summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-08-11KVM: s390: Fix length check __import_wp_info()Christian Borntraeger1-1/+1
struct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user space. This is then assigned to wp_info->len, which is an int. The bounds check is done on the truncated value while the allocation uses the untruncated one: wp_info->len = bp_data->len; [...] if (wp_info->len < 0 || wp_info->len > MAX_WP_SIZE) return -EINVAL; wp_info->old_data = kmalloc(bp_data->len, GFP_KERNEL_ACCOUNT); Use the validated value for the allocation as intended. Without this fix userspace can trigger >4GB allocations which will fail and result in a WARN due to MAX_PAGE_ORDER. Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-9-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Free guest debug data on vcpu destroyChristian Borntraeger1-0/+1
kvm_s390_clear_bp_data() is only called from kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are still armed - the normal case when the VMM just exits or crashes - leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM frees the vCPU right after kvm_arch_vcpu_destroy(). That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but it is unbounded over VM lifetimes. The allocations are GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and pins dying memcgs. Fix by clearing the debug data on vCPU destruction. Calling it unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU that never enabled debugging the counters are 0 and the pointers NULL. Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-8-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Take srcu when importing watchpoint dataChristian Borntraeger1-2/+4
__import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed. As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import. Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-7-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Fix old_data leak in guest debug error pathChristian Borntraeger1-1/+5
__import_wp_info() allocates a per-watchpoint old_data buffer to back up the original guest memory contents. If a later watchpoint of the same KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data() jumps to the error label, which frees the wp_info array but not the old_data buffers of the entries that were imported successfully. Up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed request, and the request can be repeated. Create error handling for cleaning up all created old_data memory areas. Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-6-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Fix memory leak in guest debug handlingChristian Borntraeger1-0/+1
bp_data is freed only for the error case by kfree(bp_data). Every successful KVM_SET_GUEST_DEBUG will leak bp_data. Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-5-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Zero initialize irq in reinject_machine_checkChristian Borntraeger1-1/+1
kvm_s390_reinject_machine_check() fills cr14, mcic, ext_damage_code and failing_storage_address of the on-stack struct kvm_s390_irq, but struct kvm_s390_mchk_info also has a pad word and a 16 byte fixed_logout array. struct mcck_volatile_info carries no logout data, so there is nothing to copy there and both stay whatever was on the stack. __inject_mchk() then memcpy()s fixed_logout into the vcpu local interrupt state unconditionally. This will reach the guest during deliver and userspace during migration. Reflecting zeroes is the correct behaviour here, as KVM has no logout data for a reinjected machine check. This needs a host machine check while the cpu is in SIE so not trivial to trigger. Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-4-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Zero initialize data structures for inject_pfault_tokenChristian Borntraeger1-2/+2
__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values. Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data. Fix by zero-initializing the irq struct. Do the same for the inti data structure. Fixes: 383d0b050106 ("KVM: s390: handle pending local interrupts via bitmap") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-3-borntraeger@linux.ibm.com>
2026-08-11KVM: s390: Remove user triggerable WARN_ONChristian Borntraeger1-1/+1
pin_map_page() fails legitimately whenever the userspace mapping behind the adapter route has gone away, e.g. when the VMM unmaps that memory. As this can happen without a kernel programming error, remove the WARN_ON. Fixes: 1e95e3bc6b05 ("KVM: s390: Enable adapter_indicators_set to use mapped pages") Cc: Douglas Freimuth <freimuth@linux.ibm.com> Cc: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Douglas Freimuth <freimuth@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260805110455.7200-2-borntraeger@linux.ibm.com>
2026-08-11objtool/headers: Sync tools/include/linux/objtool_types.h with ↵Ingo Molnar1-2/+2
include/linux/objtool_types.h Sync up the kernel and tooling headers to fix this build warning: Warning: Kernel ABI header at 'tools/include/linux/objtool_types.h' differs from latest version at 'include/linux/objtool_types.h' Fixes: 6e5716b187fa ("objtool: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files") Cc: Thomas Huth <thuth@redhat.com> Cc: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-08-11sctp: auth: propagate HMAC calculation errors to callersQing Luo4-13/+24
sctp_auth_calculate_hmac() can fail when building the association secret under memory pressure, but its void return silently leaves the HMAC digest zeroed. On the receive path, sctp_sf_authenticate() compares this zeroed digest against the peer-supplied one using crypto_memneq(), potentially accepting an all-zero HMAC from the peer if the allocation failed. On the send path, sctp_packet_pack() transmits a packet with a zeroed HMAC that the peer would reject. Improve error handling by making sctp_auth_calculate_hmac() return int: - sctp_sf_authenticate() returns SCTP_IERROR_NOMEM instead of accepting a zero HMAC. - sctp_packet_pack() drops the packet on failure instead of transmitting a zeroed HMAC. Update the declaration in auth.h accordingly. Assisted-by: LLM Signed-off-by: Qing Luo <luoqing@kylinos.cn> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20260807064314.500742-1-l1138897701@163.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-11firewire: core: add KUnit tests for failure of tree buildingTakashi Sakamoto1-0/+84
Abdun Nihaal has reported a memory leak when tree building fails in the middle of self ID sequence enumeration. This is caused by an invalid self ID sequence and is not a common occurrence. This commit is intended to assist in fixing the issue by adding KUnit tests to show the cases in which the memory leak is triggered. The leak occurs internally in the build_tree() function, therefore it cannot be detected directly by the tests. Link: https://lore.kernel.org/r/20260810064119.410324-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-08-11firewire: core: add KUnit tests for successful tree buildingTakashi Sakamoto1-0/+508
After a bus reset, self ID sequence is captured by 1394 OHCI hardware and passed to software through SelfID DMA context. The core parses the sequence to build an internal cache of the node tree for the current generation of the bus. This is the first step in managing resources on the bus. The tree is build by the build_tree() function. This commit adds KUnit tests for the function, covering several successful scenarios. Link: https://lore.kernel.org/r/20260810064119.410324-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-08-11firewire: core: add KUnit test skeleton for node treeTakashi Sakamoto4-0/+39
Some issues have been reported in node tree management. Refactoring the topology-related code in the core is required. Adding unit tests would help ensure that the refactoring does not introduce regressions. This commit adds a KUnit test skeleton for this purpose. Link: https://lore.kernel.org/r/20260810064119.410324-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-08-11drm/panel: remove accidentally committed .orig fileJani Nikula1-722/+0
Apparently an extra file drivers/gpu/drm/drm_panel.c.orig was accidentally added and committed while committing ac3baea883da ("drm/panel: find_panel_by_fwnode() return a counted reference"). Remove it. Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/r/annCRqegoQ9PBClJ@sirena.org.uk Fixes: ac3baea883da ("drm/panel: find_panel_by_fwnode() return a counted reference") Cc: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260810125204.3258447-1-jani.nikula@intel.com Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-08-11Merge branches 'arm/smmu/updates', 'arm/smmu/bindings', 'mediatek', ↵Joerg Roedel44-463/+1026
'qualcomm/msm', 'rockchip', 'ti/omap', 'riscv', 'intel/vt-d', 'amd/amd-vi', 'core' and 'typos' into next
2026-08-11iommu/amd: Add SNP page mode 0 supportVasant Hegde3-15/+35
Newer AMD IOMMUs supports DTE[Mode]=0 for SNP-enabled system. This is detected using new feature bit (EFR2[SNP_Page_Mode_0_Sup]). If this feature is enabled, then IOMMU supports: - Passthrough mode (i.e. iommu=pt) - amd_iommu=pgtbl_v2: Forcing Linux DMA-API to use IOMMU v2 page table - Setting up device for SVA mode in the host. Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Tested-by: Amandeep Kaur Longia <AmandeepKaur.Longia@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-11iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST commandVasant Hegde2-5/+22
The GN bit in the COMPLETE_PPR_REQUEST command indicates whether the device is operating under a guest (v2) page table. Currently, dev_data->pri_tlp is incorrectly used to derive this bit. However, pri_tlp indicates whether the device uses PRI TLP which is unrelated to page table mode. Fix this by refactoring amd_iommu_complete_ppr() into a static internal helper __amd_iommu_complete_ppr() that accepts an explicit 'gn' argument. The amd_iommu_complete_ppr() wrapper then derives the GN bit correctly from the device's active protection domain via pdom_is_v2_pgtbl_mode(). In the INVALID_PPR_REQUEST error handling path, the device's protection domain may not be accessible, so derive the GN bit directly from the EVENT_FLAG_PPR_GN flag in the event log entry instead. While at it, change the 'gn' parameter type in build_complete_ppr() from u8 to bool to better reflect its semantics. Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-11iommu/amd: Rate limit INVALID_PPR_REQUEST error loggingVasant Hegde1-3/+4
The amd_iommu_report_ppr_err() function logs an error message for every INVALID_PPR_REQUEST event. Under certain fault conditions, a misbehaving or malicious device can flood the IOMMU event log with PPR faults, causing the kernel log to be overwhelmed with repeated error messages. Switch from dev_err() to dev_err_ratelimited() to suppress duplicate messages when INVALID_PPR_REQUEST events occur at a high rate. Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-11iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requestsVasant Hegde2-6/+33
The AMD IOMMU spec, requires the host to respond with a CMD_COMPLETE_PPR command when an EVENT_TYPE_INV_PPR_REQ event is received with the RX bit cleared. This response was missing in the current implementation, leaving invalid PPR requests unacknowledged. Introduce amd_iommu_report_ppr_err() to handle EVENT_TYPE_INV_PPR_REQ events. The new function logs the invalid PPR request and when the RX bit is cleared, sends CMD_COMPLETE_PPR response. Reported-by: Gaultier Delbarre <Gaultier.Delbarre@amd.com> Co-developed-by: Wei Huang <wei.huang2@amd.com> Signed-off-by: Wei Huang <wei.huang2@amd.com> Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-11iommu/amd: Introduce PPR_TAG_LAST_PAGE() macroVasant Hegde2-5/+5
The PPR tag field (PPRtag) encodes two distinct fields: the 9-bit tag value (bits 8-0) and the last-page indicator L bit (bit 9). Fix PPR_TAG() to mask only the 9-bit tag field and introduce PPR_TAG_LAST_PAGE to explicitly extract the L bit. This way it becomes easy to read. Cc: Wei Huang <wei.huang2@amd.com> Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-11iommu/amd: Fix incorrect device ID in invalid PASID error messageVasant Hegde1-1/+1
The IO page fault notifier handler logs pdev->dev.id when reporting an invalid PASID, but pdev->dev.id is the kernel-internal device ID and not the IOMMU device ID (BDF). Use dev_data->devid instead, which reflects actual devid. Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler") Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-11Revert "Merge branch 'ib-rsk7204' into devel"Linus Walleij4-254/+79
This reverts commit d922b54e942ee9c798b0d688b025362a24d864ea, reversing changes made to 3f0245e23a176e78f00a760291b8e4f88d01d77e. The SH maintainer has indicated that he want to carry these changes in the SH tree instead, and need more time to review and merge the changes, so reverting it out from my tree. Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-08-11ALSA: hda/realtek: Rename Line Out control to Headphone on ThinkPad X1 ↵Zhang Heng1-0/+13
Carbon 6th The ThinkPad X1 Carbon 6th Gen (ALC285, SSID 17aa:225c) has no physical Line Out jack. The 3.5mm headphone jack is wired to the headphone DAC, but the ALSA HDA driver names the corresponding control as "Line Out Playback Volume" (node 0x02). PipeWire's ALSA Card Profile (ACP) silences "Line Out" when headphones are activated, which incorrectly mutes the headphone output. Add a quirk to rename the control to "Headphone Playback Volume" via alc285_lenovo_dac_rename(). Tested on openSUSE Tumbleweed (kernel 7.1.5): - Control renamed successfully, no name collision with "Headphone Playback Switch" - Headphone output works across multiple PipeWire/WirePlumber restarts and port switches Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221522 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Tested-by: Branislav Klocok <branislav.klocok@orava.sk> Link: https://patch.msgid.link/20260811062734.400512-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-11ALSA: pci: asihpi: use pcim_iomap for managed PCI memory mappingRosen Penev1-16/+1
Replace manual ioremap() calls with pcim_iomap() which uses devres for automatic cleanup. This eliminates the need for manual iounmap() in both the error path of asihpi_adapter_probe() and the asihpi_adapter_remove() function. The pcim_iomap() helper is cleaner and less error-prone since it handles unmapping automatically when the PCI device is released. Assisted-by: opencode/big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260811042122.44923-1-rosenp@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-11m68k: coldfire/5441x: register mcf-rcm-reset platform deviceJean-Michel Hautbois1-0/+25
Add SoC-level registration of the mcf-rcm-reset platform device so the power_on_reason sysfs attribute is created on every MCF5441x board without per-board boilerplate. Signed-off-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-08-11m68k/coldfire: replace linux/gpio.h inclusionsArnd Bergmann2-2/+2
linux/gpio.h should no longer be used, convert these instead to linux/gpio/legacy.h for coldfire. Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@kernel.org>
2026-08-11m68k: defconfig: add config for M5282EVB boardGreg Ungerer1-0/+51
Add a default configuration for a basic M5282 based EVB board. The SoC has been supported for a long time but there is no default configuration. Create one to improve build and test coverage. Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-08-11m68k: defconfig: add config for M52358EVB boardGreg Ungerer1-0/+52
Add a default configuration for a basic M5235 based EVB board. The SoC has been supported for a long time but there is no default configuration. Create one to improve build and test coverage. Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-08-11ALSA: usb-audio: Fix popping noise on Valeton GP-200Zhang Heng1-0/+2
The Valeton GP-200 guitar multi-effects processor exhibits a continuous popping noise (~6Hz) during playback and recording. Force implicit feedback to resolve the issue. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221662 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260811024902.134457-4-zhangheng@kylinos.cn
2026-08-11ALSA: hda/realtek: Add quirk for Lenovo Legion Pro 5 16ADR10Zhang Heng1-0/+1
The Lenovo Legion Pro 5 16ADR10 (codec SSID 0x17aa:0x3926) suffers from distorted/crackling speaker output, as only one speaker pin is driven without proper COEF/amp initialization. Add HDA_CODEC_QUIRK applying ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to enable both speaker pins and proper amp initialization, restoring clean audio output at all volume levels. Tested: Both internal speaker pairs are now driven correctly and distortion is gone; headphone output remains unaffected. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221595 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Tested-by: Efe Yılmaz <efe.tcyilmaz@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260811024902.134457-3-zhangheng@kylinos.cn
2026-08-11ALSA: hda/realtek: Add quirk for Acer Predator PH16-71Zhang Heng1-0/+1
The Acer Predator PH16-71 (subsystem 0x1025:0x166c) with Realtek ALC245 codec has a non-functional headset microphone. Adding the ALC2XX_FIXUP_HEADSET_MIC quirk resolves the issue. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221641 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260811024902.134457-2-zhangheng@kylinos.cn
2026-08-11media: ipu-bridge: check all DMI entries when overriding sensor rotationJosé María Martín1-3/+5
A machine can have more than one sensor whose rotation needs to be overridden, which takes one upside_down_sensor_dmi_ids[] entry per sensor, all sharing the same DMI match but with different ACPI HIDs in driver_data. ipu_bridge_parse_rotation() uses dmi_first_match(), which always stops at the first entry matching the running machine, so any further entry for the same machine is unreachable and only one sensor per machine can ever be corrected. Walk the whole table and match every entry for the running machine against the sensor's ACPI HID instead. Fixes: b75710155a82 ("media: ipu-bridge: Add DMI quirk for Dell XPS laptops with upside down sensors") Cc: stable@vger.kernel.org Signed-off-by: José María Martín <jmmartinf@hotmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-08-10apparmor: constify aa_label parameters on read-only query helpersJohn Johansen2-20/+23
Several label helpers only read from their struct aa_label * arguments: they compare labels, test subset relationships, or check the mediation bitmask, all via direct field/index access. Mark those parameters const struct aa_label * to document intent and let the compiler enforce that the label is not modified. The converted functions are: - label_mediates(), label_mediates_safe() - aa_label_cmp() (and its vec_cmp() helper) - __aa_label_next_not_in_set(), aa_label_is_subset(), aa_label_is_unconfined_subset() - __aa_subj_label_is_cached() - aa_label_next_confined(), aa_label_next_in_merge() These all access the label through direct indexing or manual iterators rather than the label_for_each()/fn_for_each() macros, which are not const-correct and so gate the majority of the remaining label consumers (the print, match, and permission-check paths) from being constified. No functional change. Signed-off-by: John Johansen <john.johansen@canonical.com> Assisted-by: Claude:claude-opus-4.8
2026-08-10apparmor: constify aa_dfa parameters on read-only compute pathsJohn Johansen8-32/+37
Most uses of aa_dfa a read-only walking of the dfa. Have the compiler enforce this. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: constify aa_profile parameters on read-only compute pathsJohn Johansen10-23/+25
A number of functions take a struct aa_profile * argument that is only ever read from: they compute DFA matches or apply the profile's mode flags without modifying the profile, taking a reference on it, or touching its embedded label. Mark those parameters const struct aa_profile * to document intent and let the compiler enforce it. The converted functions are the permission "compute" path plus a few pure readers: - aa_apply_modes_to_perms(), aa_profile_match_label() - AUDIT_MODE() - aa_label_match() and its match_component()/label_compound_match()/ label_components_match() helpers (label.c) - match_component()/label_compound_match()/label_components_match()/ label_match()/change_profile_perms()/aa_xattrs_match() (domain.c) - match_iface()/match_addr_iface()/match_addr_iface_label()/ skb_match_to_sk()/skb_match_to_cmd() (af_inet.c) - aa_profile_capget(), path_flags(), profile_query_cb() The remaining aa_profile * parameters cannot be made const: the audit path stores &profile->label into the owned, refcounted apparmor_audit_data.subj_label/peer fields, and the domain/lifecycle paths take references on the profile's embedded label (aa_get_label()/aa_get_newest_label()/aa_get_profile()) or write profile fields. No functional change. Signed-off-by: John Johansen <john.johansen@canonical.com> Assisted-by: Claude:claude-opus-4.8
2026-08-10apparmor: constify aa_perms parameters that are read-onlyJohn Johansen6-10/+11
Several functions take a struct aa_perms * argument that is only ever read from and never modified through the pointer. Mark those parameters const struct aa_perms * to document intent and let the compiler enforce that the permission set is not mutated. The converted functions are: - aa_check_perms() - aa_do_perms() - do_perms() (af_inet) - match_label() (af_unix) - verify_perm() - aa_perms_accum() / aa_perms_accum_raw() (@addend only) No functional change. Signed-off-by: John Johansen <john.johansen@canonical.com> Assisted-by: Claude:claude-opus-4.8
2026-08-10apparmor: drop use of _confined variant for iterationJohn Johansen1-7/+7
In preparation for allowing unconfined to be replaced and mediate select rules drop use of the _confined variant for iteration in the mount code. The RULE_MEDIATES() check will continue to allow unconfined profile mediation to be skipped unless it is replaced and is given mount rules. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: refactory mount to use check_permsJohn Johansen4-168/+144
Move the mount permissions check to use the common backend aa_check_perms() to check permissions. This will make it so caching, audit, complain, logic can be handled consistently in a single place. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: fix auditing of mount binary dataJohn Johansen1-2/+2
AppArmor only mediates non-binary mount data, and should only audit the mount data if it is non-binary. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: add audit mode to provide a mechanism to silence complain messagesJohn Johansen4-10/+22
Complain messages can be very noisy and fill the logs quickly. Allow complain (allow) messages to be silenced separate from denied messages. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: mark static tables and structs as read onlyJohn Johansen8-20/+22
static tables, and structs that are initialized as part of their data section or during init should be read only to protect against accidental or malicous changes. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: fix error debug output in fn_label_buildJohn Johansen1-2/+2
checking PTR_ERROR() is not correct to just determine if any error occured, instead use the IS_ERR macro and also output the PTR_ERR as part of the debug message. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: make table entry count last enum for static tablesJohn Johansen3-5/+5
Instead of keeping an external define for the various tables indexed by an enum, make the size the last entry of the enum so the table size will get updated correctly with changes to the enum. Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: fix race condition in label replacementJohn Johansen1-12/+48
label replacement can result in the need for locking on two separate trees. Currently this is done by locking the tree to remove and then the tree to add to. For compound labels the race can result in the old label proxy pointing to the the new label that lost the race and that was not inserted in to the new tree. This does not break mediation, but it does result in a task that will not update its profile correctly on future mediation, and that will leak its refcount due to a circular reference in its proxy, resulting in a memory leak. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: refactor xattr attachment, to take the file pathJohn Johansen1-15/+19
The full bprm does not need to be passed into xattrs_match, so only pass in the path, and propagate the change backup the call stack until bprm is actually needed. Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: fix unconfined user namespace restriction forced stackJohn Johansen1-26/+54
If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitions through an unconfined profile can be executed. Fix this by pushing the check into the per profile label build. The check will always be done against unconfined and result in a stack of just the unconfined component when necessary. Fixes: 2d9da9b188b8 ("apparmor: allow restricting unprivileged change_profile") Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: reserve mediation class for packet mediationJohn Johansen2-1/+2
Packet mediation is going to be added in the future, reserve a class for it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: move sock_rcv_skb() next to inet_conn_requestJohn Johansen1-36/+33
both of these fns are using ifdef CONFIG_NETWORK_SECMARK and related to AppArmor's secmark based mediation, so move them together. Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: move netfilter functions next to the LSM network operationsJohn Johansen1-44/+46
Make sure all the network mediation hooks are next to each other in a logical block. This just makes it easier to read/understand the network mediation code. Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10apparmor: refactor network socket mediation to support compatibilityJohn Johansen1-8/+10
Make it easier for distros to support the network backwards compat patch by refactoring the code to minimize the changes needed. Signed-off-by: John Johansen <john.johansen@canonical.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-29 09:14:51 +0000