Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
a933fd1
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
PlaidCat Jul 16, 2025
2b1936b
net: atm: fix use after free in lec_send()
PlaidCat Jul 16, 2025
86b58d3
ext4: fix off-by-one error in do_split
PlaidCat Jul 16, 2025
904b6b6
ext4: ignore xattrs past end
PlaidCat Jul 16, 2025
950581e
s390: Add z17 elf platform
PlaidCat Jul 16, 2025
35a1215
cifs: potential buffer overflow in handling symlinks
PlaidCat Jul 16, 2025
41fade3
media: uvcvideo: Fix double free in error path
PlaidCat Jul 16, 2025
c8d29a5
media: uvcvideo: Refactor iterators
PlaidCat Jul 16, 2025
85bf676
media: uvcvideo: Only save async fh if success
PlaidCat Jul 16, 2025
29275ed
media: uvcvideo: Remove redundant NULL assignment
PlaidCat Jul 16, 2025
c31ce29
media: uvcvideo: Remove dangling pointers
PlaidCat Jul 16, 2025
26c7f37
media: uvcvideo: Annotate lock requirements for uvc_ctrl_set
PlaidCat Jul 16, 2025
5b1f634
media: uvcvideo: Flush the control cache when we get an event
PlaidCat Jul 16, 2025
c3812e2
media: uvcvideo: Propagate buf->error to userspace
PlaidCat Jul 16, 2025
9d0366a
media: uvcvideo: Invert default value for nodrop module param
PlaidCat Jul 16, 2025
17aaaea
media: uvcvideo: Allow changing noparam on the fly
PlaidCat Jul 16, 2025
a6bb0e9
media: uvcvideo: Announce the user our deprecation intentions
PlaidCat Jul 16, 2025
b74437f
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
PlaidCat Jul 16, 2025
a4c9f0d
locking: Introduce __cleanup() based infrastructure
PlaidCat Jul 16, 2025
448ca59
cleanup: Make no_free_ptr() __must_check
PlaidCat Jul 16, 2025
0919361
cleanup: Add conditional guard support
PlaidCat Jul 16, 2025
cbb3cca
cleanup: Standardize the header guard define's name
PlaidCat Jul 16, 2025
193367f
file: add take_fd() cleanup helper
PlaidCat Jul 16, 2025
1fe6d6a
cleanup: Add usage and style documentation
PlaidCat Jul 16, 2025
7799d1e
cleanup: Remove address space of returned pointer
PlaidCat Jul 16, 2025
fce5532
cleanup: Adjust scoped_guard() macros to avoid potential warning
PlaidCat Jul 16, 2025
ba0f209
cleanup: Add conditional guard helper
PlaidCat Jul 16, 2025
fe41269
Revert "drivers: core: synchronize really_probe() and dev_uevent()"
PlaidCat Jul 16, 2025
fa444de
driver core: introduce device_set_driver() helper
PlaidCat Jul 16, 2025
8aed90a
driver core: fix potential NULL pointer dereference in dev_uevent()
PlaidCat Jul 16, 2025
809952d
mm/slab: make __free(kfree) accept error pointers
PlaidCat Jul 16, 2025
f2ebb8e
s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
PlaidCat Jul 16, 2025
e252413
Rebuild rocky8_10 with kernel-4.18.0-553.62.1.el8_10
PlaidCat Jul 16, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Documentation/core-api/cleanup.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
.. SPDX-License-Identifier: GPL-2.0
===========================
Scope-based Cleanup Helpers
===========================

.. kernel-doc:: include/linux/cleanup.h
:doc: scope-based cleanup helpers
19 changes: 19 additions & 0 deletions Documentation/core-api/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,25 @@ Core utilities
:maxdepth: 1

kernel-api
workqueue
watch_queue
printk-basics
printk-formats
printk-index
symbol-namespaces
asm-annotations

Data structures and low-level utilities
=======================================

Library functionality that is used throughout the kernel.

.. toctree::
:maxdepth: 1

kobject
kref
cleanup
assoc_array
atomic_ops
cachetlb
Expand Down
28 changes: 28 additions & 0 deletions Documentation/sysctl/fs.txt
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ before actually making adjustments.
Currently, these files are in /proc/sys/fs:
- aio-max-nr
- aio-nr
- dentry-fs-klimit
- dentry-state
- dquot-max
- dquot-nr
Expand Down Expand Up @@ -54,6 +55,33 @@ of any kernel data structures.

==============================================================

dentry-fs-klimit:

The number of positive dentries for a filesystem is limited by the
total number of files in that filesystem. However, there is no limit
on negative dentries which can grow to an exceedingly large number.

This integer value specifies a soft limit on the maximum number of
dentries (in thousands) that are allowed in any one of the mounted
filesystems. It has a default value of 0 which means no limit. A value
of 10, for example, means that the limit will be 10,000.

If the limit is exceeded, the system will attempt to reclaim currently
unused dentries from the LRU lists of the filesystem to reduce its total
number. Enabling this limit does impose a performance cost, especially
when the limit is low. So it should only be enabled if excessive number
of negative dentries is becoming a problem in a particular workload
environment.

With dentry-fs-klimit properly set, dentries reclaim should only be
invoked infrequently if at all. If this happens frequently, it is
either the value is set too low for the current workload or there are
misbehaving applications generating too many negative dentries. The
dentry-state sysctl file described below can be used to view the current
mix of positive and negative dentries in the system.

==============================================================

dentry-state:

From linux/include/linux/dcache.h:
Expand Down
2 changes: 1 addition & 1 deletion Makefile.rhelver
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ RHEL_MINOR = 10
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 553.60.1
RHEL_RELEASE = 553.62.1

#
# ZSTREAM
Expand Down
4 changes: 4 additions & 0 deletions arch/s390/kernel/setup.c
Original file line number Diff line number Diff line change
Expand Up @@ -928,6 +928,10 @@ static int __init setup_hwcaps(void)
case 0x3932:
strcpy(elf_platform, "z16");
break;
case 0x9175:
case 0x9176:
strcpy(elf_platform, "z17");
break;
}

/*
Expand Down
2 changes: 1 addition & 1 deletion arch/x86/kernel/cpu/microcode/amd.c
Original file line number Diff line number Diff line change
Expand Up @@ -835,7 +835,7 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz
return ret;
}

for_each_node(nid) {
for_each_node_with_cpus(nid) {
cpu = cpumask_first(cpumask_of_node(nid));
c = &cpu_data(cpu);

Expand Down
107 changes: 107 additions & 0 deletions ciq/ciq_backports/kernel-4.18.0-553.62.1.el8_10/04d3e546.failed
Original file line number Diff line number Diff line change
@@ -0,0 +1,107 @@
driver core: introduce device_set_driver() helper

jira LE-3587
Rebuild_History Non-Buildable kernel-4.18.0-553.62.1.el8_10
commit-author Dmitry Torokhov <[email protected]>
commit 04d3e5461c1f5cf8eec964ab64948ebed826e95e
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.62.1.el8_10/04d3e546.failed

In preparation to closing a race when reading driver pointer in
dev_uevent() code, instead of setting device->driver pointer directly
introduce device_set_driver() helper.

Signed-off-by: Dmitry Torokhov <[email protected]>
Reviewed-by: Masami Hiramatsu (Google) <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit 04d3e5461c1f5cf8eec964ab64948ebed826e95e)
Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
# drivers/base/base.h
# drivers/base/dd.c
diff --cc drivers/base/base.h
index f1ca94ed4ea3,eb203cf8370b..000000000000
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@@ -161,19 -176,23 +161,33 @@@ static inline void dev_sync_state(struc
dev->driver->sync_state(dev);
}

-int driver_add_groups(const struct device_driver *drv, const struct attribute_group **groups);
-void driver_remove_groups(const struct device_driver *drv, const struct attribute_group **groups);
+extern int driver_add_groups(struct device_driver *drv,
+ const struct attribute_group **groups);
+extern void driver_remove_groups(struct device_driver *drv,
+ const struct attribute_group **groups);
void device_driver_detach(struct device *dev);

++<<<<<<< HEAD
+extern int devres_release_all(struct device *dev);
+extern void device_block_probing(void);
+extern void device_unblock_probing(void);
++=======
+ static inline void device_set_driver(struct device *dev, const struct device_driver *drv)
+ {
+ // FIXME - this cast should not be needed "soon"
+ dev->driver = (struct device_driver *)drv;
+ }
+
+ int devres_release_all(struct device *dev);
+ void device_block_probing(void);
+ void device_unblock_probing(void);
+ void deferred_probe_extend_timeout(void);
+ void driver_deferred_probe_trigger(void);
++>>>>>>> 04d3e5461c1f (driver core: introduce device_set_driver() helper)
const char *device_get_devnode(const struct device *dev, umode_t *mode,
kuid_t *uid, kgid_t *gid, const char **tmp);
+extern void deferred_probe_extend_timeout(void);
+extern void driver_deferred_probe_trigger(void);

/* /sys/devices directory */
extern struct kset *devices_kset;
diff --cc drivers/base/dd.c
index 9c5db2007422,b526e0e0f52d..000000000000
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@@ -648,12 -620,16 +648,16 @@@ static int really_probe(struct device *
if (link_ret == -EPROBE_DEFER)
return link_ret;

- dev_dbg(dev, "bus: '%s': %s: probing driver %s with device\n",
- drv->bus->name, __func__, drv->name);
- if (!list_empty(&dev->devres_head)) {
- dev_crit(dev, "Resources present before probing\n");
- ret = -EBUSY;
- goto done;
- }
+ pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+ drv->bus->name, __func__, drv->name, dev_name(dev));
+ WARN_ON(!list_empty(&dev->devres_head));

re_probe:
++<<<<<<< HEAD
+ dev->driver = drv;
++=======
+ device_set_driver(dev, drv);
++>>>>>>> 04d3e5461c1f (driver core: introduce device_set_driver() helper)

/* If using pinctrl, bind pins now before probing */
ret = pinctrl_bind_pins(dev);
* Unmerged path drivers/base/base.h
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 85168dc6be18..2e041155b2da 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -3603,7 +3603,7 @@ int device_add(struct device *dev)
device_pm_remove(dev);
dpm_sysfs_remove(dev);
DPMError:
- dev->driver = NULL;
+ device_set_driver(dev, NULL);
bus_remove_device(dev);
BusError:
device_remove_attrs(dev);
* Unmerged path drivers/base/dd.c
156 changes: 156 additions & 0 deletions ciq/ciq_backports/kernel-4.18.0-553.62.1.el8_10/18daa524.failed
Original file line number Diff line number Diff line change
@@ -0,0 +1,156 @@
driver core: fix potential NULL pointer dereference in dev_uevent()

jira LE-3587
Rebuild_History Non-Buildable kernel-4.18.0-553.62.1.el8_10
commit-author Dmitry Torokhov <[email protected]>
commit 18daa52418e7e4629ed1703b64777294209d2622
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.62.1.el8_10/18daa524.failed

If userspace reads "uevent" device attribute at the same time as another
threads unbinds the device from its driver, change to dev->driver from a
valid pointer to NULL may result in crash. Fix this by using READ_ONCE()
when fetching the pointer, and take bus' drivers klist lock to make sure
driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the driver pointer to ensure there is no
tearing.

Signed-off-by: Dmitry Torokhov <[email protected]>
Reviewed-by: Masami Hiramatsu (Google) <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit 18daa52418e7e4629ed1703b64777294209d2622)
Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
# drivers/base/base.h
# drivers/base/core.c
diff --cc drivers/base/base.h
index f1ca94ed4ea3,123031a757d9..000000000000
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@@ -60,6 -73,9 +60,12 @@@ static inline void subsys_put(struct su
kset_put(&sp->subsys);
}

++<<<<<<< HEAD
++=======
+ struct subsys_private *bus_to_subsys(const struct bus_type *bus);
+ struct subsys_private *class_to_subsys(const struct class *class);
+
++>>>>>>> 18daa52418e7 (driver core: fix potential NULL pointer dereference in dev_uevent())
struct driver_private {
struct kobject kobj;
struct klist klist_devices;
@@@ -161,19 -177,33 +167,43 @@@ static inline void dev_sync_state(struc
dev->driver->sync_state(dev);
}

-int driver_add_groups(const struct device_driver *drv, const struct attribute_group **groups);
-void driver_remove_groups(const struct device_driver *drv, const struct attribute_group **groups);
+extern int driver_add_groups(struct device_driver *drv,
+ const struct attribute_group **groups);
+extern void driver_remove_groups(struct device_driver *drv,
+ const struct attribute_group **groups);
void device_driver_detach(struct device *dev);

++<<<<<<< HEAD
+extern int devres_release_all(struct device *dev);
+extern void device_block_probing(void);
+extern void device_unblock_probing(void);
++=======
+ static inline void device_set_driver(struct device *dev, const struct device_driver *drv)
+ {
+ /*
+ * Majority (all?) read accesses to dev->driver happens either
+ * while holding device lock or in bus/driver code that is only
+ * invoked when the device is bound to a driver and there is no
+ * concern of the pointer being changed while it is being read.
+ * However when reading device's uevent file we read driver pointer
+ * without taking device lock (so we do not block there for
+ * arbitrary amount of time). We use WRITE_ONCE() here to prevent
+ * tearing so that READ_ONCE() can safely be used in uevent code.
+ */
+ // FIXME - this cast should not be needed "soon"
+ WRITE_ONCE(dev->driver, (struct device_driver *)drv);
+ }
+
+ int devres_release_all(struct device *dev);
+ void device_block_probing(void);
+ void device_unblock_probing(void);
+ void deferred_probe_extend_timeout(void);
+ void driver_deferred_probe_trigger(void);
++>>>>>>> 18daa52418e7 (driver core: fix potential NULL pointer dereference in dev_uevent())
const char *device_get_devnode(const struct device *dev, umode_t *mode,
kuid_t *uid, kgid_t *gid, const char **tmp);
+extern void deferred_probe_extend_timeout(void);
+extern void driver_deferred_probe_trigger(void);

/* /sys/devices directory */
extern struct kset *devices_kset;
diff --cc drivers/base/core.c
index 85168dc6be18,cbc0099d8ef2..000000000000
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@@ -2469,10 -2624,38 +2469,43 @@@ static const char *dev_uevent_name(stru
return NULL;
}

++<<<<<<< HEAD
+static int dev_uevent(struct kset *kset, struct kobject *kobj,
+ struct kobj_uevent_env *env)
++=======
+ /*
+ * Try filling "DRIVER=<name>" uevent variable for a device. Because this
+ * function may race with binding and unbinding the device from a driver,
+ * we need to be careful. Binding is generally safe, at worst we miss the
+ * fact that the device is already bound to a driver (but the driver
+ * information that is delivered through uevents is best-effort, it may
+ * become obsolete as soon as it is generated anyways). Unbinding is more
+ * risky as driver pointer is transitioning to NULL, so READ_ONCE() should
+ * be used to make sure we are dealing with the same pointer, and to
+ * ensure that driver structure is not going to disappear from under us
+ * we take bus' drivers klist lock. The assumption that only registered
+ * driver can be bound to a device, and to unregister a driver bus code
+ * will take the same lock.
+ */
+ static void dev_driver_uevent(const struct device *dev, struct kobj_uevent_env *env)
+ {
+ struct subsys_private *sp = bus_to_subsys(dev->bus);
+
+ if (sp) {
+ scoped_guard(spinlock, &sp->klist_drivers.k_lock) {
+ struct device_driver *drv = READ_ONCE(dev->driver);
+ if (drv)
+ add_uevent_var(env, "DRIVER=%s", drv->name);
+ }
+
+ subsys_put(sp);
+ }
+ }
+
+ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env)
++>>>>>>> 18daa52418e7 (driver core: fix potential NULL pointer dereference in dev_uevent())
{
- const struct device *dev = kobj_to_dev(kobj);
+ struct device *dev = kobj_to_dev(kobj);
int retval = 0;

/* add device node properties if present */
* Unmerged path drivers/base/base.h
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index cca569e4d734..443c008fdfca 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -56,7 +56,7 @@ static int __must_check bus_rescan_devices_helper(struct device *dev,
* NULL. A call to subsys_put() must be done when finished with the pointer in
* order for it to be properly freed.
*/
-static struct subsys_private *bus_to_subsys(const struct bus_type *bus)
+struct subsys_private *bus_to_subsys(const struct bus_type *bus)
{
struct subsys_private *sp = NULL;
struct kobject *kobj;
* Unmerged path drivers/base/core.c
Loading