sync update - #54
Merged
Merged
Conversation
The bus matching rework made of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. parser_init() stored that NULL bus, and the range iterator later dereferenced it. Reject such nodes in parser_init(), leaving an explicit empty iterator for callers that ignore the init return, and make of_dma_get_max_cpu_address() honour the init failure so a rejected node cannot clamp the DMA limit. Fixes: 64ee3cf ("of/address: Rework bus matching to avoid warnings") Cc: stable@vger.kernel.org Signed-off-by: Carlo Caione <ccaione@baylibre.com> Link: https://patch.msgid.link/20260727-of-range-parser-null-bus-v3-1-be01b708a4ce@baylibre.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
…ux/kernel/git/kvms390/linux into HEAD KVM: s390: Fixes for 7.2 - several fixes for PCI passthru in s390 kvm - fix a 7.2-rc regression in the adapter interrupt mapping code
…kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.2, take #3 - Fix a tiny buglet when propagating the deactivation of an interrupt from a nested guest, which happened to trigger a gold plated CPU bug on a particular implementation - Fix a race between LPI unmapping and mapping, resulting in leaked LPIs - Make LPI mapping more robust on memory allocation failure - Fix the handling of the EL2 tracing clock being disabled - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing code - Add missing sysreg tracepoint for the EL2 code - Tidy-up the mutual exclusion of guest-memfd and MTE - Update Fuad's email address to point to @linux.dev
VMCLEAR/VMREAD/VMWRITE/VMPTRLD access the internal VMCS cache, which is not visible to the compiler; without a memory clobber, the compiler can reorder them in troublesome ways because "asm volatile" and "asm goto" only protect against removal of the asm. For example, placing a VMWRITE before the corresponding VMCS pointer is loaded can lead to corruption. While none of this has been observed, it is better to prevent than cure. Likewise, INVEPT and INVVPID access the TLB and, even though in their case the effect is only visible to the next VMLAUNCH/VMRESUME, it is technically correct to add the clobber there too. So avoid any urge to special case them, and simply hardcode "memory" into the clobber list of vmx_asm1() and vmx_asm2(). __vmcs_readl() open-codes its own asm, so add the clobber there as well. Link: https://lore.kernel.org/kvm/CABgObfbL3t21yVeSwiLSjjOUER+rTYDPHYAH9YU4TWGRjx6XHg@mail.gmail.com/ Cc: Sean Christopherson <seanjc@google.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cancel (and flush) the I/O APIC's delayed EOI handling work during the "pre VM destroy" phase, before vCPUs are destroyed, as processing the EOI broadcast will inject another IRQ if the line is asserted, i.e. will try to deliver an IRQ to the target vCPU(s). Canceling the work after vCPUs are destroyed leads to UAF if the delayed work is processed after vCPUs are destroyed. BUG: KASAN: slab-use-after-free in __kvm_irq_delivery_to_apic_fast+0x9bf/0xa20 arch/x86/kvm/lapic.c:1250 Read of size 8 at addr ffff8880499abea0 by task kworker/1:2/1218 CPU: 1 UID: 0 PID: 1218 Comm: kworker/1:2 Not tainted 7.1.0-rc7 #5 PREEMPT(lazy) Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events kvm_ioapic_eoi_inject_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 print_report+0x139/0x4ad mm/kasan/report.c:482 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595 __kvm_irq_delivery_to_apic_fast+0x9bf/0xa20 arch/x86/kvm/lapic.c:1250 __kvm_irq_delivery_to_apic+0xd8/0xbf0 arch/x86/kvm/lapic.c:1345 kvm_irq_delivery_to_apic arch/x86/kvm/lapic.h:129 ioapic_service+0x308/0x590 arch/x86/kvm/ioapic.c:492 kvm_ioapic_eoi_inject_work+0x13c/0x190 arch/x86/kvm/ioapic.c:532 process_one_work+0xa59/0x19a0 kernel/workqueue.c:3314 process_scheduled_works kernel/workqueue.c:3397 worker_thread+0x5eb/0xe50 kernel/workqueue.c:3478 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Note, the VM is unreachable once kvm_destroy_vm() starts, and scheduling new work via kvm_ioapic_send_eoi() can only be done via KVM_RUN, i.e. requires a live vCPU. Alternatively, KVM could simply destroy the I/O APIC during the "pre" phase of VM destruction, but that gets more than a bit sketchy as KVM expects the I/O APIC to exist if ioapic_in_kernel() is true, and nested virtualization in particular has a bad habit of touching VM-scope state during vCPU destruction. E.g. attempting to free the PIC during the pre phase would lead to a NULL pointer dereference in kvm_cpu_has_extint(), and it's not hard to imagine the I/O APIC having a similar flaw. Fixes: 17bcd71 ("KVM: x86: Free vCPUs before freeing VM state") Reported-by: <zdi-disclosures@trendmicro.com> Reported-by: Zhong Wang <wangzhong.c0ss4ck@bytedance.com> Reported-by: Xuanqing Shi <shixuanqing.11@bytedance.com> Cc: stable@vger.kernel.org Signed-off-by: Weiming Shi <bestswngs@gmail.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260727171718.543491-1-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
pmbus_update_byte_data() is supposed to return a negative error code or 0. However, if no change is made to the register, it actually returns the register value. This can result in problems if the calling code explicitly expects to see an error code or 0. Fix it to return 0 on success or the error code as expected. Fixes: 11c1199 ("hwmon: (pmbus) add helpers for byte write and read modify write") Signed-off-by: Guenter Roeck <linux@roeck-us.net>
kvm_gfn_is_write_tracked() checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can therefore be write-tracked in one address space and appear untracked through the other. Check the supplied slot first, then the slot for the other address space. This ensures all callers honor write tracking regardless of the active address space. In particular, it prevents mmu_try_to_unsync_pages() from marking an upper-level shadow page unsync and eventually triggering the BUG in pte_list_remove(). Fixes: 699023e ("KVM: x86: add SMM to the MMU role, support SMRAM address space") Assisted-by: Codex:GPT-5 Signed-off-by: Jinu Kim <kimjw04271234@gmail.com> Message-ID: <20260721103512.2136240-2-kimjw04271234@gmail.com> [invert direction of the conditional. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
mmu_try_to_unsync_pages() skips the shadow-page lookup when the supplied memslot allows a hugepage, because a shadow page would disallow hugepages. But hugepage metadata is per-address-space while shadow pages are shared across all address spaces. With SMM, the other address space can therefore have a shadow page even when the supplied memslot allows a hugepage. Check the corresponding memslot in the other address space before taking the fast path. Skip the shadow-page lookup only when all address spaces allow a hugepage. Fixes: b3ae3ce ("KVM: x86/mmu: KVM: x86/mmu: Skip unsync when large pages are allowed") Assisted-by: Codex:GPT-5 Signed-off-by: Jinu Kim <kimjw04271234@gmail.com> [invert direction of the conditional. - Paolo] Message-ID: <20260721103512.2136240-3-kimjw04271234@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it only if that peer is still found in the caller's group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream's sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream. Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped. The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained. Fixes: f57f3df ("ALSA: pcm: More fine-grained PCM link locking") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Link: https://patch.msgid.link/A0705100-D10B-4286-9980-0142ABEEAD51@doyensec.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add USB mixer mapping quirk for later revisions of the Corsair Virtuoso headset with USB IDs 0x1b1c:0x0a43 (wired) and 0x1b1c:0x0a44 (wireless). These devices exhibit the same mixer label collision as earlier Virtuoso variants: all controls are labelled "Headset", causing applications like PulseAudio to move the sidetone control instead of the main playback volume. Signed-off-by: Robert Abrahamse <denobyte2@gmail.com> Link: https://patch.msgid.link/20260728140314.11601-1-denobyte2@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
…ncing commit 610fa91 ("PCI: imx6: Assert PERST# before enabling regulators") introduced a boot hang on i.MX6Q/DL variants by reordering imx_pcie_host_init() to call imx6q_pcie_enable_ref_clk() (which powered up the PHY) before imx6q_pcie_core_reset() (which powered it back down). Before 610fa91, the sequence was: 1. imx_pcie_assert_core_reset() - power down PHY (set TEST_PD), set REF_CLK_EN 2. imx_pcie_clk_enable() - power up PHY (clear TEST_PD), set REF_CLK_EN 3. Link training starts with PHY powered up (TEST_PD cleared) 4. Link training succeeds After 610fa91, the sequence became: 1. imx_pcie_clk_enable() - power up PHY (clear TEST_PD), set REF_CLK_EN 2. imx_pcie_assert_core_reset() - power down PHY (set TEST_PD), set REF_CLK_EN 3. imx_pcie_deassert_core_reset() - does nothing 4. Link training starts with PHY powered down (TEST_PD set) 5. Link training fails and boot hangs when PHY register accesses hang To fix this: - Remove TEST_PD PHY power control from imx6q_pcie_enable_ref_clk() - Remove REF_CLK_EN control from imx6q_pcie_core_reset() - Add TEST_PD PHY power control to imx6qp_pcie_core_reset(), which previously relied on imx6q_pcie_enable_ref_clk() to power up the PHY by clearing TEST_PD - Clear TEST_PD to power on PHY in imx_pcie_deassert_core_reset() These changes together ensure the correct sequence: 1. REF_CLK_EN set in clk_enable() (TEST_PD untouched) 2. TEST_PD set in assert_core_reset() (PHY power off) 3. TEST_PD cleared in deassert_core_reset() (PHY power on) 4. Link training starts with proper PHY state The i.MX6Q/DL PCIe PHY requires approximately 120us between TEST_PD de-assertion and link training start. Add usleep_range(200, 500) in imx6q_pcie_core_reset() after clearing TEST_PD to satisfy this requirement. Add explicit imx_pcie_assert_core_reset() calls in error paths and host_exit() to ensure no power leak. Fixes: 610fa91 ("PCI: imx6: Assert PERST# before enabling regulators") Reported-by: Leonardo Costa <leoreis.costa@gmail.com> Closes: https://lore.kernel.org/lkml/20260629143439.361560-1-leoreis.costa@gmail.com/ Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Leonardo Costa <leonardo.costa@toradex.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260728035159.2702021-1-hongxing.zhu@oss.nxp.com
…TURE qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits the descriptors, which makes the controller execute the command immediately. For SPINAND_SET_FEATURE the value to be written is only placed into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a second submission - so the chip is programmed with whatever that register happened to hold from a previous operation, and the intended value is only applied by the *next* SET_FEATURE. Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing 0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the subsequent write of 0x00 leaves it at 0x40 - every write lands one operation late. This stayed unnoticed until v6.18 added SPI-NAND OTP support together with OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode, reads, and disables it again, and mtd_otp_nvmem_add() does this during MTD registration. With the off-by-one, the "disable" write actually applies the previously requested value, so CFG_OTP_ENABLE ends up set: the chip stays in OTP mode, every subsequent array read returns the OTP area instead of the array (UBI reports an empty device) and all writes fail with -EIO because the OTP area is write protected. On this board that makes the whole flash unusable and the device unbootable. Write the feature value into NAND_FLASH_FEATURES as part of the same transaction, before NAND_EXEC_CMD. While at it, copy only the bytes the operation actually carries - the previous code dereferenced a 4-byte pointer on a one-byte buffer (spinand->scratchbuf). With this patch the flash contents read back bit-identical to a known-good dump of the same board taken under the vendor firmware (md5-verified across partitions), and writes work. Fixes: 7304d19 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Pal <kuncy7@gmail.com> Reviewed-by: Md Sadre Alam <md.alam@oss.qualcomm.com> Link: https://patch.msgid.link/20260727163216.109938-1-kuncy7@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding its inner loop only by the per-chunk num_vectors. The array is sized separately: idpf_intr_reg_init() allocates kzalloc_objs(struct idpf_vec_regs, total_vecs) from caps.num_allocated_vectors and only checks the returned count after the fill. The sum of per-chunk num_vectors is never reconciled against total_vecs, so a reply with a small num_allocated_vectors but chunks summing higher writes past the end of reg_vals[]. Impact: a control plane (a PF or hypervisor device model) that returns a VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds num_allocated_vectors writes struct idpf_vec_regs entries past the end of the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write). Bound the fill loop to the array capacity passed in by the callers, mirroring the sibling idpf_vport_get_q_reg(). The existing num_regs < num_vecs check then rejects an undersized reply without the out-of-bounds write happening first. Fixes: d4d5587 ("idpf: initialize interrupts and enable vport") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Set the TxQ ring count minimum to 128 descriptors. Any lower than this, and the queue will stall and trigger Tx timeouts in flow based scheduling mode. This is because next_to_clean might never be updated. In flow based scheduling mode, next_to_clean is only updated after a descriptor completion is processed, i.e. after the RE bit is set in the last descriptor of a Tx packet. This will never happen with a ring size of 64 and an IDPF_TX_SPLITQ_RE_MIN_GAP of 64. No matter what the value of last_re is initialized/set to, the calculated gap will be at most 63 and never trigger the RE bit. Even a ring size of 96 does not solve this. Because of how infrequent next_to_clean is updated and how small the ring is, IDPF_DESC_UNUSED will be much smaller on average. This increases the chance the queue will be stopped because a multi-descriptor packet, e.g. a large LSO packet, does not see enough resources on the ring. In this case, the queue will trigger the stop logic. The queue permanently stalls because there is no chance for a descriptor completion to update next_to_clean since it is dependent on a packet being sent. Fixes: 5f417d5 ("idpf: replace flow scheduling buffer ring with buffer pool") Signed-off-by: Joshua Hay <joshua.a.hay@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
idpf_mb_intr_req_irq() allocates the mailbox IRQ name before calling request_irq(). On success, the name is released later through kfree(free_irq()), but request_irq() failure returns without freeing it. Free the allocated name on the request_irq() failure path. Fixes: 4930fbf ("idpf: add core init and interrupt request") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
ice_resume() schedules an asynchronous PF reset and returns
immediately. The reset runs later in ice_service_task(). If
userspace tries to bring up the net device before the reset
finishes, ice_open() fails with -EBUSY:
ice_resume()
ice_schedule_reset() # sets ICE_PFR_REQ, returns
...
ice_open()
ice_is_reset_in_progress() # ICE_PFR_REQ still set, -EBUSY
...
ice_service_task()
ice_do_reset()
ice_rebuild() # clears ICE_PFR_REQ, too late
Reproduced on E800 series NICs during suspend/resume with irdma
enabled, where the aux device probe widens the race window.
ice 0000:81:00.0: can't open net device while reset is in progress
Add a best-effort wait (10s timeout, matching ice_devlink_info_get())
for the reset to complete before returning from ice_resume(). In
practice the reset completes in ~300ms.
Fixes: 769c500 ("ice: Add advanced power mgmt for WoL")
Cc: stable@vger.kernel.org
Reviewed-by: Kohei Enju <kohei@enjuk.jp>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Tested-by: Alexander Nowlin <alexander.nowlin@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
When a virtual function sends an IRQ map command, the PF will set up interrupts according to that request. However, because these interrupts are never reset, the next time Virtual Function initializes, the interrupts are still enabled for a given VF, which leads to performance degradation in certain cases due to interrupts being unexpectedly enabled and thus causing interrupt floods. Cc: stable@vger.kernel.org Fixes: 1071a83 ("ice: Implement virtchnl commands for AVF support") Suggested-by: Vladimir Medvedkin <vladimir.medvedkin@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Patryk Holda <patryk.holda@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
ice_lbtest_prepare_rings() frees Rx rings only when ice_vsi_start_all_rx_rings() fails. If ice_vsi_setup_rx_rings() fails after allocating some descriptors, or if ice_vsi_cfg_lan() fails after the Rx rings were prepared, the function reaches the Tx cleanup path without releasing the initialized Rx resources. Fix this by adding separate unwind paths for Rx setup failure and LAN configuration failure. The Rx setup failure path releases the partially prepared Rx rings before freeing Tx rings, while later failures first undo the LAN Tx configuration and then release the Rx rings in reverse setup order. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have an Intel E800 Series adapter available to run the ethtool offline loopback selftest, no runtime testing was able to be performed. Fixes: 0e674ae ("ice: Add handler for ethtool selftest") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
During reset recovery, the admin queue returns EBUSY which is expected behavior. However, the DPLL subsystem was logging these as errors and incrementing the error counter, potentially leading to unnecessary warnings and even disabling the DPLL periodic worker if the threshold was reached. Suppress error logging and error counter increments when the admin queue returns EBUSY, as this is expected during reset recovery and not a real failure condition. test case: - ethtool --reset eth3 irq-shared dma-shared filter-shared offload-shared mac-shared phy-shared ram-shared - observe if dmesg EBUSY errors are gone Fixes: d7999f5 ("ice: implement dpll interface to control cgu") Signed-off-by: Przemyslaw Korba <przemyslaw.korba@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED. igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e0672. Fixes: fc9df2a ("igc: Enable RX via AF_XDP zero-copy") Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented before each frag mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping (the head) would leak. This bug was introduced by a 2010 fix for an endless loop in dma_error. All other affected drivers have already been fixed. Fixes: c1fa347 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-4-7-opus Signed-off-by: Matt Vollrath <tactii@gmail.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
In the e1000_probe() path, e1000_sw_init() allocates adapter->tx_ring and adapter->rx_ring. If the subsequent CE4100-specific MDIO BAR mapping fails, the error handling jumps past the ring cleanup code, leaking both allocations. Fix this leak by moving the err_mdio_ioremap label above the ring deallocation logic. This guarantees the proper release of these resources and prevents the memory leak. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have a CE4100 reference platform to test with, no runtime testing was able to be performed. Fixes: 5377a41 ("e1000: Add support for the CE4100 reference platform") Cc: stable@vger.kernel.org Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF. Fix clearing of iso_data in iso_sock_disconn() Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync(). Fixes: fbdc4bc ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync") Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The lookup returned a command that was still linked on the shared pending list, without keeping mgmt_pending_lock held for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The reverse race is also possible when cancel_pair_device() gets a command from pending_find() and a callback removes it before the cancel path dereferences it. This can lead to a use-after-free and a second list_del(). Make the pairing lookup helpers transfer ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock. The callbacks and cancel path then complete the command and free it directly, so racing paths cannot find or free the same command again. Take a temporary hci_conn reference in cancel_pair_device() because the command completion drops the reference stored in the pending command. Fixes: e9a416b ("Bluetooth: Add mgmt_pair_device command") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Assisted-by: Codex:gpt-5.4 Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn> Reviewed-by: Ren Wei <enjou1224z@gmail.com> Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name. Fixes: 6fe26f6 ("Bluetooth: MGMT: Protect mgmt_pending list with its own lock") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Assisted-by: Codex:gpt-5.4 Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
before checking that the L2CAP SDU contains a transaction header. A
connected HIDP peer can send an empty basic-mode SDU and make both paths
use an uninitialized byte from skb tailroom.
KMSAN reports the use in hidp_session_run(), with the uninitialized value
originating in __alloc_skb() through vhci_write(). The control path
produces two reports and the interrupt path produces one.
The byte can also be controlled by a malformed lower-layer packet. If an
HCI ACL packet contains an L2CAP PDU with a declared zero-length payload
followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to
the declared PDU length before dispatch. The current HIDP path nevertheless
consumes the extra byte as HIDP_TRANS_HID_CONTROL |
HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this
change, the same packet is discarded and a subsequent feature report
request succeeds.
Pull the transaction header with skb_pull_data() and discard frames that
do not contain it.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Sangho Lee <kudo3228@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload. Fixes: 0ff1731 ("HID: bt: Add support for hidraw HIDIOCGFEATURE and HIDIOCSFEATURE") Cc: stable@vger.kernel.org Signed-off-by: Sangho Lee <kudo3228@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free. The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected. Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers. Fixes: f1496de ("Bluetooth: Add initial code for LE L2CAP Connect Request") Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer. Commit 23882b8 ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports: BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870 Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS). Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
hci_find_adv_instance() returns an adv_info pointer that is valid only
while hdev->lock is held. The advertising command-sync paths perform
instance lookups without that lock and, in some cases, retain the pointer
while waiting for a controller response.
An advertising termination event can therefore interleave as follows:
hci_cmd_sync_work hci_rx_work
hci_find_adv_instance()
__hci_cmd_sync_status()
wait for controller reply hci_dev_lock()
hci_remove_adv_instance()
kfree(adv)
adv->scan_rsp_changed = false
KASAN reported:
BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300
Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
hci_set_ext_scan_rsp_data_sync+0x2e1/0x300
hci_schedule_adv_instance_sync+0x390/0x4c0
hci_cmd_sync_work+0x173/0x300
Allocated by task 87:
hci_add_adv_instance+0x538/0xac0
add_advertising+0x885/0x1160
Freed by task 89:
kfree+0x131/0x3c0
hci_remove_adv_instance+0x1d8/0x3b0
hci_le_ext_adv_term_evt+0x17b/0x730
Protect the instance lookup and payload construction in the extended
advertising, scan response, and periodic advertising data paths. Snapshot
the advertising parameters under hdev->lock, but release the lock before
waiting for the controller.
Clear advertising-data dirty bits before issuing their commands and
restore them after a failure using a fresh lookup. Likewise, update the
reported transmit power through a fresh lookup after the parameter command
completes. No adv_info pointer then survives an HCI command wait.
Fixes: cba6b75 ("Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2")
Cc: stable@vger.kernel.org
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
dasd_release_space() checks the implementation of the is_ese() discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND operator will lead to a NULL pointer dereference as the function is called even if the function pointer is NULL. Fix this by using the logical OR operator. Fixes: 91dc4a1 ("s390/dasd: Add new ioctl to release space") Cc: stable@vger.kernel.org # v5.3+ Reported-by: Vasily Gorbik <gor@linux.ibm.com> Acked-by: Eduard Shishkin <edward6@linux.ibm.com> Reviewed-by: Stefan Haberland <sth@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Link: https://patch.msgid.link/20260727142840.567286-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
fmt_buffer_size in dasd_eckd_check_device_format() is declared as
int, even though one of the multiplicands, sizeof(struct eckd_count),
is a size_t. The expression
trkcount * rpt_max * sizeof(struct eckd_count)
is therefore correctly evaluated at 64-bit width, but the result is
silently truncated when it is stored back into the 32-bit
fmt_buffer_size variable. For a sufficiently large track range
(start_unit/stop_unit are caller-controlled) this truncation
yields a buffer size far smaller than the number of tracks actually
requested. kzalloc() then succeeds with an undersized allocation,
while the subsequent channel program build still operates on the
untruncated track count and writes past the end of that buffer.
Compute the buffer size with check_mul_overflow() and keep it in a
size_t, so that a value that no longer fits results in -EINVAL
instead of a silently truncated allocation size.
Fixes: 8fd5752 ("s390/dasd: Add new ioctl BIODASDCHECKFMT")
Cc: stable@vger.kernel.org #4.7
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20260727142840.567286-4-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
…rg/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "12 hotfixes. 6 are cc:stable. 9 are for MM. There's a two-patch series from Nico which fixes a couple of PMD level mTHP accounting bugs and a two-patch series from Chris Gellermann which addresses mishandling of getline() in selftests. All the remainder are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-07-30-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: selftests/mm: fix potential wild pointer access of getline due to missing init selftests/clone3: fix wild pointer access of getline due to missing init mm/page_reporting: use system_freezable_wq to fix UAF during suspend mm: vmscan: abort proactive reclaim early when freezing for suspend MAINTAINERS: update Nico Pache's email address arm64, mailmap: update email address for Peter Collingbourne MAINTAINERS: update address for Burak Emir mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios riscv/mm: use physical alignment for vmemmap_start_pfn mm/migrate: exclude hugetlb folios from MTHP_STAT_NR_ANON accounting mm: decrement MTHP_STAT_NR_ANON in free_zone_device_folio() mm: memcg: initialize *locked in memcg1_oom_prepare() stub
…ux/kernel/git/uml/linux Pull UML fix from Richard Weinberger: - Fix use-after-free in UML's vector networking driver * tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: vector: fix use-after-free in vector_mmsg_rx()
…l/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of sound fixes for the 7.2-rc6 cycle. Again, it became
far larger than wished; I'll throttle from now on.
There are no major changes, just a normal flow of small fixes. The
majority of them are device-specific quirks and ASoC SDCA/codec
updates, but it includes a few ALSA core fixes as well.
ALSA Core:
- Fix for ALSA sequencer timer division-by-zero
- Fix potential race in ALSA timer core
- Wake up linked drain waiters on PCM stream unlink
- Fix double-free of converter objects on UMP rawmidi error path
USB-audio:
- Fix a few potential out-of-bounds access bugs
- Prevent stack info leak in RME Digiface status
- Fix UAF during UMP endpoint destruction
- Fix UAF at error handling during probe in Line6 6fire driver
- Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4,
JKY Technology, and generic USB headphones
HD-audio:
- Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP
Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and
HP Pavilion All-in-One
ASoC:
- Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers
- DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI
Crosshair A16, and ASUS ExpertBook
- ACPI match table entry for SOF RT5682 on Intel Nova Lake
- Device-specific mixer / clock, irq fixes for TI TAS2562, TI
TAS2781, Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC
and Realtek RT5640"
* tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
ASoC: rt722: reset codec to fix abnormal sound
ASoC: dt-bindings: realtek,rt5640: Make interrupts optional
ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
ALSA: usb-audio: Add GET_SAMPLE_RATE quirk for C-Media CM6206
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
ALSA: pcm: wake linked drain waiters on unlink
ASoC: amd: acp: Add DMI quirk for Lenovo Legion 7 15ASH11
ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
ASoC: SDCA: Move kcontrol search out of IRQ
ASoC: SDCA: Switch to fixup_controls callback for IRQ registration
ASoC: Add a component fixup_controls callback
ASoC: SDCA: Populate IRQ data earlier
ASoC: SDCA: Remove devm from primary IRQ cleanup
ASoC: SDCA: Add sdca_irq_cleanup_late()
ASoC: SDCA: Rename sdca_irq_allocate() to include devm
ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
ALSA:hda/realtek:ALC269 fixup for Legion 7 15ASH11 Mic Mute LED
...
…kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
"Most of the patches are fixes for pre-existing issues reported by
Sashiko. I suspect we'll see a lot of those for a while.
- adt7470:
- Fix PWM auto temp state array and bounds check
- Fix divide-by-zero TOCTOU crash in fan speed read
- Use cached PWM frequency value
- Fix swapped PWM3 and PWM4 auto mode masks
- Fix temperature alarm logic in hwmon_temp_read()
- Fix busy-loop and I2C flooding in update thread
- Fix cache updated before hardware write on I2C error
- Fix fans stuck in manual mode on I2C errors
- ina2xx: Fix various overflow issues
- ltc4282: Fix reading the minimum alarm voltage
- lm63: Mask PWM frequency multiplier to supported bits
- lm90: Only report alarms if driver is ready
- nct6775-core:
- Prevent access to unsupported weight registers
- Fix number of temperature registers for NCT6116
- npcm750-pwm-fan: stop fan timer on device detach
- nzxt-smart2: DMA-align output buffer
- pmbus:
- Fix return value from pmbus_update_byte_data()
- Notify on the hwmon device, not the i2c client
- sht3x: Fix unaligned accesses"
* tag 'hwmon-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
hwmon: (adt7470) Use cached PWM frequency value
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
hwmon: (nct6775-core) Prevent access to unsupported weight registers
hwmon: (lm63) Mask PWM frequency multiplier to supported bits
hwmon: (nzxt-smart2) DMA-align output buffer
hwmon: (lm90) Only report alarms if driver is ready
hwmon: (sht3x) Fix unaligned accesses
hwmon: (ltc4282) Fix reading the minimum alarm voltage
hwmon: (ina2xx) Fix various overflow issues
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
…rnel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Remove Karthikeyan Mitran from Mobiveil MAINTAINERS PCIe entry since email bounces (Manivannan Sadhasivam) - Preserve i.MX6Q, i.MX6QP, and i.MX6SX Root Port MSI/MSI-X Capabilities when using iMSI-RX to work around hardware defect (Soeren Moch) - Reorder i.MX6Q/DL PHY power up to fix boot hang regression (Richard Zhu) * tag 'pci-v7.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: imx6: Fix i.MX6Q/DL boot hang caused by improper PHY power sequencing PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug MAINTAINERS: Drop Karthikeyan Mitran from Mobiveil PCIe entry
…rnel/git/broonie/spi Pull spi fixes from Mark Brown: "The drip of driver specific fixes, mostly from the device vendors themselves, keeps on coming in. There's more than I'd like right now but equally nothing hugely alarming" * tag 'spi-fix-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-nxp-fspi: propagate clock reconfig failures in nxp_fspi_select_mem() spi: spi-nxp-fspi: enter stop mode before reconfiguring MCR0 and DLL spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs spi: spi-qpic-snand: write the feature value before executing SET_FEATURE spi: spi-cadence: Move TX FIFO full busy-wait into FIFO spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure spi: spacemit: prepare both DMA descriptors before submitting
mshv_portid_free() uses synchronize_rcu() followed by kfree() to reclaim port table entries. This blocks the caller until a full RCU grace period elapses, which is unnecessary since the same module already uses the non-blocking kfree_rcu() pattern in mshv_port_table_fini(). Replace with kfree_rcu() to avoid the blocking wait and keep the reclamation strategy consistent across the file. Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(), which does take the lock before calling mshv_irqfd_deactivate(). Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons the node pointers rather than resetting them. Since mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshv_irqfd_deactivate() again on the same irqfd, the guard fails to prevent a double hlist_del() on poisoned pointers. Fix both issues: - Add the missing spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(). - Use hlist_del_init() instead of hlist_del() so the node is properly marked as unhashed after removal, making the is_active guard reliable. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
In mshv_irqfd_assign(), the level-triggered validation for resample irqfds checks irqfd_lapic_irq.lapic_control.level_triggered before mshv_irqfd_update() has populated the field. Since the irqfd struct is zero-allocated, level_triggered is always 0 at that point, causing the check to always reject resample irqfds with -EINVAL. This makes level-triggered interrupt resampling — used to avoid interrupt storms with assigned devices — completely non-functional. Move the check after the mshv_irqfd_update() call, which resolves the IRQ routing entry and populates irqfd_lapic_irq with the actual trigger mode. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
In mshv_partition_ioctl_create_vp(), when kzalloc for the VP struct fails, the code jumps to the cleanup path without setting ret. At that point ret is 0 from the preceding successful mshv_vp_stats_map() call, so the function returns success to userspace despite having failed to create the VP. No fd is installed and no VP is registered in pt_vp_array, but userspace has no way to know the operation failed. Set ret to -ENOMEM before jumping to the cleanup path. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations, mutex_init, init_waitqueue_head, page mappings) and then publishes the pointer into partition->pt_vp_array. Several ISR paths read this array locklessly: the intercept ISR, the two scheduler ISRs, and mshv_try_assert_irq_fast() on the irqfd fast path. Of these, only mshv_try_assert_irq_fast() can structurally race the publish. It runs from an eventfd waker without holding pt_mutex, and MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to refer to an existing VP at registration time. A user can therefore register an irqfd targeting a yet-to-be-created VP, then trigger mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the same index. On weakly-ordered architectures the reader can observe a non-NULL pointer in pt_vp_array before the initialising stores to the VP struct become visible, leading to use of partially-initialised fields (e.g. vp_register_page). The other ISR readers cannot reach this race: the hypervisor will not generate intercept or scheduler messages for a VP that has never been told to run, and the user can only call MSHV_RUN_VP on the VP fd returned by MSHV_CREATE_VP, which by construction is returned after the publish. Leave those readers as plain loads. Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish the pointer, and pair it with smp_load_acquire() in mshv_try_assert_irq_fast(). On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers, acceptable on this fast path. The destroy-side path (destroy_partition() clearing pt_vp_array[i] to NULL after kfree(vp)) has a separate ordering and lifetime concern that is out of scope here. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
VMBus sends CHANNELMSG_INITIATE_CONTACT through a Hyper-V message connection ID. Older protocol versions use VMBUS_MESSAGE_CONNECTION_ID, while protocol version 5.0 and newer normally use VMBUS_MESSAGE_CONNECTION_ID_4. For a VTL2 kernel using VMBus protocol 5.0 or newer, the host may expect INITIATE_CONTACT on either the redirect connection ID or VMBUS_MESSAGE_CONNECTION_ID_4. There is no capability indication that identifies which ID is active, so the driver must determine it at runtime. During VMBus negotiation, the redirect ID is tried first because it is used by VTL2 configurations with VMBus redirection enabled. If the redirect ID is unavailable, the host rejects it synchronously with HV_STATUS_INVALID_CONNECTION_ID, allowing fallback to the standard ID. Return a distinct error for an invalid Initiate Contact connection ID so this fallback does not mask other post-message failures or protocol-version rejections. Preserve the existing connection ID selection for older protocol versions or when running below VTL2. Signed-off-by: Hardik Garg <hargar@linux.microsoft.com> Reviewed-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
mshv_partition_ioctl_create_vp() called anon_inode_getfd() before publishing the new VP into partition->pt_vp_array. anon_inode_getfd() includes fd_install(), so the fd was live in current->files before the publish ran. A concurrent MSHV_RUN_VP ioctl on that fd does not serialise against the in-progress MSHV_CREATE_VP — it takes vp->vp_mutex, not the partition mutex. Once the VP starts running and traps, mshv_intercept_isr() can look up partition->pt_vp_array[vp_index] and observe NULL, silently dropping the intercept message. Split the fd creation: reserve an fd with get_unused_fd_flags(), create the file with anon_inode_getfile(), publish the VP via smp_store_release(), and finally call fd_install() as the userspace-visibility commit point. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >= nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset. Signed-off-by: Yi Xie <xieyi@kylinos.cn> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
…x/kernel/git/trace/linux-trace Pull RTLA fix from Steven Rostedt: - Fix timerlat top actions triggering on signal Fix a bug in RTLA's timerlat top actions feature where on-threshold actions are triggered on any signal, regardless of whether a latency spike had actually occurred during the measurement. The return retval was checked for non-zero to do actions. But if a signal came in, it returns a negative and actions were being incorrectly triggered when they should not have been. * tag 'trace-tools-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/timerlat_top: Fix on-threshold actions firing on signal
…scm/linux/kernel/git/hyperv/linux Pull hyper-v fixes from Wei Liu: - Multiple fixes for the MSHV driver (Stanislav Kinsburskii, Wei Liu, Yi Xie, Yousef Alhouseen) - Multiple fixes for the VMBus driver (Hardik Garg, Michael Kelley, Sebastian Andrzej Siewior) * tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv_vtl: bounds-check cpu index in vtl mmap fault handler mshv: Publish VP to pt_vp_array before installing the file descriptor Drivers: hv: vmbus: add VTL2 redirect connection ID mshv: Order pt_vp_array publish against irqfd assertion path mshv: Fix missing error code on VP allocation failure mshv: Fix level-triggered check on uninitialized data mshv: Fix race in mshv_irqfd_deassign mshv: Use kfree_rcu in mshv_portid_free mshv: Fix sleeping under spinlock in mshv_portid_alloc mshv: Fix duplicate GSI detection for GSI 0 Drivers: hv: vmbus: Remove vmbus_irq_initialized Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() mshv_vtl: clear hypercall output before copyout Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices mshv: fix hv_input_get_system_property struct
…linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix NULL bus dereference in of_pci_range_parser_one() - Prevent out-of-bounds access when too many dynamic reserved memory regions are defined * tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/address: Fix NULL bus dereference in of_pci_range_parser_one() of: reserved_mem: prevent OOB when too many dynamic regions are defined
…m/kernel Pull drm fixes from Dave Airlie: "Weekly pulls request. As expected there is more AMD this week since Alex was off last week, vmwgfx looks to have been hit with the AI stick a bit and mediatek as well. Otherwise some minor fixes across the board, the new normal definitely seems to be a thing. dp: - Restrict some DP bandwidth calculations to HDMI DFP bridge: - Fix small leak in bridge/display-connector mediatek: - Check CRTC state before freeing - mtk_hdmi: Fix DDC adapter double put in v2 - mtk_hdmi_common: take i2c adapter module reference - mtk_dsi: Enable HS clock only at pre-enable - ovl_adaptor: balance component registrations amdgpu: - VCN 5.3 fix - UserQ fixes - GEM close optimization - HDMI AV mute fix - UML build fixes - GFXOFF residency metrics fixes - SMU 15 fixes - debug_vm fix - PSP 15 fixes - NBIO 7.11.5 fix - pptable use after free fix - gpu metrics fetch fix - DC viewport fix - DML2.1 fix - i2c retimer spam fix - UMD profile pstate fix - Power metrics format cleanup - GTT size fix on APUs - DC context logging fix - PM sysfs fix for APUs - Follow on pageflip timeout fix amdkfd: - Various bounds checking fixes - Mutex locking fix i915/xe: - Check no-DMA huge-pte cases before DMA segment test - sink FRL rate fix - 200ms fix for TMDS scrambler status vmwgfx: - Improve various size checks and limit checks - Fix oops when submitting invalid execbuf ioctl - Correctly lock in vmfwgx fence signaling path - More validation of execbuf ioctl - Fix oops in vmwgfx vkms init failure path - Overflow handling in shader path panthor: - Improve firmware validation imagination: - Improve imagination trace points. qaic: - Fix QAIC transaction length check" * tag 'drm-fixes-2026-08-01' of https://gitlab.freedesktop.org/drm/kernel: (59 commits) drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status drm/amd/display: Exit idle optimizations before programming drm/amd/pm: hide pp_table sysfs on APUs accel/qaic: use sizeof(*trans_hdr) for transaction length check drm/panthor: validate firmware interface structure sizes drm/xe/pt: check no-DMA huge-pte cases before DMA segment test drm/imagination: Update the trace point pvr_job_submit_fw() drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder drm/mediatek: ovl_adaptor: balance component registrations drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs drm/amd/display: use proper context for logging drm/amdgpu: cap GTT size to physical RAM on APUs drm/amd/pm: use milliwatts for GPU power sensors drm/amdgpu: restore UMD profile pstate after runtime resume drm/amd/display: Silence link_dpms I2C retimer failures drm/amdkfd: hold event_mutex while checkpointing CRIU events drm/amd/display: check if dml21_add_phantom_plane() is successful drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport drm/amd/display: Add AV mute wait frames to dce110_set_avmute ...
…ux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix for a bug in how length caps are handled in multishot, and along with it, a generic fix for avoiding these kinds of conversion issues in the future. - Ensure that task restrictions are always preserved across exec. - Revert of the io_uring controlled epoll restriction, which disallowed nested contexts. Turns out that libuv is already using it like that, so we cannot simply remove it, sadly. - Fix for a reference leak in the zcrx code. * tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: preserve task restrictions across exec io_uring/zcrx: don't clear master_ctx from the import path Revert "io_uring/epoll: disallow adding an epoll file to an epoll context" io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT io_uring/net: initialize mshot_len for send
…kernel/git/axboe/linux Pull block fixes from Jens Axboe: - A set of fixes for s390/dasd, via Stefan - Fix for a missing stop of the timeout timer, if a disk has never been added - Clear kernel owned fields on ublk setup by default * tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: s390/dasd: Fix undersized format-check buffer s390/dasd: Fix potential NULL pointer dereference s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly block: stop the timeout timer when releasing a never added disk ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
…rror path In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages() fails), execution jumps to fail_free_reader. While __free(kfree) automatically frees the outer cpu_buffer structure at scope exit, kfree(cpu_buffer) does not recursively free nested heap pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak. Fix this by explicitly freeing cpu_buffer->subbuf_ids in the fail_free_reader error unwinding path when cpu_buffer->remote is set. Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2 Fixes: 2e67fab ("ring-buffer: Introduce ring-buffer remotes") Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
…git/libata/linux Pull ata fixes from Damien Le Moal: - Fix PCI resource initialization in the sata_mv driver to keep legacy Marvell boards functional (Rosen) - Fix ahci_ceva driver initialization error path (Radhey) - Fix libata header file to remove a kernel doc compilation warning (Randy) - Increase the timeout for the STANDBY IMMEDIATE command to avoid suspend failures with drives that are slow to respond to this command (Matt) - Fixes for the handling of timed out commands in the presence of deferred non-NCQ commands, to avoid excessive delays in executing the error handler (me) - Disable link power management for a couple of WD drives that have been identified as not functioning properly when power management is used (Niklas) - Fix the device iteration loop when checking for link power management support to correctly handle port multiplier setups (Niklas) * tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-sata: fix ata_scsi_lpm_supported() iteration ata: libata-core: Disable LPM on WD Green 2.5 480GB ata: libata-core: Disable LPM on some WD drives scsi: libsas: terminate deferred commands on time out ata: libata-scsi: schedule deferred atapi command ata: libata-scsi: terminate deferred commands on time out ata: libata-eh: Increase STANDBY IMMEDIATE timeout ata: libata: avoid kernel-doc warnings ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() ata: sata_mv: accept 1 or 2 resources in platform probe
Pull smb server fixes from Steve French: - Use memcmp() when comparing fixed-size binary ClientGUIDs, so embedded NUL bytes are handled correctly - Reject repeated SMB2 NEGOTIATE requests after dialect selection This prevents preauth_info leaks, enforces the SMB2 protocol requirements, and serializes negotiation state updates. - Fix a use-after-free in __close_file_table_ids() by removing the volatile file ID from the owning IDR before dropping the IDR reference * tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: use memcmp() to compare ClientGUIDs ksmbd: reject repeated SMB2 NEGOTIATE requests ksmbd: fix use-after-free in __close_file_table_ids()
…rnel/git/linkinjeon/ntfs Pull ntfs fixes from Namjae Jeon: - Keep RECALL_ON_OPEN in inode flags when reloading them from $FILE_NAME - Check runlist reallocation sizes for negative values and overflow - Drop stale page cache after shrinking non-resident attributes to prevent writeback failures and data loss * tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: drop stale page-cache when shrinking a non-resident attr ntfs: harden runlist realloc size calculations ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
…el/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Reset dropped_count in mmio_reset_data() When mmio_reset_data() is called, it does not reset the dropped_count so that subsequent runs will have incorrect reporting. - Add NULL check for mmio_trace_array in logging functions The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may have the 'tr' variable passed to it as NULL. But they both dereference it without checking if it is NULL first. - Check return value of __register_event() in trace_module_add_events() If __register_event() fails, the __add_event_to_tracers() call after it will create a file for it. If the module fails to load and its memory is freed, the file will still point to it and it will not be removed as the registering of the event did not complete. Only call __add_event_to_tracers() if the __register_event() was successful. - Fix false positive match in regex_match_full() The regex full matching uses a strncmp() to test against the match string and the value. It should not match if value is a prefix of the string to match. Check to make sure the length of the strings match before comparing. - Fix reader page read offset for remote buffers A page swapped in by __rb_get_reader_page_from_remote() retains its stale read offset, causing subsequent reads to skip events or read past valid data. - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. * tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path ring-buffer: Fix reader page read offset for remote buffers tracing/filters: Fix false positive match in regex_match_full() tracing: Check return value of __register_event() in trace_module_add_events() tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
…kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Fix regression with MO= when building out of tree kernel modules due to incorrectly overwriting build tree's Makefile - Avoid stripping .BTF sections from modules when building debug .rpm packages * tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: rpm-pkg: Preserve BTF sections in kernel modules during debuginfo stripping kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos
…ernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "A set of fixes across several host controller drivers. The largest part addresses three issues in the i.MX driver, while the remaining changes fix probe ordering, power management, timeout recovery and error handling. amd-mp2: - unregister callback if adapter registration fails designware: - defer probe until child GPIO controllers are bound imx: - mark adapter suspended while hardware is powered down - fix stale slave pointer and shared IRQ registration race - stop slave timer before clearing slave pointer iproc: - reset controller if START_BUSY remains set after timeout jz4780: - cache clock rate to avoid clk_get_rate() deadlock qcom-cci: - rely on runtime PM helpers for system sleep spacemit: - request interrupt after clock initialization" * tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers i2c: imx: Cancel hrtimer before clearing slave pointer i2c: imx: Fix slave registration race and error handling i2c: iproc: reset bus after timeout if START_BUSY is stuck i2c: imx: mark I2C adapter when hardware is powered down i2c: designware: defer probe if child GpioInt controllers are not bound i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: amd-mp2: Unregister callback on adapter add failure i2c: spacemit: request IRQ after controller initialization
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.