MFD_SI476X_CORE is not set
# CONFIG_MFD_SM501 is not set
# CONFIG_MFD_SKY81452 is not set
CONFIG_MFD_SYSCON=y
# CONFIG_MFD_LP3943 is not set
# CONFIG_MFD_LP8788 is not set
# CONFIG_MFD_TI_LMU is not set
# CONFIG_MFD_BQ257XX is not set
# CONFIG_MFD_PALMAS is not set
# CONFIG_TPS6105X is not set
# CONFIG_TPS65010 is not set
# CONFIG_TPS6507X is not set
# CONFIG_MFD_TPS65086 is not set
# CONFIG_MFD_TPS65090 is not set
# CONFIG_MFD_TI_LP873X is not set
# CONFIG_MFD_TPS6586X is not set
# CONFIG_MFD_TPS65910 is not set
# CONFIG_MFD_TPS65912_I2C is not set
# CONFIG_MFD_TPS65912_SPI is not set
# CONFIG_MFD_TPS6594_I2C is not set
# CONFIG_MFD_TPS6594_SPI is not set
# CONFIG_TWL4030_CORE is not set
# CONFIG_TWL6040_CORE is not set
# CONFIG_MFD_LM3533 is not set
# CONFIG_MFD_TQMX86 is not set
# CONFIG_MFD_VX855 is not set
# CONFIG_MFD_ARIZONA_I2C is not set
# CONFIG_MFD_ARIZONA_SPI is not set
# CONFIG_MFD_WM8400 is not set
# CONFIG_MFD_WM831X_I2C is not set
# CONFIG_MFD_WM831X_SPI is not set
# CONFIG_MFD_WM8350_I2C is not set
# CONFIG_MFD_WM8994 is not set
# CONFIG_MFD_ATC260X_I2C is not set
# CONFIG_RAVE_SP_CORE is not set
# CONFIG_MFD_INTEL_M10_BMC_SPI is not set
# CONFIG_MFD_QNAP_MCU is not set
# CONFIG_MFD_UPBOARD_FPGA is not set
# CONFIG_MFD_MAX7360 is not set
# end of Multifunction device drivers
# CONFIG_REGULATOR is not set
# CONFIG_RC_CORE is not set
#
# CEC support
#
# CONFIG_MEDIA_CEC_SUPPORT is not set
# end of CEC support
# CONFIG_MEDIA_SUPPORT is not set
#
# Graphics support
#
CONFIG_APERTURE_HELPERS=y
CONFIG_SCREEN_INFO=y
CONFIG_VIDEO=y
# CONFIG_AUXDISPLAY is not set
CONFIG_AGP=y
CONFIG_AGP_INTEL=y
# CONFIG_AGP_SIS is not set
# CONFIG_AGP_VIA is not set
CONFIG_INTEL_GTT=y
# CONFIG_VGA_SWITCHEROO is not set
CONFIG_GPU_BUDDY=y
CONFIG_DRM=y
#
# DRM debugging options
#
# CONFIG_DRM_DEBUG_MM is not set
# end of DRM debugging options
CONFIG_DRM_MIPI_DSI=y
CONFIG_DRM_KMS_HELPER=y
CONFIG_DRM_DRAW=y
CONFIG_DRM_PANIC=y
CONFIG_DRM_PANIC_FOREGROUND_COLOR=0xffffff
CONFIG_DRM_PANIC_BACKGROUND_COLOR=0x000000
# CONFIG_DRM_PANIC_DEBUG is not set
CONFIG_DRM_PANIC_SCREEN="user"
# CONFIG_DRM_RAS is not set
# CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
# CONFIG_DRM_DEBUG_MODESET_LOCK is not set
CONFIG_DRM_CLIENT=y
CONFIG_DRM_CLIENT_LIB=y
CONFIG_DRM_CLIENT_SELECTION=y
CONFIG_DRM_CLIENT_SETUP=y
#
# Supported DRM clients
#
CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_FBDEV_OVERALLOC=100
# CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM is not set
# CONFIG_DRM_CLIENT_LOG is not set
CONFIG_DRM_CLIENT_DEFAULT_FBDEV=y
CONFIG_DRM_CLIENT_DEFAULT="fbdev"
# end of Supported DRM clients
CONFIG_DRM_LOAD_EDID_FIRMWARE=y
CONFIG_DRM_DISPLAY_HELPER=m
# CONFIG_DRM_DISPLAY_DP_AUX_CEC is not set
# CONFIG_DRM_DISPLAY_DP_AUX_CHARDEV is not set
CONFIG_DRM_DISPLAY_DP_HELPER=y
CONFIG_DRM_DISPLAY_DP_TUNNEL=y
CONFIG_DRM_DISPLAY_DSC_HELPER=y
CONFIG_DRM_DISPLAY_HDCP_HELPER=y
CONFIG_DRM_DISPLAY_HDMI_HELPER=y
CONFIG_DRM_TTM=m
CONFIG_DRM_BUDDY=m
CONFIG_DRM_GEM_SHMEM_HELPER=y
# CONFIG_DRM_AMDGPU is not set
#
# ARM devices
#
# end of ARM devices
# CONFIG_DRM_AST is not set
CONFIG_DRM_BRIDGE=y
CONFIG_DRM_PANEL_BRIDGE=y
#
# Display Interface Bridges
#
# CONFIG_DRM_I2C_NXP_TDA998X is not set
# end of Display Interface Bridges
# CONFIG_DRM_ETNAVIV is not set
# CONFIG_DRM_GMA500 is not set
# CONFIG_DRM_GUD is not set
# CONFIG_DRM_HISI_HIBMC is not set
CONFIG_DRM_I915=m
CONFIG_DRM_I915_FORCE_PROBE=""
CONFIG_DRM_I915_CAPTURE_ERROR=y
CONFIG_DRM_I915_COMPRESS_ERROR=y
CONFIG_DRM_I915_USERPTR=y
CONFIG_DRM_I915_PXP=y
CONFIG_DRM_I915_DP_TUNNEL=y
#
# drm/i915 Debugging
#
# CONFIG_DRM_I915_WERROR is not set
# CONFIG_DRM_I915_REPLAY_GPU_HANGS_API is not set
# CONFIG_DRM_I915_DEBUG is not set
# CONFIG_DRM_I915_DEBUG_MMIO is not set
# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
# CONFIG_DRM_I915_DEBUG_GUC is not set
# CONFIG_DRM_I915_SELFTEST is not set
# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
# CONFIG_DRM_I915_DEBUG_WAKEREF is not set
# end of drm/i915 Debugging
#
# drm/i915 Profile Guided Optimisation
#
CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
CONFIG_DRM_I915_FENCE_TIMEOUT=10000
CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500
CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
CONFIG_DRM_I915_STOP_TIMEOUT=100
CONFIG_DRM_I915_TIMESLICE_DURATION=1
# end of drm/i915 Profile Guided Optimisation
# CONFIG_DRM_MGAG200 is not set
# CONFIG_DRM_NOUVEAU is not set
CONFIG_DRM_PANEL=y
#
# Display Panels
#
# CONFIG_DRM_PANEL_AUO_A030JTN01 is not set
# CONFIG_DRM_PANEL_FOCALTECH_OTA7290B is not set
# CONFIG_DRM_PANEL_ILITEK_ILI9341 is not set
# CONFIG_DRM_PANEL_ORISETECH_OTA5601A is not set
# CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN is not set
# CONFIG_DRM_PANEL_WIDECHIPS_WS2401 is not set
# end of Display Panels
# CONFIG_DRM_QXL is not set
# CONFIG_DRM_RADEON is not set
# CONFIG_DRM_ST7571 is not set
# CONFIG_DRM_ST7586 is not set
# CONFIG_DRM_ST7735R is not set
# CONFIG_DRM_ST7920 is not set
# CONFIG_DRM_SSD130X is not set
#
# Drivers for system framebuffers
#
CONFIG_DRM_SYSFB_HELPER=y
CONFIG_DRM_SIMPLEDRM=y
# end of Drivers for system framebuffers
# CONFIG_DRM_APPLETBDRM is not set
# CONFIG_DRM_BOCHS is not set
# CONFIG_DRM_CIRRUS_QEMU is not set
# CONFIG_DRM_GM12U320 is not set
# CONFIG_DRM_PANEL_MIPI_DBI is not set
# CONFIG_DRM_PIXPAPER is not set
# CONFIG_TINYDRM_HX8357D is not set
# CONFIG_TINYDRM_ILI9163 is not set
# CONFIG_TINYDRM_ILI9225 is not set
# CONFIG_TINYDRM_ILI9341 is not set
# CONFIG_TINYDRM_ILI9486 is not set
# CONFIG_TINYDRM_MI0283QT is not set
# CONFIG_TINYDRM_REPAPER is not set
# CONFIG_TINYDRM_SHARP_MEMORY is not set
# CONFIG_DRM_UDL is not set
# CONFIG_DRM_VBOXVIDEO is not set
CONFIG_DRM_VGEM=m
CONFIG_DRM_VIRTIO_GPU=m
CONFIG_DRM_VIRTIO_GPU_KMS=y
CONFIG_DRM_VKMS=m
# CONFIG_DRM_XE is not set
CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
#
# Frame buffer Devices
#
CONFIG_FB=y
# CONFIG_FB_CIRRUS is not set
# CONFIG_FB_PM2 is not set
# CONFIG_FB_CYBER2000 is not set
# CONFIG_FB_ARC is not set
# CONFIG_FB_ASILIANT is not set
# CONFIG_FB_IMSTT is not set
# CONFIG_FB_VGA16 is not set
# CONFIG_FB_UVESA is not set
CONFIG_FB_VESA=y
CONFIG_FB_EFI=y
# CONFIG_FB_N411 is not set
# CONFIG_FB_OPENCORES is not set
# CONFIG_FB_S1D13XXX is not set
# CONFIG_FB_NVIDIA is not set
# CONFIG_FB_RIVA is not set
# CONFIG_FB_I740 is not set
# CONFIG_FB_RADEON is not set
# CONFIG_FB_ATY128 is not set
# CONFIG_FB_ATY is not set
# CONFIG_FB_SAVAGE is not set
# CONFIG_FB_SIS is not set
# CONFIG_FB_VIA is not set
# CONFIG_FB_NEOMAGIC is not set
# CONFIG_FB_KYRO is not set
# CONFIG_FB_3DFX is not set
# CONFIG_FB_VOODOO1 is not set
# CONFIG_FB_TRIDENT is not set
# CONFIG_FB_PM3 is not set
# CONFIG_FB_CARMINE is not set
# CONFIG_FB_SMSCUFX is not set
# CONFIG_FB_IBM_GXT4500 is not set
# CONFIG_FB_VIRTUAL is not set
# CONFIG_FB_METRONOME is not set
# CONFIG_FB_MB862XX is not set
# CONFIG_FB_SSD1307 is not set
# CONFIG_FB_SM712 is not set
CONFIG_FB_CORE=y
CONFIG_FB_NOTIFY=y
# CONFIG_FB_DEVICE is not set
CONFIG_FB_CFB_FILLRECT=y
CONFIG_FB_CFB_COPYAREA=y
CONFIG_FB_CFB_IMAGEBLIT=y
CONFIG_FB_SYS_FILLRECT=y
CONFIG_FB_SYS_COPYAREA=y
CONFIG_FB_SYS_IMAGEBLIT=y
# CONFIG_FB_FOREIGN_ENDIAN is not set
CONFIG_FB_SYSMEM_FOPS=y
CONFIG_FB_DEFERRED_IO=y
CONFIG_FB_IOMEM_FOPS=y
CONFIG_FB_IOMEM_HELPERS=y
CONFIG_FB_SYSMEM_HELPERS=y
CONFIG_FB_SYSMEM_HELPERS_DEFERRED=y
# CONFIG_FB_TILEBLITTING is not set
# end of Frame buffer Devices
#
# Backlight & LCD device support
#
CONFIG_LCD_CLASS_DEVICE=y
# CONFIG_LCD_L4F00242T03 is not set
# CONFIG_LCD_LMS283GF05 is not set
# CONFIG_LCD_LTV350QV is not set
# CONFIG_LCD_ILI922X is not set
# CONFIG_LCD_ILI9320 is not set
# CONFIG_LCD_TDO24M is not set
# CONFIG_LCD_VGG2432A4 is not set
# CONFIG_LCD_PLATFORM is not set
# CONFIG_LCD_AMS369FG06 is not set
# CONFIG_LCD_LMS501KF03 is not set
# CONFIG_LCD_HX8357 is not set
# CONFIG_LCD_OTM3225A is not set
CONFIG_BACKLIGHT_CLASS_DEVICE=y
# CONFIG_BACKLIGHT_AW99706 is not set
# CONFIG_BACKLIGHT_KTD253 is not set
# CONFIG_BACKLIGHT_KTD2801 is not set
# CONFIG_BACKLIGHT_KTZ8866 is not set
# CONFIG_BACKLIGHT_SY7758 is not set
# CONFIG_BACKLIGHT_PWM is not set
# CONFIG_BACKLIGHT_MAX25014 is not set
# CONFIG_BACKLIGHT_APPLE is not set
# CONFIG_BACKLIGHT_QCOM_WLED is not set
# CONFIG_BACKLIGHT_SAHARA is not set
# CONFIG_BACKLIGHT_ADP8860 is not set
# CONFIG_BACKLIGHT_ADP8870 is not set
# CONFIG_BACKLIGHT_LM3509 is not set
# CONFIG_BACKLIGHT_LM3630A is not set
# CONFIG_BACKLIGHT_LM3639 is not set
# CONFIG_BACKLIGHT_LP855X is not set
# CONFIG_BACKLIGHT_MP3309C is not set
# CONFIG_BACKLIGHT_GPIO is not set
# CONFIG_BACKLIGHT_LV5207LP is not set
# CONFIG_BACKLIGHT_BD6107 is not set
# CONFIG_BACKLIGHT_ARCXCNN is not set
# end of Backlight & LCD device support
CONFIG_HDMI=y
# CONFIG_FIRMWARE_EDID is not set
#
# Console display driver support
#
CONFIG_VGA_CONSOLE=y
CONFIG_DUMMY_CONSOLE=y
CONFIG_DUMMY_CONSOLE_COLUMNS=80
CONFIG_DUMMY_CONSOLE_ROWS=25
CONFIG_FRAMEBUFFER_CONSOLE=y
# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER=y
# end of Console display driver support
CONFIG_LOGO=y
# CONFIG_LOGO_LINUX_MONO is not set
# CONFIG_LOGO_LINUX_VGA16 is not set
CONFIG_LOGO_LINUX_CLUT224=y
CONFIG_LOGO_LINUX_CLUT224_FILE="drivers/video/logo/logo_linux_clut224.ppm"
# CONFIG_TRACE_GPU_MEM is not set
# end of Graphics support
# CONFIG_DRM_ACCEL is not set
CONFIG_SOUND=y
CONFIG_SOUND_OSS_CORE=y
CONFIG_SOUND_OSS_CORE_PRECLAIM=y
CONFIG_SND=y
CONFIG_SND_TIMER=y
CONFIG_SND_PCM=y
CONFIG_SND_HWDEP=y
CONFIG_SND_RAWMIDI=y
CONFIG_SND_UMP=y
# CONFIG_SND_UMP_LEGACY_RAWMIDI is not set
CONFIG_SND_OSSEMUL=y
CONFIG_SND_MIXER_OSS=y
CONFIG_SND_PCM_OSS=y
CONFIG_SND_PCM_OSS_PLUGINS=y
# CONFIG_SND_PCM_TIMER is not set
CONFIG_SND_HRTIMER=y
CONFIG_SND_DYNAMIC_MINORS=y
CONFIG_SND_MAX_CARDS=32
# CONFIG_SND_SUPPORT_OLD_API is not set
CONFIG_SND_PROC_FS=y
CONFIG_SND_VERBOSE_PROCFS=y
# CONFIG_SND_CTL_FAST_LOOKUP is not set
# CONFIG_SND_DEBUG is not set
# CONFIG_SND_CTL_INPUT_VALIDATION is not set
CONFIG_SND_UTIMER=y
CONFIG_SND_DMA_SGBUF=y
# CONFIG_SND_SEQUENCER is not set
# CONFIG_SND_DRIVERS is not set
# CONFIG_SND_PCI is not set
#
# HD-Audio
#
# CONFIG_SND_HDA_INTEL is not set
# CONFIG_SND_HDA_ACPI is not set
# end of HD-Audio
# CONFIG_SND_SPI is not set
CONFIG_SND_USB=y
CONFIG_SND_USB_AUDIO=y
CONFIG_SND_USB_AUDIO_MIDI_V2=y
# CONFIG_SND_USB_UA101 is not set
# CONFIG_SND_USB_USX2Y is not set
# CONFIG_SND_USB_CAIAQ is not set
# CONFIG_SND_USB_US122L is not set
# CONFIG_SND_USB_US144MKII is not set
# CONFIG_SND_USB_6FIRE is not set
# CONFIG_SND_USB_HIFACE is not set
# CONFIG_SND_BCD2000 is not set
# CONFIG_SND_USB_POD is not set
# CONFIG_SND_USB_PODHD is not set
# CONFIG_SND_USB_TONEPORT is not set
# CONFIG_SND_USB_VARIAX is not set
# CONFIG_SND_SOC is not set
# CONFIG_SND_X86 is not set
# CONFIG_SND_VIRTIO is not set
CONFIG_HID_SUPPORT=y
CONFIG_HID=y
CONFIG_HID_BATTERY_STRENGTH=y
CONFIG_HIDRAW=y
# CONFIG_UHID is not set
CONFIG_HID_GENERIC=y
# CONFIG_HID_HAPTIC is not set
#
# Special HID drivers
#
# CONFIG_HID_A4TECH is not set
# CONFIG_HID_ACCUTOUCH is not set
# CONFIG_HID_ACRUX is not set
# CONFIG_HID_APPLE is not set
# CONFIG_HID_APPLEIR is not set
# CONFIG_HID_APPLETB_BL is not set
# CONFIG_HID_APPLETB_KBD is not set
# CONFIG_HID_ASUS is not set
# CONFIG_HID_AUREAL is not set
# CONFIG_HID_BELKIN is not set
# CONFIG_HID_BETOP_FF is not set
# CONFIG_HID_BIGBEN_FF is not set
# CONFIG_HID_CHERRY is not set
# CONFIG_HID_CHICONY is not set
# CONFIG_HID_CORSAIR is not set
# CONFIG_HID_COUGAR is not set
# CONFIG_HID_MACALLY is not set
# CONFIG_HID_PRODIKEYS is not set
# CONFIG_HID_CMEDIA is not set
# CONFIG_HID_CP2112 is not set
# CONFIG_HID_CREATIVE_SB0540 is not set
# CONFIG_HID_CYPRESS is not set
# CONFIG_HID_DRAGONRISE is not set
# CONFIG_HID_EMS_FF is not set
# CONFIG_HID_ELAN is not set
# CONFIG_HID_ELECOM is not set
# CONFIG_HID_ELO is not set
# CONFIG_HID_EVISION is not set
# CONFIG_HID_EZKEY is not set
# CONFIG_HID_FT260 is not set
# CONFIG_HID_GEMBIRD is not set
# CONFIG_HID_GFRM is not set
# CONFIG_HID_GLORIOUS is not set
# CONFIG_HID_HOLTEK is not set
# CONFIG_HID_HYPERX is not set
# CONFIG_HID_GOODIX_SPI is not set
# CONFIG_HID_GOOGLE_STADIA_FF is not set
# CONFIG_HID_VIVALDI is not set
# CONFIG_HID_GT683R is not set
# CONFIG_HID_MSI is not set
# CONFIG_HID_KEYTOUCH is not set
# CONFIG_HID_KYE is not set
# CONFIG_HID_KYSONA is not set
# CONFIG_HID_UCLOGIC is not set
# CONFIG_HID_WALTOP is not set
# CONFIG_HID_VIEWSONIC is not set
# CONFIG_HID_VRC2 is not set
# CONFIG_HID_XIAOMI is not set
# CONFIG_HID_GYRATION is not set
# CONFIG_HID_ICADE is not set
# CONFIG_HID_ITE is not set
# CONFIG_HID_JABRA is not set
# CONFIG_HID_TWINHAN is not set
# CONFIG_HID_KENSINGTON is not set
# CONFIG_HID_LCPOWER is not set
# CONFIG_HID_LED is not set
# CONFIG_HID_LENOVO is not set
# CONFIG_HID_LETSKETCH is not set
# CONFIG_HID_MAGICMOUSE is not set
# CONFIG_HID_MALTRON is not set
# CONFIG_HID_MAYFLASH is not set
# CONFIG_HID_MEGAWORLD_FF is not set
# CONFIG_HID_RAKK is not set
# CONFIG_HID_REDRAGON is not set
# CONFIG_HID_MICROSOFT is not set
# CONFIG_HID_MONTEREY is not set
# CONFIG_HID_MULTITOUCH is not set
# CONFIG_HID_NINTENDO is not set
# CONFIG_HID_NTI is not set
# CONFIG_HID_NTRIG is not set
# CONFIG_HID_NVIDIA_SHIELD is not set
# CONFIG_HID_ORTEK is not set
# CONFIG_HID_PANTHERLORD is not set
# CONFIG_HID_PENMOUNT is not set
# CONFIG_HID_PETALYNX is not set
# CONFIG_HID_PICOLCD is not set
# CONFIG_HID_PLANTRONICS is not set
# CONFIG_HID_PXRC is not set
# CONFIG_HID_RAPOO is not set
# CONFIG_HID_RAZER is not set
# CONFIG_HID_PRIMAX is not set
# CONFIG_HID_RETRODE is not set
# CONFIG_HID_ROCCAT is not set
# CONFIG_HID_SAITEK is not set
# CONFIG_HID_SAMSUNG is not set
# CONFIG_HID_SEMITEK is not set
# CONFIG_HID_SIGMAMICRO is not set
# CONFIG_HID_SONY is not set
# CONFIG_HID_SPEEDLINK is not set
# CONFIG_HID_STEAM is not set
# CONFIG_HID_STEELSERIES is not set
# CONFIG_HID_SUNPLUS is not set
# CONFIG_HID_RMI is not set
# CONFIG_HID_GREENASIA is not set
# CONFIG_HID_SMARTJOYPLUS is not set
# CONFIG_HID_TIVO is not set
# CONFIG_HID_TOPSEED is not set
# CONFIG_HID_TOPRE is not set
# CONFIG_HID_THINGM is not set
# CONFIG_HID_THRUSTMASTER is not set
# CONFIG_HID_UDRAW_PS3 is not set
# CONFIG_HID_U2FZERO is not set
# CONFIG_HID_UNIVERSAL_PIDFF is not set
# CONFIG_HID_WACOM is not set
# CONFIG_HID_WIIMOTE is not set
# CONFIG_HID_WINWING is not set
# CONFIG_HID_XINMO is not set
# CONFIG_HID_ZEROPLUS is not set
# CONFIG_HID_ZYDACRON is not set
# CONFIG_HID_SENSOR_HUB is not set
# CONFIG_HID_ALPS is not set
# CONFIG_HID_MCP2200 is not set
# CONFIG_HID_MCP2221 is not set
# CONFIG_HID_HUAWEI is not set
# end of Special HID drivers
#
# HID-BPF support
#
CONFIG_HID_BPF=y
# end of HID-BPF support
# CONFIG_I2C_HID is not set
#
# Intel ISH HID support
#
# CONFIG_INTEL_ISH_HID is not set
# end of Intel ISH HID support
#
# AMD SFH HID Support
#
# CONFIG_AMD_SFH_HID is not set
# end of AMD SFH HID Support
#
# Intel THC HID Support
#
# CONFIG_INTEL_THC_HID is not set
# end of Intel THC HID Support
#
# USB HID support
#
CONFIG_USB_HID=y
CONFIG_HID_PID=y
CONFIG_USB_HIDDEV=y
# end of USB HID support
CONFIG_USB_OHCI_LITTLE_ENDIAN=y
CONFIG_USB_SUPPORT=y
CONFIG_USB_COMMON=y
CONFIG_USB_LED_TRIG=y
# CONFIG_USB_ULPI_BUS is not set
# CONFIG_USB_CONN_GPIO is not set
CONFIG_USB_ARCH_HAS_HCD=y
CONFIG_USB=y
CONFIG_USB_PCI=y
# CONFIG_USB_PCI_AMD is not set
CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
#
# Miscellaneous USB options
#
CONFIG_USB_DEFAULT_PERSIST=y
# CONFIG_USB_FEW_INIT_RETRIES is not set
# CONFIG_USB_DYNAMIC_MINORS is not set
# CONFIG_USB_OTG is not set
# CONFIG_USB_OTG_PRODUCTLIST is not set
# CONFIG_USB_OTG_DISABLE_EXTERNAL_HUB is not set
# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set
CONFIG_USB_AUTOSUSPEND_DELAY=2
CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
# CONFIG_USB_MON is not set
#
# USB Host Controller Drivers
#
# CONFIG_USB_C67X00_HCD is not set
CONFIG_USB_XHCI_HCD=y
# CONFIG_USB_XHCI_DBGCAP is not set
CONFIG_USB_XHCI_PCI=y
# CONFIG_USB_XHCI_PCI_RENESAS is not set
# CONFIG_USB_XHCI_PLATFORM is not set
# CONFIG_USB_XHCI_SIDEBAND is not set
# CONFIG_USB_EHCI_HCD is not set
# CONFIG_USB_OXU210HP_HCD is not set
# CONFIG_USB_ISP116X_HCD is not set
# CONFIG_USB_MAX3421_HCD is not set
# CONFIG_USB_OHCI_HCD is not set
# CONFIG_USB_UHCI_HCD is not set
# CONFIG_USB_SL811_HCD is not set
# CONFIG_USB_R8A66597_HCD is not set
# CONFIG_USB_HCD_TEST_MODE is not set
#
# USB Device Class drivers
#
# CONFIG_USB_ACM is not set
CONFIG_USB_PRINTER=y
# CONFIG_USB_WDM is not set
# CONFIG_USB_TMC is not set
#
# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed; see USB_STORAGE Help for more info
#
CONFIG_USB_STORAGE=y
# CONFIG_USB_STORAGE_DEBUG is not set
# CONFIG_USB_STORAGE_REALTEK is not set
# CONFIG_USB_STORAGE_DATAFAB is not set
# CONFIG_USB_STORAGE_FREECOM is not set
# CONFIG_USB_STORAGE_ISD200 is not set
# CONFIG_USB_STORAGE_USBAT is not set
# CONFIG_USB_STORAGE_SDDR09 is not set
# CONFIG_USB_STORAGE_SDDR55 is not set
# CONFIG_USB_STORAGE_JUMPSHOT is not set
# CONFIG_USB_STORAGE_ALAUDA is not set
# CONFIG_USB_STORAGE_ONETOUCH is not set
# CONFIG_USB_STORAGE_KARMA is not set
# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
# CONFIG_USB_STORAGE_ENE_UB6250 is not set
CONFIG_USB_UAS=y
#
# USB Imaging devices
#
# CONFIG_USB_MDC800 is not set
# CONFIG_USB_MICROTEK is not set
# CONFIG_USBIP_CORE is not set
#
# USB dual-mode controller drivers
#
# CONFIG_USB_CDNS_SUPPORT is not set
# CONFIG_USB_MUSB_HDRC is not set
# CONFIG_USB_DWC3 is not set
# CONFIG_USB_DWC2 is not set
# CONFIG_USB_ISP1760 is not set
#
# USB port drivers
#
# CONFIG_USB_SERIAL is not set
#
# USB Miscellaneous drivers
#
# CONFIG_USB_EMI62 is not set
# CONFIG_USB_EMI26 is not set
# CONFIG_USB_ADUTUX is not set
# CONFIG_USB_SEVSEG is not set
# CONFIG_USB_LEGOTOWER is not set
# CONFIG_USB_LCD is not set
# CONFIG_USB_CYPRESS_CY7C63 is not set
# CONFIG_USB_CYTHERM is not set
# CONFIG_USB_IDMOUSE is not set
# CONFIG_USB_APPLEDISPLAY is not set
# CONFIG_APPLE_MFI_FASTCHARGE is not set
# CONFIG_USB_LJCA is not set
# CONFIG_USB_USBIO is not set
# CONFIG_USB_LD is not set
# CONFIG_USB_TRANCEVIBRATOR is not set
# CONFIG_USB_IOWARRIOR is not set
# CONFIG_USB_TEST is not set
# CONFIG_USB_EHSET_TEST_FIXTURE is not set
# CONFIG_USB_ISIGHTFW is not set
# CONFIG_USB_YUREX is not set
# CONFIG_USB_EZUSB_FX2 is not set
# CONFIG_USB_HUB_USB251XB is not set
# CONFIG_USB_HSIC_USB3503 is not set
# CONFIG_USB_HSIC_USB4604 is not set
# CONFIG_USB_LINK_LAYER_TEST is not set
# CONFIG_USB_CHAOSKEY is not set
#
# USB Physical Layer drivers
#
# CONFIG_NOP_USB_XCEIV is not set
# CONFIG_USB_GPIO_VBUS is not set
# CONFIG_USB_ISP1301 is not set
# end of USB Physical Layer drivers
# CONFIG_USB_GADGET is not set
CONFIG_TYPEC=y
CONFIG_TYPEC_TCPM=m
CONFIG_TYPEC_TCPCI=m
# CONFIG_TYPEC_RT1711H is not set
# CONFIG_TYPEC_TCPCI_MAXIM is not set
# CONFIG_TYPEC_FUSB302 is not set
CONFIG_TYPEC_UCSI=m
# CONFIG_UCSI_CCG is not set
# CONFIG_UCSI_ACPI is not set
# CONFIG_UCSI_STM32G0 is not set
# CONFIG_TYPEC_TPS6598X is not set
# CONFIG_TYPEC_ANX7411 is not set
# CONFIG_TYPEC_RT1719 is not set
# CONFIG_TYPEC_HD3SS3220 is not set
# CONFIG_TYPEC_STUSB160X is not set
# CONFIG_TYPEC_WUSB3801 is not set
#
# USB Type-C Multiplexer/DeMultiplexer Switch support
#
# CONFIG_TYPEC_MUX_FSA4480 is not set
# CONFIG_TYPEC_MUX_GPIO_SBU is not set
# CONFIG_TYPEC_MUX_PI3USB30532 is not set
# CONFIG_TYPEC_MUX_IT5205 is not set
# CONFIG_TYPEC_MUX_NB7VPQ904M is not set
# CONFIG_TYPEC_MUX_PS883X is not set
# CONFIG_TYPEC_MUX_PTN36502 is not set
# CONFIG_TYPEC_MUX_TUSB1046 is not set
# CONFIG_TYPEC_MUX_WCD939X_USBSS is not set
# end of USB Type-C Multiplexer/DeMultiplexer Switch support
#
# USB Type-C Alternate Mode drivers
#
CONFIG_TYPEC_DP_ALTMODE=m
# CONFIG_TYPEC_NVIDIA_ALTMODE is not set
# CONFIG_TYPEC_TBT_ALTMODE is not set
# end of USB Type-C Alternate Mode drivers
CONFIG_USB_ROLE_SWITCH=y
CONFIG_USB_ROLES_INTEL_XHCI=m
# CONFIG_MMC is not set
# CONFIG_SCSI_UFSHCD is not set
# CONFIG_MEMSTICK is not set
CONFIG_NEW_LEDS=y
CONFIG_LEDS_CLASS=y
# CONFIG_LEDS_CLASS_FLASH is not set
# CONFIG_LEDS_CLASS_MULTICOLOR is not set
# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
#
# LED drivers
#
# CONFIG_LEDS_APU is not set
# CONFIG_LEDS_OSRAM_AMS_AS3668 is not set
# CONFIG_LEDS_AW200XX is not set
# CONFIG_LEDS_LM3530 is not set
# CONFIG_LEDS_LM3532 is not set
# CONFIG_LEDS_LM3642 is not set
# CONFIG_LEDS_PCA9532 is not set
# CONFIG_LEDS_GPIO is not set
# CONFIG_LEDS_LP3944 is not set
# CONFIG_LEDS_LP3952 is not set
# CONFIG_LEDS_PCA955X is not set
# CONFIG_LEDS_PCA963X is not set
# CONFIG_LEDS_PCA995X is not set
# CONFIG_LEDS_DAC124S085 is not set
# CONFIG_LEDS_PWM is not set
# CONFIG_LEDS_BD2606MVV is not set
# CONFIG_LEDS_BD2802 is not set
# CONFIG_LEDS_INTEL_SS4200 is not set
# CONFIG_LEDS_LT3593 is not set
# CONFIG_LEDS_TCA6507 is not set
# CONFIG_LEDS_TLC591XX is not set
# CONFIG_LEDS_LM355x is not set
# CONFIG_LEDS_IS31FL319X is not set
#
# LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM)
#
# CONFIG_LEDS_BLINKM is not set
# CONFIG_LEDS_MLXCPLD is not set
# CONFIG_LEDS_MLXREG is not set
# CONFIG_LEDS_USER is not set
# CONFIG_LEDS_NIC78BX is not set
# CONFIG_LEDS_SPI_BYTE is not set
# CONFIG_LEDS_LTC3220 is not set
#
# Flash and Torch LED drivers
#
#
# RGB LED drivers
#
#
# LED Triggers
#
CONFIG_LEDS_TRIGGERS=y
# CONFIG_LEDS_TRIGGER_TIMER is not set
# CONFIG_LEDS_TRIGGER_ONESHOT is not set
# CONFIG_LEDS_TRIGGER_DISK is not set
# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
# CONFIG_LEDS_TRIGGER_CPU is not set
# CONFIG_LEDS_TRIGGER_ACTIVITY is not set
# CONFIG_LEDS_TRIGGER_GPIO is not set
# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
#
# iptables trigger is under Netfilter config (LED target)
#
# CONFIG_LEDS_TRIGGER_TRANSIENT is not set
# CONFIG_LEDS_TRIGGER_CAMERA is not set
# CONFIG_LEDS_TRIGGER_PANIC is not set
# CONFIG_LEDS_TRIGGER_NETDEV is not set
# CONFIG_LEDS_TRIGGER_PATTERN is not set
# CONFIG_LEDS_TRIGGER_TTY is not set
# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
#
# Simatic LED drivers
#
# CONFIG_ACCESSIBILITY is not set
# CONFIG_INFINIBAND is not set
CONFIG_EDAC_ATOMIC_SCRUB=y
CONFIG_EDAC_SUPPORT=y
CONFIG_EDAC=y
# CONFIG_EDAC_DEBUG is not set
# CONFIG_EDAC_GHES is not set
CONFIG_EDAC_SCRUB=y
CONFIG_EDAC_ECS=y
CONFIG_EDAC_MEM_REPAIR=y
# CONFIG_EDAC_E752X is not set
# CONFIG_EDAC_I82975X is not set
# CONFIG_EDAC_I3000 is not set
# CONFIG_EDAC_I3200 is not set
# CONFIG_EDAC_IE31200 is not set
# CONFIG_EDAC_X38 is not set
# CONFIG_EDAC_I5400 is not set
# CONFIG_EDAC_I7CORE is not set
# CONFIG_EDAC_I5100 is not set
# CONFIG_EDAC_I7300 is not set
# CONFIG_EDAC_SBRIDGE is not set
# CONFIG_EDAC_SKX is not set
# CONFIG_EDAC_I10NM is not set
# CONFIG_EDAC_IMH is not set
# CONFIG_EDAC_PND2 is not set
# CONFIG_EDAC_IGEN6 is not set
CONFIG_RTC_LIB=y
CONFIG_RTC_MC146818_LIB=y
CONFIG_RTC_CLASS=y
CONFIG_RTC_HCTOSYS=y
CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
CONFIG_RTC_SYSTOHC=y
CONFIG_RTC_SYSTOHC_DEVICE="rtc0"
# CONFIG_RTC_DEBUG is not set
CONFIG_RTC_NVMEM=y
#
# RTC interfaces
#
CONFIG_RTC_INTF_SYSFS=y
CONFIG_RTC_INTF_PROC=y
CONFIG_RTC_INTF_DEV=y
# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
# CONFIG_RTC_DRV_TEST is not set
#
# I2C RTC drivers
#
# CONFIG_RTC_DRV_ABB5ZES3 is not set
# CONFIG_RTC_DRV_ABEOZ9 is not set
# CONFIG_RTC_DRV_ABX80X is not set
# CONFIG_RTC_DRV_DS1307 is not set
# CONFIG_RTC_DRV_DS1374 is not set
# CONFIG_RTC_DRV_DS1672 is not set
# CONFIG_RTC_DRV_MAX6900 is not set
# CONFIG_RTC_DRV_MAX31335 is not set
# CONFIG_RTC_DRV_RS5C372 is not set
# CONFIG_RTC_DRV_ISL1208 is not set
# CONFIG_RTC_DRV_ISL12022 is not set
# CONFIG_RTC_DRV_X1205 is not set
# CONFIG_RTC_DRV_PCF8523 is not set
# CONFIG_RTC_DRV_PCF85363 is not set
# CONFIG_RTC_DRV_PCF8563 is not set
# CONFIG_RTC_DRV_PCF8583 is not set
# CONFIG_RTC_DRV_M41T80 is not set
# CONFIG_RTC_DRV_BQ32K is not set
# CONFIG_RTC_DRV_S35390A is not set
# CONFIG_RTC_DRV_FM3130 is not set
# CONFIG_RTC_DRV_RX8010 is not set
# CONFIG_RTC_DRV_RX8111 is not set
# CONFIG_RTC_DRV_RX8581 is not set
# CONFIG_RTC_DRV_RX8025 is not set
# CONFIG_RTC_DRV_EM3027 is not set
# CONFIG_RTC_DRV_RV3028 is not set
# CONFIG_RTC_DRV_RV3032 is not set
# CONFIG_RTC_DRV_RV8803 is not set
# CONFIG_RTC_DRV_SD2405AL is not set
# CONFIG_RTC_DRV_SD3078 is not set
#
# SPI RTC drivers
#
# CONFIG_RTC_DRV_M41T93 is not set
# CONFIG_RTC_DRV_M41T94 is not set
# CONFIG_RTC_DRV_DS1302 is not set
# CONFIG_RTC_DRV_DS1305 is not set
# CONFIG_RTC_DRV_DS1343 is not set
# CONFIG_RTC_DRV_DS1347 is not set
# CONFIG_RTC_DRV_DS1390 is not set
# CONFIG_RTC_DRV_MAX6916 is not set
# CONFIG_RTC_DRV_R9701 is not set
# CONFIG_RTC_DRV_RX4581 is not set
# CONFIG_RTC_DRV_RS5C348 is not set
# CONFIG_RTC_DRV_MAX6902 is not set
# CONFIG_RTC_DRV_PCF2123 is not set
# CONFIG_RTC_DRV_MCP795 is not set
CONFIG_RTC_I2C_AND_SPI=y
#
# SPI and I2C RTC drivers
#
# CONFIG_RTC_DRV_DS3232 is not set
# CONFIG_RTC_DRV_PCF2127 is not set
# CONFIG_RTC_DRV_PCF85063 is not set
# CONFIG_RTC_DRV_RV3029C2 is not set
# CONFIG_RTC_DRV_RX6110 is not set
#
# Platform RTC drivers
#
CONFIG_RTC_DRV_CMOS=y
# CONFIG_RTC_DRV_DS1286 is not set
# CONFIG_RTC_DRV_DS1511 is not set
# CONFIG_RTC_DRV_DS1553 is not set
# CONFIG_RTC_DRV_DS1685_FAMILY is not set
# CONFIG_RTC_DRV_DS1742 is not set
# CONFIG_RTC_DRV_DS2404 is not set
# CONFIG_RTC_DRV_STK17TA8 is not set
# CONFIG_RTC_DRV_M48T86 is not set
# CONFIG_RTC_DRV_M48T35 is not set
# CONFIG_RTC_DRV_M48T59 is not set
# CONFIG_RTC_DRV_MSM6242 is not set
# CONFIG_RTC_DRV_RP5C01 is not set
#
# on-CPU RTC drivers
#
# CONFIG_RTC_DRV_FTRTC010 is not set
# CONFIG_RTC_DRV_GOLDFISH is not set
#
# HID Sensor RTC drivers
#
CONFIG_DMADEVICES=y
# CONFIG_DMADEVICES_DEBUG is not set
#
# DMA Devices
#
CONFIG_DMA_ENGINE=y
CONFIG_DMA_VIRTUAL_CHANNELS=y
CONFIG_DMA_ACPI=y
# CONFIG_ALTERA_MSGDMA is not set
CONFIG_INTEL_IDMA64=y
# CONFIG_INTEL_IDXD is not set
# CONFIG_INTEL_IDXD_COMPAT is not set
# CONFIG_INTEL_IOATDMA is not set
# CONFIG_PLX_DMA is not set
# CONFIG_SWITCHTEC_DMA is not set
# CONFIG_XILINX_DMA is not set
# CONFIG_XILINX_XDMA is not set
# CONFIG_AMD_PTDMA is not set
# CONFIG_AMD_QDMA is not set
# CONFIG_QCOM_HIDMA_MGMT is not set
# CONFIG_QCOM_HIDMA is not set
# CONFIG_DW_DMAC is not set
# CONFIG_DW_DMAC_PCI is not set
# CONFIG_DW_EDMA is not set
# CONFIG_SF_PDMA is not set
# CONFIG_INTEL_LDMA is not set
#
# DMA Clients
#
CONFIG_ASYNC_TX_DMA=y
# CONFIG_DMATEST is not set
#
# DMABUF options
#
CONFIG_SYNC_FILE=y
# CONFIG_SW_SYNC is not set
# CONFIG_UDMABUF is not set
# CONFIG_DMABUF_DEBUG is not set
CONFIG_DMABUF_HEAPS=y
CONFIG_DMABUF_HEAPS_SYSTEM=y
# CONFIG_DMABUF_HEAPS_SYSTEM_CC_SHARED is not set
CONFIG_DMABUF_HEAPS_CMA=y
# end of DMABUF options
# CONFIG_UIO is not set
# CONFIG_VFIO is not set
CONFIG_IRQ_BYPASS_MANAGER=m
CONFIG_VIRT_DRIVERS=y
CONFIG_VMGENID=y
# CONFIG_VBOXGUEST is not set
# CONFIG_NITRO_ENCLAVES is not set
CONFIG_EFI_SECRET=m
CONFIG_VIRTIO_ANCHOR=y
CONFIG_VIRTIO=y
CONFIG_VIRTIO_PCI_LIB=m
CONFIG_VIRTIO_MENU=y
CONFIG_VIRTIO_PCI=m
CONFIG_VIRTIO_PCI_ADMIN_LEGACY=y
# CONFIG_VIRTIO_PCI_LEGACY is not set
CONFIG_VIRTIO_PMEM=m
CONFIG_VIRTIO_BALLOON=m
CONFIG_VIRTIO_INPUT=m
# CONFIG_VIRTIO_MMIO is not set
CONFIG_VIRTIO_DMA_SHARED_BUFFER=m
# CONFIG_VIRTIO_DEBUG is not set
CONFIG_VIRTIO_RTC=m
CONFIG_VIRTIO_RTC_PTP=y
CONFIG_VIRTIO_RTC_CLASS=y
# CONFIG_VDPA is not set
CONFIG_VHOST_IOTLB=m
CONFIG_VHOST_TASK=y
CONFIG_VHOST=m
CONFIG_VHOST_MENU=y
CONFIG_VHOST_NET=m
CONFIG_VHOST_VSOCK=m
# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y
#
# Microsoft Hyper-V guest support
#
# end of Microsoft Hyper-V guest support
# CONFIG_GREYBUS is not set
# CONFIG_COMEDI is not set
# CONFIG_GPIB is not set
# CONFIG_STAGING is not set
# CONFIG_GOLDFISH is not set
# CONFIG_CHROME_PLATFORMS is not set
# CONFIG_MELLANOX_PLATFORM is not set
# CONFIG_SURFACE_PLATFORMS is not set
CONFIG_X86_PLATFORM_DEVICES=y
CONFIG_WMI_BMOF=m
# CONFIG_HUAWEI_WMI is not set
# CONFIG_X86_PLATFORM_DRIVERS_UNIWILL is not set
# CONFIG_MXM_WMI is not set
# CONFIG_NVIDIA_WMI_EC_BACKLIGHT is not set
# CONFIG_XIAOMI_WMI is not set
# CONFIG_REDMI_WMI is not set
# CONFIG_GIGABYTE_WMI is not set
# CONFIG_BITLAND_MIFS_WMI is not set
# CONFIG_ACERHDF is not set
# CONFIG_ACER_WIRELESS is not set
# CONFIG_ACER_WMI is not set
# CONFIG_AMD_3D_VCACHE is not set
# CONFIG_AMD_WBRF is not set
# CONFIG_AMD_ISP_PLATFORM is not set
# CONFIG_ADV_SWBUTTON is not set
# CONFIG_APPLE_GMUX is not set
# CONFIG_ASUS_LAPTOP is not set
# CONFIG_ASUS_WIRELESS is not set
# CONFIG_ASUS_WMI is not set
# CONFIG_ASUS_TF103C_DOCK is not set
# CONFIG_AYANEO_EC is not set
# CONFIG_EEEPC_LAPTOP is not set
# CONFIG_X86_PLATFORM_DRIVERS_DELL is not set
# CONFIG_AMILO_RFKILL is not set
# CONFIG_FUJITSU_LAPTOP is not set
# CONFIG_FUJITSU_TABLET is not set
# CONFIG_GPD_POCKET_FAN is not set
# CONFIG_X86_PLATFORM_DRIVERS_HP is not set
# CONFIG_WIRELESS_HOTKEY is not set
# CONFIG_IBM_RTL is not set
# CONFIG_SENSORS_HDAPS is not set
# CONFIG_INTEL_ATOMISP2_PM is not set
# CONFIG_INTEL_IFS is not set
# CONFIG_INTEL_SAR_INT1092 is not set
# CONFIG_INTEL_PMC_CORE is not set
CONFIG_INTEL_PMT_CLASS=m
CONFIG_INTEL_PMT_TELEMETRY=m
CONFIG_INTEL_PMT_CRASHLOG=m
CONFIG_INTEL_PMT_DISCOVERY=m
#
# Intel Speed Select Technology interface support
#
# CONFIG_INTEL_SPEED_SELECT_INTERFACE is not set
# end of Intel Speed Select Technology interface support
CONFIG_INTEL_WMI=y
CONFIG_INTEL_WMI_SBL_FW_UPDATE=m
CONFIG_INTEL_WMI_THUNDERBOLT=m
#
# Intel Uncore Frequency Control
#
CONFIG_INTEL_UNCORE_FREQ_CONTROL=y
# end of Intel Uncore Frequency Control
# CONFIG_INTEL_HID_EVENT is not set
# CONFIG_INTEL_VBTN is not set
# CONFIG_INTEL_EHL_PSE_IO is not set
# CONFIG_INTEL_INT0002_VGPIO is not set
# CONFIG_INTEL_OAKTRAIL is not set
# CONFIG_INTEL_PUNIT_IPC is not set
CONFIG_INTEL_RST=y
# CONFIG_INTEL_SDSI is not set
CONFIG_INTEL_SMARTCONNECT=y
# CONFIG_INTEL_TPMI is not set
CONFIG_INTEL_TURBO_MAX_3=y
CONFIG_INTEL_VSEC=m
# CONFIG_IDEAPAD_LAPTOP is not set
# CONFIG_LENOVO_WMI_HOTKEY_UTILITIES is not set
# CONFIG_LENOVO_WMI_CAMERA is not set
# CONFIG_LENOVO_YB9_KBDOCK is not set
# CONFIG_THINKPAD_ACPI is not set
# CONFIG_THINKPAD_LMI is not set
# CONFIG_YOGABOOK is not set
# CONFIG_LENOVO_WMI_GAMEZONE is not set
# CONFIG_LENOVO_WMI_TUNING is not set
# CONFIG_ACPI_QUICKSTART is not set
# CONFIG_MEEGOPAD_ANX7428 is not set
# CONFIG_MSI_EC is not set
# CONFIG_MSI_LAPTOP is not set
# CONFIG_MSI_WMI is not set
# CONFIG_MSI_WMI_PLATFORM is not set
# CONFIG_PCENGINES_APU2 is not set
# CONFIG_BARCO_P50_GPIO is not set
# CONFIG_SAMSUNG_GALAXYBOOK is not set
# CONFIG_SAMSUNG_LAPTOP is not set
# CONFIG_SAMSUNG_Q10 is not set
# CONFIG_TOSHIBA_BT_RFKILL is not set
# CONFIG_TOSHIBA_HAPS is not set
# CONFIG_TOSHIBA_WMI is not set
# CONFIG_ACPI_CMPC is not set
# CONFIG_COMPAL_LAPTOP is not set
# CONFIG_LG_LAPTOP is not set
# CONFIG_PANASONIC_LAPTOP is not set
# CONFIG_SONY_LAPTOP is not set
# CONFIG_SYSTEM76_ACPI is not set
# CONFIG_TOPSTAR_LAPTOP is not set
# CONFIG_SERIAL_MULTI_INSTANTIATE is not set
# CONFIG_INSPUR_PLATFORM_PROFILE is not set
# CONFIG_DASHARO_ACPI is not set
# CONFIG_X86_ANDROID_TABLETS is not set
CONFIG_INTEL_IPS=y
# CONFIG_INTEL_SCU_PCI is not set
# CONFIG_INTEL_SCU_PLATFORM is not set
# CONFIG_SIEMENS_SIMATIC_IPC is not set
# CONFIG_WINMATE_FM07_KEYS is not set
# CONFIG_OXP_EC is not set
# CONFIG_TUXEDO_NB04_WMI_AB is not set
CONFIG_P2SB=y
CONFIG_ACPI_WMI=m
# CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set
CONFIG_HAVE_CLK=y
CONFIG_HAVE_CLK_PREPARE=y
CONFIG_COMMON_CLK=y
# CONFIG_LMK04832 is not set
# CONFIG_COMMON_CLK_MAX9485 is not set
# CONFIG_COMMON_CLK_SI5341 is not set
# CONFIG_COMMON_CLK_SI5351 is not set
# CONFIG_COMMON_CLK_SI544 is not set
# CONFIG_COMMON_CLK_CDCE706 is not set
# CONFIG_COMMON_CLK_CS2000_CP is not set
# CONFIG_COMMON_CLK_PWM is not set
#
# Cixtech Audio Subsystem Clock Driver
#
# end of Cixtech Audio Subsystem Clock Driver
# CONFIG_XILINX_VCU is not set
CONFIG_HWSPINLOCK=y
#
# Clock Source drivers
#
CONFIG_CLKEVT_I8253=y
CONFIG_I8253_LOCK=y
CONFIG_CLKBLD_I8253=y
# end of Clock Source drivers
CONFIG_MAILBOX=y
CONFIG_PCC=y
# CONFIG_ALTERA_MBOX is not set
CONFIG_IOMMU_IOVA=y
CONFIG_IOMMU_API=y
CONFIG_IOMMUFD_DRIVER=y
CONFIG_IOMMU_SUPPORT=y
#
# Generic IOMMU Pagetable Support
#
# end of Generic IOMMU Pagetable Support
# CONFIG_IOMMU_DEBUGFS is not set
# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set
CONFIG_IOMMU_DEFAULT_DMA_LAZY=y
# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
CONFIG_IOMMU_DMA=y
CONFIG_IOMMU_SVA=y
CONFIG_IOMMU_IOPF=y
# CONFIG_AMD_IOMMU is not set
CONFIG_DMAR_TABLE=y
CONFIG_INTEL_IOMMU=y
CONFIG_INTEL_IOMMU_SVM=y
# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set
CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON=y
CONFIG_INTEL_IOMMU_PERF_EVENTS=y
CONFIG_IOMMUFD_DRIVER_CORE=y
CONFIG_IOMMUFD=m
CONFIG_IRQ_REMAP=y
CONFIG_VIRTIO_IOMMU=y
CONFIG_GENERIC_PT=y
# CONFIG_DEBUG_GENERIC_PT is not set
CONFIG_IOMMU_PT=y
# CONFIG_IOMMU_PT_AMDV1 is not set
CONFIG_IOMMU_PT_VTDSS=y
# CONFIG_IOMMU_PT_RISCV64 is not set
CONFIG_IOMMU_PT_X86_64=y
#
# Remoteproc drivers
#
CONFIG_REMOTEPROC=y
# CONFIG_REMOTEPROC_CDEV is not set
# end of Remoteproc drivers
#
# Rpmsg drivers
#
# CONFIG_RPMSG_QCOM_GLINK_RPM is not set
# CONFIG_RPMSG_VIRTIO is not set
# end of Rpmsg drivers
#
# SOC (System On Chip) specific Drivers
#
#
# Amlogic SoC drivers
#
# end of Amlogic SoC drivers
#
# Broadcom SoC drivers
#
# end of Broadcom SoC drivers
#
# NXP/Freescale QorIQ SoC drivers
#
# end of NXP/Freescale QorIQ SoC drivers
#
# fujitsu SoC drivers
#
# end of fujitsu SoC drivers
#
# i.MX SoC drivers
#
# end of i.MX SoC drivers
#
# Enable LiteX SoC Builder specific drivers
#
# end of Enable LiteX SoC Builder specific drivers
# CONFIG_WPCM450_SOC is not set
# CONFIG_SOC_TI is not set
#
# Xilinx SoC drivers
#
# end of Xilinx SoC drivers
# end of SOC (System On Chip) specific Drivers
#
# PM Domains
#
#
# Amlogic PM Domains
#
# end of Amlogic PM Domains
#
# Broadcom PM Domains
#
# end of Broadcom PM Domains
#
# i.MX PM Domains
#
# end of i.MX PM Domains
#
# Qualcomm PM Domains
#
# end of Qualcomm PM Domains
# end of PM Domains
CONFIG_PM_DEVFREQ=y
#
# DEVFREQ Governors
#
CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVFREQ_GOV_PASSIVE is not set
#
# DEVFREQ Drivers
#
# CONFIG_PM_DEVFREQ_EVENT is not set
# CONFIG_EXTCON is not set
# CONFIG_MEMORY is not set
# CONFIG_IIO is not set
# CONFIG_NTB is not set
CONFIG_PWM=y
# CONFIG_PWM_DEBUG is not set
# CONFIG_PWM_PROVIDE_GPIO is not set
# CONFIG_PWM_CLK is not set
# CONFIG_PWM_DWC is not set
CONFIG_PWM_GPIO=m
CONFIG_PWM_LPSS=m
CONFIG_PWM_LPSS_PCI=m
CONFIG_PWM_LPSS_PLATFORM=m
# CONFIG_PWM_PCA9685 is not set
#
# IRQ chip support
#
CONFIG_IRQ_MSI_LIB=y
# end of IRQ chip support
# CONFIG_IPACK_BUS is not set
# CONFIG_RESET_CONTROLLER is not set
#
# PHY Subsystem
#
CONFIG_GENERIC_PHY=y
# CONFIG_PHY_CAN_TRANSCEIVER is not set
# CONFIG_PHY_GOOGLE_USB is not set
# CONFIG_USB_LGM_PHY is not set
# CONFIG_PHY_NXP_TJA1145 is not set
#
# PHY drivers for Broadcom platforms
#
# CONFIG_BCM_KONA_USB2_PHY is not set
# end of PHY drivers for Broadcom platforms
# CONFIG_PHY_INTEL_LGM_EMMC is not set
# CONFIG_PHY_PXA_28NM_HSIC is not set
# CONFIG_PHY_PXA_28NM_USB2 is not set
# end of PHY Subsystem
CONFIG_POWERCAP=y
CONFIG_INTEL_RAPL_CORE=y
CONFIG_INTEL_RAPL=y
CONFIG_IDLE_INJECT=y
# CONFIG_MCB is not set
#
# Performance monitor support
#
# CONFIG_DWC_PCIE_PMU is not set
# end of Performance monitor support
CONFIG_RAS=y
CONFIG_RAS_CEC=y
# CONFIG_RAS_CEC_DEBUG is not set
CONFIG_USB4=m
CONFIG_USB4_CONFIGFS=m
# CONFIG_USB4_DEBUGFS_WRITE is not set
# CONFIG_USB4_DMA_TEST is not set
# CONFIG_USB4_STREAM is not set
#
# Android
#
# CONFIG_ANDROID_BINDER_IPC is not set
# end of Android
CONFIG_LIBNVDIMM=y
CONFIG_BLK_DEV_PMEM=y
# CONFIG_BTT is not set
CONFIG_RAMDAX=y
CONFIG_NVDIMM_KEYS=y
# CONFIG_NVDIMM_SECURITY_TEST is not set
CONFIG_DAX=y
CONFIG_DEV_DAX=m
CONFIG_DEV_DAX_HMEM=m
CONFIG_DEV_DAX_HMEM_DEVICES=y
CONFIG_NVMEM=y
CONFIG_NVMEM_SYSFS=y
# CONFIG_NVMEM_LAYOUTS is not set
CONFIG_EEPROM_AT24=y
# CONFIG_EEPROM_AT25 is not set
# CONFIG_EEPROM_93XX46 is not set
CONFIG_EEPROM_EE1004=y
# CONFIG_EEPROM_M24LR is not set
CONFIG_NVMEM_RMEM=y
#
# HW tracing support
#
# CONFIG_STM is not set
# CONFIG_INTEL_TH is not set
# end of HW tracing support
# CONFIG_FPGA is not set
CONFIG_MULTIPLEXER=y
# CONFIG_MUX_CORE is not set
#
# Multiplexer drivers
#
# CONFIG_MUX_ADG792A is not set
# CONFIG_MUX_ADGS1408 is not set
CONFIG_MUX_GPIO=y
# end of Multiplexer drivers
CONFIG_PM_OPP=y
# CONFIG_SIOX is not set
# CONFIG_SLIMBUS is not set
# CONFIG_INTERCONNECT is not set
# CONFIG_COUNTER is not set
# CONFIG_MOST is not set
# CONFIG_PECI is not set
# CONFIG_HTE is not set
# end of Device Drivers
#
# File systems
#
CONFIG_DCACHE_WORD_ACCESS=y
CONFIG_VALIDATE_FS_PARSER=y
CONFIG_FS_IOMAP=y
CONFIG_FS_STACK=y
CONFIG_BUFFER_HEAD=y
CONFIG_LEGACY_DIRECT_IO=y
# CONFIG_EXT2_FS is not set
CONFIG_EXT4_FS=y
CONFIG_EXT4_USE_FOR_EXT2=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_EXT4_FS_SECURITY=y
# CONFIG_EXT4_DEBUG is not set
CONFIG_JBD2=y
# CONFIG_JBD2_DEBUG is not set
CONFIG_FS_MBCACHE=y
# CONFIG_JFS_FS is not set
# CONFIG_XFS_FS is not set
# CONFIG_GFS2_FS is not set
# CONFIG_OCFS2_FS is not set
CONFIG_BTRFS_FS=y
CONFIG_BTRFS_FS_POSIX_ACL=y
# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
# CONFIG_BTRFS_DEBUG is not set
# CONFIG_BTRFS_ASSERT is not set
# CONFIG_BTRFS_EXPERIMENTAL is not set
# CONFIG_NILFS2_FS is not set
# CONFIG_F2FS_FS is not set
# CONFIG_ZONEFS_FS is not set
CONFIG_FS_POSIX_ACL=y
CONFIG_EXPORTFS=y
CONFIG_EXPORTFS_BLOCK_OPS=y
CONFIG_FILE_LOCKING=y
CONFIG_FS_ENCRYPTION=y
CONFIG_FS_ENCRYPTION_ALGS=y
CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y
CONFIG_FS_VERITY=y
# CONFIG_FS_VERITY_BUILTIN_SIGNATURES is not set
CONFIG_FSNOTIFY=y
CONFIG_DNOTIFY=y
CONFIG_INOTIFY_USER=y
CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
CONFIG_QUOTA=y
CONFIG_QUOTA_NETLINK_INTERFACE=y
# CONFIG_QUOTA_DEBUG is not set
CONFIG_QUOTA_TREE=y
# CONFIG_QFMT_V1 is not set
CONFIG_QFMT_V2=y
CONFIG_QUOTACTL=y
CONFIG_AUTOFS_FS=y
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
CONFIG_VIRTIO_FS=m
CONFIG_FUSE_PASSTHROUGH=y
CONFIG_FUSE_IO_URING=y
CONFIG_OVERLAY_FS=y
# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set
CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y
# CONFIG_OVERLAY_FS_INDEX is not set
# CONFIG_OVERLAY_FS_XINO_AUTO is not set
# CONFIG_OVERLAY_FS_METACOPY is not set
# CONFIG_OVERLAY_FS_DEBUG is not set
#
# Caches
#
CONFIG_NETFS_SUPPORT=y
CONFIG_NETFS_STATS=y
# CONFIG_NETFS_DEBUG is not set
CONFIG_FSCACHE=y
CONFIG_FSCACHE_STATS=y
CONFIG_CACHEFILES=y
# CONFIG_CACHEFILES_DEBUG is not set
# CONFIG_CACHEFILES_ERROR_INJECTION is not set
# end of Caches
#
# CD-ROM/DVD Filesystems
#
CONFIG_ISO9660_FS=y
CONFIG_JOLIET=y
CONFIG_ZISOFS=y
CONFIG_UDF_FS=y
# end of CD-ROM/DVD Filesystems
#
# DOS/FAT/EXFAT/NT Filesystems
#
CONFIG_FAT_FS=y
CONFIG_MSDOS_FS=y
CONFIG_VFAT_FS=y
CONFIG_FAT_DEFAULT_CODEPAGE=437
CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
# CONFIG_FAT_DEFAULT_UTF8 is not set
CONFIG_EXFAT_FS=y
CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8"
# CONFIG_NTFS_FS is not set
CONFIG_NTFS3_FS=y
# CONFIG_NTFS3_64BIT_CLUSTER is not set
CONFIG_NTFS3_LZX_XPRESS=y
CONFIG_NTFS3_FS_POSIX_ACL=y
# end of DOS/FAT/EXFAT/NT Filesystems
#
# Pseudo filesystems
#
CONFIG_PROC_FS=y
CONFIG_PROC_KCORE=y
CONFIG_PROC_VMCORE=y
CONFIG_PROC_VMCORE_DEVICE_DUMP=y
CONFIG_SYSCTL=y
CONFIG_PROC_PAGE_MONITOR=y
CONFIG_PROC_CHILDREN=y
CONFIG_PROC_PID_ARCH_STATUS=y
CONFIG_PROC_CPU_RESCTRL=y
CONFIG_KERNFS=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_TMPFS_XATTR=y
CONFIG_TMPFS_INODE64=y
CONFIG_TMPFS_QUOTA=y
CONFIG_ARCH_SUPPORTS_HUGETLBFS=y
CONFIG_HUGETLBFS=y
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y
CONFIG_HUGETLB_PAGE=y
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING=y
CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
CONFIG_CONFIGFS_FS=y
CONFIG_EFIVAR_FS=y
# end of Pseudo filesystems
CONFIG_MISC_FILESYSTEMS=y
# CONFIG_ORANGEFS_FS is not set
# CONFIG_ADFS_FS is not set
# CONFIG_AFFS_FS is not set
CONFIG_ECRYPT_FS=y
# CONFIG_ECRYPT_FS_MESSAGING is not set
# CONFIG_HFS_FS is not set
# CONFIG_HFSPLUS_FS is not set
# CONFIG_BEFS_FS is not set
# CONFIG_BFS_FS is not set
# CONFIG_CRAMFS is not set
CONFIG_SQUASHFS=y
# CONFIG_SQUASHFS_FILE_CACHE is not set
CONFIG_SQUASHFS_FILE_DIRECT=y
CONFIG_SQUASHFS_DECOMP_SINGLE=y
# CONFIG_SQUASHFS_CHOICE_DECOMP_BY_MOUNT is not set
CONFIG_SQUASHFS_COMPILE_DECOMP_SINGLE=y
# CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI is not set
# CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU is not set
CONFIG_SQUASHFS_XATTR=y
# CONFIG_SQUASHFS_COMP_CACHE_FULL is not set
CONFIG_SQUASHFS_ZLIB=y
CONFIG_SQUASHFS_LZ4=y
CONFIG_SQUASHFS_LZO=y
CONFIG_SQUASHFS_XZ=y
CONFIG_SQUASHFS_ZSTD=y
# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
# CONFIG_SQUASHFS_EMBEDDED is not set
CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
# CONFIG_MINIX_FS is not set
# CONFIG_OMFS_FS is not set
# CONFIG_HPFS_FS is not set
# CONFIG_QNX4FS_FS is not set
# CONFIG_QNX6FS_FS is not set
CONFIG_RESCTRL_FS=y
CONFIG_RESCTRL_FS_PSEUDO_LOCK=y
# CONFIG_ROMFS_FS is not set
CONFIG_PSTORE=y
CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240
CONFIG_PSTORE_COMPRESS=y
# CONFIG_PSTORE_CONSOLE is not set
# CONFIG_PSTORE_PMSG is not set
# CONFIG_PSTORE_FTRACE is not set
# CONFIG_PSTORE_RAM is not set
# CONFIG_PSTORE_BLK is not set
# CONFIG_UFS_FS is not set
# CONFIG_EROFS_FS is not set
CONFIG_NETWORK_FILESYSTEMS=y
CONFIG_NFS_FS=y
# CONFIG_NFS_V2 is not set
CONFIG_NFS_V3=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFS_V4=y
CONFIG_NFS_SWAP=y
CONFIG_NFS_V4_0=y
CONFIG_NFS_V4_2=y
CONFIG_PNFS_FILE_LAYOUT=y
CONFIG_PNFS_BLOCK=y
CONFIG_PNFS_FLEXFILE_LAYOUT=y
CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org"
# CONFIG_NFS_V4_1_MIGRATION is not set
CONFIG_NFS_V4_SECURITY_LABEL=y
CONFIG_NFS_FSCACHE=y
# CONFIG_NFS_USE_LEGACY_DNS is not set
CONFIG_NFS_USE_KERNEL_DNS=y
CONFIG_NFS_DEBUG=y
CONFIG_NFS_DISABLE_UDP_SUPPORT=y
# CONFIG_NFS_V4_2_READ_PLUS is not set
CONFIG_NFSD=y
# CONFIG_NFSD_V2 is not set
CONFIG_NFSD_V3_ACL=y
CONFIG_NFSD_V4=y
CONFIG_NFSD_PNFS=y
CONFIG_NFSD_BLOCKLAYOUT=y
CONFIG_NFSD_SCSILAYOUT=y
CONFIG_NFSD_FLEXFILELAYOUT=y
CONFIG_NFSD_V4_2_INTER_SSC=y
CONFIG_NFSD_V4_SECURITY_LABEL=y
# CONFIG_NFSD_LEGACY_CLIENT_TRACKING is not set
CONFIG_NFSD_V4_POSIX_ACLS=y
CONFIG_GRACE_PERIOD=y
CONFIG_LOCKD=y
CONFIG_LOCKD_V4=y
CONFIG_NFS_ACL_SUPPORT=y
CONFIG_NFS_COMMON=y
CONFIG_NFS_COMMON_LOCALIO_SUPPORT=y
CONFIG_NFS_LOCALIO=y
CONFIG_NFS_V4_2_SSC_HELPER=y
CONFIG_SUNRPC=y
CONFIG_SUNRPC_GSS=y
CONFIG_SUNRPC_BACKCHANNEL=y
CONFIG_SUNRPC_SWAP=y
CONFIG_RPCSEC_GSS_KRB5=y
CONFIG_SUNRPC_DEBUG=y
# CONFIG_SUNRPC_DEBUG_TRACE is not set
# CONFIG_CEPH_FS is not set
CONFIG_CIFS=y
# CONFIG_CIFS_STATS2 is not set
CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
CONFIG_CIFS_UPCALL=y
CONFIG_CIFS_XATTR=y
CONFIG_CIFS_POSIX=y
CONFIG_CIFS_DEBUG=y
# CONFIG_CIFS_DEBUG2 is not set
# CONFIG_CIFS_DEBUG_DUMP_KEYS is not set
CONFIG_CIFS_DFS_UPCALL=y
CONFIG_CIFS_SWN_UPCALL=y
CONFIG_CIFS_FSCACHE=y
# CONFIG_CIFS_COMPRESSION is not set
# CONFIG_SMB_SERVER is not set
CONFIG_SMBFS=y
# CONFIG_CODA_FS is not set
# CONFIG_AFS_FS is not set
CONFIG_NLS=y
CONFIG_NLS_DEFAULT="utf8"
CONFIG_NLS_CODEPAGE_437=y
# CONFIG_NLS_CODEPAGE_737 is not set
# CONFIG_NLS_CODEPAGE_775 is not set
CONFIG_NLS_CODEPAGE_850=y
CONFIG_NLS_CODEPAGE_852=y
# CONFIG_NLS_CODEPAGE_855 is not set
# CONFIG_NLS_CODEPAGE_857 is not set
# CONFIG_NLS_CODEPAGE_860 is not set
# CONFIG_NLS_CODEPAGE_861 is not set
# CONFIG_NLS_CODEPAGE_862 is not set
# CONFIG_NLS_CODEPAGE_863 is not set
# CONFIG_NLS_CODEPAGE_864 is not set
# CONFIG_NLS_CODEPAGE_865 is not set
# CONFIG_NLS_CODEPAGE_866 is not set
# CONFIG_NLS_CODEPAGE_869 is not set
# CONFIG_NLS_CODEPAGE_936 is not set
# CONFIG_NLS_CODEPAGE_950 is not set
# CONFIG_NLS_CODEPAGE_932 is not set
# CONFIG_NLS_CODEPAGE_949 is not set
# CONFIG_NLS_CODEPAGE_874 is not set
# CONFIG_NLS_ISO8859_8 is not set
CONFIG_NLS_CODEPAGE_1250=y
# CONFIG_NLS_CODEPAGE_1251 is not set
CONFIG_NLS_ASCII=y
CONFIG_NLS_ISO8859_1=y
CONFIG_NLS_ISO8859_2=y
# CONFIG_NLS_ISO8859_3 is not set
# CONFIG_NLS_ISO8859_4 is not set
# CONFIG_NLS_ISO8859_5 is not set
# CONFIG_NLS_ISO8859_6 is not set
# CONFIG_NLS_ISO8859_7 is not set
# CONFIG_NLS_ISO8859_9 is not set
CONFIG_NLS_ISO8859_13=y
# CONFIG_NLS_ISO8859_14 is not set
CONFIG_NLS_ISO8859_15=y
# CONFIG_NLS_KOI8_R is not set
# CONFIG_NLS_KOI8_U is not set
CONFIG_NLS_MAC_ROMAN=y
# CONFIG_NLS_MAC_CELTIC is not set
# CONFIG_NLS_MAC_CENTEURO is not set
# CONFIG_NLS_MAC_CROATIAN is not set
# CONFIG_NLS_MAC_CYRILLIC is not set
# CONFIG_NLS_MAC_GAELIC is not set
# CONFIG_NLS_MAC_GREEK is not set
# CONFIG_NLS_MAC_ICELAND is not set
# CONFIG_NLS_MAC_INUIT is not set
# CONFIG_NLS_MAC_ROMANIAN is not set
# CONFIG_NLS_MAC_TURKISH is not set
CONFIG_NLS_UTF8=y
CONFIG_NLS_UCS2_UTILS=y
CONFIG_DLM=m
CONFIG_DLM_DEBUG=y
CONFIG_UNICODE=y
CONFIG_IO_WQ=y
# end of File systems
#
# Security options
#
CONFIG_KEYS=y
CONFIG_KEYS_REQUEST_CACHE=y
CONFIG_PERSISTENT_KEYRINGS=y
CONFIG_BIG_KEYS=y
CONFIG_TRUSTED_KEYS=y
CONFIG_HAVE_TRUSTED_KEYS=y
CONFIG_HAVE_TRUSTED_KEYS_DEBUG=y
# CONFIG_TRUSTED_KEYS_DEBUG is not set
CONFIG_TRUSTED_KEYS_TPM=y
CONFIG_ENCRYPTED_KEYS=y
# CONFIG_USER_DECRYPTED_DATA is not set
CONFIG_KEY_DH_OPERATIONS=y
CONFIG_KEY_NOTIFICATIONS=y
CONFIG_SECURITY_DMESG_RESTRICT=y
# CONFIG_PROC_MEM_ALWAYS_FORCE is not set
CONFIG_PROC_MEM_FORCE_PTRACE=y
# CONFIG_PROC_MEM_NO_FORCE is not set
CONFIG_SECURITY=y
CONFIG_HAS_SECURITY_AUDIT=y
CONFIG_SECURITYFS=y
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_NETWORK_XFRM=y
CONFIG_SECURITY_PATH=y
CONFIG_INTEL_TXT=y
CONFIG_LSM_MMAP_MIN_ADDR=65535
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9
# CONFIG_SECURITY_SELINUX_DEBUG is not set
# CONFIG_SECURITY_SMACK is not set
CONFIG_SECURITY_TOMOYO=y
CONFIG_SECURITY_TOMOYO_MAX_ACCEPT_ENTRY=2048
CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024
# CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER is not set
CONFIG_SECURITY_TOMOYO_POLICY_LOADER="/sbin/tomoyo-init"
CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER="/usr/lib/systemd/systemd"
# CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING is not set
# CONFIG_SECURITY_APPARMOR is not set
# CONFIG_SECURITY_LOADPIN is not set
CONFIG_SECURITY_YAMA=y
# CONFIG_SECURITY_SAFESETID is not set
CONFIG_SECURITY_LOCKDOWN_LSM=y
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
CONFIG_SECURITY_LANDLOCK=y
CONFIG_SECURITY_LANDLOCK_LOG=y
CONFIG_SECURITY_IPE=y
CONFIG_IPE_BOOT_POLICY=""
CONFIG_IPE_POLICY_SIG_SECONDARY_KEYRING=y
CONFIG_IPE_POLICY_SIG_PLATFORM_KEYRING=y
#
# IPE Trust Providers
#
CONFIG_IPE_PROP_FS_VERITY=y
# end of IPE Trust Providers
CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y
CONFIG_INTEGRITY_CA_MACHINE_KEYRING=y
CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y
CONFIG_LOAD_UEFI_KEYS=y
CONFIG_INTEGRITY_AUDIT=y
CONFIG_IMA=y
CONFIG_IMA_KEXEC=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_LSM_RULES=y
CONFIG_IMA_NG_TEMPLATE=y
# CONFIG_IMA_SIG_TEMPLATE is not set
CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
# CONFIG_IMA_DEFAULT_HASH_SHA1 is not set
CONFIG_IMA_DEFAULT_HASH_SHA256=y
# CONFIG_IMA_DEFAULT_HASH_SHA512 is not set
# CONFIG_IMA_DEFAULT_HASH_WP512 is not set
CONFIG_IMA_DEFAULT_HASH="sha256"
CONFIG_IMA_WRITE_POLICY=y
CONFIG_IMA_READ_POLICY=y
CONFIG_IMA_APPRAISE=y
CONFIG_IMA_ARCH_POLICY=y
# CONFIG_IMA_APPRAISE_BUILD_POLICY is not set
CONFIG_IMA_APPRAISE_BOOTPARAM=y
CONFIG_IMA_APPRAISE_MODSIG=y
CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y
# CONFIG_IMA_BLACKLIST_KEYRING is not set
# CONFIG_IMA_LOAD_X509 is not set
CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y
CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y
# CONFIG_IMA_DISABLE_HTABLE is not set
CONFIG_IMA_KEXEC_EXTRA_MEMORY_KB=0
# CONFIG_IMA_STAGING is not set
# CONFIG_IMA_INIT_LATE_SYNC is not set
CONFIG_EVM=y
CONFIG_EVM_ATTR_FSUUID=y
# CONFIG_EVM_ADD_XATTRS is not set
# CONFIG_EVM_LOAD_X509 is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,integrity,selinux,bpf,landlock,ipe"
#
# Kernel hardening options
#
#
# Memory initialization
#
CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
# CONFIG_INIT_STACK_NONE is not set
# CONFIG_INIT_STACK_ALL_PATTERN is not set
CONFIG_INIT_STACK_ALL_ZERO=y
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
# CONFIG_ZERO_CALL_USED_REGS is not set
# end of Memory initialization
#
# Bounds checking
#
CONFIG_FORTIFY_SOURCE=y
CONFIG_HARDENED_USERCOPY=y
CONFIG_HARDENED_USERCOPY_DEFAULT_ON=y
# end of Bounds checking
#
# Hardening of kernel data structures
#
CONFIG_LIST_HARDENED=y
CONFIG_BUG_ON_DATA_CORRUPTION=y
# end of Hardening of kernel data structures
CONFIG_RANDSTRUCT_NONE=y
# end of Kernel hardening options
# end of Security options
CONFIG_CRYPTO=y
#
# Crypto core or helper
#
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
CONFIG_CRYPTO_AEAD2=y
CONFIG_CRYPTO_SIG=y
CONFIG_CRYPTO_SIG2=y
CONFIG_CRYPTO_SKCIPHER=y
CONFIG_CRYPTO_SKCIPHER2=y
CONFIG_CRYPTO_HASH=y
CONFIG_CRYPTO_HASH2=y
CONFIG_CRYPTO_RNG=y
CONFIG_CRYPTO_RNG2=y
CONFIG_CRYPTO_AKCIPHER2=y
CONFIG_CRYPTO_AKCIPHER=y
CONFIG_CRYPTO_KPP2=y
CONFIG_CRYPTO_KPP=y
CONFIG_CRYPTO_ACOMP2=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
CONFIG_CRYPTO_USER=y
# CONFIG_CRYPTO_SELFTESTS is not set
# CONFIG_CRYPTO_NULL is not set
CONFIG_CRYPTO_PCRYPT=y
# CONFIG_CRYPTO_CRYPTD is not set
CONFIG_CRYPTO_AUTHENC=y
CONFIG_CRYPTO_KRB5ENC=y
# CONFIG_CRYPTO_BENCHMARK is not set
# end of Crypto core or helper
#
# Public-key cryptography
#
CONFIG_CRYPTO_RSA=y
CONFIG_CRYPTO_DH=y
CONFIG_CRYPTO_DH_RFC7919_GROUPS=y
CONFIG_CRYPTO_ECC=y
CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECDSA=y
CONFIG_CRYPTO_ECRDSA=y
# CONFIG_CRYPTO_MLDSA is not set
# end of Public-key cryptography
#
# Block ciphers
#
CONFIG_CRYPTO_AES=y
# CONFIG_CRYPTO_ARIA is not set
CONFIG_CRYPTO_BLOWFISH=y
CONFIG_CRYPTO_BLOWFISH_COMMON=y
CONFIG_CRYPTO_CAMELLIA=y
CONFIG_CRYPTO_CAST_COMMON=y
CONFIG_CRYPTO_CAST5=y
CONFIG_CRYPTO_CAST6=y
CONFIG_CRYPTO_DES=y
CONFIG_CRYPTO_SERPENT=y
# CONFIG_CRYPTO_SM4_GENERIC is not set
CONFIG_CRYPTO_TWOFISH=y
CONFIG_CRYPTO_TWOFISH_COMMON=y
# end of Block ciphers
#
# Length-preserving ciphers and modes
#
CONFIG_CRYPTO_ADIANTUM=y
CONFIG_CRYPTO_CHACHA20=y
CONFIG_CRYPTO_CBC=y
CONFIG_CRYPTO_CTR=y
CONFIG_CRYPTO_CTS=y
CONFIG_CRYPTO_ECB=y
CONFIG_CRYPTO_HCTR2=y
CONFIG_CRYPTO_LRW=y
CONFIG_CRYPTO_XCTR=y
CONFIG_CRYPTO_XTS=y
# end of Length-preserving ciphers and modes
#
# AEAD (authenticated encryption with associated data) ciphers
#
CONFIG_CRYPTO_AEGIS128=y
CONFIG_CRYPTO_CHACHA20POLY1305=y
CONFIG_CRYPTO_CCM=y
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GENIV=y
CONFIG_CRYPTO_SEQIV=y
CONFIG_CRYPTO_ECHAINIV=y
CONFIG_CRYPTO_ESSIV=y
# end of AEAD (authenticated encryption with associated data) ciphers
#
# Hashes, digests, and MACs
#
# CONFIG_CRYPTO_BLAKE2B is not set
CONFIG_CRYPTO_CMAC=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_MD4=y
# CONFIG_CRYPTO_MD5 is not set
CONFIG_CRYPTO_RMD160=y
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_SHA512=y
# CONFIG_CRYPTO_SHA3 is not set
# CONFIG_CRYPTO_SM3 is not set
CONFIG_CRYPTO_STREEBOG=y
CONFIG_CRYPTO_WP512=y
CONFIG_CRYPTO_XCBC=y
# CONFIG_CRYPTO_XXHASH is not set
# end of Hashes, digests, and MACs
#
# CRCs (cyclic redundancy checks)
#
# CONFIG_CRYPTO_CRC32C is not set
CONFIG_CRYPTO_CRC32=m
# end of CRCs (cyclic redundancy checks)
#
# Compression
#
CONFIG_CRYPTO_DEFLATE=y
CONFIG_CRYPTO_LZO=y
CONFIG_CRYPTO_842=y
CONFIG_CRYPTO_LZ4=y
CONFIG_CRYPTO_LZ4HC=y
CONFIG_CRYPTO_ZSTD=y
# end of Compression
#
# Random number generation
#
# CONFIG_CRYPTO_DRBG is not set
# CONFIG_CRYPTO_JITTERENTROPY is not set
CONFIG_CRYPTO_KDF800108_CTR=y
# end of Random number generation
#
# Userspace interface (deprecated)
#
CONFIG_CRYPTO_USER_API=y
CONFIG_CRYPTO_USER_API_HASH=y
CONFIG_CRYPTO_USER_API_SKCIPHER=y
CONFIG_CRYPTO_USER_API_RNG=y
CONFIG_CRYPTO_USER_API_AEAD=y
# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
# end of Userspace interface (deprecated)
#
# Accelerated Cryptographic Algorithms for CPU (x86)
#
CONFIG_CRYPTO_AES_NI_INTEL=y
CONFIG_CRYPTO_BLOWFISH_X86_64=y
CONFIG_CRYPTO_CAMELLIA_X86_64=y
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64=y
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=y
CONFIG_CRYPTO_CAST5_AVX_X86_64=y
CONFIG_CRYPTO_CAST6_AVX_X86_64=y
CONFIG_CRYPTO_SERPENT_SSE2_X86_64=y
CONFIG_CRYPTO_SERPENT_AVX_X86_64=y
CONFIG_CRYPTO_SERPENT_AVX2_X86_64=y
# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set
# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set
CONFIG_CRYPTO_TWOFISH_X86_64=y
CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y
CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y
# CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set
# CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64 is not set
# CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64 is not set
CONFIG_CRYPTO_AEGIS128_AESNI_SSE2=y
# end of Accelerated Cryptographic Algorithms for CPU (x86)
# CONFIG_CRYPTO_HW is not set
CONFIG_ASYMMETRIC_KEY_TYPE=y
CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
CONFIG_X509_CERTIFICATE_PARSER=y
CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
CONFIG_PKCS7_MESSAGE_PARSER=y
# CONFIG_PKCS7_TEST_KEY is not set
CONFIG_SIGNED_PE_FILE_VERIFICATION=y
# CONFIG_FIPS_SIGNATURE_SELFTEST is not set
#
# Certificates for signature checking
#
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set
# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set
# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set
# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set
CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SYSTEM_TRUSTED_KEYS=""
CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
CONFIG_SECONDARY_TRUSTED_KEYRING=y
# CONFIG_SECONDARY_TRUSTED_KEYRING_SIGNED_BY_BUILTIN is not set
CONFIG_SYSTEM_BLACKLIST_KEYRING=y
CONFIG_SYSTEM_BLACKLIST_HASH_LIST=""
# CONFIG_SYSTEM_REVOCATION_LIST is not set
CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE=y
CONFIG_OPENSSL_SUPPORTS_ML_DSA=y
# end of Certificates for signature checking
CONFIG_CRYPTO_KRB5=y
# CONFIG_CRYPTO_KRB5_SELFTESTS is not set
CONFIG_BINARY_PRINTF=y
#
# Library routines
#
CONFIG_PACKING=y
CONFIG_BITREVERSE=y
CONFIG_GENERIC_BITREVERSE=y
CONFIG_GENERIC_STRNCPY_FROM_USER=y
CONFIG_GENERIC_STRNLEN_USER=y
CONFIG_GENERIC_NET_UTILS=y
CONFIG_CORDIC=y
# CONFIG_PRIME_NUMBERS is not set
CONFIG_RATIONAL=y
CONFIG_GENERIC_IOMAP=y
CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
CONFIG_ARCH_HAS_FAST_MULTIPLIER=y
CONFIG_ARCH_USE_SYM_ANNOTATIONS=y
CONFIG_CRC8=m
CONFIG_CRC16=y
CONFIG_CRC_CCITT=y
CONFIG_CRC_ITU_T=y
CONFIG_CRC_T10DIF=y
CONFIG_CRC_T10DIF_ARCH=y
CONFIG_CRC32=y
CONFIG_CRC32_ARCH=y
CONFIG_CRC64=y
CONFIG_CRC64_ARCH=y
CONFIG_CRC_OPTIMIZATIONS=y
CONFIG_CRYPTO_HASH_INFO=y
CONFIG_CRYPTO_LIB_UTILS=y
CONFIG_CRYPTO_LIB_AES=y
CONFIG_CRYPTO_LIB_AES_ARCH=y
CONFIG_CRYPTO_LIB_AES_CBC=y
CONFIG_CRYPTO_LIB_AES_CBC_MACS=y
CONFIG_CRYPTO_LIB_AES_CCM=y
CONFIG_CRYPTO_LIB_AES_CTR=y
CONFIG_CRYPTO_LIB_AES_ECB=y
CONFIG_CRYPTO_LIB_AES_GCM=y
CONFIG_CRYPTO_LIB_AES_XTS=y
CONFIG_CRYPTO_LIB_ARC4=y
CONFIG_CRYPTO_LIB_GF128MUL=y
CONFIG_CRYPTO_LIB_BLAKE2B=y
CONFIG_CRYPTO_LIB_BLAKE2S_ARCH=y
CONFIG_CRYPTO_LIB_CHACHA=y
CONFIG_CRYPTO_LIB_CHACHA_ARCH=y
CONFIG_CRYPTO_LIB_CURVE25519=m
CONFIG_CRYPTO_LIB_CURVE25519_ARCH=y
CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=y
CONFIG_CRYPTO_LIB_DES=y
CONFIG_CRYPTO_LIB_GF128HASH=y
CONFIG_CRYPTO_LIB_GF128HASH_ARCH=y
CONFIG_CRYPTO_LIB_MD5=y
CONFIG_CRYPTO_LIB_NH=y
CONFIG_CRYPTO_LIB_NH_ARCH=y
CONFIG_CRYPTO_LIB_POLY1305=y
CONFIG_CRYPTO_LIB_POLY1305_ARCH=y
CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y
CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
CONFIG_CRYPTO_LIB_CHACHA20POLY1305=y
CONFIG_CRYPTO_LIB_SHA1=y
CONFIG_CRYPTO_LIB_SHA1_ARCH=y
CONFIG_CRYPTO_LIB_SHA256=y
CONFIG_CRYPTO_LIB_SHA256_ARCH=y
CONFIG_CRYPTO_LIB_SHA512=y
CONFIG_CRYPTO_LIB_SHA512_ARCH=y
CONFIG_XOR_BLOCKS=y
CONFIG_XOR_BLOCKS_ARCH=y
CONFIG_RAID6_PQ=y
CONFIG_RAID6_PQ_ARCH=y
CONFIG_RAID6_PQ_BENCHMARK=y
CONFIG_XXHASH=y
CONFIG_842_COMPRESS=y
CONFIG_842_DECOMPRESS=y
CONFIG_ZLIB_INFLATE=y
CONFIG_ZLIB_DEFLATE=y
CONFIG_LZO_COMPRESS=y
CONFIG_LZO_DECOMPRESS=y
CONFIG_LZ4_COMPRESS=y
CONFIG_LZ4HC_COMPRESS=y
CONFIG_LZ4_DECOMPRESS=y
CONFIG_ZSTD_COMMON=y
CONFIG_ZSTD_COMPRESS=y
CONFIG_ZSTD_DECOMPRESS=y
CONFIG_XZ_DEC=y
CONFIG_XZ_DEC_X86=y
CONFIG_XZ_DEC_POWERPC=y
CONFIG_XZ_DEC_ARM=y
CONFIG_XZ_DEC_ARMTHUMB=y
CONFIG_XZ_DEC_ARM64=y
CONFIG_XZ_DEC_SPARC=y
CONFIG_XZ_DEC_RISCV=y
CONFIG_XZ_DEC_MICROLZMA=y
CONFIG_XZ_DEC_BCJ=y
# CONFIG_XZ_DEC_TEST is not set
CONFIG_DECOMPRESS_GZIP=y
CONFIG_DECOMPRESS_BZIP2=y
CONFIG_DECOMPRESS_LZMA=y
CONFIG_DECOMPRESS_XZ=y
CONFIG_DECOMPRESS_LZO=y
CONFIG_DECOMPRESS_LZ4=y
CONFIG_DECOMPRESS_ZSTD=y
CONFIG_GENERIC_ALLOCATOR=y
CONFIG_TEXTSEARCH=y
CONFIG_TEXTSEARCH_KMP=m
CONFIG_TEXTSEARCH_BM=m
CONFIG_TEXTSEARCH_FSM=m
CONFIG_INTERVAL_TREE=y
CONFIG_INTERVAL_TREE_SPAN_ITER=y
CONFIG_XARRAY_MULTI=y
CONFIG_ASSOCIATIVE_ARRAY=y
CONFIG_HAS_IOMEM=y
CONFIG_HAS_IOPORT=y
CONFIG_HAS_IOPORT_MAP=y
CONFIG_HAS_DMA=y
CONFIG_DMA_OPS_HELPERS=y
CONFIG_NEED_SG_DMA_FLAGS=y
CONFIG_NEED_SG_DMA_LENGTH=y
CONFIG_NEED_DMA_MAP_STATE=y
CONFIG_ARCH_DMA_ADDR_T_64BIT=y
CONFIG_SWIOTLB=y
CONFIG_SWIOTLB_DEFAULT_SIZE_MB=64
# CONFIG_SWIOTLB_DYNAMIC is not set
CONFIG_DMA_NEED_SYNC=y
CONFIG_DMA_CMA=y
CONFIG_DMA_NUMA_CMA=y
CONFIG_CMA_SIZE_PERNUMA=y
#
# Default contiguous memory area size:
#
CONFIG_CMA_SIZE_MBYTES=0
CONFIG_CMA_SIZE_SEL_MBYTES=y
# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
# CONFIG_CMA_SIZE_SEL_MIN is not set
# CONFIG_CMA_SIZE_SEL_MAX is not set
CONFIG_CMA_ALIGNMENT=8
# CONFIG_DMA_API_DEBUG is not set
# CONFIG_DMA_MAP_BENCHMARK is not set
CONFIG_SGL_ALLOC=y
CONFIG_CHECK_SIGNATURE=y
CONFIG_CPUMASK_OFFSTACK=y
CONFIG_CPU_RMAP=y
CONFIG_DQL=y
CONFIG_GLOB=y
CONFIG_NLATTR=y
CONFIG_CLZ_TAB=y
CONFIG_IRQ_POLL=y
CONFIG_MPILIB=y
CONFIG_SIGNATURE=y
CONFIG_DIMLIB=y
CONFIG_LIBFDT=y
CONFIG_OID_REGISTRY=y
CONFIG_UCS2_STRING=y
CONFIG_VDSO_DATASTORE=y
CONFIG_GENERIC_GETTIMEOFDAY=y
CONFIG_GENERIC_VDSO_OVERFLOW_PROTECT=y
CONFIG_VDSO_GETRANDOM=y
CONFIG_FONT_SUPPORT=y
# CONFIG_FONTS is not set
CONFIG_FONT_8x8=y
CONFIG_FONT_8x16=y
CONFIG_SG_POOL=y
CONFIG_ARCH_HAS_PMEM_API=y
CONFIG_MEMREGION=y
CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y
CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y
CONFIG_ARCH_HAS_COPY_MC=y
CONFIG_ARCH_STACKWALK=y
CONFIG_STACKDEPOT=y
CONFIG_STACKDEPOT_MAX_FRAMES=64
CONFIG_SBITMAP=y
# CONFIG_LWQ_TEST is not set
# end of Library routines
CONFIG_ASN1_ENCODER=y
CONFIG_FIRMWARE_TABLE=y
CONFIG_UNION_FIND=y
#
# Kernel hacking
#
#
# printk and dmesg options
#
CONFIG_PRINTK_TIME=y
# CONFIG_PRINTK_CALLER is not set
CONFIG_PRINTK_EXECUTION_CTX=y
# CONFIG_STACKTRACE_BUILD_ID is not set
CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
CONFIG_CONSOLE_LOGLEVEL_QUIET=3
CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
CONFIG_BOOT_PRINTK_DELAY=y
CONFIG_DYNAMIC_DEBUG=y
CONFIG_DYNAMIC_DEBUG_CORE=y
CONFIG_SYMBOLIC_ERRNAME=y
CONFIG_DEBUG_BUGVERBOSE=y
# CONFIG_DEBUG_BUGVERBOSE_DETAILED is not set
# end of printk and dmesg options
CONFIG_DEBUG_KERNEL=y
# CONFIG_DEBUG_MISC is not set
#
# Compile-time checks and compiler options
#
CONFIG_DEBUG_INFO=y
CONFIG_AS_HAS_NON_CONST_ULEB128=y
# CONFIG_DEBUG_INFO_NONE is not set
CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
# CONFIG_DEBUG_INFO_DWARF4 is not set
# CONFIG_DEBUG_INFO_DWARF5 is not set
# CONFIG_DEBUG_INFO_REDUCED is not set
CONFIG_DEBUG_INFO_COMPRESSED_NONE=y
# CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set
# CONFIG_DEBUG_INFO_COMPRESSED_ZSTD is not set
# CONFIG_DEBUG_INFO_SPLIT is not set
CONFIG_DEBUG_INFO_BTF=y
CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
CONFIG_DEBUG_INFO_BTF_MODULES=y
# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set
# CONFIG_GDB_SCRIPTS is not set
CONFIG_FRAME_WARN=2048
CONFIG_STRIP_ASM_SYMS=y
# CONFIG_READABLE_ASM is not set
CONFIG_HEADERS_INSTALL=y
# CONFIG_DEBUG_SECTION_MISMATCH is not set
CONFIG_SECTION_MISMATCH_WARN_ONLY=y
# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
CONFIG_OBJTOOL=y
# CONFIG_OBJTOOL_WERROR is not set
# CONFIG_VMLINUX_MAP is not set
# end of Compile-time checks and compiler options
#
# Generic Kernel Debugging Instruments
#
CONFIG_MAGIC_SYSRQ=y
CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x0
CONFIG_MAGIC_SYSRQ_SERIAL=y
CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_FS_ALLOW_ALL=y
# CONFIG_DEBUG_FS_ALLOW_NONE is not set
CONFIG_HAVE_ARCH_KGDB=y
CONFIG_KGDB=y
CONFIG_KGDB_HONOUR_BLOCKLIST=y
CONFIG_KGDB_SERIAL_CONSOLE=y
CONFIG_KGDB_TESTS=y
# CONFIG_KGDB_TESTS_ON_BOOT is not set
CONFIG_KGDB_LOW_LEVEL_TRAP=y
# CONFIG_KGDB_KDB is not set
CONFIG_ARCH_HAS_EARLY_DEBUG=y
CONFIG_ARCH_HAS_UBSAN=y
CONFIG_UBSAN=y
# CONFIG_UBSAN_TRAP is not set
CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y
CONFIG_UBSAN_BOUNDS=y
CONFIG_UBSAN_BOUNDS_STRICT=y
CONFIG_UBSAN_SHIFT=y
# CONFIG_UBSAN_DIV_ZERO is not set
# CONFIG_UBSAN_BOOL is not set
# CONFIG_UBSAN_ENUM is not set
# CONFIG_UBSAN_ALIGNMENT is not set
# CONFIG_TEST_UBSAN is not set
CONFIG_HAVE_ARCH_KCSAN=y
CONFIG_HAVE_KCSAN_COMPILER=y
# CONFIG_KCSAN is not set
# end of Generic Kernel Debugging Instruments
#
# Networking Debugging
#
# CONFIG_NET_DEV_REFCNT_TRACKER is not set
# CONFIG_NET_NS_REFCNT_TRACKER is not set
# CONFIG_DEBUG_NET is not set
# CONFIG_DEBUG_NET_SMALL_RTNL is not set
# end of Networking Debugging
#
# Memory Debugging
#
CONFIG_PAGE_EXTENSION=y
# CONFIG_DEBUG_PAGEALLOC is not set
CONFIG_SLUB_DEBUG=y
# CONFIG_SLUB_DEBUG_ON is not set
CONFIG_PAGE_OWNER=y
# CONFIG_PAGE_TABLE_CHECK is not set
# CONFIG_PAGE_POISONING is not set
# CONFIG_DEBUG_PAGE_REF is not set
# CONFIG_DEBUG_RODATA_TEST is not set
CONFIG_ARCH_HAS_DEBUG_WX=y
CONFIG_DEBUG_WX=y
CONFIG_ARCH_HAS_PTDUMP=y
CONFIG_PTDUMP=y
# CONFIG_PTDUMP_DEBUGFS is not set
CONFIG_HAVE_DEBUG_KMEMLEAK=y
# CONFIG_DEBUG_KMEMLEAK is not set
# CONFIG_PER_VMA_LOCK_STATS is not set
# CONFIG_MEM_ALLOC_PROFILING is not set
# CONFIG_DEBUG_OBJECTS is not set
# CONFIG_SHRINKER_DEBUG is not set
# CONFIG_DEBUG_STACK_USAGE is not set
CONFIG_SCHED_STACK_END_CHECK=y
CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y
# CONFIG_DEBUG_VFS is not set
# CONFIG_DEBUG_VM is not set
# CONFIG_DEBUG_VM_PGTABLE is not set
CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y
# CONFIG_DEBUG_VIRTUAL is not set
CONFIG_DEBUG_MEMORY_INIT=y
# CONFIG_DEBUG_PER_CPU_MAPS is not set
CONFIG_HAVE_ARCH_KASAN=y
CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
CONFIG_CC_HAS_KASAN_GENERIC=y
CONFIG_CC_HAS_KASAN_SW_TAGS=y
CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
# CONFIG_KASAN is not set
CONFIG_HAVE_ARCH_KFENCE=y
CONFIG_KFENCE=y
CONFIG_KFENCE_SAMPLE_INTERVAL=100
CONFIG_KFENCE_NUM_OBJECTS=255
# CONFIG_KFENCE_DEFERRABLE is not set
# CONFIG_KFENCE_STATIC_KEYS is not set
CONFIG_KFENCE_STRESS_TEST_FAULTS=0
CONFIG_HAVE_ARCH_KMSAN=y
# end of Memory Debugging
CONFIG_DEBUG_SHIRQ=y
#
# Debug Oops, Lockups and Hangs
#
# CONFIG_PANIC_ON_OOPS is not set
CONFIG_PANIC_TIMEOUT=0
CONFIG_LOCKUP_DETECTOR=y
CONFIG_SOFTLOCKUP_DETECTOR=y
CONFIG_SOFTLOCKUP_DETECTOR_INTR_STORM=y
CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=0
CONFIG_HAVE_HARDLOCKUP_DETECTOR_BUDDY=y
CONFIG_HARDLOCKUP_DETECTOR=y
# CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY is not set
CONFIG_HARDLOCKUP_DETECTOR_PERF=y
# CONFIG_HARDLOCKUP_DETECTOR_BUDDY is not set
# CONFIG_HARDLOCKUP_DETECTOR_ARCH is not set
CONFIG_HARDLOCKUP_DETECTOR_COUNTS_HRTIMER=y
CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set
# CONFIG_DETECT_HUNG_TASK is not set
# CONFIG_WQ_WATCHDOG is not set
# CONFIG_WQ_CPU_INTENSIVE_REPORT is not set
# CONFIG_TEST_LOCKUP is not set
# end of Debug Oops, Lockups and Hangs
#
# Scheduler Debugging
#
CONFIG_SCHED_INFO=y
CONFIG_SCHEDSTATS=y
# end of Scheduler Debugging
# CONFIG_DEBUG_PREEMPT is not set
# CONFIG_DEBUG_ATOMIC is not set
#
# Lock Debugging (spinlocks, mutexes, etc...)
#
CONFIG_LOCK_DEBUGGING_SUPPORT=y
# CONFIG_PROVE_LOCKING is not set
# CONFIG_LOCK_STAT is not set
# CONFIG_DEBUG_RT_MUTEXES is not set
# CONFIG_DEBUG_SPINLOCK is not set
# CONFIG_DEBUG_MUTEXES is not set
# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
# CONFIG_DEBUG_RWSEMS is not set
# CONFIG_DEBUG_LOCK_ALLOC is not set
# CONFIG_DEBUG_ATOMIC_SLEEP is not set
# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
# CONFIG_LOCK_TORTURE_TEST is not set
# CONFIG_WW_MUTEX_SELFTEST is not set
# CONFIG_SCF_TORTURE_TEST is not set
# CONFIG_CSD_LOCK_WAIT_DEBUG is not set
# end of Lock Debugging (spinlocks, mutexes, etc...)
# CONFIG_NMI_CHECK_CPU is not set
# CONFIG_DEBUG_IRQFLAGS is not set
CONFIG_STACKTRACE=y
# CONFIG_DEBUG_KOBJECT is not set
#
# Debug kernel data structures
#
# CONFIG_DEBUG_LIST is not set
# CONFIG_DEBUG_PLIST is not set
# CONFIG_DEBUG_SG is not set
# CONFIG_DEBUG_NOTIFIERS is not set
# CONFIG_DEBUG_MAPLE_TREE is not set
# end of Debug kernel data structures
#
# RCU Debugging
#
# CONFIG_RCU_SCALE_TEST is not set
# CONFIG_RCU_TORTURE_TEST is not set
# CONFIG_RCU_REF_SCALE_TEST is not set
CONFIG_RCU_CPU_STALL_TIMEOUT=60
CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0
# CONFIG_RCU_CPU_STALL_CPUTIME is not set
# CONFIG_RCU_TRACE is not set
# CONFIG_RCU_EQS_DEBUG is not set
# end of RCU Debugging
# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set
# CONFIG_LATENCYTOP is not set
# CONFIG_DEBUG_CGROUP_REF is not set
CONFIG_USER_STACKTRACE_SUPPORT=y
CONFIG_NOP_TRACER=y
CONFIG_HAVE_RETHOOK=y
CONFIG_RETHOOK=y
CONFIG_HAVE_FUNCTION_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_FREGS=y
CONFIG_HAVE_FTRACE_GRAPH_FUNC=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y
CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS=y
CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_JMP=y
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
CONFIG_HAVE_FENTRY=y
CONFIG_HAVE_OBJTOOL_MCOUNT=y
CONFIG_HAVE_OBJTOOL_NOP_MCOUNT=y
CONFIG_HAVE_C_RECORDMCOUNT=y
CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y
CONFIG_BUILDTIME_MCOUNT_SORT=y
CONFIG_TRACER_MAX_TRACE=y
CONFIG_TRACE_CLOCK=y
CONFIG_RING_BUFFER=y
CONFIG_EVENT_TRACING=y
CONFIG_CONTEXT_SWITCH_TRACER=y
CONFIG_TRACING=y
CONFIG_GENERIC_TRACER=y
CONFIG_TRACING_SUPPORT=y
CONFIG_FTRACE=y
CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED=y
CONFIG_BOOTTIME_TRACING=y
CONFIG_FUNCTION_TRACER=y
CONFIG_FUNCTION_GRAPH_TRACER=y
CONFIG_FUNCTION_GRAPH_RETVAL=y
# CONFIG_FUNCTION_GRAPH_RETADDR is not set
CONFIG_FUNCTION_TRACE_ARGS=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y
CONFIG_DYNAMIC_FTRACE_WITH_JMP=y
# CONFIG_FUNCTION_SELF_TRACING is not set
# CONFIG_FPROBE is not set
# CONFIG_FUNCTION_PROFILER is not set
CONFIG_STACK_TRACER=y
# CONFIG_IRQSOFF_TRACER is not set
# CONFIG_PREEMPT_TRACER is not set
CONFIG_SCHED_TRACER=y
CONFIG_HWLAT_TRACER=y
CONFIG_OSNOISE_TRACER=y
CONFIG_TIMERLAT_TRACER=y
# CONFIG_MMIOTRACE is not set
CONFIG_FTRACE_SYSCALLS=y
CONFIG_TRACE_SYSCALL_BUF_SIZE_DEFAULT=63
CONFIG_TRACER_SNAPSHOT=y
# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
CONFIG_BRANCH_PROFILE_NONE=y
# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
# CONFIG_BLK_DEV_IO_TRACE is not set
CONFIG_PROBE_EVENTS_BTF_ARGS=y
# CONFIG_PROBE_EVENTS_DUMP_FETCHARG is not set
CONFIG_KPROBE_EVENTS=y
# CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set
CONFIG_UPROBE_EVENTS=y
CONFIG_EPROBE_EVENTS=y
CONFIG_BPF_EVENTS=y
CONFIG_DYNAMIC_EVENTS=y
CONFIG_PROBE_EVENTS=y
CONFIG_FTRACE_MCOUNT_USE_CC=y
CONFIG_SYNTH_EVENTS=y
# CONFIG_USER_EVENTS is not set
# CONFIG_HIST_TRIGGERS is not set
# CONFIG_TRACE_EVENT_INJECT is not set
# CONFIG_TRACEPOINT_BENCHMARK is not set
# CONFIG_RING_BUFFER_BENCHMARK is not set
# CONFIG_TRACE_EVAL_MAP_FILE is not set
# CONFIG_FTRACE_RECORD_RECURSION is not set
# CONFIG_FTRACE_VALIDATE_RCU_IS_WATCHING is not set
# CONFIG_FTRACE_STARTUP_TEST is not set
# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
# CONFIG_RING_BUFFER_STARTUP_TEST is not set
# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set
# CONFIG_RING_BUFFER_PERSISTENT_INJECT is not set
# CONFIG_PREEMPTIRQ_DELAY_TEST is not set
# CONFIG_SYNTH_EVENT_GEN_TEST is not set
# CONFIG_KPROBE_EVENT_GEN_TEST is not set
CONFIG_RV_MON_EVENTS=y
CONFIG_RV_MON_MAINTENANCE_EVENTS=y
CONFIG_DA_MON_EVENTS_ID=y
CONFIG_RV=y
CONFIG_RV_PER_TASK_MONITORS=2
CONFIG_RV_MON_WWNR=y
# CONFIG_RV_MON_STALL is not set
# CONFIG_RV_MON_DEADLINE is not set
CONFIG_RV_REACTORS=y
CONFIG_RV_REACT_PRINTK=y
CONFIG_RV_REACT_PANIC=y
# CONFIG_TRACE_REMOTE_TEST is not set
# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
# CONFIG_SAMPLES is not set
CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y
CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y
CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y
#
# x86 Debugging
#
CONFIG_EARLY_PRINTK_USB=y
# CONFIG_X86_VERBOSE_BOOTUP is not set
CONFIG_EARLY_PRINTK=y
CONFIG_EARLY_PRINTK_DBGP=y
CONFIG_EARLY_PRINTK_USB_XDBC=y
# CONFIG_EFI_PGT_DUMP is not set
# CONFIG_DEBUG_TLBFLUSH is not set
CONFIG_HAVE_MMIOTRACE_SUPPORT=y
# CONFIG_X86_DECODER_SELFTEST is not set
CONFIG_IO_DELAY_0X80=y
# CONFIG_IO_DELAY_0XED is not set
# CONFIG_IO_DELAY_UDELAY is not set
# CONFIG_IO_DELAY_NONE is not set
CONFIG_DEBUG_BOOT_PARAMS=y
# CONFIG_CPA_DEBUG is not set
# CONFIG_DEBUG_ENTRY is not set
# CONFIG_DEBUG_NMI_SELFTEST is not set
# CONFIG_X86_DEBUG_FPU is not set
# CONFIG_PUNIT_ATOM_DEBUG is not set
CONFIG_UNWINDER_ORC=y
# CONFIG_UNWINDER_FRAME_POINTER is not set
# end of x86 Debugging
#
# Kernel Testing and Coverage
#
# CONFIG_KUNIT is not set
# CONFIG_NOTIFIER_ERROR_INJECTION is not set
# CONFIG_FUNCTION_ERROR_INJECTION is not set
# CONFIG_FAULT_INJECTION is not set
CONFIG_ARCH_HAS_KCOV=y
# CONFIG_KCOV is not set
CONFIG_RUNTIME_TESTING_MENU=y
# CONFIG_TEST_DHRY is not set
# CONFIG_LKDTM is not set
# CONFIG_TEST_DIV64 is not set
# CONFIG_TEST_MULDIV64 is not set
# CONFIG_BACKTRACE_SELF_TEST is not set
# CONFIG_TEST_REF_TRACKER is not set
# CONFIG_RBTREE_TEST is not set
# CONFIG_REED_SOLOMON_TEST is not set
# CONFIG_INTERVAL_TREE_TEST is not set
# CONFIG_PERCPU_TEST is not set
# CONFIG_ATOMIC64_SELFTEST is not set
# CONFIG_TEST_HEXDUMP is not set
CONFIG_TEST_KSTRTOX=y
# CONFIG_TEST_BITMAP is not set
# CONFIG_TEST_XARRAY is not set
# CONFIG_TEST_MAPLE_TREE is not set
# CONFIG_TEST_RHASHTABLE is not set
# CONFIG_TEST_IDA is not set
# CONFIG_TEST_LKM is not set
# CONFIG_TEST_BITOPS is not set
# CONFIG_TEST_VMALLOC is not set
# CONFIG_TEST_WORKQUEUE is not set
# CONFIG_TEST_BPF is not set
# CONFIG_FIND_BIT_BENCHMARK is not set
# CONFIG_REGION_ALLOC_BENCHMARK is not set
# CONFIG_TEST_FIRMWARE is not set
# CONFIG_TEST_SYSCTL is not set
# CONFIG_CONTEXT_ANALYSIS_TEST is not set
# CONFIG_TEST_UDELAY is not set
# CONFIG_TEST_STATIC_KEYS is not set
# CONFIG_TEST_DYNAMIC_DEBUG is not set
# CONFIG_TEST_KMOD is not set
# CONFIG_TEST_KALLSYMS is not set
# CONFIG_TEST_MEMCAT_P is not set
# CONFIG_TEST_MEMINIT is not set
# CONFIG_TEST_FREE_PAGES is not set
# CONFIG_TEST_FPU is not set
# CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set
# CONFIG_TEST_OBJPOOL is not set
# CONFIG_TEST_KEXEC_HANDOVER is not set
CONFIG_ARCH_USE_MEMTEST=y
CONFIG_MEMTEST=y
# end of Kernel Testing and Coverage
#
# Rust hacking
#
# end of Rust hacking
# end of Kernel hacking
CONFIG_IO_URING_ZCRX=y
CONFIG_IO_URING_BPF=y
CONFIG_IO_URING_BPF_OPS=y
[-- Attachment #3: dmesg --]
[-- Type: text/plain, Size: 90694 bytes --]
[ 0.000000] Linux version 7.3.2-rc1_MY-g75eaee7a6465 (ron@obelix) (gcc (GCC) 16.2.1 20261029 (Red Hat 16.2.1-3), GNU ld version 2.47.20260726) #1 SMP PREEMPT_DYNAMIC Wed Nov 4 23:56:00 CET 2026
[ 0.000000] Command line: BOOT_IMAGE=(hd1,gpt1)/vmlinuz-7.3.2-rc1_MY-g75eaee7a6465 root=UUID=2ab6e75b-4e3c-4a9d-a329-431178fdd0e7 ro rootflags=subvol=ROOT i915.enable_guc=3 rhgb quiet
[ 0.000000] KERNEL supported cpus:
[ 0.000000] Intel GenuineIntel
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009dfff] System RAM
[ 0.000000] BIOS-e820: [mem 0x000000000009e000-0x000000000009efff] device reserved
[ 0.000000] BIOS-e820: [mem 0x000000000009f000-0x000000000009ffff] System RAM
[ 0.000000] BIOS-e820: [mem 0x00000000000a0000-0x00000000000fffff] device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x0000000077945fff] System RAM
[ 0.000000] BIOS-e820: [mem 0x0000000077946000-0x0000000077946fff] device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000077947000-0x0000000077983fff] System RAM
[ 0.000000] BIOS-e820: [mem 0x0000000077984000-0x0000000077984fff] device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000077985000-0x0000000087deefff] System RAM
[ 0.000000] BIOS-e820: [mem 0x0000000087def000-0x000000008a2eefff] device reserved
[ 0.000000] BIOS-e820: [mem 0x000000008a2ef000-0x000000008a56efff] ACPI data
[ 0.000000] BIOS-e820: [mem 0x000000008a56f000-0x000000008a6fefff] ACPI NVS
[ 0.000000] BIOS-e820: [mem 0x000000008a6ff000-0x000000008bffefff] device reserved
[ 0.000000] BIOS-e820: [mem 0x000000008bfff000-0x000000008bffffff] System RAM
[ 0.000000] BIOS-e820: [mem 0x000000008c000000-0x000000008dffffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x000000008e000000-0x000000008e5fffff]
[ 0.000000] BIOS-e820: [mem 0x000000008e600000-0x000000008e7fffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x000000008e800000-0x000000008effffff]
[ 0.000000] BIOS-e820: [mem 0x000000008f000000-0x00000000a07fffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000a0800000-0x00000000dfffffff]
[ 0.000000] BIOS-e820: [mem 0x00000000e0000000-0x00000000efffffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000f0000000-0x00000000fdffffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fe000000-0x00000000fe010fff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fe011000-0x00000000febfffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fec01000-0x00000000fecfffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fed00000-0x00000000fed00fff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fed01000-0x00000000fed1ffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fed20000-0x00000000fed7ffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fed80000-0x00000000fedfffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000fee01000-0x00000000feffffff]
[ 0.000000] BIOS-e820: [mem 0x00000000ff000000-0x00000000ffffffff] device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000045f7fffff] System RAM
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] APIC: Static calls initialized
[ 0.000000] efi: EFI v2.7 by American Megatrends
[ 0.000000] efi: ACPI=0x8a56e000 ACPI 2.0=0x8a56e014 TPMFinalLog=0x8a66c000 SMBIOS=0x8bd61000 SMBIOS 3.0=0x8bd60000 MEMATTR=0x85899418 ESRT=0x85e80698 MOKvar=0x8ba59000 RNG=0x8a4ffc18 TPMEventLog=0x8a4e5018
[ 0.000000] random: crng init done
[ 0.000000] efi: Remove mem83: MMIO range=[0xe0000000-0xefffffff] (256MB) from e820 map
[ 0.000000] e820: remove [mem 0xe0000000-0xefffffff] device reserved
[ 0.000000] efi: Not removing mem84: MMIO range=[0xfe000000-0xfe010fff] (68KB) from e820 map
[ 0.000000] efi: Not removing mem85: MMIO range=[0xfec00000-0xfec00fff] (4KB) from e820 map
[ 0.000000] efi: Not removing mem86: MMIO range=[0xfed00000-0xfed00fff] (4KB) from e820 map
[ 0.000000] efi: Not removing mem88: MMIO range=[0xfee00000-0xfee00fff] (4KB) from e820 map
[ 0.000000] efi: Remove mem89: MMIO range=[0xff000000-0xffffffff] (16MB) from e820 map
[ 0.000000] e820: remove [mem 0xff000000-0xffffffff] device reserved
[ 0.000000] DMI: SMBIOS 3.3.0 present.
[ 0.000000] DMI: ASUS System Product Name/ROG STRIX B560-G GAMING WIFI, BIOS 2501 05/22/2026
[ 0.000000] DMI: Memory slots populated: 2/4
[ 0.000000] tsc: Detected 2600.000 MHz processor
[ 0.000000] tsc: Detected 2592.000 MHz TSC
[ 0.000633] e820: update [mem 0x00000000-0x00000fff] System RAM ==> device reserved
[ 0.000635] e820: remove [mem 0x000a0000-0x000fffff] System RAM
[ 0.000643] last_pfn = 0x45f800 max_arch_pfn = 0x400000000
[ 0.000646] MTRR map: 5 entries (3 fixed + 2 variable; max 23), built from 10 variable MTRRs
[ 0.000647] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT
[ 0.000915] last_pfn = 0x8c000 max_arch_pfn = 0x400000000
[ 0.008080] esrt: Reserving ESRT space from 0x0000000085e80698 to 0x0000000085e806d0.
[ 0.008085] e820: update [mem 0x85e80000-0x85e80fff] System RAM ==> device reserved
[ 0.008102] Using GB pages for direct mapping
[ 0.008571] Secure boot disabled
[ 0.008571] RAMDISK: [mem 0x7297b000-0x77945fff]
[ 0.008575] ACPI: Early table checksum verification disabled
[ 0.008576] ACPI: RSDP 0x000000008A56E014 000024 (v02 ALASKA)
[ 0.008579] ACPI: XSDT 0x000000008A56D728 0000DC (v01 ALASKA A M I 01072009 AMI 01000013)
[ 0.008583] ACPI: FACP 0x000000008A56B000 000114 (v06 ALASKA A M I 01072009 AMI 01000013)
[ 0.008587] ACPI: DSDT 0x000000008A514000 0567A3 (v02 ALASKA A M I 01072009 INTL 20180209)
[ 0.008589] ACPI: FACS 0x000000008A6FE000 000040
[ 0.008591] ACPI: MCFG 0x000000008A56C000 00003C (v01 ALASKA A M I 01072009 MSFT 00000097)
[ 0.008593] ACPI: FIDT 0x000000008A513000 00009C (v01 ALASKA A M I 01072009 AMI 00010013)
[ 0.008595] ACPI: SSDT 0x000000008A50F000 0025EB (v02 CpuRef CpuSsdt 00003000 INTL 20180209)
[ 0.008597] ACPI: SSDT 0x000000008A50A000 004476 (v02 SaSsdt SaSsdt 00003000 INTL 20180209)
[ 0.008599] ACPI: SSDT 0x000000008A506000 0032CD (v02 INTEL IgfxSsdt 00003000 INTL 20180209)
[ 0.008600] ACPI: HPET 0x000000008A505000 000038 (v01 ALASKA A M I 01072009 AMI 01000013)
[ 0.008602] ACPI: APIC 0x000000008A504000 000164 (v04 ALASKA A M I 01072009 AMI 01000013)
[ 0.008604] ACPI: SSDT 0x000000008A503000 000E66 (v02 ALASKA Ther_Rvp 00001000 INTL 20180209)
[ 0.008606] ACPI: SSDT 0x000000008A501000 0017E5 (v02 INTEL xh_rksu4 00000000 INTL 20180209)
[ 0.008608] ACPI: NHLT 0x000000008A500000 00002D (v00 ALASKA A M I 01072009 AMI 01000013)
[ 0.008610] ACPI: LPIT 0x000000008A4FE000 0000CC (v01 ALASKA A M I 01072009 AMI 01000013)
[ 0.008612] ACPI: SSDT 0x000000008A4FC000 000DC6 (v02 ALASKA TbtTypeC 00000000 INTL 20180209)
[ 0.008614] ACPI: SSDT 0x000000008A4F9000 002720 (v02 ALASKA PtidDevc 00001000 INTL 20180209)
[ 0.008616] ACPI: DBGP 0x000000008A4F8000 000034 (v01 ALASKA A M I 01072009 AMI 01000013)
[ 0.008617] ACPI: DBG2 0x000000008A4F7000 000054 (v00 ALASKA A M I 01072009 AMI 01000013)
[ 0.008619] ACPI: SSDT 0x000000008A4F6000 0006E3 (v02 ALASKA UsbCTabl 00001000 INTL 20180209)
[ 0.008622] ACPI: DMAR 0x000000008A4F5000 000088 (v02 INTEL EDK2 00000002 01000013)
[ 0.008624] ACPI: SSDT 0x000000008A4F4000 000144 (v02 Intel ADebTabl 00001000 INTL 20180209)
[ 0.008625] ACPI: TPM2 0x000000008A4F3000 00004C (v04 ALASKA A M I 00000001 AMI 00000000)
[ 0.008627] ACPI: PTDT 0x000000008A4F2000 000CF0 (v00 ALASKA A M I 00000005 MSFT 0100000D)
[ 0.008629] ACPI: WSMT 0x000000008A4FD000 000028 (v01 ALASKA A M I 01072009 AMI 00010013)
[ 0.008631] ACPI: FPDT 0x000000008A4F1000 000044 (v01 ALASKA RKL 01072009 AMI 01000013)
[ 0.008633] ACPI: Reserving FACP table memory at [mem 0x8a56b000-0x8a56b113]
[ 0.008634] ACPI: Reserving DSDT table memory at [mem 0x8a514000-0x8a56a7a2]
[ 0.008634] ACPI: Reserving FACS table memory at [mem 0x8a6fe000-0x8a6fe03f]
[ 0.008635] ACPI: Reserving MCFG table memory at [mem 0x8a56c000-0x8a56c03b]
[ 0.008635] ACPI: Reserving FIDT table memory at [mem 0x8a513000-0x8a51309b]
[ 0.008636] ACPI: Reserving SSDT table memory at [mem 0x8a50f000-0x8a5115ea]
[ 0.008636] ACPI: Reserving SSDT table memory at [mem 0x8a50a000-0x8a50e475]
[ 0.008636] ACPI: Reserving SSDT table memory at [mem 0x8a506000-0x8a5092cc]
[ 0.008637] ACPI: Reserving HPET table memory at [mem 0x8a505000-0x8a505037]
[ 0.008637] ACPI: Reserving APIC table memory at [mem 0x8a504000-0x8a504163]
[ 0.008638] ACPI: Reserving SSDT table memory at [mem 0x8a503000-0x8a503e65]
[ 0.008638] ACPI: Reserving SSDT table memory at [mem 0x8a501000-0x8a5027e4]
[ 0.008639] ACPI: Reserving NHLT table memory at [mem 0x8a500000-0x8a50002c]
[ 0.008639] ACPI: Reserving LPIT table memory at [mem 0x8a4fe000-0x8a4fe0cb]
[ 0.008639] ACPI: Reserving SSDT table memory at [mem 0x8a4fc000-0x8a4fcdc5]
[ 0.008640] ACPI: Reserving SSDT table memory at [mem 0x8a4f9000-0x8a4fb71f]
[ 0.008640] ACPI: Reserving DBGP table memory at [mem 0x8a4f8000-0x8a4f8033]
[ 0.008641] ACPI: Reserving DBG2 table memory at [mem 0x8a4f7000-0x8a4f7053]
[ 0.008641] ACPI: Reserving SSDT table memory at [mem 0x8a4f6000-0x8a4f66e2]
[ 0.008641] ACPI: Reserving DMAR table memory at [mem 0x8a4f5000-0x8a4f5087]
[ 0.008642] ACPI: Reserving SSDT table memory at [mem 0x8a4f4000-0x8a4f4143]
[ 0.008642] ACPI: Reserving TPM2 table memory at [mem 0x8a4f3000-0x8a4f304b]
[ 0.008643] ACPI: Reserving PTDT table memory at [mem 0x8a4f2000-0x8a4f2cef]
[ 0.008643] ACPI: Reserving WSMT table memory at [mem 0x8a4fd000-0x8a4fd027]
[ 0.008644] ACPI: Reserving FPDT table memory at [mem 0x8a4f1000-0x8a4f1043]
[ 0.008705] No NUMA configuration found
[ 0.008706] Faking a node at [mem 0x0000000000000000-0x000000045f7fffff]
[ 0.008710] NODE_DATA(0) allocated [mem 0x45f7dd780-0x45f7fffff]
[ 0.008853] Reserving Intel graphics memory at [mem 0x90800000-0xa07fffff]
[ 0.010205] ACPI: PM-Timer IO Port: 0x1808
[ 0.010211] ACPI: LAPIC_NMI (acpi_id[0x01] high edge lint[0x1])
[ 0.010212] ACPI: LAPIC_NMI (acpi_id[0x02] high edge lint[0x1])
[ 0.010212] ACPI: LAPIC_NMI (acpi_id[0x03] high edge lint[0x1])
[ 0.010213] ACPI: LAPIC_NMI (acpi_id[0x04] high edge lint[0x1])
[ 0.010213] ACPI: LAPIC_NMI (acpi_id[0x05] high edge lint[0x1])
[ 0.010213] ACPI: LAPIC_NMI (acpi_id[0x06] high edge lint[0x1])
[ 0.010214] ACPI: LAPIC_NMI (acpi_id[0x07] high edge lint[0x1])
[ 0.010214] ACPI: LAPIC_NMI (acpi_id[0x08] high edge lint[0x1])
[ 0.010214] ACPI: LAPIC_NMI (acpi_id[0x09] high edge lint[0x1])
[ 0.010215] ACPI: LAPIC_NMI (acpi_id[0x0a] high edge lint[0x1])
[ 0.010215] ACPI: LAPIC_NMI (acpi_id[0x0b] high edge lint[0x1])
[ 0.010216] ACPI: LAPIC_NMI (acpi_id[0x0c] high edge lint[0x1])
[ 0.010216] ACPI: LAPIC_NMI (acpi_id[0x0d] high edge lint[0x1])
[ 0.010216] ACPI: LAPIC_NMI (acpi_id[0x0e] high edge lint[0x1])
[ 0.010217] ACPI: LAPIC_NMI (acpi_id[0x0f] high edge lint[0x1])
[ 0.010217] ACPI: LAPIC_NMI (acpi_id[0x10] high edge lint[0x1])
[ 0.010217] ACPI: LAPIC_NMI (acpi_id[0x11] high edge lint[0x1])
[ 0.010218] ACPI: LAPIC_NMI (acpi_id[0x12] high edge lint[0x1])
[ 0.010218] ACPI: LAPIC_NMI (acpi_id[0x13] high edge lint[0x1])
[ 0.010219] ACPI: LAPIC_NMI (acpi_id[0x14] high edge lint[0x1])
[ 0.010254] IOAPIC[0]: apic_id 2, version 32, address 0xfec00000, GSI 0-119
[ 0.010257] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[ 0.010258] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[ 0.010261] ACPI: Using ACPI (MADT) for SMP configuration information
[ 0.010262] ACPI: HPET id: 0x8086a201 base: 0xfed00000
[ 0.010264] TSC deadline timer available
[ 0.010265] CPU topo: Max. logical packages: 1
[ 0.010266] CPU topo: Max. logical nodes: 1
[ 0.010266] CPU topo: Num. nodes per package: 1
[ 0.010268] CPU topo: Max. logical dies: 1
[ 0.010268] CPU topo: Max. dies per package: 1
[ 0.010270] CPU topo: Max. threads per core: 2
[ 0.010270] CPU topo: Num. cores per package: 6
[ 0.010271] CPU topo: Num. threads per package: 12
[ 0.010271] CPU topo: Allowing 12 present CPUs plus 0 hotplug CPUs
[ 0.010284] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff]
[ 0.010285] PM: hibernation: Registered nosave memory: [mem 0x0009e000-0x0009efff]
[ 0.010286] PM: hibernation: Registered nosave memory: [mem 0x000a0000-0x000fffff]
[ 0.010287] PM: hibernation: Registered nosave memory: [mem 0x77946000-0x77946fff]
[ 0.010288] PM: hibernation: Registered nosave memory: [mem 0x77984000-0x77984fff]
[ 0.010289] PM: hibernation: Registered nosave memory: [mem 0x85e80000-0x85e80fff]
[ 0.010290] PM: hibernation: Registered nosave memory: [mem 0x87def000-0x8bffefff]
[ 0.010291] PM: hibernation: Registered nosave memory: [mem 0x8c000000-0xffffffff]
[ 0.010292] [gap 0xa0800000-0xfdffffff] available for PCI devices
[ 0.010293] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns
[ 0.016742] Zone ranges:
[ 0.016743] DMA [mem 0x0000000000001000-0x0000000000ffffff]
[ 0.016745] DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
[ 0.016746] Normal [mem 0x0000000100000000-0x000000045f7fffff]
[ 0.016746] Movable zone start for each node
[ 0.016748] Early memory node ranges
[ 0.016748] node 0: [mem 0x0000000000001000-0x000000000009dfff]
[ 0.016749] node 0: [mem 0x000000000009f000-0x000000000009ffff]
[ 0.016749] node 0: [mem 0x0000000000100000-0x0000000077945fff]
[ 0.016750] node 0: [mem 0x0000000077947000-0x0000000077983fff]
[ 0.016750] node 0: [mem 0x0000000077985000-0x0000000087deefff]
[ 0.016751] node 0: [mem 0x000000008bfff000-0x000000008bffffff]
[ 0.016751] node 0: [mem 0x0000000100000000-0x000000045f7fffff]
[ 0.016752] Initmem setup node 0 [mem 0x0000000000001000-0x000000045f7fffff]
[ 0.016852] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.016853] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.016870] On node 0, zone DMA: 96 pages in unavailable ranges
[ 0.019180] On node 0, zone DMA32: 1 pages in unavailable ranges
[ 0.019515] On node 0, zone DMA32: 1 pages in unavailable ranges
[ 0.019610] On node 0, zone DMA32: 16912 pages in unavailable ranges
[ 0.036600] On node 0, zone Normal: 16384 pages in unavailable ranges
[ 0.036611] On node 0, zone Normal: 2048 pages in unavailable ranges
[ 0.036619] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:12 nr_cpu_ids:12 nr_node_ids:1
[ 0.037145] percpu: Embedded 78 pages/cpu s195664 r8192 d115632 u524288
[ 0.037151] pcpu-alloc: s195664 r8192 d115632 u524288 alloc=1*2097152
[ 0.037153] pcpu-alloc: [0] 00 01 02 03 [0] 04 05 06 07
[ 0.037156] pcpu-alloc: [0] 08 09 10 11
[ 0.037168] Kernel command line: BOOT_IMAGE=(hd1,gpt1)/vmlinuz-7.3.2-rc1_MY-g75eaee7a6465 root=UUID=2ab6e75b-4e3c-4a9d-a329-431178fdd0e7 ro rootflags=subvol=ROOT i915.enable_guc=3 rhgb quiet
[ 0.037229] Unknown kernel command line parameters "rhgb", will be passed to user space.
[ 0.037237] printk: log buffer data + meta data: 262144 + 1114112 = 1376256 bytes
[ 0.038384] Dentry cache hash table entries: 2097152 (order: 12, 16777216 bytes, linear)
[ 0.038973] Inode-cache hash table entries: 1048576 (order: 11, 8388608 bytes, linear)
[ 0.039096] software IO TLB: area num 16.
[ 0.048522] Fallback order for Node 0: 0
[ 0.048525] Built 1 zonelists, mobility grouping on. Total pages: 4093324
[ 0.048526] Policy zone: Normal
[ 0.048698] mem auto-init: stack:all(zero), heap alloc:on, heap free:off
[ 0.072516] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=12, Nodes=1
[ 0.081314] ftrace: allocating 69225 entries in 272 pages
[ 0.081316] ftrace: allocated 272 pages with 2 groups
[ 0.081884] Dynamic Preempt: lazy
[ 0.081937] rcu: Preemptible hierarchical RCU implementation.
[ 0.081938] rcu: RCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=12.
[ 0.081939] Trampoline variant of Tasks RCU enabled.
[ 0.081939] Rude variant of Tasks RCU enabled.
[ 0.081940] Tracing variant of Tasks RCU enabled.
[ 0.081940] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies.
[ 0.081940] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=12
[ 0.081949] RCU Tasks: Setting shift to 4 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=12.
[ 0.081951] RCU Tasks Rude: Setting shift to 4 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=12.
[ 0.093671] NR_IRQS: 524544, nr_irqs: 2152, preallocated irqs: 16
[ 0.094015] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.094215] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
[ 0.094298] kfence: initialized - using 2097152 bytes for 255 objects at 0x(____ptrval____)-0x(____ptrval____)
[ 0.094337] Console: colour dummy device 80x25
[ 0.094339] printk: legacy console [tty0] enabled
[ 0.094372] ACPI: Core revision 20260408
[ 0.094752] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635855245 ns
[ 0.094850] APIC: Switch to symmetric I/O mode setup
[ 0.094852] DMAR: Host address width 39
[ 0.094853] DMAR: DRHD base: 0x000000fed90000 flags: 0x0
[ 0.094859] DMAR: dmar0: reg_base_addr fed90000 ver 4:0 cap 1c0000c40660462 ecap 29a00f0505e
[ 0.094861] DMAR: DRHD base: 0x000000fed91000 flags: 0x1
[ 0.094865] DMAR: dmar1: reg_base_addr fed91000 ver 1:0 cap d2008c40660462 ecap f050da
[ 0.094866] DMAR: RMRR base: 0x00000090000000 end: 0x000000a07fffff
[ 0.094868] DMAR-IR: IOAPIC id 2 under DRHD base 0xfed91000 IOMMU 1
[ 0.094869] DMAR-IR: HPET id 0 under DRHD base 0xfed91000
[ 0.094870] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping.
[ 0.096548] DMAR-IR: Enabled IRQ remapping in x2apic mode
[ 0.096549] x2apic enabled
[ 0.096604] APIC: Switched APIC routing to: cluster x2apic
[ 0.100969] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[ 0.105848] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x255cb6cc5db, max_idle_ns: 440795203504 ns
[ 0.105851] Calibrating delay loop (skipped), value calculated using timer frequency.. 5184.00 BogoMIPS (lpj=2592000)
[ 0.105878] CPU0: Thermal monitoring enabled (TM1)
[ 0.105879] x86/cpu: User Mode Instruction Prevention (UMIP) activated
[ 0.105938] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
[ 0.105939] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
[ 0.105945] process: using mwait in idle threads
[ 0.105947] mitigations: Enabled attack vectors: user_kernel, user_user, guest_host, guest_guest, SMT mitigations: auto
[ 0.105951] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[ 0.105952] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.105952] RETBleed: Mitigation: Enhanced IBRS
[ 0.105953] ITS: Mitigation: Aligned branch/return thunks
[ 0.105953] MMIO Stale Data: Mitigation: Clear CPU buffers
[ 0.105954] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 0.105955] Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT
[ 0.105957] Spectre V2 : Enabling IBPB for BPF
[ 0.105958] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 0.105963] GDS: Mitigation: Microcode
[ 0.105963] active return thunk: its_return_thunk
[ 0.105966] Spectre V2 : Spectre BHI mitigation: SW BHB clearing on syscall and VM exit
[ 0.105971] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[ 0.105972] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.105973] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.105973] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
[ 0.105974] x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
[ 0.105974] x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
[ 0.105975] x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
[ 0.105975] x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
[ 0.105976] x86/fpu: Supporting XSAVE feature 0x200: 'Protection Keys User registers'
[ 0.105977] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
[ 0.105978] x86/fpu: xstate_offset[3]: 832, xstate_sizes[3]: 64
[ 0.105978] x86/fpu: xstate_offset[4]: 896, xstate_sizes[4]: 64
[ 0.105979] x86/fpu: xstate_offset[5]: 960, xstate_sizes[5]: 64
[ 0.105979] x86/fpu: xstate_offset[6]: 1024, xstate_sizes[6]: 512
[ 0.105980] x86/fpu: xstate_offset[7]: 1536, xstate_sizes[7]: 1024
[ 0.105981] x86/fpu: xstate_offset[9]: 2560, xstate_sizes[9]: 8
[ 0.105981] x86/fpu: Enabled xstate features 0x2ff, context size is 2568 bytes, using 'compacted' format.
[ 0.108036] ------------[ cut here ]------------
[ 0.108037] CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 101000
[ 0.108039] WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xc4c/0x11f0, CPU#0: swapper/0/0
[ 0.108043] Modules linked in:
[ 0.108045] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.2-rc1_MY-g75eaee7a6465 #1 PREEMPT(lazy)
[ 0.108047] Hardware name: ASUS System Product Name/ROG STRIX B560-G GAMING WIFI, BIOS 2501 05/22/2026
[ 0.108048] RIP: 0010:__change_page_attr_set_clr+0xc65/0x11f0
[ 0.108050] Code: 7c 24 4c 00 0f 85 e9 03 00 00 48 8d 3d a4 78 01 03 48 8b 34 24 4d 89 e9 4d 8d 84 24 ff 0f 00 00 4c 89 e1 48 89 c2 48 89 04 24 <67> 48 0f b9 3a 48 8b 04 24 48 ba 00 f0 ff ff ff ff 0f 00 48 21 d3
[ 0.108052] RSP: 0000:ffffffff85203c40 EFLAGS: 00010246
[ 0.108053] RAX: 0000000000000123 RBX: 8000000101000123 RCX: ffffffffc0400000
[ 0.108054] RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff857c8f70
[ 0.108055] RBP: 8000000101000123 R08: ffffffffc0400fff R09: 0000000000101000
[ 0.108056] R10: 0000000000000123 R11: 0000000000000000 R12: ffffffffc0400000
[ 0.108056] R13: 0000000000101000 R14: 000ffffffffff000 R15: ffffffff85203d40
[ 0.108057] FS: 0000000000000000(0000) GS:ffff97940910f000(0000) knlGS:0000000000000000
[ 0.108058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.108059] CR2: ffff979067570000 CR3: 0000000126238001 CR4: 0000000000770ef0
[ 0.108060] PKRU: 55555554
[ 0.108061] Call Trace:
[ 0.108062] <TASK>
[ 0.108064] ? _vm_unmap_aliases+0x229/0x2a0
[ 0.108067] change_page_attr_set_clr+0x154/0x5a0
[ 0.108070] ? perf_get_hw_event_config+0x28/0x30
[ 0.108072] set_memory_x+0x39/0x50
[ 0.108073] apply_retpolines+0x695/0x710
[ 0.108077] ? perf_get_hw_event_config+0x28/0x30
[ 0.108078] ? __pfx_x86_pmu_filter+0x7/0x10
[ 0.108080] ? perf_get_hw_event_config+0x2d/0x30
[ 0.108081] alternative_instructions+0x37/0xc0
[ 0.108086] arch_cpu_finalize_init+0x11b/0x170
[ 0.108087] start_kernel+0x9ae/0xa50
[ 0.108089] x86_64_start_reservations+0x24/0x30
[ 0.108091] x86_64_start_kernel+0x121/0x130
[ 0.108092] common_startup_64+0x13e/0x158
[ 0.108095] </TASK>
[ 0.108095] ---[ end trace 0000000000000000 ]---
[ 0.125517] pid_max: default: 32768 minimum: 301
[ 0.125585] Yama: becoming mindful.
[ 0.125589] SELinux: Initializing.
[ 0.125820] LSM support for eBPF active
[ 0.125835] landlock: Up and running.
[ 0.125884] Mount-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.125893] Mountpoint-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.125956] VFS: Finished mounting rootfs on nullfs
[ 0.126543] smpboot: CPU0: 11th Gen Intel(R) Core(TM) i5-11400 @ 2.60GHz (family: 0x6, model: 0xa7, stepping: 0x1)
[ 0.126658] Performance Events: PEBS fmt4+-baseline, Icelake events, AnyThread deprecated, 32-deep LBR, full-width counters, Intel PMU driver.
[ 0.126683] ... version: 5
[ 0.126684] ... bit width: 48
[ 0.126684] ... generic counters: 8
[ 0.126684] ... generic bitmap: 00000000000000ff
[ 0.126685] ... fixed-purpose counters: 4
[ 0.126685] ... fixed-purpose bitmap: 000000000000000f
[ 0.126686] ... value mask: 0000ffffffffffff
[ 0.126686] ... max period: 00007fffffffffff
[ 0.126687] ... global_ctrl mask: 0001000f000000ff
[ 0.126807] signal: max sigframe size: 3632
[ 0.126817] Estimated ratio of average max frequency by base frequency (times 1024): 1693
[ 0.126849] rcu: Hierarchical SRCU implementation.
[ 0.126850] rcu: Max phase no-delay instances is 400.
[ 0.126850] Timer migration: 2 hierarchy levels; 8 children per group; 2 crossnode level
[ 0.128398] NMI watchdog: Enabled. Permanently consumes one hw-PMU counter.
[ 0.128459] smp: Bringing up secondary CPUs ...
[ 0.128517] smpboot: x86: Booting SMP configuration:
[ 0.128518] .... node #0, CPUs: #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 #11
[ 0.131508] MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.
[ 0.131907] smp: Brought up 1 node, 12 CPUs
[ 0.131907] smpboot: Total of 12 processors activated (62208.00 BogoMIPS)
[ 0.132921] Memory: 15747668K/16373296K available (27824K kernel code, 5914K rwdata, 17616K rodata, 5236K init, 2356K bss, 594316K reserved, 0K cma-reserved)
[ 0.133206] devtmpfs: initialized
[ 0.133206] ACPI: PM: Registering ACPI NVS region [mem 0x8a56f000-0x8a6fefff] (1638400 bytes)
[ 0.133206] posixtimers hash table entries: 8192 (order: 5, 131072 bytes, linear)
[ 0.133206] futex hash table entries: 4096 (262144 bytes on 1 NUMA nodes, total 256 KiB, linear).
[ 0.133206] xor: automatically using best checksumming function avx
[ 0.134063] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.134172] audit: initializing netlink subsys (disabled)
[ 0.134181] audit: type=2000 audit(1793833083.035:1): state=initialized audit_enabled=0 res=1
[ 0.143357] thermal_sys: Registered thermal governor 'fair_share'
[ 0.143359] thermal_sys: Registered thermal governor 'bang_bang'
[ 0.143360] thermal_sys: Registered thermal governor 'step_wise'
[ 0.143361] thermal_sys: Registered thermal governor 'user_space'
[ 0.143368] cpuidle: using governor ladder
[ 0.143368] cpuidle: using governor menu
[ 0.145399] efi: Freeing EFI boot services memory: 89504K
[ 0.145499] PCI: ECAM [mem 0xe0000000-0xefffffff] (base 0xe0000000) for domain 0000 [bus 00-ff]
[ 0.145512] PCI: Using configuration type 1 for base access
[ 0.145570] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible.
[ 0.145570] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[ 0.145570] HugeTLB: 16380 KiB vmemmap can be freed for a 1.00 GiB page
[ 0.145570] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.145570] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.146313] raid6: using avx512x2 recovery algorithm
[ 0.146408] ACPI: Added _OSI(Module Device)
[ 0.146408] ACPI: Added _OSI(Processor Device)
[ 0.146409] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.195784] ACPI: 10 ACPI AML tables successfully acquired and loaded
[ 0.201865] ACPI: \_SB_: platform _OSC: OS support mask [006e7eff]
[ 0.201947] ACPI: \_SB_: platform _OSC: OS control mask [006e7efb]
[ 0.202154] ACPI: Dynamic OEM Table Load:
[ 0.202161] ACPI: SSDT 0xFFFF979042248800 000394 (v02 PmRef Cpu0Cst 00003001 INTL 20180209)
[ 0.202972] ACPI: Dynamic OEM Table Load:
[ 0.202977] ACPI: SSDT 0xFFFF97904208A800 000581 (v02 PmRef Cpu0Ist 00003000 INTL 20180209)
[ 0.203721] ACPI: Dynamic OEM Table Load:
[ 0.203725] ACPI: SSDT 0xFFFF9790420BB200 0001CB (v02 PmRef Cpu0Psd 00003000 INTL 20180209)
[ 0.204408] ACPI: Dynamic OEM Table Load:
[ 0.204411] ACPI: SSDT 0xFFFF97904224B000 0002F4 (v02 PmRef Cpu0Hwp 00003000 INTL 20180209)
[ 0.205281] ACPI: Dynamic OEM Table Load:
[ 0.205288] ACPI: SSDT 0xFFFF979042328000 0008E7 (v02 PmRef ApIst 00003000 INTL 20180209)
[ 0.206115] ACPI: Dynamic OEM Table Load:
[ 0.206118] ACPI: SSDT 0xFFFF97904208D800 00048A (v02 PmRef ApHwp 00003000 INTL 20180209)
[ 0.206879] ACPI: Dynamic OEM Table Load:
[ 0.206883] ACPI: SSDT 0xFFFF97904208D000 0004D4 (v02 PmRef ApPsd 00003000 INTL 20180209)
[ 0.207632] ACPI: Dynamic OEM Table Load:
[ 0.207636] ACPI: SSDT 0xFFFF97904208F800 00048A (v02 PmRef ApCst 00003000 INTL 20180209)
[ 0.213647] ACPI: Interpreter enabled
[ 0.213688] ACPI: PM: (supports S0 S3 S4 S5)
[ 0.213689] ACPI: Using IOAPIC for interrupt routing
[ 0.214590] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 0.214591] PCI: Ignoring E820 reservations for host bridge windows
[ 0.215973] ACPI: Enabled 6 GPEs in block 00 to 7F
[ 0.228798] ACPI: \_SB_.PC00.XHCI.RHUB.HS14.BTRT: New power resource
[ 0.237267] ACPI: \_SB_.PC00.CNVW.WRST: New power resource
[ 0.237434] ACPI: \_SB_.PC00.SAT0.VOL0.V0PR: New power resource
[ 0.237520] ACPI: \_SB_.PC00.SAT0.VOL1.V1PR: New power resource
[ 0.237600] ACPI: \_SB_.PC00.SAT0.VOL2.V2PR: New power resource
[ 0.248380] ACPI: \_TZ_.FN00: New power resource
[ 0.248419] ACPI: \_TZ_.FN01: New power resource
[ 0.248457] ACPI: \_TZ_.FN02: New power resource
[ 0.248493] ACPI: \_TZ_.FN03: New power resource
[ 0.248531] ACPI: \_TZ_.FN04: New power resource
[ 0.248940] ACPI: \PIN_: New power resource
[ 0.249184] ACPI: PCI Root Bridge [PC00] (domain 0000 [bus 00-fe])
[ 0.249189] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI EDR HPX-Type3]
[ 0.251843] acpi PNP0A08:00: _OSC: OS now controls [PCIeHotplug PME AER PCIeCapability LTR DPC]
[ 0.252385] PCI host bridge to bus 0000:00
[ 0.252388] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 0.252389] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 0.252390] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[ 0.252391] pci_bus 0000:00: root bus resource [mem 0x000e0000-0x000effff window]
[ 0.252392] pci_bus 0000:00: root bus resource [mem 0xa0800000-0xdfffffff window]
[ 0.252393] pci_bus 0000:00: root bus resource [mem 0x4000000000-0x7fffffffff window]
[ 0.252394] pci_bus 0000:00: root bus resource [bus 00-fe]
[ 0.252587] pci 0000:00:00.0: [8086:4c53] type 00 class 0x060000 conventional PCI endpoint
[ 0.252741] pci 0000:00:02.0: [8086:4c8b] type 00 class 0x030000 PCIe Root Complex Integrated Endpoint
[ 0.252756] pci 0000:00:02.0: BAR 0 [mem 0x6000000000-0x6000ffffff 64bit]
[ 0.252758] pci 0000:00:02.0: BAR 2 [mem 0x4000000000-0x400fffffff 64bit pref]
[ 0.252759] pci 0000:00:02.0: BAR 4 [io 0x5000-0x503f]
[ 0.252768] pci 0000:00:02.0: DMAR: Skip IOMMU disabling for graphics
[ 0.252770] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[ 0.252957] pci 0000:00:06.0: [8086:4c09] type 01 class 0x060400 PCIe Root Port
[ 0.252978] pci 0000:00:06.0: PCI bridge to [bus 01]
[ 0.252986] pci 0000:00:06.0: bridge window [mem 0xa1e00000-0xa1efffff]
[ 0.253061] pci 0000:00:06.0: PME# supported from D0 D3hot D3cold
[ 0.253672] pci 0000:00:08.0: [8086:4c11] type 00 class 0x088000 conventional PCI endpoint
[ 0.253690] pci 0000:00:08.0: BAR 0 [mem 0x600101e000-0x600101efff 64bit]
[ 0.253830] pci 0000:00:14.0: [8086:43ed] type 00 class 0x0c0330 conventional PCI endpoint
[ 0.253869] pci 0000:00:14.0: BAR 0 [mem 0x6001000000-0x600100ffff 64bit]
[ 0.253912] pci 0000:00:14.0: PME# supported from D3hot D3cold
[ 0.255519] pci 0000:00:14.2: [8086:43ef] type 00 class 0x050000 conventional PCI endpoint
[ 0.255565] pci 0000:00:14.2: BAR 0 [mem 0x6001014000-0x6001017fff 64bit]
[ 0.255569] pci 0000:00:14.2: BAR 2 [mem 0x600101d000-0x600101dfff 64bit]
[ 0.255743] pci 0000:00:14.3: [8086:43f0] type 00 class 0x028000 PCIe Root Complex Integrated Endpoint
[ 0.255807] pci 0000:00:14.3: BAR 0 [mem 0x6001010000-0x6001013fff 64bit]
[ 0.255901] pci 0000:00:14.3: PME# supported from D0 D3hot D3cold
[ 0.256790] pci 0000:00:15.0: [8086:43e8] type 00 class 0x0c8000 conventional PCI endpoint
[ 0.258974] pci 0000:00:15.0: BAR 0 [mem 0x00000000-0x00000fff 64bit]
[ 0.271134] pci 0000:00:15.1: [8086:43e9] type 00 class 0x0c8000 conventional PCI endpoint
[ 0.271197] pci 0000:00:15.1: BAR 0 [mem 0x00000000-0x00000fff 64bit]
[ 0.281125] pci 0000:00:15.2: [8086:43ea] type 00 class 0x0c8000 conventional PCI endpoint
[ 0.281177] pci 0000:00:15.2: BAR 0 [mem 0x00000000-0x00000fff 64bit]
[ 0.291135] pci 0000:00:16.0: [8086:43e0] type 00 class 0x078000 conventional PCI endpoint
[ 0.291185] pci 0000:00:16.0: BAR 0 [mem 0x6001019000-0x6001019fff 64bit]
[ 0.291239] pci 0000:00:16.0: PME# supported from D3hot
[ 0.291717] pci 0000:00:17.0: [8086:43d2] type 00 class 0x010601 conventional PCI endpoint
[ 0.291755] pci 0000:00:17.0: BAR 0 [mem 0xa1f00000-0xa1f01fff]
[ 0.291757] pci 0000:00:17.0: BAR 1 [mem 0xa1f03000-0xa1f030ff]
[ 0.291759] pci 0000:00:17.0: BAR 2 [io 0x5090-0x5097]
[ 0.291760] pci 0000:00:17.0: BAR 3 [io 0x5080-0x5083]
[ 0.291762] pci 0000:00:17.0: BAR 4 [io 0x5060-0x507f]
[ 0.291764] pci 0000:00:17.0: BAR 5 [mem 0xa1f02000-0xa1f027ff]
[ 0.291799] pci 0000:00:17.0: PME# supported from D3hot
[ 0.292325] pci 0000:00:1c.0: [8086:43bc] type 01 class 0x060400 PCIe Root Port
[ 0.292351] pci 0000:00:1c.0: PCI bridge to [bus 02]
[ 0.292354] pci 0000:00:1c.0: bridge window [io 0x4000-0x4fff]
[ 0.292357] pci 0000:00:1c.0: bridge window [mem 0xa1200000-0xa1bfffff]
[ 0.292427] pci 0000:00:1c.0: PME# supported from D0 D3hot D3cold
[ 0.293063] pci 0000:00:1c.6: [8086:43be] type 01 class 0x060400 PCIe Root Port
[ 0.293089] pci 0000:00:1c.6: PCI bridge to [bus 03]
[ 0.293095] pci 0000:00:1c.6: bridge window [mem 0xa1c00000-0xa1dfffff]
[ 0.293187] pci 0000:00:1c.6: PME# supported from D0 D3hot D3cold
[ 0.293868] pci 0000:00:1d.0: [8086:43b0] type 01 class 0x060400 PCIe Root Port
[ 0.293893] pci 0000:00:1d.0: PCI bridge to [bus 04]
[ 0.293897] pci 0000:00:1d.0: bridge window [io 0x3000-0x3fff]
[ 0.293900] pci 0000:00:1d.0: bridge window [mem 0xa0800000-0xa11fffff]
[ 0.293970] pci 0000:00:1d.0: PME# supported from D0 D3hot D3cold
[ 0.294594] pci 0000:00:1f.0: [8086:4387] type 00 class 0x060100 conventional PCI endpoint
[ 0.294952] pci 0000:00:1f.4: [8086:43a3] type 00 class 0x0c0500 conventional PCI endpoint
[ 0.295002] pci 0000:00:1f.4: BAR 0 [mem 0x6001018000-0x60010180ff 64bit]
[ 0.295009] pci 0000:00:1f.4: BAR 4 [io 0xefa0-0xefbf]
[ 0.295275] pci 0000:00:1f.5: [8086:43a4] type 00 class 0x0c8000 conventional PCI endpoint
[ 0.295329] pci 0000:00:1f.5: BAR 0 [mem 0xfe010000-0xfe010fff]
[ 0.295736] pci 0000:01:00.0: [144d:a80a] type 00 class 0x010802 PCIe Endpoint
[ 0.295770] pci 0000:01:00.0: BAR 0 [mem 0xa1e00000-0xa1e03fff 64bit]
[ 0.296019] pci 0000:00:06.0: PCI bridge to [bus 01]
[ 0.296101] pci 0000:00:1c.0: PCI bridge to [bus 02]
[ 0.296267] pci 0000:03:00.0: [8086:15f3] type 00 class 0x020000 PCIe Endpoint
[ 0.296325] pci 0000:03:00.0: BAR 0 [mem 0xa1c00000-0xa1cfffff]
[ 0.296330] pci 0000:03:00.0: BAR 3 [mem 0xa1d00000-0xa1d03fff]
[ 0.296449] pci 0000:03:00.0: PME# supported from D0 D3hot D3cold
[ 0.296679] pci 0000:00:1c.6: PCI bridge to [bus 03]
[ 0.296723] pci 0000:00:1d.0: PCI bridge to [bus 04]
[ 0.299229] ACPI: PCI: Interrupt link LNKA configured for IRQ 0
[ 0.299315] ACPI: PCI: Interrupt link LNKB configured for IRQ 1
[ 0.299398] ACPI: PCI: Interrupt link LNKC configured for IRQ 0
[ 0.299482] ACPI: PCI: Interrupt link LNKD configured for IRQ 0
[ 0.299565] ACPI: PCI: Interrupt link LNKE configured for IRQ 0
[ 0.299647] ACPI: PCI: Interrupt link LNKF configured for IRQ 0
[ 0.299731] ACPI: PCI: Interrupt link LNKG configured for IRQ 0
[ 0.299814] ACPI: PCI: Interrupt link LNKH configured for IRQ 0
[ 0.306862] iommu: Default domain type: Translated
[ 0.306862] iommu: DMA domain TLB invalidation policy: lazy mode
[ 0.306932] SCSI subsystem initialized
[ 0.306937] libata version 3.00 loaded.
[ 0.306948] ACPI: bus type USB registered
[ 0.306956] usbcore: registered new interface driver usbfs
[ 0.306960] usbcore: registered new interface driver hub
[ 0.306965] usbcore: registered new device driver usb
[ 0.306978] pps_core: LinuxPPS API ver. 1 registered
[ 0.306979] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.306981] PTP clock support registered
[ 0.306986] EDAC MC: Ver: 3.0.0
[ 0.307938] efivars: Registered efivars operations
[ 0.307938] Advanced Linux Sound Architecture Driver Initialized.
[ 0.307968] NetLabel: Initializing
[ 0.307969] NetLabel: domain hash size = 128
[ 0.307969] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 0.307980] NetLabel: unlabeled traffic allowed by default
[ 0.307988] mctp: management component transport protocol core
[ 0.307988] NET: Registered PF_MCTP protocol family
[ 0.307988] PCI: Using ACPI for IRQ routing
[ 0.330339] PCI: pci_cache_line_size set to 64 bytes
[ 0.330792] pci 0000:00:1f.5: BAR 0 [mem 0xfe010000-0xfe010fff]: can't claim; no compatible bridge window
[ 0.330996] e820: register RAM buffer resource [mem 0x0009e000-0x0009ffff]
[ 0.330997] e820: register RAM buffer resource [mem 0x77946000-0x77ffffff]
[ 0.330998] e820: register RAM buffer resource [mem 0x77984000-0x77ffffff]
[ 0.330998] e820: register RAM buffer resource [mem 0x85e80000-0x87ffffff]
[ 0.330999] e820: register RAM buffer resource [mem 0x87def000-0x87ffffff]
[ 0.331000] e820: register RAM buffer resource [mem 0x45f800000-0x45fffffff]
[ 0.331023] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[ 0.331023] pci 0000:00:02.0: vgaarb: bridge control possible
[ 0.331023] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[ 0.331023] vgaarb: loaded
[ 0.331851] Monitor-Mwait will be used to enter C-1 state
[ 0.331853] Monitor-Mwait will be used to enter C-2 state
[ 0.331853] Monitor-Mwait will be used to enter C-3 state
[ 0.331937] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0, 0, 0, 0, 0, 0
[ 0.331942] hpet0: 8 comparators, 64-bit 24.000000 MHz counter
[ 0.333876] clocksource: Switched to clocksource tsc-early
[ 0.334013] VFS: Disk quotas dquot_6.6.0
[ 0.334020] VFS: Dquot-cache hash table entries: 512 (4096 bytes)
[ 0.334079] netfs: FS-Cache loaded
[ 0.334110] CacheFiles: Loaded
[ 0.334205] acpi PNP0C02:00: Reserved [io 0x0290-0x029f]
[ 0.334211] acpi PNP0C02:01: Skipped [io 0x002e-0x002f]
[ 0.334211] acpi PNP0C02:01: Skipped [io 0x004e-0x004f]
[ 0.334212] acpi PNP0C02:01: Skipped [io 0x0061]
[ 0.334213] acpi PNP0C02:01: Skipped [io 0x0063]
[ 0.334213] acpi PNP0C02:01: Skipped [io 0x0065]
[ 0.334214] acpi PNP0C02:01: Skipped [io 0x0067]
[ 0.334214] acpi PNP0C02:01: Skipped [io 0x0070]
[ 0.334215] acpi PNP0C02:01: Skipped [io 0x0080]
[ 0.334216] acpi PNP0C02:01: Skipped [io 0x0092]
[ 0.334216] acpi PNP0C02:01: Skipped [io 0x00b2-0x00b3]
[ 0.334217] acpi PNP0C02:01: Reserved [io 0x0680-0x069f]
[ 0.334218] acpi PNP0C02:01: Reserved [io 0x164e-0x164f]
[ 0.334285] acpi PNP0C02:02: Reserved [mem 0xfed10000-0xfed17fff]
[ 0.334287] acpi PNP0C02:02: Reserved [mem 0xfeda0000-0xfeda0fff]
[ 0.334288] acpi PNP0C02:02: Reserved [mem 0xfeda1000-0xfeda1fff]
[ 0.334289] acpi PNP0C02:02: Reserved [mem 0xe0000000-0xefffffff]
[ 0.334290] acpi PNP0C02:02: Could not reserve [mem 0xfed20000-0xfed7ffff]
[ 0.334290] acpi PNP0C02:02: Could not reserve [mem 0xfed90000-0xfed93fff]
[ 0.334291] acpi PNP0C02:02: Could not reserve [mem 0xfed45000-0xfed8ffff]
[ 0.334292] acpi PNP0C02:02: Could not reserve [mem 0xfee00000-0xfeefffff]
[ 0.334484] acpi PNP0C02:03: Could not reserve [mem 0xfe000000-0xfe01ffff]
[ 0.334485] acpi PNP0C02:03: Reserved [mem 0xfe04c000-0xfe04ffff]
[ 0.334486] acpi PNP0C02:03: Reserved [mem 0xfe050000-0xfe0affff]
[ 0.334487] acpi PNP0C02:03: Reserved [mem 0xfe0d0000-0xfe0fffff]
[ 0.334488] acpi PNP0C02:03: Reserved [mem 0xfe200000-0xfe7fffff]
[ 0.334489] acpi PNP0C02:03: Reserved [mem 0xff000000-0xffffffff]
[ 0.334490] acpi PNP0C02:03: Could not reserve [io 0x1800-0x18fe]
[ 0.334491] acpi PNP0C02:03: Reserved [mem 0xfd000000-0xfd68ffff]
[ 0.334491] acpi PNP0C02:03: Reserved [mem 0xfd6c0000-0xfd6cffff]
[ 0.334492] acpi PNP0C02:03: Reserved [mem 0xfd6f0000-0xfdffffff]
[ 0.334712] acpi PNP0C02:04: Reserved [io 0x2000-0x20fe]
[ 0.335015] pnp: PnP ACPI init
[ 0.335509] pnp 00:00: [dma 0 disabled]
[ 0.336570] pnp: PnP ACPI: found 1 devices
[ 0.341825] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 0.341871] NET: Registered PF_INET protocol family
[ 0.341957] IP idents hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 0.343875] tcp_listen_portaddr_hash hash table entries: 8192 (order: 5, 131072 bytes, linear)
[ 0.343891] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.343933] TCP established hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.344071] TCP bind hash table entries: 65536 (order: 9, 2097152 bytes, linear)
[ 0.344181] TCP: Hash tables configured (established 131072 bind 65536)
[ 0.344231] MPTCP token hash table entries: 16384 (order: 7, 393216 bytes, linear)
[ 0.344270] UDP hash table entries: 8192 (order: 7, 524288 bytes, linear)
[ 0.344324] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.344465] RPC: Registered named UNIX socket transport module.
[ 0.344466] RPC: Registered udp transport module.
[ 0.344467] RPC: Registered tcp transport module.
[ 0.344467] RPC: Registered tcp-with-tls transport module.
[ 0.344468] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.344469] NET: Registered PF_XDP protocol family
[ 0.344477] pci 0000:00:1c.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 02] add_size 200000 add_align 100000
[ 0.344480] pci 0000:00:1d.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 04] add_size 200000 add_align 100000
[ 0.344487] pci 0000:00:1c.0: bridge window [mem 0x4010000000-0x40101fffff 64bit pref]: assigned
[ 0.344489] pci 0000:00:1d.0: bridge window [mem 0x4010200000-0x40103fffff 64bit pref]: assigned
[ 0.344490] pci 0000:00:15.0: BAR 0 [mem 0x4010400000-0x4010400fff 64bit]: assigned
[ 0.344529] pci 0000:00:15.1: BAR 0 [mem 0x4010401000-0x4010401fff 64bit]: assigned
[ 0.344544] pci 0000:00:15.2: BAR 0 [mem 0x4010402000-0x4010402fff 64bit]: assigned
[ 0.344564] pci 0000:00:1f.5: BAR 0 [mem 0xa1f04000-0xa1f04fff]: assigned
[ 0.344575] pci 0000:00:06.0: PCI bridge to [bus 01]
[ 0.344582] pci 0000:00:06.0: bridge window [mem 0xa1e00000-0xa1efffff]
[ 0.344587] pci 0000:00:1c.0: PCI bridge to [bus 02]
[ 0.344593] pci 0000:00:1c.0: bridge window [io 0x4000-0x4fff]
[ 0.344597] pci 0000:00:1c.0: bridge window [mem 0xa1200000-0xa1bfffff]
[ 0.344600] pci 0000:00:1c.0: bridge window [mem 0x4010000000-0x40101fffff 64bit pref]
[ 0.344605] pci 0000:00:1c.6: PCI bridge to [bus 03]
[ 0.344608] pci 0000:00:1c.6: bridge window [mem 0xa1c00000-0xa1dfffff]
[ 0.344615] pci 0000:00:1d.0: PCI bridge to [bus 04]
[ 0.344617] pci 0000:00:1d.0: bridge window [io 0x3000-0x3fff]
[ 0.344620] pci 0000:00:1d.0: bridge window [mem 0xa0800000-0xa11fffff]
[ 0.344623] pci 0000:00:1d.0: bridge window [mem 0x4010200000-0x40103fffff 64bit pref]
[ 0.344628] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 0.344629] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 0.344630] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 0.344631] pci_bus 0000:00: resource 7 [mem 0x000e0000-0x000effff window]
[ 0.344632] pci_bus 0000:00: resource 8 [mem 0xa0800000-0xdfffffff window]
[ 0.344632] pci_bus 0000:00: resource 9 [mem 0x4000000000-0x7fffffffff window]
[ 0.344633] pci_bus 0000:01: resource 1 [mem 0xa1e00000-0xa1efffff]
[ 0.344634] pci_bus 0000:02: resource 0 [io 0x4000-0x4fff]
[ 0.344647] pci_bus 0000:02: resource 1 [mem 0xa1200000-0xa1bfffff]
[ 0.344648] pci_bus 0000:02: resource 2 [mem 0x4010000000-0x40101fffff 64bit pref]
[ 0.344649] pci_bus 0000:03: resource 1 [mem 0xa1c00000-0xa1dfffff]
[ 0.344650] pci_bus 0000:04: resource 0 [io 0x3000-0x3fff]
[ 0.344651] pci_bus 0000:04: resource 1 [mem 0xa0800000-0xa11fffff]
[ 0.344652] pci_bus 0000:04: resource 2 [mem 0x4010200000-0x40103fffff 64bit pref]
[ 0.345525] PCI: CLS 64 bytes, default 64
[ 0.345558] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 0.345559] software IO TLB: mapped [mem 0x000000007f431000-0x0000000083431000] (64MB)
[ 0.345602] Trying to unpack rootfs image as initramfs...
[ 0.348844] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x255cb6cc5db, max_idle_ns: 440795203504 ns
[ 0.348888] clocksource: Switched to clocksource tsc
[ 0.348907] platform rtc_cmos: registered fallback platform RTC device
[ 0.354302] Initialise system trusted keyrings
[ 0.354321] Key type blacklist registered
[ 0.354375] workingset: timestamp_bits=36 (anon: 31) max_order=22 bucket_order=0 (anon: 0)
[ 0.354619] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.354757] NFS: Registering the id_resolver key type
[ 0.354764] Key type id_resolver registered
[ 0.354764] Key type id_legacy registered
[ 0.354770] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 0.354775] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 0.355069] Key type cifs.spnego registered
[ 0.355075] Key type cifs.idmap registered
[ 0.355119] ntfs3: Enabled Linux POSIX ACLs support
[ 0.355120] ntfs3: Read-only LZX/Xpress compression included
[ 0.355169] fuse: init (API version 7.46)
[ 0.355422] integrity: Platform Keyring initialized
[ 0.355426] integrity: Machine keyring initialized
[ 0.355582] NET: Registered PF_ALG protocol family
[ 0.355587] Key type asymmetric registered
[ 0.355588] Asymmetric key parser 'x509' registered
[ 0.355601] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243)
[ 0.355628] io scheduler mq-deadline registered
[ 0.355629] io scheduler kyber registered
[ 0.355642] io scheduler bfq registered
[ 0.356453] raid6: avx2x1 gen() 34971 MB/s
[ 0.357046] raid6: avx2x2 gen() 44317 MB/s
[ 0.357593] raid6: avx2x4 gen() 48136 MB/s
[ 0.358065] raid6: avx512x1 gen() 55668 MB/s
[ 0.358479] raid6: avx512x2 gen() 63444 MB/s
[ 0.358888] raid6: avx512x4 gen() 64238 MB/s
[ 0.358892] raid6: using algorithm avx512x4 gen() 64238 MB/s
[ 0.359363] raid6: .... xor() 27882 MB/s, rmw enabled
[ 0.362054] pcieport 0000:00:06.0: PME: Signaling with IRQ 120
[ 0.362126] pcieport 0000:00:06.0: AER: enabled with IRQ 120
[ 0.362157] pcieport 0000:00:06.0: DPC: enabled with IRQ 120
[ 0.362157] pcieport 0000:00:06.0: DPC: error containment capabilities: Int Msg #0, RPExt+ PoisonedTLP+ SwTrigger+ RP PIO Log 4, DL_ActiveErr+
[ 0.362312] pcieport 0000:00:1c.0: PME: Signaling with IRQ 121
[ 0.362327] pcieport 0000:00:1c.0: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+
[ 0.362575] pcieport 0000:00:1c.6: PME: Signaling with IRQ 122
[ 0.362641] pcieport 0000:00:1c.6: AER: enabled with IRQ 122
[ 0.362695] pcieport 0000:00:1c.6: DPC: enabled with IRQ 122
[ 0.362696] pcieport 0000:00:1c.6: DPC: error containment capabilities: Int Msg #0, RPExt+ PoisonedTLP+ SwTrigger+ RP PIO Log 4, DL_ActiveErr+
[ 0.362827] pcieport 0000:00:1d.0: PME: Signaling with IRQ 123
[ 0.362841] pcieport 0000:00:1d.0: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+
[ 0.363090] input: Sleep Button as /devices/platform/PNP0C0E:00/input/input0
[ 0.363101] ACPI: button: Sleep Button [SLPB]
[ 0.363121] input: Power Button as /devices/platform/PNP0C0C:00/input/input1
[ 0.363129] ACPI: button: Power Button [PWRB]
[ 0.363143] input: Power Button as /devices/platform/LNXPWRBN:00/input/input2
[ 0.363185] ACPI: button: Power Button [PWRF]
[ 0.364249] acpi-tad ACPI000E:00: registered as rtc0
[ 0.364537] acpi-tad ACPI000E:00: setting system clock to 2026-11-04T22:58:03 UTC (1793833083)
[ 0.366793] acpi LNXTHERM:00: registered as thermal_zone0
[ 0.366795] ACPI: thermal: Thermal Zone [TZ00] (28 C)
[ 0.366951] Serial: 8250/16550 driver, 32 ports, IRQ sharing disabled
[ 0.367080] 00:00: ttyS0 I/O:0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 0.369600] Non-volatile memory driver v1.3
[ 0.376210] ACPI: bus type drm_connector registered
[ 0.378343] brd: module loaded
[ 0.378355] loop: module loaded
[ 0.378402] zram: Added device: zram0
[ 0.378456] intel-lpss 0000:00:15.0: enabling device (0004 -> 0006)
[ 0.378700] idma64 idma64.0: Found Intel integrated DMA 64-bit
[ 0.378737] intel-lpss 0000:00:15.1: enabling device (0004 -> 0006)
[ 0.378878] idma64 idma64.1: Found Intel integrated DMA 64-bit
[ 0.378926] intel-lpss 0000:00:15.2: enabling device (0004 -> 0006)
[ 0.379055] idma64 idma64.2: Found Intel integrated DMA 64-bit
[ 0.379255] nvme 0000:01:00.0: platform quirk: setting simple suspend
[ 0.379296] nvme nvme0: pci function 0000:01:00.0
[ 0.380190] ahci 0000:00:17.0: AHCI vers 0001.0301, 32 command slots, 6 Gbps, SATA mode
[ 0.380193] ahci 0000:00:17.0: 6/6 ports implemented (port mask 0x3f)
[ 0.380194] ahci 0000:00:17.0: flags: 64bit ncq sntf pm clo only pio slum part ems deso sadm sds
[ 0.389918] scsi host0: ahci
[ 0.389995] scsi host1: ahci
[ 0.390046] scsi host2: ahci
[ 0.390091] scsi host3: ahci
[ 0.390139] scsi host4: ahci
[ 0.390189] scsi host5: ahci
[ 0.390235] ata1: SATA max UDMA/133 abar m2048@0xa1f02000 port 0xa1f02100 irq 125 lpm-pol 3
[ 0.390237] ata2: SATA max UDMA/133 abar m2048@0xa1f02000 port 0xa1f02180 irq 125 lpm-pol 3
[ 0.390239] ata3: SATA max UDMA/133 abar m2048@0xa1f02000 port 0xa1f02200 irq 125 lpm-pol 3
[ 0.390240] ata4: SATA max UDMA/133 abar m2048@0xa1f02000 port 0xa1f02280 irq 125 lpm-pol 3
[ 0.390242] ata5: SATA max UDMA/133 abar m2048@0xa1f02000 port 0xa1f02300 irq 125 lpm-pol 3
[ 0.390243] ata6: SATA max UDMA/133 abar m2048@0xa1f02000 port 0xa1f02380 irq 125 lpm-pol 3
[ 0.390449] MACsec IEEE 802.1AE
[ 0.390480] Intel(R) 2.5G Ethernet Linux Driver
[ 0.390481] Copyright(c) 2018 Intel Corporation.
[ 0.390733] igc 0000:03:00.0: enabling device (0000 -> 0002)
[ 0.391123] nvme nvme0: D3 entry latency set to 10 seconds
[ 0.391294] pcieport 0000:00:1c.6: PTM enabled (root), 4ns granularity
[ 0.391491] igc 0000:03:00.0: PTM enabled, 4ns granularity
[ 0.392816] nvme nvme0: passthrough uses implicit buffer lengths
[ 0.395207] nvme nvme0: 12/0/0 default/read/poll queues
[ 0.397156] nvme0n1: p1 p2 p3
[ 0.441286] igc 0000:03:00.0 (unnamed net_device) (uninitialized): PHC added
[ 0.469913] igc 0000:03:00.0: 4.000 Gb/s available PCIe bandwidth (5.0 GT/s PCIe x1 link)
[ 0.469917] igc 0000:03:00.0 eth0: MAC: fc:34:97:e0:39:f6
[ 0.470146] xhci_hcd 0000:00:14.0: xHCI Host Controller
[ 0.470150] xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 1
[ 0.471286] xhci_hcd 0000:00:14.0: hcc params 0x20007fc1 hci version 0x120 quirks 0x0000000200009810
[ 0.471650] xhci_hcd 0000:00:14.0: xHCI Host Controller
[ 0.471653] xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 2
[ 0.471654] xhci_hcd 0000:00:14.0: Host supports USB 3.2 Enhanced SuperSpeed
[ 0.471678] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.03
[ 0.471695] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 0.471696] usb usb1: Product: xHCI Host Controller
[ 0.471697] usb usb1: Manufacturer: Linux 7.3.2-rc1_MY-g75eaee7a6465 xhci-hcd
[ 0.471698] usb usb1: SerialNumber: 0000:00:14.0
[ 0.471814] hub 1-0:1.0: USB hub found
[ 0.471863] hub 1-0:1.0: 16 ports detected
[ 0.474440] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.03
[ 0.474459] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 0.474460] usb usb2: Product: xHCI Host Controller
[ 0.474461] usb usb2: Manufacturer: Linux 7.3.2-rc1_MY-g75eaee7a6465 xhci-hcd
[ 0.474462] usb usb2: SerialNumber: 0000:00:14.0
[ 0.474511] hub 2-0:1.0: USB hub found
[ 0.474549] hub 2-0:1.0: 5 ports detected
[ 0.475748] usbcore: registered new interface driver usblp
[ 0.475809] usbcore: registered new interface driver uas
[ 0.475816] usbcore: registered new interface driver usb-storage
[ 0.475832] i8042: PNP: No PS/2 controller found.
[ 0.475861] mousedev: PS/2 mouse device common for all mice
[ 0.475920] rtc_cmos rtc_cmos: RTC can wake from S4
[ 0.476817] rtc_cmos rtc_cmos: registered as rtc1
[ 0.476864] rtc_cmos rtc_cmos: alarms up to one month, y3k, 114 bytes nvram, hpet irqs
[ 0.476876] i2c_dev: i2c /dev entries driver
[ 0.477118] i801_smbus 0000:00:1f.4: SPD Write Disable is set
[ 0.477135] i801_smbus 0000:00:1f.4: SMBus using PCI interrupt
[ 0.478722] i2c i2c-0: Successfully instantiated SPD at 0x51
[ 0.479632] i2c i2c-0: Successfully instantiated SPD at 0x53
[ 0.481085] nct6775: Found NCT6798D/NCT5585D or compatible chip at 0x2e:0x290
[ 0.528730] device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is disabled. Duplicate IMA measurements will not be recorded in the IMA log.
[ 0.528739] device-mapper: uevent: version 1.0.3
[ 0.528780] device-mapper: ioctl: 4.50.0-ioctl (2025-04-28) initialised: dm-devel@lists.linux.dev
[ 0.528784] intel_pstate: HWP enabled by BIOS
[ 0.528785] intel_pstate: Intel P-state driver initializing
[ 0.529212] intel_pstate: HWP enabled
[ 0.529578] simple-framebuffer simple-framebuffer.0: [drm] Registered 1 planes with drm panic
[ 0.529588] [drm] Initialized simpledrm 1.0.0 for simple-framebuffer.0 on minor 0
[ 0.530059] fbcon: Deferring console take-over
[ 0.530061] simple-framebuffer simple-framebuffer.0: [drm] fb0: simpledrmdrmfb frame buffer device
[ 0.530089] pstore: Using crash dump compression: deflate
[ 0.530090] pstore: Registered efi_pstore as persistent store backend
[ 0.530099] hid: raw HID events driver (C) Jiri Kosina
[ 0.530113] usbcore: registered new interface driver usbhid
[ 0.530114] usbhid: USB HID core driver
[ 0.530777] intel_rapl_common: Found RAPL domain package
[ 0.530780] intel_rapl_common: Found RAPL domain core
[ 0.533631] ee1004 0-0051: 512 byte EE1004-compliant SPD EEPROM, read-only
[ 0.535176] ee1004 0-0053: 512 byte EE1004-compliant SPD EEPROM, read-only
[ 0.535259] usbcore: registered new interface driver snd-usb-audio
[ 0.535268] drop_monitor: Initializing network drop monitor service
[ 0.535366] Initializing XFRM netlink socket
[ 0.535383] NET: Registered PF_INET6 protocol family
[ 0.535544] Segment Routing with IPv6
[ 0.535545] RPL Segment Routing with IPv6
[ 0.535550] In-situ OAM (IOAM) with IPv6
[ 0.535562] mip6: Mobile IPv6
[ 0.535564] NET: Registered PF_PACKET protocol family
[ 0.535572] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 0.535602] NET: Registered PF_RXRPC protocol family
[ 0.535604] Key type rxrpc registered
[ 0.535604] Key type rxrpc_s registered
[ 0.535624] NET: Registered PF_KCM protocol family
[ 0.535692] NET: Registered PF_RDS protocol family
[ 0.535710] Registered RDS/tcp transport
[ 0.535730] Key type dns_resolver registered
[ 0.535732] Key type ceph registered
[ 0.535768] libceph: loaded (mon/osd proto 15/24)
[ 0.535787] NET: Registered PF_VSOCK protocol family
[ 0.537001] ENERGY_PERF_BIAS: Set to 'normal', was 'performance'
[ 0.537792] microcode: Current revision: 0x00000065
[ 0.538761] IPI shorthand broadcast: enabled
[ 0.540247] sched_clock: Marking stable (535001101, 4635085)->(544842601, -5206415)
[ 0.540454] registered taskstats version 1
[ 0.541849] Loading compiled-in X.509 certificates
[ 0.542209] Loaded X.509 cert 'Build time autogenerated kernel key: 2459d2907a16424fd634f6d91423079f301221fa'
[ 0.545305] Demotion targets for Node 0: null
[ 0.545312] page_owner is disabled
[ 0.545325] Key type .fscrypt registered
[ 0.545325] Key type fscrypt-provisioning registered
[ 0.545571] Btrfs loaded, zoned=yes, fsverity=yes
[ 0.545592] Key type big_key registered
[ 0.545593] Key type trusted registered
[ 0.545786] Key type encrypted registered
[ 0.545790] Loading compiled-in module X.509 certificates
[ 0.546117] Loaded X.509 cert 'Build time autogenerated kernel key: 2459d2907a16424fd634f6d91423079f301221fa'
[ 0.546119] ima: Allocated hash algorithm: sha256
[ 0.563945] ima: No architecture policies found
[ 0.563957] evm: Initialising EVM extended attributes:
[ 0.563957] evm: security.selinux
[ 0.563958] evm: security.SMACK64 (disabled)
[ 0.563958] evm: security.SMACK64EXEC (disabled)
[ 0.563959] evm: security.SMACK64TRANSMUTE (disabled)
[ 0.563959] evm: security.SMACK64MMAP (disabled)
[ 0.563959] evm: security.apparmor (disabled)
[ 0.563960] evm: security.ima
[ 0.563960] evm: security.capability
[ 0.563961] evm: HMAC attrs: 0x1
[ 0.564246] integrity: Loading X.509 certificate: UEFI:db
[ 0.564436] integrity: Loaded X.509 cert 'ASUSTeK MotherBoard SW Key Certificate: da83b990422ebc8c441f8d8b039a65a2'
[ 0.564437] integrity: Loading X.509 certificate: UEFI:db
[ 0.564527] integrity: Loaded X.509 cert 'ASUSTeK Notebook SW Key Certificate: b8e581e4df77a5bb4282d5ccfc00c071'
[ 0.564527] integrity: Loading X.509 certificate: UEFI:db
[ 0.564535] integrity: Loaded X.509 cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4'
[ 0.564536] integrity: Loading X.509 certificate: UEFI:db
[ 0.564543] integrity: Loaded X.509 cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53'
[ 0.564543] integrity: Loading X.509 certificate: UEFI:db
[ 0.564551] integrity: Loaded X.509 cert 'Microsoft Option ROM UEFI CA 2023: 514fbf937fa46fb57bf07af8bed84b3b864b1711'
[ 0.564552] integrity: Loading X.509 certificate: UEFI:db
[ 0.564561] integrity: Loaded X.509 cert 'Microsoft UEFI CA 2023: 81aa6b3244c935bce0d6628af39827421e32497d'
[ 0.564562] integrity: Loading X.509 certificate: UEFI:db
[ 0.564568] integrity: Loaded X.509 cert 'Microsoft Corporation: Windows UEFI CA 2023: aefc5fbbbe055d8f8daa585473499417ab5a5272'
[ 0.565420] netconsole: network logging started
[ 0.565489] RAS: Correctable Errors collector initialized.
[ 0.565623] clk: Disabling unused clocks
[ 0.565625] ALSA device list:
[ 0.565626] No soundcards found.
[ 0.661704] Freeing initrd memory: 81708K
[ 0.697173] ata3: SATA link down (SStatus 4 SControl 300)
[ 0.697215] ata1: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
[ 0.697541] ata5: SATA link down (SStatus 4 SControl 300)
[ 0.697582] ata4: SATA link down (SStatus 4 SControl 300)
[ 0.697634] ata6: SATA link down (SStatus 4 SControl 300)
[ 0.697688] ata2: SATA link down (SStatus 4 SControl 300)
[ 0.707505] ata1.00: Model 'INTEL SSDSC2CT120A3', rev '300i', applying quirks: zeroaftertrim
[ 0.707891] ata1.00: ATA-9: INTEL SSDSC2CT120A3, 300i, max UDMA/133
[ 0.708325] ata1.00: 234441648 sectors, multi 16: LBA48 NCQ (depth 32), AA
[ 0.708338] ata1.00: Features: HIPM DIPM
[ 0.715791] usb 1-2: new full-speed USB device number 2 using xhci_hcd
[ 0.718288] ata1.00: configured for UDMA/133
[ 0.719414] scsi 0:0:0:0: Direct-Access ATA INTEL SSDSC2CT12 300i PQ: 0 ANSI: 5
[ 0.720034] sd 0:0:0:0: Attached scsi generic sg0 type 0
[ 0.720127] sd 0:0:0:0: [sda] 234441648 512-byte logical blocks: (120 GB/112 GiB)
[ 0.720147] sd 0:0:0:0: [sda] Write Protect is off
[ 0.720152] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
[ 0.720178] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 0.720226] sd 0:0:0:0: [sda] Preferred minimum I/O size 512 bytes
[ 0.757199] sda: sda1 sda2 sda3 sda4 sda5 sda6
[ 0.758192] sd 0:0:0:0: [sda] Attached SCSI disk
[ 0.774216] Freeing unused kernel image (initmem) memory: 5236K
[ 0.774239] Write protecting the kernel read-only data: 47104k
[ 0.774680] Freeing unused kernel image (text/rodata gap) memory: 844K
[ 0.774931] Freeing unused kernel image (rodata/data gap) memory: 816K
[ 0.781072] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 0.781078] Run /init as init process
[ 0.781079] with arguments:
[ 0.781080] /init
[ 0.781081] rhgb
[ 0.781081] with environment:
[ 0.781082] HOME=/
[ 0.781082] TERM=linux
[ 0.815482] systemd[1]: Successfully made /usr/ read-only.
[ 0.815594] systemd[1]: systemd 262.1-1.fc45 running in system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA +IPE +SMACK +SECCOMP +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP +LIBARCHIVE)
[ 0.815597] systemd[1]: Detected architecture x86-64.
[ 0.815598] systemd[1]: Running in initrd.
[ 0.815740] systemd[1]: Hostname set to <obelix>.
[ 0.840010] usb 1-2: New USB device found, idVendor=0b05, idProduct=19af, bcdDevice= 1.00
[ 0.842952] usb 1-2: config 1 has an invalid interface number: 2 but max is 1
[ 0.842955] usb 1-2: config 1 has no interface number 1
[ 0.843937] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 0.843939] usb 1-2: Product: AURA LED Controller
[ 0.843940] usb 1-2: Manufacturer: AsusTek Computer Inc.
[ 0.843941] usb 1-2: SerialNumber: 9876543210
[ 0.845920] hid-generic 0003:0B05:19AF.0001: hiddev96,hidraw0: USB HID v1.11 Device [AsusTek Computer Inc. AURA LED Controller] on usb-0000:00:14.0-2/input2
[ 0.856679] systemd[1]: bpf-restrict-fs: LSM BPF program attached
[ 0.884769] systemd[1]: Queued start job for default target initrd.target.
[ 0.898271] systemd[1]: Expecting device dev-disk-by\x2duuid-2ab6e75b\x2d4e3c\x2d4a9d\x2da329\x2d431178fdd0e7.device - /dev/disk/by-uuid/2ab6e75b-4e3c-4a9d-a329-431178fdd0e7...
[ 0.898334] systemd[1]: Reached target initrd-usr-fs.target - Initrd /usr File System.
[ 0.898385] systemd[1]: Reached target slices.target - Slice Units.
[ 0.898408] systemd[1]: Reached target swap.target - Swaps.
[ 0.898429] systemd[1]: Reached target timers.target - Timer Units.
[ 0.898545] systemd[1]: Listening on systemd-journald-dev-log.socket - Journal Socket (/dev/log).
[ 0.898662] systemd[1]: Listening on systemd-journald.socket - Journal Sockets.
[ 0.898751] systemd[1]: Listening on systemd-udevd-kernel.socket - udev Kernel Socket.
[ 0.898890] systemd[1]: Listening on systemd-udevd-varlink.socket - udev Varlink Socket.
[ 0.898917] systemd[1]: Reached target sockets.target - Socket Units.
[ 0.899018] systemd[1]: kmod-static-nodes.service - Create List of Static Device Nodes skipped, unmet condition check ConditionFileNotEmpty=/lib/modules/7.3.2-rc1_MY-g75eaee7a6465/modules.devname
[ 0.899077] systemd[1]: memstrack.service - Memstrack Anylazing Service skipped, no trigger condition checks were met.
[ 0.901821] systemd[1]: Starting systemd-journald.service - Journal Service...
[ 0.902523] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules...
[ 0.902571] systemd[1]: systemd-pcrphase-initrd.service - TPM PCR Barrier (initrd) skipped, unmet condition check ConditionSecurity=measured-os
[ 0.903145] systemd[1]: Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully...
[ 0.903733] systemd[1]: Starting systemd-vconsole-setup.service - Virtual Console Setup...
[ 0.907890] systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules.
[ 0.908431] systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
[ 0.908621] systemd[1]: Finished systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully.
[ 0.909075] systemd[1]: Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev...
[ 0.912025] systemd[1]: Finished systemd-sysctl.service - Apply Kernel Variables.
[ 0.912512] systemd-journald[229]: Collecting audit messages is disabled.
[ 0.912749] systemd[1]: Finished systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev.
[ 0.912845] systemd[1]: Reached target local-fs-pre.target - Preparation for Local File Systems.
[ 0.912860] systemd[1]: Reached target local-fs.target - Local File Systems.
[ 0.924829] systemd[1]: Finished systemd-vconsole-setup.service - Virtual Console Setup.
[ 0.924909] systemd[1]: dracut-cmdline-ask.service - dracut ask for additional cmdline parameters skipped, no trigger condition checks were met.
[ 0.925391] systemd[1]: Starting dracut-cmdline.service - dracut cmdline hook...
[ 0.934979] systemd[1]: Started systemd-journald.service - Journal Service.
[ 0.958653] usb 1-9: new high-speed USB device number 3 using xhci_hcd
[ 1.082966] usb 1-9: New USB device found, idVendor=05e3, idProduct=0610, bcdDevice=60.60
[ 1.084272] usb 1-9: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[ 1.084274] usb 1-9: Product: USB2.0 Hub
[ 1.085593] hub 1-9:1.0: USB hub found
[ 1.085984] hub 1-9:1.0: 4 ports detected
[ 1.201658] usb 1-10: new high-speed USB device number 4 using xhci_hcd
[ 1.327976] usb 1-10: New USB device found, idVendor=05e3, idProduct=0610, bcdDevice=60.60
[ 1.329160] usb 1-10: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[ 1.329172] usb 1-10: Product: USB2.0 Hub
[ 1.330467] hub 1-10:1.0: USB hub found
[ 1.330793] hub 1-10:1.0: 4 ports detected
[ 1.446684] usb 1-14: new full-speed USB device number 5 using xhci_hcd
[ 1.570647] usb 1-14: New USB device found, idVendor=8087, idProduct=0026, bcdDevice= 0.02
[ 1.571237] usb 1-14: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1.642697] usb 1-10.1: new full-speed USB device number 6 using xhci_hcd
[ 1.727832] usb 1-10.1: New USB device found, idVendor=046d, idProduct=c548, bcdDevice= 5.01
[ 1.729865] usb 1-10.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1.729867] usb 1-10.1: Product: USB Receiver
[ 1.729868] usb 1-10.1: Manufacturer: Logitech
[ 1.738766] input: Logitech USB Receiver as /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.0/0003:046D:C548.0002/input/input3
[ 1.837713] Setting dangerous option enable_guc - tainting kernel
[ 1.839193] i915 0000:00:02.0: [drm] Found rocketlake (device ID 4c8b) integrated display version 12.00 stepping C0
[ 1.851963] hid-generic 0003:046D:C548.0002: input,hidraw1: USB HID v1.11 Keyboard [Logitech USB Receiver] on usb-0000:00:14.0-10.1/input0
[ 1.853084] input: Logitech USB Receiver Mouse as /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.1/0003:046D:C548.0003/input/input4
[ 1.853214] input: Logitech USB Receiver Consumer Control as /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.1/0003:046D:C548.0003/input/input5
[ 1.853275] input: Logitech USB Receiver System Control as /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.1/1-10.1:1.1/0003:046D:C548.0003/input/input6
[ 1.853400] hid-generic 0003:046D:C548.0003: input,hidraw2: USB HID v1.11 Mouse [Logitech USB Receiver] on usb-0000:00:14.0-10.1/input1
[ 1.854465] hid-generic 0003:046D:C548.0004: hiddev97,hidraw3: USB HID v1.11 Device [Logitech USB Receiver] on usb-0000:00:14.0-10.1/input2
[ 1.855912] i915 0000:00:02.0: vgaarb: deactivate vga console
[ 1.855975] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[ 1.857765] i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/rkl_dmc_ver2_03.bin (v2.3)
[ 1.858426] i915 0000:00:02.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io:owns=io+mem
[ 1.875766] i915 0000:00:02.0: [drm] GT0: GuC firmware i915/tgl_guc_70.1.1.bin version 70.1.1
[ 1.875770] i915 0000:00:02.0: [drm] GT0: HuC firmware i915/tgl_huc_7.9.3.bin version 7.9.3
[ 1.879531] i915 0000:00:02.0: [drm] GT0: HuC: authenticated for all workloads
[ 1.880250] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
[ 1.880251] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
[ 1.880560] i915 0000:00:02.0: [drm] GT0: GUC: RC enabled
[ 1.880859] i915 0000:00:02.0: [drm] Protected Xe Path (PXP) protected content support initialized
[ 1.898633] i915 0000:00:02.0: [drm] Registered 3 planes with drm panic
[ 1.903857] [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 1
[ 1.906121] ACPI: video: Video Device [GFX0] (multi-head: yes rom: no post: no)
[ 1.907211] input: Video Bus as /devices/pci0000:00/acpi.video_bus.0/input/input7
[ 1.928729] usb 1-10.4: new full-speed USB device number 7 using xhci_hcd
[ 1.951131] fbcon: i915drmfb (fb0) is primary device
[ 1.951133] fbcon: Deferring console take-over
[ 1.951134] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
[ 2.002865] usb 1-10.4: New USB device found, idVendor=08bb, idProduct=2900, bcdDevice= 1.00
[ 2.007632] usb 1-10.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 2.007635] usb 1-10.4: Product: USB Audio CODEC
[ 2.007639] usb 1-10.4: Manufacturer: Burr-Brown from TI
[ 2.035153] input: Burr-Brown from TI USB Audio CODEC as /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.4/1-10.4:1.3/0003:08BB:2900.0005/input/input8
[ 2.086265] hid-generic 0003:08BB:2900.0005: input,hidraw4: USB HID v1.00 Device [Burr-Brown from TI USB Audio CODEC ] on usb-0000:00:14.0-10.4/input3
[ 2.181759] BTRFS: device fsid 2ab6e75b-4e3c-4a9d-a329-431178fdd0e7 devid 1 transid 380259 /dev/nvme0n1p3 (259:3) scanned by mount (417)
[ 2.182287] BTRFS info (device nvme0n1p3): first mount of filesystem 2ab6e75b-4e3c-4a9d-a329-431178fdd0e7
[ 2.182304] BTRFS info (device nvme0n1p3): using crc32c checksum algorithm
[ 2.202248] BTRFS info (device nvme0n1p3): enabling ssd optimizations
[ 2.202250] BTRFS info (device nvme0n1p3): turning on async discard
[ 2.202251] BTRFS info (device nvme0n1p3): enabling free space tree
[ 2.349447] systemd-journald[229]: Received SIGTERM from PID 1 (systemd).
[ 2.367391] audit: type=1404 audit(1793833085.501:2): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=selinux res=1
[ 2.385156] SELinux: Permission firmware_load in class system not defined in policy.
[ 2.385160] SELinux: Permission kexec_image_load in class system not defined in policy.
[ 2.385161] SELinux: Permission kexec_initramfs_load in class system not defined in policy.
[ 2.385161] SELinux: Permission policy_load in class system not defined in policy.
[ 2.385162] SELinux: Permission x509_certificate_load in class system not defined in policy.
[ 2.385195] SELinux: Permission map_create_as in class bpf not defined in policy.
[ 2.385195] SELinux: Permission prog_load_as in class bpf not defined in policy.
[ 2.385197] SELinux: Permission allowed in class io_uring not defined in policy.
[ 2.385198] SELinux: Class memfd_file not defined in policy.
[ 2.385198] SELinux: the above unknown classes and permissions will be allowed
[ 2.386661] SELinux: policy capability network_peer_controls=1
[ 2.386663] SELinux: policy capability open_perms=1
[ 2.386663] SELinux: policy capability extended_socket_class=1
[ 2.386664] SELinux: policy capability always_check_network=0
[ 2.386664] SELinux: policy capability cgroup_seclabel=1
[ 2.386665] SELinux: policy capability nnp_nosuid_transition=1
[ 2.386665] SELinux: policy capability genfs_seclabel_symlinks=1
[ 2.386666] SELinux: policy capability ioctl_skip_cloexec=0
[ 2.386666] SELinux: policy capability userspace_initial_context=0
[ 2.386667] SELinux: policy capability netlink_xperm=0
[ 2.386667] SELinux: policy capability netif_wildcard=0
[ 2.386668] SELinux: policy capability genfs_seclabel_wildcard=0
[ 2.386669] SELinux: policy capability functionfs_seclabel=0
[ 2.386669] SELinux: policy capability memfd_class=0
[ 2.386670] SELinux: policy capability bpf_token_perms=0
[ 2.415277] audit: type=1403 audit(1793833085.549:3): auid=4294967295 ses=4294967295 lsm=selinux res=1
[ 2.415813] systemd[1]: Successfully loaded SELinux policy in 48.560ms.
[ 2.426245] systemd[1]: Relabeled /dev/, /dev/shm/, /run/ in 7.407ms.
[ 2.427414] systemd[1]: systemd 262.1-1.fc45 running in system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA +IPE +SMACK +SECCOMP +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP +LIBARCHIVE)
[ 2.427418] systemd[1]: Detected architecture x86-64.
[ 2.481302] systemd[1]: bpf-restrict-fs: LSM BPF program attached
[ 2.659008] systemd[1]: initrd-switch-root.service: Deactivated successfully.
[ 2.659104] systemd[1]: Stopped initrd-switch-root.service - Switch Root.
[ 2.659738] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1.
[ 2.660062] systemd[1]: Created slice system-getty.slice - Slice /system/getty.
[ 2.660304] systemd[1]: Created slice system-kmsconvt.slice - Slice /system/kmsconvt.
[ 2.660533] systemd[1]: Created slice system-sshd\x2dkeygen.slice - Slice /system/sshd-keygen.
[ 2.660782] systemd[1]: Created slice system-systemd\x2dfsck.slice - Slice /system/systemd-fsck.
[ 2.661047] systemd[1]: Created slice system-systemd\x2dzram\x2dsetup.slice - Slice /system/systemd-zram-setup.
[ 2.661199] systemd[1]: Created slice user.slice - User and Session Slice.
[ 2.661232] systemd[1]: systemd-ask-password-console.path - Dispatch Password Requests to Console Directory Watch skipped, unmet condition check ConditionPathExists=!/run/plymouth/pid
[ 2.661280] systemd[1]: Started systemd-ask-password-wall.path - Forward Password Requests to Wall Directory Watch.
[ 2.661469] systemd[1]: Set up automount proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats File System Automount Point.
[ 2.661495] systemd[1]: Expecting device dev-disk-by\x2duuid-2ab6e75b\x2d4e3c\x2d4a9d\x2da329\x2d431178fdd0e7.device - /dev/disk/by-uuid/2ab6e75b-4e3c-4a9d-a329-431178fdd0e7...
[ 2.661508] systemd[1]: Expecting device dev-disk-by\x2duuid-385484bb\x2d0f27\x2d4dae\x2d8577\x2d7d1866d9e9bc.device - /dev/disk/by-uuid/385484bb-0f27-4dae-8577-7d1866d9e9bc...
[ 2.661520] systemd[1]: Expecting device dev-disk-by\x2duuid-4D03\x2d2603.device - /dev/disk/by-uuid/4D03-2603...
[ 2.661529] systemd[1]: Expecting device dev-disk-by\x2duuid-80ce69a9\x2d95d2\x2d4182\x2da493\x2db0a5c7618748.device - /dev/disk/by-uuid/80ce69a9-95d2-4182-a493-b0a5c7618748...
[ 2.661540] systemd[1]: Expecting device dev-zram0.device - /dev/zram0...
[ 2.661554] systemd[1]: Reached target clonesetup.target - Local dm-clone Devices.
[ 2.661574] systemd[1]: Reached target getty.target - Login Prompts.
[ 2.661590] systemd[1]: Reached target imports.target - Image Downloads.
[ 2.661610] systemd[1]: Stopped target initrd-switch-root.target - Switch Root.
[ 2.661628] systemd[1]: Stopped target initrd-fs.target - Initrd File Systems.
[ 2.661647] systemd[1]: Stopped target initrd-root-fs.target - Initrd Root File System.
[ 2.661664] systemd[1]: Reached target integritysetup.target - Local Integrity Protected Volumes.
[ 2.661713] systemd[1]: Reached target slices.target - Slice Units.
[ 2.661743] systemd[1]: Reached target veritysetup.target - Local Verity Protected Volumes.
[ 2.670635] systemd[1]: Listening on rpcbind.socket - RPCbind Server Activation Socket.
[ 2.670683] systemd[1]: Reached target rpcbind.target - RPC Port Mapper.
[ 2.671332] systemd[1]: Listening on systemd-ask-password.socket - Query the User Interactively for a Password.
[ 2.672062] systemd[1]: Listening on systemd-coredump.socket - Process Core Dump Socket.
[ 2.672447] systemd[1]: Listening on systemd-creds.socket - Credential Encryption/Decryption.
[ 2.672877] systemd[1]: Listening on systemd-cryptenroll.socket - Disk Encryption Enrollment Service Socket.
[ 2.673361] systemd[1]: Listening on systemd-factory-reset.socket - Factory Reset Management.
[ 2.673501] systemd[1]: Listening on systemd-hostnamed.socket - Hostname Service Socket.
[ 2.673785] systemd[1]: Listening on systemd-journald-audit.socket - Journal Audit Socket.
[ 2.674269] systemd[1]: Listening on systemd-mute-console.socket - Console Output Muting Service Socket.
[ 2.674462] systemd[1]: Listening on systemd-oomd.socket - Userspace Out-Of-Memory (OOM) Killer Socket.
[ 2.674508] systemd[1]: systemd-pcrextend.socket - TPM PCR Measurements skipped, unmet condition check ConditionSecurity=measured-os
[ 2.674520] systemd[1]: systemd-pcrlock.socket - Make TPM PCR Policy skipped, unmet condition check ConditionSecurity=measured-uki
[ 2.674976] systemd[1]: Listening on systemd-repart.socket - Disk Repartitioning Service Socket.
[ 2.675154] systemd[1]: Listening on systemd-resolved-monitor.socket - Resolve Monitor Varlink Socket.
[ 2.675242] systemd[1]: Listening on systemd-resolved-varlink.socket - Resolve Service Varlink Socket.
[ 2.675840] systemd[1]: Listening on systemd-storage-block.socket - Simple Block Device Backed Storage Provider.
[ 2.676328] systemd[1]: Listening on systemd-storage-fs.socket - Simple File System Backed Storage Provider.
[ 2.676775] systemd[1]: Listening on systemd-sysinstall.socket - System Install Tool.
[ 2.677411] systemd[1]: Listening on systemd-sysupdate.socket - System Updates.
[ 2.677987] systemd[1]: Listening on systemd-udevd-varlink.socket - udev Varlink Socket.
[ 2.678207] systemd[1]: Listening on systemd-userdbd.socket - User Database Manager Socket.
[ 2.679054] systemd[1]: Mounting dev-hugepages.mount - Huge Pages File System...
[ 2.679549] systemd[1]: Mounting dev-mqueue.mount - POSIX Message Queue File System...
[ 2.680079] systemd[1]: Mounting sys-kernel-debug.mount - Kernel Debug File System...
[ 2.680520] systemd[1]: Mounting sys-kernel-tracing.mount - Kernel Trace File System...
[ 2.680597] systemd[1]: auth-rpcgss-module.service - Kernel Module supporting RPCSEC_GSS skipped, unmet condition check ConditionPathExists=/etc/krb5.keytab
[ 2.680653] systemd[1]: fips-crypto-policy-overlay.service - Bind-mount FIPS crypto-policy in FIPS mode skipped, unmet condition check ConditionKernelCommandLine=fips=1
[ 2.681593] systemd[1]: Starting kmod-static-nodes.service - Create List of Static Device Nodes...
[ 2.681631] systemd[1]: modprobe@configfs.service - Load Kernel Module configfs skipped, unmet condition check ConditionKernelModuleLoaded=!configfs
[ 2.681658] systemd[1]: modprobe@drm.service - Load Kernel Module drm skipped, unmet condition check ConditionKernelModuleLoaded=!drm
[ 2.681675] systemd[1]: modprobe@fuse.service - Load Kernel Module fuse skipped, unmet condition check ConditionKernelModuleLoaded=!fuse
[ 2.682184] systemd[1]: Mounting sys-fs-fuse-connections.mount - FUSE Control File System...
[ 2.682218] systemd[1]: plymouth-switch-root.service: Deactivated successfully.
[ 2.682237] systemd[1]: Stopped plymouth-switch-root.service - Plymouth switch root service.
[ 2.682395] systemd[1]: systemd-boot-clear-sysfail.service - Clear SysFail Entry If The Boot Is Successful skipped, unmet condition check ConditionPathExists=/sys/firmware/efi/efivars/LoaderEntrySysFail-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
[ 2.682425] systemd[1]: systemd-fsck-root.service: Deactivated successfully.
[ 2.682443] systemd[1]: Stopped systemd-fsck-root.service - File System Check on Root Device.
[ 2.682497] systemd[1]: systemd-hibernate-clear.service - Clear Stale Hibernate Storage Info skipped, unmet condition check ConditionPathExists=/sys/firmware/efi/efivars/HibernateLocation-8cf2644b-4b0b-428f-9387-6d876050dc67
[ 2.684097] systemd[1]: Starting systemd-journald.service - Journal Service...
[ 2.685366] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules...
[ 2.686176] systemd[1]: Starting systemd-network-generator.service - Generate Network Units from Kernel Command Line...
[ 2.686224] systemd[1]: systemd-pcrmachine.service - TPM PCR Machine ID Measurement skipped, unmet condition check ConditionSecurity=measured-os
[ 2.686260] systemd[1]: systemd-pcrosseparator.service - TPM PCR OS Separator skipped, unmet condition check ConditionSecurity=measured-os
[ 2.687023] systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems...
[ 2.687078] systemd[1]: systemd-tpm2-setup-early.service - Early TPM SRK Setup skipped, unmet condition check ConditionSecurity=measured-os
[ 2.687098] systemd[1]: systemd-pcrnvdone.service - TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release
[ 2.687110] systemd[1]: Reached target cryptsetup.target - Local Encrypted Volumes.
[ 2.687131] systemd[1]: systemd-pcrproduct.service - TPM NvPCR Product ID Measurement skipped, unmet condition check ConditionSecurity=measured-os
[ 2.687709] systemd[1]: Starting systemd-udev-load-credentials.service - Load udev Rules from Credentials...
[ 2.688300] systemd[1]: Starting systemd-udev-trigger.service - Coldplug All udev Devices...
[ 2.691198] systemd[1]: Mounted dev-hugepages.mount - Huge Pages File System.
[ 2.691307] systemd[1]: Mounted dev-mqueue.mount - POSIX Message Queue File System.
[ 2.691376] systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug File System.
[ 2.691442] systemd[1]: Mounted sys-kernel-tracing.mount - Kernel Trace File System.
[ 2.691675] systemd[1]: Finished kmod-static-nodes.service - Create List of Static Device Nodes.
[ 2.691823] systemd[1]: Mounted sys-fs-fuse-connections.mount - FUSE Control File System.
[ 2.692316] BTRFS info (device nvme0n1p3 state M): use zstd compression, level 1
[ 2.692698] systemd[1]: Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully...
[ 2.693540] systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules.
[ 2.693842] systemd[1]: Finished systemd-network-generator.service - Generate Network Units from Kernel Command Line.
[ 2.694254] systemd[1]: Finished systemd-remount-fs.service - Remount Root and Kernel File Systems.
[ 2.694537] systemd[1]: systemd-hwdb-update.service - Rebuild Hardware Database skipped, unmet condition check ConditionNeedsUpdate=/etc
[ 2.695224] systemd[1]: Starting systemd-random-seed.service - Load/Save OS Random Seed...
[ 2.695840] systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
[ 2.695861] systemd[1]: systemd-tpm2-setup.service - TPM SRK Setup skipped, unmet condition check ConditionSecurity=measured-os
[ 2.696083] systemd[1]: Finished systemd-udev-load-credentials.service - Load udev Rules from Credentials.
[ 2.719355] systemd-journald[517]: Collecting audit messages is enabled.
[ 2.722282] systemd[1]: Finished systemd-sysctl.service - Apply Kernel Variables.
[ 2.722341] audit: type=1130 audit(1793833085.856:4): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-sysctl comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 2.722487] systemd[1]: Started systemd-journald.service - Journal Service.
[ 2.722538] audit: type=1130 audit(1793833085.856:5): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-journald comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 2.724950] audit: type=1130 audit(1793833085.859:6): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-tmpfiles-setup-dev-early comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 2.733930] audit: type=1334 audit(1793833085.868:7): prog-id=48 op=LOAD
[ 2.735279] audit: type=1130 audit(1793833085.869:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-random-seed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 2.735708] systemd-journald[517]: Received client request to flush runtime journal.
[ 2.737808] audit: type=1334 audit(1793833085.872:9): prog-id=49 op=LOAD
[ 2.737878] audit: type=1334 audit(1793833085.872:10): prog-id=50 op=LOAD
[ 2.826331] zram0: detected capacity change from 0 to 16777216
[ 2.831998] igc 0000:03:00.0 enp3s0: renamed from eth0
[ 2.903074] Adding 8388604k swap on /dev/zram0. Priority:100 extents:1 across:8388604k SSDsc
[ 2.920926] mei_me 0000:00:16.0: enabling device (0000 -> 0002)
[ 2.960172] mei_pxp 0000:00:16.0-fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1: bound 0000:00:02.0 (ops 0xffffffffc064ca10)
[ 2.960534] mei_hdcp 0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0 (ops 0xffffffffc062d750)
[ 2.974907] Bluetooth: Core ver 2.22
[ 2.974925] NET: Registered PF_BLUETOOTH protocol family
[ 2.974926] Bluetooth: HCI device and connection manager initialized
[ 2.974934] Bluetooth: HCI socket layer initialized
[ 2.974935] Bluetooth: L2CAP socket layer initialized
[ 2.974938] Bluetooth: SCO socket layer initialized
[ 2.994783] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 2.995084] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 2.995185] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 3.030014] usbcore: registered new interface driver btusb
[ 3.031267] Bluetooth: hci0: Bootloader revision 0.4 build 0 week 30 2018
[ 3.032260] Bluetooth: hci0: Device revision is 2
[ 3.032271] Bluetooth: hci0: Secure boot is enabled
[ 3.032286] Bluetooth: hci0: OTP lock is enabled
[ 3.032288] Bluetooth: hci0: API lock is enabled
[ 3.032289] Bluetooth: hci0: Debug lock is disabled
[ 3.032290] Bluetooth: hci0: Minimum firmware build 1 week 10 2014
[ 3.045227] iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
[ 3.047230] iwlwifi 0000:00:14.3: Detected crf-id 0x3617, cnv-id 0x20000302 wfpm id 0x80000000
[ 3.047251] iwlwifi 0000:00:14.3: PCI dev 43f0/0074, rev=0x351, rfid=0x10a100
[ 3.047253] iwlwifi 0000:00:14.3: Detected Intel(R) Wi-Fi 6 AX201 160MHz
[ 3.061823] Bluetooth: hci0: Found device firmware: intel/ibt-19-0-4.sfi
[ 3.061870] Bluetooth: hci0: Boot Address: 0x24800
[ 3.061871] Bluetooth: hci0: Firmware Version: 83-7.26
[ 3.076665] iwlwifi 0000:00:14.3: loaded firmware version 77.563a6e92.0 QuZ-a0-hr-b0-77.ucode op_mode iwlmvm
[ 3.404799] iwlwifi 0000:00:14.3: Detected RF HR B3, rfid=0x10a100
[ 3.471782] iwlwifi 0000:00:14.3: base HW address: 28:d0:ea:2b:cf:fa
[ 3.489427] iwlwifi 0000:00:14.3 wlo1: renamed from wlan0
[ 3.697931] EXT4-fs (nvme0n1p1): mounted filesystem 385484bb-0f27-4dae-8577-7d1866d9e9bc r/w with ordered data mode. Quota mode: none.
[ 3.718751] BTRFS: device label DEVEL devid 1 transid 25373 /dev/sda6 (8:6) scanned by mount (715)
[ 3.719010] BTRFS info (device sda6): first mount of filesystem 80ce69a9-95d2-4182-a493-b0a5c7618748
[ 3.719013] BTRFS info (device sda6): using crc32c checksum algorithm
[ 3.724464] BTRFS info (device sda6): enabling ssd optimizations
[ 3.724466] BTRFS info (device sda6): turning on async discard
[ 3.724467] BTRFS info (device sda6): enabling free space tree
[ 3.724468] BTRFS info (device sda6): use zstd compression, level 1
[ 3.872782] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 3.872788] Bluetooth: BNEP filters: protocol multicast
[ 3.872792] Bluetooth: BNEP socket layer initialized
[ 4.935455] Bluetooth: hci0: Waiting for firmware download to complete
[ 4.936254] Bluetooth: hci0: Firmware loaded in 1830483 usecs
[ 4.936329] Bluetooth: hci0: Waiting for device to boot
[ 4.951290] Bluetooth: hci0: Device booted in 14662 usecs
[ 4.951966] Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-19-0-4.ddc
[ 4.954333] Bluetooth: hci0: Applying Intel DDC parameters completed
[ 4.955326] Bluetooth: hci0: Firmware revision 0.4 build 83 week 7 2026
[ 4.957339] Bluetooth: hci0: HCI LE Coded PHY feature bit is set, but its usage is not supported.
[ 5.040748] Bluetooth: MGMT ver 1.23
[ 5.050932] Bluetooth: RFCOMM TTY layer initialized
[ 5.050941] Bluetooth: RFCOMM socket layer initialized
[ 5.050946] Bluetooth: RFCOMM ver 1.11
[ 5.227715] rfkill: input handler disabled
[ 7.069795] igc 0000:03:00.0 enp3s0: NIC Link is Up 2500 Mbps Full Duplex, Flow Control: RX
[ 83.797498] rfkill: input handler enabled
[ 84.670254] rfkill: input handler disabled
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-11-05 16:16 ` Brett A C Sheffield
@ 2026-11-05 21:56 ` Florian Fainelli
2026-11-05 23:15 ` Shuah Khan
555 siblings, 0 replies; 560+ messages in thread
From: Florian Fainelli @ 2026-11-05 21:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 11/4/26 13:03, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.3.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 560+ messages in thread
* Re: [PATCH 7.3 000/547] 7.3.2-rc1 review
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-11-05 21:56 ` Florian Fainelli
@ 2026-11-05 23:15 ` Shuah Khan
555 siblings, 0 replies; 560+ messages in thread
From: Shuah Khan @ 2026-11-05 23:15 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr, Shuah Khan
On 11/4/26 14:03, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.3.2 release.
> There are 547 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.3.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 560+ messages in thread
end of thread, other threads:[~2026-11-05 23:15 UTC | newest]
Thread overview: 560+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-04 21:03 [PATCH 7.3 000/547] 7.3.2-rc1 review Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 001/547] net: skbuff: propagate shared-frag marker in skb_zerocopy() Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 002/547] ksmbd: wait for negotiation before receiving another PDU Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 003/547] smb: smbdirect: dont wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync() Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 004/547] smb: smbdirect: release failed pending sockets of a listener Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 005/547] smb: smbdirect: dont hand out already failed sockets in smbdirect_socket_accept() Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 006/547] ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 007/547] wifi: ath12k: move dp_profile_params to dp.h Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 008/547] wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 009/547] wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 010/547] wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 011/547] wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 012/547] wifi: ath12k: convert ATH12K_RX_DESC_COUNT " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 013/547] wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 014/547] wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 015/547] wifi: ath12k: Increase RXDMA buffer ring size for default " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 016/547] platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE() Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 017/547] io_uring/waitid: own the request before clearing ->head Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 018/547] io_uring/cmd: dont leave list poison in ->hash_node Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 019/547] io_uring/wait: dont spin on a stuck overflow list Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 020/547] io_uring/io-wq: dont lose the signal that ends work Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 021/547] io_uring/io-wq: dont hide a link from cancellations Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 022/547] io_uring: dont flood a cancelling task with task_work Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 023/547] io_uring: dont lose the DEFER_TASKRUN wake up Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 024/547] io_uring/cancel: rearm local work wake up before sleep Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 025/547] io_uring/mpscq: disable preemption while pushing Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 026/547] io_uring/io-wq: dont go to sleep on pending work Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 027/547] io_uring/io-wq: dont strand work when a worker exits Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 028/547] io_uring/io-wq: dont exit with a creation pending Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 029/547] io_uring/io-wq: let cancel find picked up hashed work Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 030/547] io_uring/poll: dont lose a cancel as io-wq arms poll Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 031/547] io_uring: dont lose a cancel as io-wq parks a request Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 032/547] io_uring/cancel: dont forget that the work was running Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 033/547] io_uring/cancel: recognize "no timeout" on 32-bit Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 034/547] io_uring/cancel: let CANCEL_ALL find parked requests Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 035/547] io_uring: wake ring pollers for local task_work Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 036/547] io_uring/wait: look at all CQ waiters on wake up Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 037/547] io_uring/poll: drop stale double poll entry on rearm Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 038/547] io_uring/futex: allocate private hash before waiting Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 039/547] io_uring: drop the CQE cache if a refill fails Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 040/547] io_uring: dont split 128b SQEs at the SQPOLL cap Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 041/547] io_uring/register: dont wrap 32b CQEs when resizing Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 042/547] io_uring/register: handle index wrap " Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 043/547] io_uring/register: keep 128b SQEs intact on resize Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 044/547] io_uring/fdinfo: fix CQE dump of CQE32 rings Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 045/547] io_uring/timeout: dont skip over reached sequences Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 046/547] io_uring/timeout: keep repeat count on multishot update Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 047/547] io_uring/timeout: use the right clock for ABS updates Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 048/547] io_uring/wait: no early -ETIME if min_wait finds work Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 049/547] io_uring/napi: make stale entries time out after 60s Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 050/547] io_uring/napi: dont busy poll past an expired timeout Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 051/547] io_uring/zcrx: fix buffer offsets in areas above 4GB Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 052/547] io_uring/kbuf: handle index wrap in last buffer check Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 053/547] io_uring/sqpoll: let the thread sleep on disabled rings Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 054/547] io_uring/openclose: keep the lock in io_pipe_fixed() Greg Kroah-Hartman
2026-11-04 21:03 ` [PATCH 7.3 055/547] io_uring: dont pass restart error codes to userspace Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 056/547] io_uring/net: dont retry recv on uncommitted buffers Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 057/547] io_uring/timeout: no ABS update of multishot timeouts Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 058/547] io_uring/timeout: dont end a linked timeout with 1 Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 059/547] io_uring: look up the file before queueing to io-wq Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 060/547] io_uring/timeout: dont put a sequence target behind the last flush Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 061/547] io_uring/timeout: dont flush with the sequence " Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 062/547] io_uring/timeout: dont lose a cancel as io-wq arms a timeout Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 063/547] exec: cancel io_uring requests before de_thread() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 064/547] fork: move the coredump and exec checks into create_io_thread() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 065/547] fork: dont create io threads once PF_POSTCOREDUMP is set Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 066/547] clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 067/547] ALSA: line6: Clear prev_fbuf on capture buffer release Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 068/547] Bluetooth: forget a peers RPA once it advertises its identity address Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 069/547] wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 070/547] ARM: 9524/1: mm: align hugetlb mappings to the huge page size Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 071/547] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 072/547] ceph: fail readdir when the MDS reply carries no dirfrag Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 073/547] fuse: dont BUG when the copy buffer is exhausted Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 074/547] kcov: ignore an out-of-range comparison count in write_comp_data() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 075/547] kcsan: Avoid division by zero in kcsan_prandom_u32_max() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 076/547] ksmbd: serialize directory emptiness checks with readdir Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 077/547] libceph: bound mon_command ack decode to front len Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 078/547] media: cx88: Disable PCI device on MPEG initialization failure Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 079/547] media: em28xx: reject audio endpoint with zero packet size Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 080/547] media: go7007: only set audio_enabled if go7007_snd_init() succeeded Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 081/547] media: usbtv: fix null-pointer dereference on disconnect Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 082/547] net: ipv4: add zero check for snd_cwnd_clamp Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 083/547] net: usb: pegasus: do not advance rx_skb->data on dropped frames Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 084/547] nfsd: fix race between client_info_show() and free_client() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 085/547] ocfs2/dlm: drain join handlers before releasing module text Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 086/547] ocfs2: drain quorum work before removing the cluster Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 087/547] ocfs2: pin owning modules for open debugfs files Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 088/547] ocfs2: publish the filecheck owner before adding sysfs attributes Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 089/547] smb: client: do not pass a NULL buf to is_oplock_break() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 090/547] smb: client: fix early procfs exposure race Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 091/547] thunderbolt: Do not RPM complete unrelated subtrees on unplug Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 092/547] udf: fix return value for non-recorded-allocated extents in udf_map_block() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 093/547] wwan: wwan_hwsim: Pin module for debugfs file operations Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 094/547] xfs: fix integer overflow problem when setting large free areas Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 095/547] dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 096/547] irqchip/gic-v5: Fix standalone IRSes OF probe Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 097/547] serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 098/547] net/sched: cls_bpf: accept dev-bound programs on shared blocks Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 099/547] net/sched: cls_flower: avoid stale mask references after delete Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 100/547] net/sched: sch_teql: fix slaves_lock IRQ deadlock Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 101/547] net/sched: sch_teql: fix use-after-free on lower qdisc drop Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 102/547] net/sched: fix packet reordering on requeue Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 103/547] net/sched: act_ife: do not consume the inner header on egress Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 104/547] driver core: take parent lock on deferred probe Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 105/547] driver core: Limit the messages on a refused uevent Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 106/547] driver core: fix parent lock use-after-free on USB disconnect Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 107/547] driver core: take parent lock in async device attach Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 108/547] Drivers: hv: vmbus: Bounds check the shared ring buffer indices Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 109/547] backlight: lm3630a: Cancel delayed work before destroying workqueue Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 110/547] backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 111/547] backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 112/547] backlight: qcom-wled: Fix WLED3 brightness register stride Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 113/547] ksmbd: accept share config responses from ksmbd-tools before 3.5.3 Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 114/547] ksmbd: avoid restoring only in-memory EOF after allocation change Greg Kroah-Hartman
2026-11-04 21:04 ` [PATCH 7.3 115/547] ksmbd: defer connection scavenging while session locks are busy Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 116/547] ksmbd: deny access for an empty DACL instead of granting the request Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 117/547] ksmbd: drain session procfs readers before dropping table references Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 118/547] ksmbd: fix extended session security negotiation for raw NTLMSSP Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 119/547] ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 120/547] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 121/547] ksmbd: fix parent dentry lifetime in directory enumeration Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 122/547] ksmbd: fix session reference leak on compounded SESSION_SETUP Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 123/547] ksmbd: hold a connection reference for each session channel Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 124/547] ksmbd: ignore network devices of other namespaces Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 125/547] ksmbd: limit sessions on each connection Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 126/547] ksmbd: preserve unreadable named streams on open Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 127/547] ksmbd: prevent session binding in compound requests Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 128/547] ksmbd: prevent share root removal through empty paths Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 129/547] ksmbd: prevent stale data from being written by SMB2 WRITE requests Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 130/547] ksmbd: reclaim ended sessions on logoff and expiration Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 131/547] ksmbd: reserve space for the UTF-16 terminator in stream info Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 132/547] ksmbd: restore Kerberos logins with released ksmbd-tools Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 133/547] ksmbd: return end of file for reads past a named streams data Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 134/547] ksmbd: use u8 for SMB2 oplock level values Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 135/547] ksmbd: validate AppInstanceId takeover target Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 136/547] ksmbd: validate security descriptor offsets before pointer arithmetic Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 137/547] ksmbd: verify transform SessionId matches the decrypted header Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 138/547] vlan: restore HW VLAN tag insertion with reorder_hdr off Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 139/547] cgroup: serialize migrations of newly forked processes Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 140/547] wifi: b43: fix use-after-free in b43_bcma_remove() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 141/547] SUNRPC: fix netns use-after-free in write_gssp() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 142/547] spmi: Fix potential use-after-free by grabbing of_node reference Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 143/547] smb: client: fix use-after-free infoleak via the readdir resume name Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 144/547] smb: client: fix use-after-free in cifs_ses_add_channel() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 145/547] sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 146/547] RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 147/547] RDMA/irdma: avoid use-after-free in icrdma_remove Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 148/547] rapidio: mport_cdev: fix use-after-free in mport_mm_close() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 149/547] pps: generators: fix use-after-free when closing a removed device Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 150/547] PM: EM: Fix use-after-free of perf domain in netlink doit handlers Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 151/547] platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 152/547] platform/x86/amd: hfi: Fix a use-after-free when unloading the driver Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 153/547] nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 154/547] nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 155/547] iommufd: Fix event queue release use-after-free Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 156/547] landlock: Fix superblock use-after-free in release_inode() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 157/547] lockd: Fix use-after-free in nlmsvc_retry_blocked Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 158/547] media: au0828: fix use-after-free in bulk_timeout timer on disconnect Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 159/547] media: cx23885: Fix use-after-free in cx23885_finidev due to race condition Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 160/547] media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 161/547] media: imon: fix use-after-free in display_close via dev_dbg Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 162/547] media: ipu-bridge: Fix use-after-free in IVSC error path Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 163/547] mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 164/547] mm/hugetlb: fix use-after-free of a new anon folio Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 165/547] apparmor: fix a use-after-free in aa_lookupn_ns() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 166/547] ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 167/547] ata: sata_fsl: Fix use-after-free of host_priv on probe() failure Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 168/547] drm/msm: Fix vm_bo use-after-free in with_vm_locks() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 169/547] s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 170/547] s390/pci: Fix MSI directed-mode teardown IRQ bit count Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 171/547] s390/pci: Fix resource leak in zpci MSI setup Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 172/547] s390/pci: Fix use-after-free race in zpci floating interrupt cleanup Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 173/547] s390/pci: Add error cleanup in zpci_directed_irq_init() Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 174/547] s390/cpum_cf: Check session mask before cpu offline Greg Kroah-Hartman
2026-11-04 21:05 ` [PATCH 7.3 175/547] s390/extable: Fix mvcos instruction decoding Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 176/547] s390/kprobes: Prevent kprobes on instructions with exception table entry Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 177/547] s390/probes: Fix wrong opcode for cgrb fixup Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 178/547] s390/signal: Fix incorrect return address in signal frame Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 179/547] s390/vmcp: Initialize full session info to zero Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 180/547] s390/zcrypt: Fix and improve zcrypt reply message verification checks Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 181/547] s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility() Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 182/547] s390/zcrypt: Guard domain index uses against speculative bypass Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 183/547] HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 184/547] HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 185/547] HID: wacom: Fix Use-After-Free in wacom_intuos_pad Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 186/547] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 187/547] HID: wacom: Redesign shared sibling data lifecycle Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 188/547] HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 189/547] HID: wacom: Write shared touch initial status only once Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 190/547] klist: avoid accesses after waking klist_remove() Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 191/547] objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0 Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 192/547] rust: bindings: fix `VM_MAYSHARE` blocklist entry Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 193/547] rust: bindings: fix VM_MAYSHARE value Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 194/547] rust: bitmap: restrict bitmap length to at most i32::MAX Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 195/547] rust: block: fix `Send` bound for `GenDisk` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 196/547] rust: block: require `Sync` for `Operations::QueueData` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 197/547] rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 198/547] rust: bug: update the SAFETY comment for " Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 199/547] rust: configfs: fix data offset calculation for subsystem callbacks Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 200/547] rust: cpufreq: reject NULL from cpufreq_cpu_get() Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 201/547] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 202/547] rust: module_param: Fix potentially incorrect access of `SetOnce<T>` Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 203/547] rust: rcpufreq_dt: add module alias Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 204/547] accel/amdxdna: clear the mailbox channel pointer when starting it fails Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 205/547] ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 206/547] ALSA: emux: Fix UAF of soundfont zones at note-on Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 207/547] ALSA: pcmtest: handle multiple wraps in random capture fill Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 208/547] ASoC: amd: ps: fix snd_acp63_remove() teardown ordering Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 209/547] Bluetooth: hci_vhci: Pin module for debugfs file operations Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 210/547] drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 211/547] fbdev: atmel_lcdfb: Prevent FIFO work after removal Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 212/547] fbdev: udlfb: dont rebuild the mode list while the framebuffer is in use Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 213/547] filelock: keep superblock active through delegation wait Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 214/547] fs/proc/task_mmu: pin mm_users in do_pagemap_scan() Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 215/547] fsverity: Set S_VERITY only after rollback is no longer possible Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 216/547] genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 217/547] genirq: Move interrupt thread exit_work object to irqaction Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 218/547] HID: hiddev: keep state alive through disconnect unlock Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 219/547] io_uring/io-wq: save worker type before dropping its reference Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 220/547] iomap: dont resubmit an ioend after ->writeback_submit() failed Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 221/547] iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 222/547] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 223/547] KVM: pfncache: use a dedicated invalidation sequence for cache refresh Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 224/547] KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 225/547] media: cx23885: unregister DVB bus when SP2 CI setup fails Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 226/547] media: gspca: use vb2_video_unregister_device() on disconnect Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 227/547] media: imx-jpeg: cancel timeout worker when streaming stops Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 228/547] media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 229/547] media: microchip-csi2dc: fix async notifier leak on probe error path Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 230/547] media: microchip-isc: take a reference on the parsed endpoints Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 231/547] media: redrat3: fix UAF in probe error path leaving rc device registered Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 232/547] media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 233/547] mm/rmap: dont discard lazyfree THPs at PMD level Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 234/547] mm/slab: sample slab_state once in kmem_cache_destroy() Greg Kroah-Hartman
2026-11-04 21:06 ` [PATCH 7.3 235/547] mm/truncate: look up the end-edge straddler by index Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 236/547] mm: khugepaged: fix folio is used after folio_put/unlock() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 237/547] mm: khugepaged: fix folio is used after pte_unmap_unlock() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 238/547] mm: khugepaged: fix swap entry value to folio_pfn() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 239/547] mptcp: hold MP_JOIN msk ref when cloning reqsk Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 240/547] mshv_vtl: detach poll waiter on POLLFREE Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 241/547] mtd: virt-concat: unlink concat node before freeing it Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 242/547] mtd: virt-concat: unlink discarded items before freeing Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 243/547] net: sched: prevent scheduling deactivated qdiscs Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 244/547] scsi: dc395x: sync the waiting_timer before freeing the host Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 245/547] serial: core: shut down initialized port on removal Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 246/547] staging: rtl8723bs: fix protected RX frame validation in decrypt path Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 247/547] xen-blkfront: unbind irq before tearing down ring and shadow requests Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 248/547] wifi: ath9k: delete channel-context timers on deinit Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 249/547] wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 250/547] virtio_net: atomically disable rx mode work Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 251/547] vfio/nvgrace-gpu: Use a core-only open_device in fallback mode Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 252/547] usb: gadget: fix refcount underflow in gadgetfs_bind() error path Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 253/547] ufs: use u64 for directory size in ufs_last_byte Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 254/547] spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 255/547] resource: report a devm_request_resource() conflict under the lock Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 256/547] phy: core: Fix race-condition between _of_phy_get() and try_module_get() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 257/547] power: supply: pf1550: drain IRQ work before unregistering supplies Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 258/547] power: supply: sbs-battery: disable polling before supply teardown Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 259/547] pps: generators: dont use the drivers info after unregister Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 260/547] nvmem: core: Fix OOB read for bit offsets of more than one byte Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 261/547] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 262/547] media: rc: Ensure that rc_unregister_device() does not free input device Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 263/547] media: rc: Ensure registered is cleared in error path Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 264/547] media: rc: fintek-cir: process a full RX buffer instead of overflowing it Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 265/547] media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 266/547] media: rc: Fix race condition during rc_register_device() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 267/547] media: rc: mce_kbd: Fix inconsistent locking of keylock Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 268/547] media: rc: Use after free in ir_raw_event_handle() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 269/547] media: rc: After rc_unregister_device() timers can be re-armed Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 270/547] media: rc: Fix use after free in bpf progs Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 271/547] media: rc: Fix ABBA deadlock by making locks more fine grained Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 272/547] ocfs2/heartbeat: unlink live slots when their node is missing Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 273/547] ocfs2/dlm: hold a lock reference across grant AST enqueue Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 274/547] ocfs2/dlm: hold the lookup reference across convert " Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 275/547] ocfs2: cancel quota sync work before freeing quota info Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 276/547] ocfs2: fix chunk number of the first chunk in a local quota file Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 277/547] ocfs2: pin refcount trees before dropping the lookup lock Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 278/547] ocfs2: snapshot dentry names in file and setattr traces Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 279/547] smb: client: fix OOB last_entry pointer from unbounded LastNameOffset Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 280/547] smb: client: hold server info until cifsd exits Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 281/547] smb: client: stop processing a read response after a receive error Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 282/547] ovl: hold a reference on the parent in readdir Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 283/547] ovl: set OVL_WHITEOUTS before publishing the upper dir Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 284/547] ovl: take a snapshot of the name for copy up Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 285/547] ovl: use the pinned upper dir in ovl_fix_origin() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 286/547] ovl: always encode the origin fh when index is enabled Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 287/547] ovl: check that the parents of volatile/dirty are dirs Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 288/547] ovl: check the casefold flag of directories only Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 289/547] ovl: do not copy up a dentry that was removed Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 290/547] ovl: do not copy up an xattr value that was never read Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 291/547] ovl: fix a torn path in ovl_get_redirect() Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 292/547] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 293/547] ovl: fortify ovl_copy_xattr() against underlying layer modifications Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 294/547] ovl: read the nlink xattr of every indexed non-dir Greg Kroah-Hartman
2026-11-04 21:07 ` [PATCH 7.3 295/547] ovl: reserve space for the casefolded name terminator Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 296/547] ovl: set the revalidate flags after d_instantiate() Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 297/547] ovl: skip copy up of empty security.capability Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 298/547] xfs: clear the symlink zapped flag if inline symlink is ok Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 299/547] xfs: mark cow extents bad if theres no rmap mapping for them Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 300/547] xfs: compute the correct fdblocks/frextents for repair when theyre negative Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 301/547] xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 302/547] xfs: fix xfs_rename_space_res for non-pptr filesystems Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 303/547] xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 304/547] xfs: fix buffer overruns in xfs_ioc_attr_list Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 305/547] xfs: online quotacheck must dirty dquot if enforcement adjustments needed Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 306/547] xfs: avoid cross-rtgroup reaping after a repair Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 307/547] xfs: actually lock the metafile reservation when adjusting after repair Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 308/547] xfs: fix unnecessary dapos truncation in xchk_dir_walk Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 309/547] xfs: fix buffer overflow in corrupt inline attr structure Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 310/547] xfs: actually report corrupt xattrs as XFAIL during cross-referencing Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 311/547] xfs: fix inode btree repair when a cluster is larger than a chunk Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 312/547] xfs: always reset incore attr fork buffer when resetting fork Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 313/547] xfs: dont pass iget failures up when marking ondisk inodes Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 314/547] xfs: zero out di_metatype when removing the metadir file iflag Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 315/547] xfs: flag excessive delalloc rt extents as corruption Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 316/547] xfs: dont fix the directory tree if live update fails Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 317/547] xfs: validate rc_domain in xchk_rtrefcount_mergeable Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 318/547] xfs: dont proceed with xattr repair if the live update fails Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 319/547] xfs: fix skipped inode mask handling in iscan Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 320/547] xfs: dont repair fs summary counters with garbage Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 321/547] xfs: fix lost errno returned from xfarray_foliosort Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 322/547] xfs: allow softlimit with no hardlimit in quota scrub Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 323/547] xfs: assign an owner to scrub_stats_fops Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 324/547] xfs: bail out of directory tree repairs on error Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 325/547] xfs: fix revalidation of xchk_dquot_iter cached mappings Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 326/547] xfs: abort dirtree repair if the live update hook dies Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 327/547] xfs: check fork type against dabtree block magic number Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 328/547] xfs: mark overfull dabtree node blocks as corrupt Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 329/547] xfs: jump out of xchk_bmap_check_rmap if fatal signals Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 330/547] xfs: cross-reference the primary superblock Greg Kroah-Hartman
2026-11-05 15:38 ` Barry K. Nathan
2026-11-04 21:08 ` [PATCH 7.3 331/547] xfs: adjust checks for cross-AG reaping issues Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 332/547] xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 333/547] xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 334/547] netfilter: nft_payload: restrict checksum offsets to known values Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 335/547] rtnetlink: wait for RCU readers in rtnl_link_unregister() Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 336/547] xfs: reduce new btree slack factor if free space is negative Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 337/547] xfs: reject absurdly large xattr value lengths in xchk_xattr_actor Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 338/547] xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 339/547] xfs: reject remote xattr entries with an out-of-range value length Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 340/547] xfs: release ip after unlinked list store failure Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 341/547] xfs: rescan the AGs if incore delalloc counter is negative Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 342/547] xfs: update quota flags on secondary supers when metadir enabled Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 343/547] xfs: abort directory tree repair whenever dl->aborted is set Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 344/547] xfs: always forget cached ACLs if the attr fork swap succeeds Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 345/547] xfs: always report inode repair setup failures Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 346/547] xfs: always report scrub errors in tracepoints Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 347/547] xfs: always zero the whole shortform header when zeroing attr fork Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 348/547] xfs: bound da-node entry count against the correct geometry Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 349/547] xfs: bound inode fork length against the fork size during log recovery Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 350/547] xfs: check for fragments when full-extent sharing matches Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 351/547] xfs: check for termination during rmap btree walk Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 352/547] xfs: clarify various parts of the bitmap API Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 353/547] xfs: clear set[ug]id mode bits when zapping attr fork Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 354/547] xfs: complain loudly when dirtree checker finds broken links Greg Kroah-Hartman
2026-11-04 21:08 ` [PATCH 7.3 355/547] xfs: dont allow sm_agno for non-group metadir path checking Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 356/547] xfs: dont clear COWEXTSIZE on directories on reflink filesystems Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 357/547] xfs: dont overrun incore inode when cleaning attr forks Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 358/547] xfs: dont queue rmap update twice when reaping a fork Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 359/547] xfs: dont rescan ifree and icount when frozen Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 360/547] xfs: dont scan across metadata/regular directory trees for dirents Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 361/547] xfs: dont set a metadata directorys parent to sb_rootino Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 362/547] xfs: dont subtract excess usage twice when computing agf_btreeblks Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 363/547] xfs: dont try to repair rtsummary if the summary file isnt computed Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 364/547] xfs: dont try to scrub self-referential dirent in metapath checker Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 365/547] xfs: fix correction of unwritten extents in quota file data fork Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 366/547] xfs: fix data fork block count check in xrep_inode_blockcounts Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 367/547] xfs: init inode number for tracepoint Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 368/547] xfs: never reset the default quota timer Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 369/547] xfs: only written file data blocks can be shared Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 370/547] xfs: opportunistically skip btree block checks Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 371/547] xfs: propagate errors while checking null siblings Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 372/547] xfs: range-check bc_levels array access in scrub tracepoints Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 373/547] xfs: reattach dquots after changing inode ids Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 374/547] x86/bugs: Adapt SRSO mitigation to Zen6 Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 375/547] smb: server: size directory name conversion buffer correctly Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 376/547] smb: smbdirect: fix buffer length underflow in RDMA transfers Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 377/547] smb: client: bound POSIX lock data area by response length Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 378/547] smb: client: dont resurrect an exiting tcon from cached dir workers Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 379/547] smb: client: fix buffer overflow in SMB2_tcon() Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 380/547] smb: client: fix fiemap wild read on empty truncated response Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 381/547] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2 Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 382/547] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 383/547] smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl() Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 384/547] smb: client: reclaim credits for decrypted reads with no matching mid Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 385/547] smb: client: reject FIND data areas that run past the received response Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 386/547] smb: client: reject short or out-of-range FIND response parameters Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 387/547] smb: client: reject short SESSION_SETUP responses Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 388/547] smb: client: require stable pages for SMB compression Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 389/547] smb: client: validate NT transaction response layout and offsets Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 390/547] smb: client: validate SMB1 EA list bounds before parsing Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 391/547] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 392/547] xfs: map pNFS layouts to the end of the extent again Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 393/547] kernfs: dont lose IN_DELETE_SELF when decoding a file handle Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 394/547] pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 395/547] pnfs/blocklayout: Complete a device upcall only on its own reply Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 396/547] pnfs/blocklayout: Complete a device upcall when the pipe is closed Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 397/547] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 398/547] NFSv4/pnfs: Free the netid when draining a data-server address list Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 399/547] NFSv4: Fix a regression in the handling of CB_RECALL_ANY Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 400/547] NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 401/547] NFSv4/filelayout: Anchor page coalescing on pattern_offset Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 402/547] NFSv4/flexfiles: fail I/O to the data server once a lock is lost Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 403/547] NFSv4/flexfiles: Use the full 64-bit offset for read DS selection Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 404/547] NFSv4/flexfiles: Use the full 64-bit stripe_unit Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 405/547] NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 406/547] NFS: Fix stale negative cache on failed nfs_mkdir() Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 407/547] NFS/localio: detect a short read or write before the iterator has moved Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 408/547] NFS/localio: fix nfs_local_dio_misaligned tracepoint Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 409/547] NFS/localio: report the stability a DIO WRITE actually has Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 410/547] NFSD: cap the number of listeners accepted in listener_set Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 411/547] nfsd: clear XDR padding in GETXATTR replies Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 412/547] NFSD: copy SETXATTR data from all XDR buffer segments Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 413/547] NFSD: Destroy a recalled delegation the client does not hold Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 414/547] NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients Greg Kroah-Hartman
2026-11-04 21:09 ` [PATCH 7.3 415/547] NFSD: Dont complete a cld upcall the daemon has not read Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 416/547] nfsd: dont modify a session slot when replaying its cached reply Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 417/547] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 418/547] NFSD: Fail a pool_threads read whose reply does not fit Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 419/547] nfsd: fetch direct I/O alignment for files handed to the filecache Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 420/547] nfsd: Fix id-to-name cache entry leak in idtoname_parse() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 421/547] NFSD: Fix out-of-bounds read in the rpc_status dump Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 422/547] nfsd: hold cl_lock in client_has_openowners() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 423/547] nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1 Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 424/547] NFSD: map fh_verify() status codes for NFS_ACLv3 replies Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 425/547] NFSD: Map flex file layout IDs through the requests user namespace Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 426/547] nfsd: preflight SEQUENCE replies before accepting a slot Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 427/547] nfsd: propagate SETXATTR value decode errors Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 428/547] NFSD: Reject an oversized principal hash from nfsdcld Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 429/547] NFSD: Resolve the recall-any mask names in the trace format Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 430/547] NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 431/547] NFSD: Set nn->cld_net before registering the cld pipe Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 432/547] NFSD: validate transport name in listener_set before serv creation Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 433/547] nfsd: zero NFSv4 COMPOUND tag padding Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 434/547] SUNRPC: Copy the deferred RPC Call from the head buffer Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 435/547] SUNRPC: Do not credit control-record octets to the RPC stream Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 436/547] SUNRPC: fix oversized GSS proxy token copy Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 437/547] sunrpc: honor the netlink unix_gid NEGATIVE flag Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 438/547] SUNRPC: keep the first error in svc_register() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 439/547] sunrpc: pin gss module across auth_domain RCU free Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 440/547] SUNRPC: Reject a socket that already has an svc_sock attached Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 441/547] SUNRPC: Reject a TLS alert record that is not two octets Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 442/547] SUNRPC: Resume receiving after a TLS control record Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 443/547] SUNRPC: trace an accepted transport before publishing it Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 444/547] sunrpc: treat empty auth.unix.gid replies as negative entries Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 445/547] SUNRPC: Treat every TLS error alert as fatal Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 446/547] rxrpc: Fix update of call->tx_pending without holding lock Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 447/547] rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 448/547] afs: Fix afs to abort the rxrpc call on send error Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 449/547] rxrpc: Fix double IRQ enablement Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 450/547] rxrpc: Fix return in rxrpc_recvmsg_data() for service calls Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 451/547] x86/cpuid: Mark CPUID function 0x23 as being indexed Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 452/547] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 453/547] ALSA: x86: hdmi: fix chmap array missing terminator entry Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 454/547] KVM: Only bind memslot to guest_memfd instance for CREATE operations Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 455/547] KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 456/547] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0 Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 457/547] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 458/547] KVM: Use goto to handle errors during memslot preparation Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 459/547] KVM: VMX: Disallow using to_vmx() in common VT code Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 460/547] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 461/547] KVM: VMX: Make handle_bus_lock_vmexit() a shared helper Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 462/547] KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 463/547] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 464/547] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0 Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 465/547] KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 466/547] KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 467/547] KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 468/547] KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 469/547] KVM: x86: Request event processing for exception VM-Exits Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 470/547] KVM: x86: Take SRCU in kvm_zap_gfn_range() Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 471/547] KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 472/547] KVM: TDX: Check if there is valid exit infos based on vp_enter_ret Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 473/547] KVM: TDX: Enable Notify VM exit Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 474/547] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason Greg Kroah-Hartman
2026-11-04 21:10 ` [PATCH 7.3 475/547] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 476/547] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason() Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 477/547] KVM: TDX: Enable Bus Lock VM exit Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 478/547] KVM: guest_memfd: Split bind() into prepare()+commit() phases Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 479/547] KVM: guest_memfd: take the invalidate lock when unbinding a dying file Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 480/547] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 481/547] KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 482/547] KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 483/547] HID: usbhid: skip interrupt IN polling for devices with no input reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 484/547] HID: zydacron: validate key report length Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 485/547] HID: amd_sfh: Remove unsupported motion-state field from accelerometer report Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 486/547] HID: amd_sfh: Use report type from request node Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 487/547] HID: asus: do not send keyboard init reports to touchpads Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 488/547] HID: core: Fix out-of-bounds left shift by 32 in s32ton() Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 489/547] HID: cougar: reject short special-key reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 490/547] HID: cp2112: validate response report lengths Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 491/547] HID: elo: reject short touchscreen reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 492/547] HID: logitech-dj: validate unnumbered keyboard reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 493/547] HID: mcp2200: validate READ_ALL response length Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 494/547] HID: mcp2221: always initialize and cancel init_work Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 495/547] HID: mcp2221: validate response report length Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 496/547] HID: picoLCD: check for fb_deferred_io_init() error Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 497/547] HID: prodikeys: validate fixed-format MIDI reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 498/547] HID: pxrc: reject short input reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 499/547] HID: quirks: Always poll the Anne Pro 2 with product ID a292 Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 500/547] HID: roccat: isku: reject short button reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 501/547] HID: roccat: koneplus: " Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 502/547] HID: roccat: konepure: " Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 503/547] HID: roccat: kovaplus: " Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 504/547] HID: roccat: pyra: " Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 505/547] HID: roccat: ryos: reject short special reports Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 506/547] HID: roccat: savu: " Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 507/547] HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 508/547] HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out() Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 509/547] HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 510/547] HID: hid-lenovo-go-s: Add suspend function and gate access under bool Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 511/547] HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 512/547] HID: hid-lenovo-go-s: Move attribute init to after device query Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 513/547] HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 514/547] HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 515/547] HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 516/547] HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 517/547] accel/amdxdna: Add support for AIE2 revision 9 Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 518/547] io_uring/kbuf: advance head when a pickup empties the buffer ring Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 519/547] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 520/547] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate() Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 521/547] io_uring/register: enforce per-task restrictions in io_uring_register_blind() Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 522/547] io_uring/net: dont retry a non-blocking connect() that fails with -EAGAIN Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 523/547] io_uring: keep the drain active when a deferred drain request is started Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 524/547] io_uring/io-wq: no new workers once the exit has begun Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 525/547] io_uring/rsrc: charge buffer arrays and nodes to memcg Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 526/547] io_uring: charge tctx nodes and personalities Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 527/547] io_uring: free XArray nodes left by a failed store Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 528/547] io_uring/bpf-ops: clear bpf_ctx while submitting SQEs Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 529/547] io_uring: free the task context after a grace period Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 530/547] io_uring/sqpoll: dont wait for the thread to exit Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 531/547] io_uring: defer foreign io-wq enqueues to task_work Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 532/547] io_uring/timeout: count cancelled timeouts in cq_timeouts Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 533/547] io_uring/net: fix multishot recv length limit accounting Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 534/547] ksmbd: fix SMB2 CREATE response buffer overflow Greg Kroah-Hartman
2026-11-04 21:11 ` [PATCH 7.3 535/547] ksmbd: fix out-of-bounds read when padding the final compound response Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 536/547] ksmbd: use clear_and_wake_up_bit() directly Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 537/547] ksmbd: track delivery of queued TCP writes Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 538/547] ksmbd: retry break notifications on another connection Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 539/547] ksmbd: fix app-instance non-durable supersede session UAF Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 540/547] ksmbd: fix invalid pointer dereference when get_inode_acl() fails Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 541/547] ksmbd: use the existing xattr name for a named stream Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 542/547] ksmbd: fix named stream write and EOF handling Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 543/547] ksmbd: rebind completed CREATE replays without draining the old channel Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 544/547] ksmbd: fix use-after-free after a failed durable reconnect Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 545/547] rust_binder: wake epoll on self-work queued to poll thread Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 546/547] media: rc: Fix build failure with CONFIG_LIRC disabled Greg Kroah-Hartman
2026-11-04 21:12 ` [PATCH 7.3 547/547] ksmbd: keep retry timeout clamp bounds constant Greg Kroah-Hartman
2026-11-05 0:27 ` [PATCH 7.3 000/547] 7.3.2-rc1 review Ronald Warsow
2026-11-05 18:39 ` Sasha Levin
2026-11-05 19:58 ` Ronald Warsow
2026-11-05 3:08 ` SJ Park
2026-11-05 8:10 ` Peter Schneider
2026-11-05 12:17 ` Takeshi Ogasawara
2026-11-05 14:16 ` Ron Economos
2026-11-05 15:30 ` Pavel Machek
2026-11-05 16:16 ` Brett A C Sheffield
2026-11-05 21:56 ` Florian Fainelli
2026-11-05 23:15 ` Shuah Khan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.