summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2025-09-26smb: client: cleanup open_cached_dir()cfid-fixes-v2Enzo Matsumiya1-77/+56
A bit of refactoring, and merge path_no_prefix() into path_to_dentry(). Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: rework cached dirs synchronizationEnzo Matsumiya3-100/+193
This patch adds usage of RCU and seqlocks for cached dir (list and entries). Traversing the list under RCU allows faster lookups (no locks) and also guarantees that entries being read are not gone (i.e. prevents UAF). seqlocks provides atomicity/consistency when reading entries, allowing callers to re-check cfid in case of write-side invalidation. Combined with refcounting, this new approach provides safety for callers and flexibility for future enhancements. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: fix dentry revalidation of cached rootEnzo Matsumiya1-4/+22
Don't check root dir dentry in cifs_dentry_needs_reval() as its inode was created before the cfid, so the time check will fail and trigger an unnecessary revalidation. Also account for dir_cache_timeout in time comparison, because if we have a cached dir, we have a lease for it, and, thus, may assume its children are (still) valid. To confirm that, let the ac*max checks go through for granular results. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: use cached dir on queryfs/smb2_compound_opEnzo Matsumiya5-24/+20
A dentry is passed to cifs_statfs(), so pass down d_is_dir() to smb2_queryfs() so we can cache/reuse this dir. Other: - make smb2_compound_op a static function, as it's not used anywhere else Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: add is_dir argument to query_path_infoEnzo Matsumiya6-14/+27
When we have an inode on upper levels, pass is_dir down to smb2_query_path_info() so we can lookup for a cached dir there. Since we now have a possible recursive lookup in open_cached_dir() e.g.: cifs_readdir open_cached_dir lookup_noperm_positive_unlocked ... cifs_d_revalidate ... smb2_query_path_info find_cached_dir the cfid must be added to the entries list only after dentry lookup, so we don't hang on an infinite recursion while waiting for itself to open. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: remove cached_dirent->fattrEnzo Matsumiya2-7/+8
Replace with ->unique_id and ->dtype -- the only fields used from cifs_fattr. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: wait for concurrent caching of dirents in cifs_readdir()Enzo Matsumiya2-29/+40
The file struct passed down to cifs_readdir() is a stack variable, which means it makes no sense to keep/track it across a cached dir lifetime. Instead, use it to track concurrent accesses to the same cached path, and wait for the previous one to finish filling/emitting. Without this patch, virtually every 'ls' will issue a Find request, even when we have both directory and dirents cached and valid. With this patch, the chances of cache hits increases a lot, so on highly concurrent scenarios, the amount of network calls are drastically reduced. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: actually use cached dirs on readdirEnzo Matsumiya5-36/+51
Currently, even when we have a valid cached dir, cifs_readdir will not make use of it for the Find request, and will reopen a separate handle in query_dir_first. Fix this by setting cifsFile->fid to cfid->fid and resetting search info parameters. Also add cifs_search_info->reset_scan to indicate SMB2_query_directory_init to include the SMB2_RESTART_SCANS flag. With this, we use query_dir_next directly instead of query_dir_first. This patch also keeps the cfid reference all through cifs_readdir(). To prevent bogus/invalid usage of it, check if cfid is still valid after each possible network call (i.e. where possible reconnects may have happened). Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: prevent lease breaks of cached parents when opening childrenEnzo Matsumiya4-68/+88
In SMB2_open_init(), when opening (not creating/deleting) a path, lookup for a cached parent and set ParentLeaseKey in lease context if found. Other: - set oparms->cifs_sb in open_cached_dir() as we need it in add_parent_lease_key(); use CIFS_OPARMS() too Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: simplify cached_fid state checkingEnzo Matsumiya4-53/+52
cached_fid validity (usable by callers) is already based on ->time != 0, having other flags/booleans to check the same thing can be confusing and make things unnecessarily complex. This patch removes cached_fid booleans ->has_lease, ->is_open, ->file_all_info_is_valid. Replace their semantics with already existing, simpler checks: - ->is_open is replaced by checking if persistent_fid != 0 - ->has_lease is currently used as a "is valid" check, but we already validate it based on ->time anyway, so drop it - ->file_all_info becomes a pointer and its presence becomes its validity This patch also concretly defines the "is opening" semantic; it's based on ->time == 0, which is used as "creation time", so the only time it's 0 is between allocation and valid (opened/cached) or invalid, and it also never transitions back to 0 again. (->last_access_time follows the same, but it's already used for expiration checks) Other: - add CFID_INVALID_TIME (value 1); this allows us to differentiate between opening (0), valid (jiffies), or invalid (1) - rename time/last_access_time to ctime/atime to follow other common usage of such fields Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: refactor dropping cached dirsEnzo Matsumiya5-63/+29
- s/drop_cached_dir_by_name/drop_cached_dir/ make it a generic find + invalidate function to replace drop_cached_dir_by_name() and cached_dir_lease_break() We now funnel any cleanup to laundromat, so we can make the release callback free only dirents, path, and cfid itself. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: enhance cached dir lookupsEnzo Matsumiya6-113/+144
Enable cfid lookups to be matched with the 3 modes (path, dentry, and lease key) currently used in a single function. Caller exposed function (find_cached_dir()) checks if cfid is mid-creation in open_cached_dir() and retries the lookup, avoiding opening the same path again. Changes: - expose find_cached_dir() - add CFID_LOOKUP_* modes - remove @lookup_only arg from open_cached_dir(), replace, in calllers, with find_cached_dir() where it was true - remove open_cached_dir_by_dentry(), replace with find_cached_dir() - use find_cached_dir() in cached_dir_lease_break() Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: split find_or_create_cached_dir()Enzo Matsumiya4-55/+53
This patch splits the function into 2 separate ones; it not only makes the code clearer, but also allows further and easier enhancements to both. So move the initialization part into init_cached_dir() and add find_cached_dir() for lookups. Other: - drop_cached_dir_by_name(): * use find_cached_dir() * remove no longer used args Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: merge free_cached_dir in release callbackEnzo Matsumiya1-20/+12
free_cached_dir() is no longer used anywhere else. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: merge {close,invalidate}_all_cached_dirs()Enzo Matsumiya5-96/+35
close_all_cached_dirs(), invalidate_all_cached_dirs() and free_cached_dirs() have become too similar now, merge their functionality in a single static invalidate_all_cfids() function. This also allows removing free_cached_dirs() altogether as it only requires cancelling the work afterwards (done directly in tconInfoFree()). Other changes: - remove struct cached_dir_dentry Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-26smb: client: remove cached_fid->on_listEnzo Matsumiya3-57/+47
That field is currently used to indicate when a cfid should be removed from the entries list. Since we now keep cfids on the list until they're going down, we can remove the field and use the other existing fields for the same effect. Other changes: - cfids->num_entries follows semantics of list_*() ops - add cfid_expired() and cfid_is_valid() helpers - check cfid_is_valid() even on success when leaving open_cached_dir() Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-25smb: client: remove cached_fids->dying listEnzo Matsumiya2-59/+48
Since any cleanup is now done on the local list in laundromat, the dying list can be removed. - entries stays on the main list until they're scheduled for cleanup (->last_access_time == 1) - cached_fids->num_entries is decremented only when cfid transitions from on_list true -> false cached_fid lifecycle on the list becomes: - list_add() on find_or_create_cached_dir() - list_move() to local list on laundromat - list_del() on release callback, if on_list == true (unlikely, see comment in the function) Other changes: - add invalidate_cfid() helper Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-25smb: client: remove cached_dir_put_work/put_workEnzo Matsumiya2-40/+17
Move cfid to dying list directly on cached_dir_lease_break(), and schedule laundromat for cleanup there too. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-25smb: client: remove cached_dir_offload_close/close_workEnzo Matsumiya2-77/+66
Make put_work an 'async dput' and then move cfid to dying list so laundromat can cleanup the rest. Other changes: - add drop_cfid() helper to drop entries counter, dput and close synchronously, when possible Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-08smb: client: remove cfids_invalidation_workerEnzo Matsumiya2-30/+10
We can do the same cleanup on laundromat. On invalidate_all_cached_dirs(), run laundromat worker with 0 timeout and flush it for immediate + sync cleanup. Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
2025-09-07smb: Use arc4 library instead of duplicate arc4 codeEric Biggers7-108/+10
fs/smb/common/cifs_arc4.c has an implementation of ARC4, but a copy of this same code is also present in lib/crypto/arc4.c to serve the other users of this legacy algorithm in the kernel. Remove the duplicate implementation in fs/smb/, which seems to have been added because of a misunderstanding, and just use the lib/crypto/ one. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-09-07smb: client: fix data loss due to broken rename(2)Paulo Alcantara8-72/+267
Rename of open files in SMB2+ has been broken for a very long time, resulting in data loss as the CIFS client would fail the rename(2) call with -ENOENT and then removing the target file. Fix this by implementing ->rename_pending_delete() for SMB2+, which will rename busy files to random filenames (e.g. silly rename) during unlink(2) or rename(2), and then marking them to delete-on-close. Besides, introduce a FIND_RD_NO_PENDING_DELETE flag for cifs_get_readable_path() to be used in smb2_query_path_info() and smb2_query_reparse_point() so we don't end up reusing open handles of files that were already removed. Reported-by: Jean-Baptiste Denis <jbdenis@pasteur.fr> Closes: https://marc.info/?i=16aeb380-30d4-4551-9134-4e7d1dc833c0@pasteur.fr Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Cc: stable@vger.kernel.org Cc: Frank Sorenson <sorenson@redhat.com> Cc: Olga Kornievskaia <okorniev@redhat.com> Cc: Benjamin Coddington <bcodding@redhat.com> Cc: Scott Mayhew <smayhew@redhat.com> Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com>
2025-09-07smb: client: fix compound alignment with encryptionPaulo Alcantara1-3/+25
The encryption layer can't handle the padding iovs, so flatten the compound request into a single buffer with required padding to prevent the server from dropping the connection when finding unaligned compound requests. Fixes: bc925c1216f0 ("smb: client: improve compound padding in encryption") Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com>
2025-09-07Linux 6.17-rc5v6.17-rc5Linus Torvalds1-1/+1
2025-09-07Merge tag 'i2c-for-6.17-rc5' of ↵Linus Torvalds2-15/+9
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - i801: drop superfluous WDT entry for Birch - rtl9300: - fix channel number check in probe - check data length boundaries in xfer - drop broken SMBus quick operation * tag 'i2c-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rtl9300: remove broken SMBus Quick operation support i2c: rtl9300: ensure data length is within supported range i2c: rtl9300: fix channel number bound check i2c: i801: Hide Intel Birch Stream SoC TCO WDT
2025-09-07Merge tag 'edac_urgent_for_v6.17_rc5' of ↵Linus Torvalds1-1/+0
git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Remove a misplaced dma_free_coherent() call in altera_edac * tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Delete an inappropriate dma_free_coherent() call
2025-09-07Merge tag 'timers-urgent-2025-09-07' of ↵Linus Torvalds3-5/+18
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix a severe slowdown regression in the timer vDSO code related to the while() loop in __iter_div_u64_rem(), when the AUX-clock is enabled" * tag 'timers-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: vdso/vsyscall: Avoid slow division loop in auxiliary clock update
2025-09-07Merge tag 'locking-urgent-2025-09-07' of ↵Linus Torvalds2-5/+13
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix an 'allocation from atomic context' regression in the futex vmalloc variant" * tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Move futex_hash_free() back to __mmput()
2025-09-07Merge tag 'perf-urgent-2025-09-07' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Ingo Molnar: "Fix regression where PERF_EVENT_IOC_REFRESH counters miss a PMU-stop" * tag 'perf-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix the POLL_HUP delivery breakage
2025-09-07Merge tag 'riscv-for-linus-6.17-rc5' of ↵Linus Torvalds9-15/+15
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - LTO fix for clang when building with CONFIG_CMODEL_MEDLOW - Fix for ACPI CPPC CSR read/write return values - Several fixes for incorrect access widths in thread_info.cpu reads - Fix an issue in __put_user_nocheck() that was causing the glibc tst-socket-timestamp test to fail - Initialize struct kexec_buf records in several kexec-related functions, which were generating UBSAN warnings - Two fixes for sparse warnings * tag 'riscv-for-linus-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix sparse warning about different address spaces riscv: Fix sparse warning in __get_user_error() riscv: kexec: Initialize kexec_buf struct riscv: use lw when reading int cpu in asm_per_cpu riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG riscv: uaccess: fix __put_user_nocheck for unaligned accesses riscv: use lw when reading int cpu in new_vmalloc_check ACPI: RISC-V: Fix FFH_CPPC_CSR error handling riscv: Only allow LTO with CMODEL_MEDANY
2025-09-06Merge tag 'rust-fixes-6.17-2' of ↵Linus Torvalds3-7/+23
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust fixes from Miguel Ojeda: - Two changes to prepare for the future Rust 1.91.0 release (expected 2025-10-30, currently in nightly): a target specification format change and a renamed, soon-to-be-stabilized 'core' function. * tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: support Rust >= 1.91.0 target spec rust: use the new name Location::file_as_c_str() in Rust >= 1.91.0
2025-09-06Merge tag 'i2c-host-fixes-6.17-rc5' of ↵Wolfram Sang323-2013/+3004
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.17-rc5 - i801: fix device IDs - in rtl9300: - fix channel number check in probe - check data length boundaries in xfer - drop unsupported SMBus quick operation
2025-09-05Merge tag 'perf-tools-fixes-for-v6.17-2025-09-05' of ↵Linus Torvalds5-40/+76
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "Fixes for use-after-free that resulted in segfaults after merging the bpf tree. Also a couple of build and test fixes" * tag 'perf-tools-fixes-for-v6.17-2025-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf symbol-elf: Add support for the block argument for libbfd perf test: Checking BPF metadata collection fails on version string perf tests: Fix "PE file support" test build perf bpf-utils: Harden get_bpf_prog_info_linear perf bpf-utils: Constify bpil_array_desc perf bpf-event: Fix use-after-free in synthesis
2025-09-05riscv: Fix sparse warning about different address spacesAlexandre Ghiti1-2/+2
We did not propagate the __user attribute of the pointers in __get_kernel_nofault() and __put_kernel_nofault(), which results in sparse complaining: >> mm/maccess.c:41:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got unsigned long long [usertype] * @@ mm/maccess.c:41:17: sparse: expected void const [noderef] __user *from mm/maccess.c:41:17: sparse: got unsigned long long [usertype] * So fix this by correctly casting those pointers. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202508161713.RWu30Lv1-lkp@intel.com/ Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Fixes: f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()") Cc: stable@vger.kernel.org Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> Reviewed-by: Cyril Bur <cyrilbur@tenstorrent.com> Link: https://lore.kernel.org/r/20250903-dev-alex-sparse_warnings_v1-v1-2-7e6350beb700@rivosinc.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv: Fix sparse warning in __get_user_error()Alexandre Ghiti1-1/+1
We used to assign 0 to x without an appropriate cast which results in sparse complaining when x is a pointer: >> block/ioctl.c:72:39: sparse: sparse: Using plain integer as NULL pointer So fix this by casting 0 to the correct type of x. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202508062321.gHv4kvuY-lkp@intel.com/ Fixes: f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()") Cc: stable@vger.kernel.org Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> Reviewed-by: Clément Léger <cleger@rivosinc.com> Reviewed-by: Cyril Bur <cyrilbur@tenstorrent.com> Link: https://lore.kernel.org/r/20250903-dev-alex-sparse_warnings_v1-v1-1-7e6350beb700@rivosinc.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv: kexec: Initialize kexec_buf structBreno Leitao3-4/+4
The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data was accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Signed-off-by: Breno Leitao <leitao@debian.org> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250827-kbuf_all-v1-2-1df9882bb01a@debian.org Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv: use lw when reading int cpu in asm_per_cpuRadim Krčmář1-1/+1
REG_L is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: be97d0db5f44 ("riscv: VMAP_STACK overflow detection thread-safe") Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com> Link: https://lore.kernel.org/r/20250725165410.2896641-5-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_idRadim Krčmář1-1/+1
emit_ld is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()") Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com> Reviewed-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/r/20250812090256.757273-4-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REGRadim Krčmář1-1/+1
emit_ld is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: 19c56d4e5be1 ("riscv, bpf: add internal-only MOV instruction to resolve per-CPU addrs") Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Tested-by: Björn Töpel <bjorn@rivosinc.com> # QEMU Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> Link: https://lore.kernel.org/r/20250812090256.757273-3-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv: uaccess: fix __put_user_nocheck for unaligned accessesAurelien Jarno1-1/+1
The type of the value to write should be determined by the size of the destination, not by the value itself, which may be a constant. This aligns the behavior with x86_64, where __typeof__(*(__gu_ptr)) is used to infer the correct type. This fixes an issue in put_cmsg, which was only writing 4 out of 8 bytes to the cmsg_len field, causing the glibc tst-socket-timestamp test to fail. Fixes: ca1a66cdd685 ("riscv: uaccess: do not do misaligned accesses in get/put_user()") Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250724220853.1969954-1-aurelien@aurel32.net Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05riscv: use lw when reading int cpu in new_vmalloc_checkRadim Krčmář1-1/+1
REG_L is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: 503638e0babf ("riscv: Stop emitting preventive sfence.vma for new vmalloc mappings") Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com> Link: https://lore.kernel.org/r/20250725165410.2896641-4-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05Merge tag 'scsi-fixes' of ↵Linus Torvalds2-10/+16
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Obvious driver patch plus update to sr to add back rotational media flag since CDROMS are rotational" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sr: Reinstate rotational media flag scsi: lpfc: Fix buffer free/clear order in deferred receive path
2025-09-05Merge tag 'spi-fix-v6.17-rc3' of ↵Linus Torvalds5-33/+70
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "The largest batch of fixes here is a series of fixes for the Freescale LPSPI driver which James Clark pulled out of their BSP while looking at support for the NXP S32G version of the controller. The majority of this turned out to be bug fixes that affect existing systems with the actual S32G support being just a small quirk that would be unremarkable by itself, the whole series has had a good amount of testing and review and the individual patches are all pretty straightforward by themselves. We also have a few other driver specific fixes, including a relatively large but simple one for the Cadence QuadSPI driver" * tag 'spi-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-qpic-snand: unregister ECC engine on probe error and device remove spi: cadence-quadspi: Implement refcount to handle unbind during busy spi: spi-fsl-lpspi: Add compatible for S32G spi: spi-fsl-lpspi: Parameterize reading num-cs from hardware spi: spi-fsl-lpspi: Treat prescale_max == 0 as no erratum spi: spi-fsl-lpspi: Constify devtype datas dt-bindings: lpspi: Document support for S32G spi: spi-fsl-lpspi: Clear status register after disabling the module spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort spi: spi-fsl-lpspi: Set correct chip-select polarity bit spi: spi-fsl-lpspi: Fix transmissions when using CONT spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback
2025-09-05Merge tag 'arm64-fixes' of ↵Linus Torvalds7-5/+42
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Incorrect __BITS_PER_LONG as 64 when compiling the compat vDSO - Unreachable PLT for ftrace_caller() in a module's .init.text following past reworking of the module VA range selection - Memory leak in the ACPI iort_rmr_alloc_sids() after a failed krealloc_array() * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO
2025-09-05Merge tag 'audit-pr-20250905' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "A single small audit patch to fix a potential out-of-bounds read caused by a negative array index when comparing paths" * tag 'audit-pr-20250905' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix out-of-bounds read in audit_compare_dname_path()
2025-09-05Merge tag '6.17-RC4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds7-19/+96
Pull smb client fixes from Steve French: - Fix two potential NULL pointer references - Two debugging improvements (to help debug recent issues) a new tracepoint, and minor improvement to DebugData - Trivial comment cleanup * tag '6.17-RC4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: prevent NULL pointer dereference in UTF16 conversion smb: client: show negotiated cipher in DebugData smb: client: add new tracepoint to trace lease break notification smb: client: fix spellings in comments smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()
2025-09-05Merge tag 'hwmon-for-v6.17-rc5' of ↵Linus Torvalds2-7/+7
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ina238: Various value range fixes when writing limit attributes - mlxreg-fan: Prevent fans from getting stuck at 0 RPM * tag 'hwmon-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ina238) Correctly clamp power limits hwmon: (ina238) Correctly clamp shunt voltage limit hwmon: (ina238) Correctly clamp temperature hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
2025-09-05Merge tag 'gpio-fixes-for-v6.17-rc5' of ↵Linus Torvalds2-4/+4
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix GPIO submenu regression in Kconfig - fix make clean under tools/gpio/ * tag 'gpio-fixes-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: tools: gpio: remove the include directory on make clean gpio: fix GPIO submenu in Kconfig
2025-09-05Merge tag 'platform-drivers-x86-v6.17-3' of ↵Linus Torvalds9-72/+74
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - acer-wmi: Stop using ACPI bitmap for platform profile choices - amd/hfi: Fix pcct_tbl leak - amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks - asus-wmi: - Fix registration races - Fix ROG button mapping, tablet mode on ASUS ROG Z13 - Support more keys on ExpertBook B9 - hp-wmi: Add support for Fn+P hotkey - intel/pmc: Add Bartlett Lake support - intel/power-domains: Use topology_logical_package_id() for package ID * tag 'platform-drivers-x86-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID platform/x86: acer-wmi: Stop using ACPI bitmap for platform profile choices platform/x86: hp-wmi: Add support for Fn+P hotkey platform/x86/intel/pmc: Add Bartlett Lake support to intel_pmc_core platform/x86: asus-wmi: Fix racy registrations platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list platform/x86: asus-wmi: map more keys on ExpertBook B9 platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk platform/x86/amd: hfi: Fix pcct_tbl leak in amd_hfi_metadata_parser()
2025-09-05Merge tag 'block-6.17-20250905' of git://git.kernel.dk/linuxLinus Torvalds3-8/+17
Pull block fixes from Jens Axboe: - NVMe pull request via Keith - Fix protection information ref tag for device side gen/strip (Christoph) - MD pull request via Yu - fix data loss for writemostly in raid1 (Yu Kuai) - fix potentional data loss by skipping recovery (Li Nan) * tag 'block-6.17-20250905' of git://git.kernel.dk/linux: md: prevent incorrect update of resync/recovery offset md/raid1: fix data lost for writemostly rdev nvme: fix PI insert on write
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-25 13:08:14 +0000