summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-08-10fbdev: mb862xxfb: Silence possibly unused functionsHelge Deller1-3/+3
When CONFIG_PCI=n, the kernel test robot reports that on powerpc some functions and variables may possibly be unused. Silence those warnings. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608081537.o23Goj8d-lkp@intel.com/ Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10sticon/parisc: Detect default STI graphics card for console outputHelge Deller1-1/+21
If a machine has multiple graphic cards, detect the graphic card which is used to display firmware messages and use that one as the default graphic card for sticon and fbcon. On parisc machines the default graphic card used for BCH (boot console handler, aka BIOS menu) is stored in the stable storage (equivalent to CMOS storage on x86) or in the console path in page zero. Extract that path and store it as default STI path for later comparism. Take care that the graphic card can be a GSC or a PCI card which use different path strings. Increase max string size for default_sti_path to 32 chars as the print_pa_hwpath() function formats a hardware path using unbounded sprintf calls for up to 6 bus converter components and 1 module component (e.g., 255/255/...), which can produce a string up to 28 bytes long. Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org
2026-08-10fbdev: ssd1307fb: defer I2C transfers from damage callbacksHui Su1-5/+67
The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transfer path from atomic context. A complete report from an RK3566 system follows: [ 258.129004] watchdog: watchdog0: watchdog did not stop! [ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003 [ 258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1 ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2 spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2 stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables x_tables autofs4 [ 258.129215] Preemption disabled at: [ 258.129216] [<ffff80008012f96c>] vprintk_emit+0x11c/0x340 [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C 6.6.0-rc5-rockchip-rk356x #4 [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT) [ 258.129243] Call trace: [ 258.129245] dump_backtrace+0xa0/0x128 [ 258.129252] show_stack+0x20/0x38 [ 258.129256] dump_stack_lvl+0x60/0xb0 [ 258.129265] dump_stack+0x18/0x28 [ 258.129269] __schedule_bug+0xa0/0xc8 [ 258.129274] __schedule+0x9ac/0xd30 [ 258.129279] schedule+0x60/0x100 [ 258.129282] schedule_timeout+0x194/0x338 [ 258.129289] rk3x_i2c_xfer_common.isra.0+0x384/0x498 [ 258.129296] rk3x_i2c_xfer+0x20/0x60 [ 258.129300] __i2c_transfer+0x194/0x648 [ 258.129308] i2c_transfer+0x9c/0x130 [ 258.129313] i2c_transfer_buffer_flags+0x64/0x98 [ 258.129318] ssd1307fb_update_rect+0x42c/0x560 [ssd1307fb] [ 258.129334] ssd1307fb_defio_imageblit+0x34/0x50 [ssd1307fb] [ 258.129343] soft_cursor+0x13c/0x210 [ 258.129350] bit_cursor+0x2dc/0x550 [ 258.129354] fbcon_cursor+0xec/0x108 [ 258.129359] hide_cursor+0x44/0xc8 [ 258.129365] vt_console_print+0x398/0x3b0 [ 258.129370] console_flush_all.isra.0+0x17c/0x410 [ 258.129377] console_unlock+0x4c/0x100 [ 258.129382] vprintk_emit+0x1c8/0x340 [ 258.129386] vprintk_default+0x40/0x58 [ 258.129389] vprintk+0xb8/0xd0 [ 258.129392] _printk+0x68/0x98 [ 258.129398] watchdog_release+0x170/0x230 [ 258.129404] __fput+0xbc/0x288 [ 258.129409] __fput_sync+0x58/0x70 [ 258.129413] __arm64_sys_close+0x40/0x90 [ 258.129419] invoke_syscall+0x4c/0x118 [ 258.129426] el0_svc_common.constprop.0+0x48/0xf0 [ 258.129432] do_el0_svc+0x24/0x38 [ 258.129437] el0_svc+0x48/0x100 [ 258.129443] el0t_64_sync_handler+0xc0/0xc8 [ 258.129448] el0t_64_sync+0x190/0x198 [ 258.573087] ------------[ cut here ]------------ [ 258.573098] DEBUG_LOCKS_WARN_ON(val > preempt_count()) [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871 preempt_count_sub+0x9c/0x148 [ 258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1 ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2 spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2 stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables x_tables autofs4 [ 258.573268] CPU: 0 PID: 1 Comm: systemd Tainted: G WC 6.6.0-rc5-rockchip-rk356x #4 [ 258.573274] Hardware name: Rockchip RK3566 OPi 3B (DT) ** 37 printk messages dropped ** [ 258.574064] Preemption disabled at: ** 42 printk messages dropped ** [ 259.190237] Preemption disabled at: Track damage in the driver's private data under a spinlock and merge multiple updates into a bounding rectangle. Queue the existing deferred-I/O work immediately for damage reported by fbdev drawing and write helpers, so allocation and I2C transfers run from process context without adding the configured mmap refresh delay. Keep full-screen updates for dirty mmap pages, for which no precise rectangle is available. Tested on an RK3566 board with a 128x64 OLED by running five rounds of 250 KERN_EMERG messages in total while issuing framebuffer writes every 15 ms. No atomic-sleep, preemption, or lockdep warning occurred. Kprobe tracing also confirmed that cursor-only damage remained an 8x16 partial update. Fixes: a2ed00da5047 ("drivers/video: add support for the Solomon SSD1307 OLED Controller") Cc: stable@vger.kernel.org Signed-off-by: Hui Su <sh_def@163.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: au1100fb: drop unneeded semicolonJulia Lawall1-1/+1
When a function-like macro expands to an expression, that expression doesn't need a semicolon after it. All uses have been verified to have their own semicolons. This was found using the following Coccinelle semantic patch: @r@ identifier i : script:ocaml() { String.lowercase_ascii i = i }; expression e; @@ *#define i(...) e; Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Program the initial video modeDaniel Palmer1-0/+8
If the card does not get bound to by fbcon set_par() never happens and the initial video mode is not setup and the display detects no signal. Program the video mode and also clear the framebuffer memory so random garbage isn't displayed. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Wake the VGA core before programming the CRTCDaniel Palmer1-0/+4
If the card was unbooted the VGA core needs to be woken up before poking at it. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Manually boot unbooted cardsDaniel Palmer1-3/+37
If the card is detected as being unbooted it isn't too difficult to use the config table in its BIOS to fire it up so do it. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Attempt to detect if the card wasn't bootedDaniel Palmer1-0/+31
Until now a card had to have been booted by its video BIOS otherwise the driver would probe, create the fb etc but there would be no output on the display. There doesn't seem to be a documented way work out if the BIOS ran or not. Checking if the values in registers match what is in the config table in the BIOS seems to be the only option. On my 16MB Voodoo 3 3000 checking the contents of the draminit0 register versus what is in the config table seems to be enough. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Add helper to read config table from BIOSDaniel Palmer1-0/+78
In the case that the video BIOS didn't run because the card isn't the primary card, the BIOS doesn't support running old skool video BIOS (modern BIOS without CSM), or the machine isn't x86 it needs to be booted manually. To do this the config table in the BIOS is needed. Add a helper to get the config table in preparation for manually booting cards. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: core: Clamp total_size to smem_len in read/write functionsMingyu Wang2-0/+32
Some legacy fbdev drivers may incorrectly set info->screen_size to a value larger than the actual mapped framebuffer size (info->fix.smem_len) during mode switches. This could allow out-of-bounds I/O and system memory accesses in fb_io_read(), fb_io_write(), fb_sys_read(), and fb_sys_write(). Prevent this by clamping total_size to smem_len when smem_len is non-zero. Virtual framebuffers (smem_len == 0) are unaffected. This is a hardening measure; no specific crash is fixed by this patch. Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: kyro: Validate overlay viewport coordinatesDanila Chernetsov1-1/+23
The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around before the resulting coordinates are passed to SetOverlayViewPort(). SetOverlayViewPort() packs the viewport coordinates into 16-bit register fields. The X coordinates are additionally adjusted by +2 and +1 before being written. Validate the coordinate calculations for 32-bit wraparound and ensure that the adjusted coordinates fit within their 16-bit register fields before calling SetOverlayViewPort(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Danila Chernetsov <listdansp@mail.ru> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: mb862xx: replace dead select with dependencyJulian Braha1-2/+1
'select' does not work on config options in a 'choice', so currently it is possible to enable FB_MB862XX_LIME without FB_LITTLE_ENDIAN. We cannot replace the 'select FB_LITTLE_ENDIAN' without also changing FB_FOREIGN_ENDIAN from 'select' to 'depends on', otherwise we will get a recursive dependency. Since the default choice is FB_BOTH_ENDIAN, let's use: 'depends on FB_LITTLE_ENDIAN || FB_BOTH_ENDIAN' to avoid breaking defconfig. This dead select was found by kconfirm, a static analysis tool for Kconfig. Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Julian Braha <julianbraha@gmail.com> Link: https://lore.kernel.org/all/20260722220023.196029-1-julianbraha@gmail.com/ Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: sa1100fb: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: s3c-fb: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pxafb: Remove redundant dev_err()Pan Chuang1-1/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pxa3xx-gcu: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pxa168fb: Remove redundant dev_err()Pan Chuang1-1/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: omapfb/dsi-cm: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: mmp: Remove redundant dev_err()Pan Chuang1-2/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fonts: fixup font.h kernel-doc warningsRandy Dunlap1-1/+3
Use the typedef keyword when describing a typedef. Add the missing function return value for font_glyph_size(). Warning: include/linux/font.h:84 cannot understand function prototype: 'typedef const unsigned char font_data_t;' Warning: include/linux/font.h:53 No description found for return value of 'font_glyph_size' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pvr2fb: correct user pointer annotation and sentinel initializerFlorian Fuchs1-2/+2
Add __user annotation to buf, as it is passed as a user pointer in pin_user_pages_fast(). Use an empty initializer for the sentinel board-table entry to avoid initializing a function pointer with an integer literal. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607131247.fpQ6eTc7-lkp@intel.com/ Cc: stable@vger.kernel.org Signed-off-by: Florian Fuchs <fuchsfl@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: udlfb: validate vendor descriptor itemsPengpeng Hou1-6/+16
dlfb_parse_vendor_descriptor() walks key-length-value items inside the DisplayLink vendor descriptor. Require each item to contain its key, length and declared value bytes before reading item-specific fields such as max_area. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: sstfb: add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has a match table for the pci bus wired into its driver structure, but the table is not exported with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE() entry so module alias information is generated for automatic module loading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the driver registration structure, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: omap2: dsi: do not copy isr tableAndreas Kemnade1-8/+1
To te able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to these isrs giving chances of UAF of these objects if irqs are unregistered while they are handled, so better do not copy that table. Suggested-by: sashiko-bot@kernel.org Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()Myeonghun Pak1-1/+1
tdfxfb_probe() enables the PCI device with pci_enable_device(), but several failure paths after that point return without disabling it. The framebuffer_alloc() failure path returns -ENOMEM directly, and the later shared out_err path releases the framebuffer and returns -ENXIO without balancing the PCI enable state. The successful probe path has the same imbalance because tdfxfb_remove() releases the framebuffer, mappings and regions, but never calls pci_disable_device(). Use pcim_enable_device() so the PCI device is disabled automatically on probe failure and driver detach. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: uvesafb: unregister connector callback on init failureMyeonghun Pak1-0/+2
uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered. The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10rust: sync: Add abstraction for rcu_barrier()Philipp Stanner1-0/+20
rcu_barrier() is a frequently used C function which is always safe to be called. Add a safe abstraction for rcu_barrier(). Tested-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Philipp Stanner <phasta@kernel.org> Acked-by: Gary Guo <gary@garyguo.net> Reviewed-by: Onur Özkan <work@onurozkan.dev> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260805145949.938505-5-phasta@kernel.org [ Formatted documentation. Sorted tags. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-10rust: types: implement ForeignOwnable for ARef<T>Danilo Krummrich1-0/+50
Implement ForeignOwnable for ARef<T>, making it possible for C code to own an ARef<T>. Since ARef represents shared ownership, BorrowedMut is &T rather than &mut T, matching the semantics of the underlying reference-counted type. Signed-off-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Tested-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Philipp Stanner <phasta@kernel.org> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260805145949.938505-4-phasta@kernel.org [ Relaxed `'static` bound and added `#[inline]` as discussed. Added the submitter's Signed-off-by tag. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-10rust: error: add remaining error codesTimur Tabi1-0/+102
Add all of the remaining error codes from include/uapi/asm-generic/errno.h. Previous updates to error.rs have been piecemeal -- adding single error codes as needed. Instead, we can avoid future problems by adding all the remaining error code in one swoop. EDEADLOCK and EWOULDBLOCK are intentionally left out: they are just deprecated compatibility aliases of EDEADLK and EAGAIN, kept around for non-Linux/POSIX code, and have no use in new kernel code. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Fiona Behrens <me@kloenk.dev> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Philipp Stanner <phasta@kernel.org> Link: https://patch.msgid.link/20260805145949.938505-3-phasta@kernel.org [ Formatted comments. Added the submitter's Signed-off-by tag. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-09apparmor: fix integer overflow in verify_tags() bounds checkFabrice Derepas1-1/+1
verify_tags() validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table[]: u32 cnt = tags->sets.table[i]; if (i+cnt >= tags->sets.size) { i, cnt and sets.size are all u32, so i+cnt is evaluated modulo 2^32. sets.table[] is filled by unpack_tagsets() with aa_unpack_u32(), so every entry is a raw unbounded 32-bit word taken from the policy blob, and verify_tags() is the function that is supposed to validate it. A count close to U32_MAX makes the sum wrap to a small value, the guard passes, and the inner loop then walks sets.table[++i] past the end of the kcalloc(size, sizeof(u32)) allocation. Note that sets.size is bounded by 65535, because unpack_tagsets() reads it with aa_unpack_array() as a u16, so the wrap cannot be reached by growing the table; it is reached purely through the attacker-supplied count. With sets.size = 2 and sets.table = { 0, 0xffffffff }: i = 0: cnt = 0, guard 0 + 0 >= 2 is false, inner loop does not run i = 1: cnt = 0xffffffff, guard (1 + 0xffffffff) mod 2^32 == 0 >= 2 is false, so the guard is bypassed and the inner loop reads sets.table[2] -- one element past a two element allocation The walk continues until an out-of-bounds value happens to be >= hdrs.size or the access faults, so a crafted policy yields an out-of-bounds read on the policy load path (aa_replace_profiles -> aa_unpack -> unpack_policydb -> unpack_tags -> verify_tags). unpack_tags() runs before the perms and DFA tables are unpacked, so no other table needs to be well formed to reach it. Policy load is gated by aa_may_manage_policy(), which checks CAP_MAC_ADMIN relative to the subject's own user namespace rather than the init user namespace, so with the default unprivileged_userns_apparmor_policy=1 the path is reachable from an unprivileged task in a matched-level nested namespace, not only by a globally privileged one. Perform the addition in u64 so that it cannot wrap, restoring the intended i + cnt < sets.size guarantee. Fixes: 3d28e2397af7 ("apparmor: add support loading per permission tagging") Signed-off-by: Fabrice Derepas <fabrice.derepas@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-10rust: bug: fix warn_on macro build error on UMLFUJITA Tomonori1-1/+1
Callers that go through `kernel::prelude` have `CStrExt` in scope, but code inside the `kernel` crate imports explicitly and may not. Using `warn_on!` from such a module fails to build on UML, which is the only configuration where `warn_flags!` needs a C string pointer rather than an inline asm bug entry: error[E0599]: no method named `as_char_ptr` found for reference `&ffi::CStr` in the current scope --> linux/rust/kernel/bug.rs:83:49 | 83 | $crate::c_str!(::core::file!()).as_char_ptr(), | ^^^^^^^^^^^ | ::: linux/rust/kernel/time.rs:427:9 | 427 | warn_on!(self.nanos < 0); | ------------------------ in this macro invocation | = help: items from traits can only be used if the trait is in scope = note: this error originates in the macro `$crate::warn_flags` which comes from the expansion of the macro `warn_on` (in Nightly builds, run with -Z mac) help: trait `CStrExt` which provides `as_char_ptr` is implemented but not in scope; perhaps you want to import it --> linux/rust/kernel/time.rs:27:1 | 27 + use crate::str::CStrExt; Call the method through its fully qualified path, which resolves without any import at the expansion site. Cc: stable@vger.kernel.org Fixes: dff64b072708 ("rust: Add warn_on macro") Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Link: https://patch.msgid.link/20260807112427.1039056-1-tomo@flapping.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-10rust: bug: skip arch-specific asm in `testlib` buildsFUJITA Tomonori1-1/+5
Running `make rusttest` with `ARCH=` set to an architecture other than the host's fails, e.g. `ARCH=arm64` on an x86_64 host: error: invalid instruction mnemonic 'brk' --> rust/kernel/bug.rs:63:17 | 63 | / concat!( 64 | | "/* {size} */", 65 | | include!(concat!(env!("OBJTREE"), "/rust/kernel/generated_arch_warn_asm.rs")), 66 | | include!(concat!(env!("OBJTREE"), "/rust/kernel/generated_arch_reachable_asm.rs"))); | |_______________________________________________________________________________________________________^ | note: instantiated into assembly here --> <inline asm>:1:115 | 1 | /* 8 */.pushsection __bug_table,"aw"; .align 2; 14470: .long 14471f - .;.short 2305;.align 2; .popsection; 14471:brk 0x800 | ^^^ The reason is that `rusttest` builds the `kernel` crate as a host library: it passes the `CONFIG_*` cfgs of the configured architecture, but not `--target`, so code generation happens for the host. `warn_flags!` then selects the arch-specific inline asm arm based on `CONFIG_*`, and the host assembler rejects it. This does not happen with the current `master` because `warn_on!` has no user inside the `kernel` crate itself yet, but it will as soon as one is added. Reported-by: Miguel Ojeda <ojeda@kernel.org> Closes: https://lore.kernel.org/all/CANiq72n4=fz=JNKY0Jdm8BnLa=RmHB2B7s0bO47YTJ7hygqBZg@mail.gmail.com/ Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Cc: stable@vger.kernel.org Fixes: dff64b072708 ("rust: Add warn_on macro") Link: https://patch.msgid.link/20260808022608.1125174-1-tomo@flapping.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-10rust: bug: prevent dead_code warning from warn_on!'s flags constantFUJITA Tomonori1-4/+22
Fix the following dead_code warning on some configurations in an atomic development branch: warning: constant `WARN_ON_FLAGS` is never used --> linux/rust/kernel/bug.rs:126:19 | 126 | const WARN_ON_FLAGS: u32 = $crate::bug::bugflag_taint($crate::bindings::TAINT_WARN); | ^^^^^^^^^^^^^ | ::: linux/rust/kernel/sync/srcu.rs:106:12 | 106 | if crate::warn_on!( | ____________- 107 | | // SAFETY: By the type invariants, `self` contains a valid and pinned `struct srcu_struct` 108 | | // and `srcu_readers_active()` only checks the active reader count. 109 | | unsafe { bindings::srcu_readers_active(ptr) } 110 | | ) { | |_________- in this macro invocation | = note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default = note: this warning originates in the macro `crate::warn_on` (in Nightly builds, run with -Z macro-backtrace for more info) The warn_on! macro always defines a WARN_ON_FLAGS constant and hands it to warn_flags!. On configurations where warn_flags! does not reference its flags argument (the LOONGARCH/ARM variant, which only calls WARN_ON(), and the !CONFIG_BUG no-op variant), the constant is left unused and triggers a dead_code warning. warn_flags! is the macro that accepts (and here discards) the flags argument, so make it responsible for the argument it drops. Also rename `_COND_STR` to `COND_STR` and consume `$file` for consistency. Fixes: dff64b072708 ("rust: Add warn_on macro") Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260801024841.786664-1-tomo@flapping.org [ Added newlines. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-09perf synthetic-events: Fix divide by zero in perf_event__synthesize_threadsIan Rogers1-1/+1
If scandir() finds no matching tasks in /proc, n is 0. If thread_nr is > 1, we bypass the single-thread fast path and then clamp thread_nr to n, making it 0. This results in a divide by zero when calculating num_per_thread. Handle n <= 1 early to use the single-thread fast path and prevent the crash. Fixes: 340b47f510bb ("perf top: Implement multithreading for perf_event__synthesize_threads") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Fix memory leak in pyrf__metrics_cbIan Rogers1-0/+2
In pyrf__metrics_cb, PyDict_SetItem does not steal the reference of the key and value, so they need to be decref'ed after successful insertion to avoid memory leaks. Fixes: 47b3e95728eb ("perf python: Add metrics function") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Fix count_values memory leak in pyrf_evsel__readIan Rogers1-5/+4
In pyrf_evsel__read, if PyArg_ParseTuple fails, the allocated count_values is leaked. Move the allocation of count_values after the PyArg_ParseTuple call to prevent the memory leak. Fixes: 739621f65702 ("perf python: Add evsel read method") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Fix MetricGroup return type in perf.pyiIan Rogers1-2/+2
The metrics() function can return a dictionary where the value is either a string or a list of strings, so the type signature in the stub file should be Union[str, List[str]]. Fixes: 430da3cd03b4 ("perf python: Add perf.pyi stubs file") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Add thread and PMU uninitialized checksIan Rogers1-1/+10
Add CHECK_INITIALIZED checks to the thread attribute getters (get_pid, get_tid, get_ppid) to prevent crashes if they are accessed before being properly initialized. Fixes: 3b96bf7af60d ("perf python: Add python session abstraction wrapping perf's session") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-10rust: bitfield: always inline test conversionsAntoni Boucher1-0/+2
When using the Rust GCC backend (i.e. `rustc_codegen_gcc`), GCC does not inline enough these `Bounded::from_expr` calls: /usr/bin/x86_64-linux-gnu-ld.bfd: rust/kernel.o: in function `<kernel::num::bounded::Bounded<u16, 2> as core::convert::From<kernel::bitfield::tests::Priority>>::from': fake.c:(.text.unlikely+0x7be): undefined reference to `rust_build_error' /usr/bin/x86_64-linux-gnu-ld.bfd: rust/kernel.o: in function `<kernel::num::bounded::Bounded<u64, 4> as core::convert::From<kernel::bitfield::tests::MemoryType>>::from': fake.c:(.text.unlikely+0x90d): undefined reference to `rust_build_error' Thus, similar to commit bc197e24a3ac ("rust: num: bounded: Always inline fits_within and from_expr"), mark them as `#[inline(always)]`. [ Reworded to add the error and to follow our usual style and sent on behalf of Antoni, who found this during his work to support Rust for Linux with the GCC backend, i.e. with `rustc_codegen_gcc`. - Miguel ] Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Antoni Boucher <bouanto@zoho.com> Acked-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260807175012.142083-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-09perf python: Zero initialize perf_data in pyrf_data__initIan Rogers1-1/+2
Replace path clearing with memset so the entire struct is zeroed, preventing uninitialized fields from causing errors later. Fixes: 4cd0142f7dec ("perf python: Add wrapper for perf_data file abstraction") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Validate attribute setters in pyrf_evselIan Rogers1-12/+77
If val is NULL when setting an attribute, PyErr_SetString should be called as deleting the attribute isn't supported. In addition, ensure PyErr_Occurred is checked before setting the attribute to avoid setting a garbage value. Fixes: 877108e42b1b ("perf tools: Initial python binding") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Validate CPU and thread maps in pyrf_evsel__openIan Rogers1-2/+12
Add explicit Py_TYPE checks to ensure the arguments passed are actually of the correct pyrf_thread_map and pyrf_cpu_map types. Fixes: 877108e42b1b ("perf tools: Initial python binding") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Check counts_values size in set_valuesIan Rogers1-8/+30
The set_values function incorrectly assumed the list contained exactly 5 elements. Add a check to prevent out-of-bounds access. Fixes: 877108e42b1b ("perf tools: Initial python binding") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf test: Fix skiplist leak in cmd_testIan Rogers1-2/+7
Fix a memory leak in cmd_test() where skiplist was not freed on exit paths. Assisted-by: Antigravity:gemini-3.1-pro Fixes: 2ae828786c65 ("perf test: Allow skipping tests") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf synthetic-events: Fix uninitialized pthread_joinIan Rogers1-2/+2
In perf_event__synthesize_threads(), fix an uninitialized pthread_join() call when thread creation fails by only joining the successfully created threads. Assisted-by: Antigravity:gemini-3.1-pro Fixes: 340b47f510bb ("perf top: Implement multithreading for perf_event__synthesize_threads") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf python: Fix memory leak in pyrf_evlist__get_pollfdIan Rogers1-0/+3
Fix a Python list object leak in pyrf_evlist__get_pollfd() by adding a missing Py_DECREF on the error exit path. Assisted-by: Antigravity:gemini-3.1-pro Fixes: 877108e42b1b ("perf tools: Initial python binding") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf tools: Fix sb_evlist leaks in top and recordIan Rogers2-0/+4
Fix a memory leak in cmd_top() where top.sb_evlist was not freed if evlist__add_bpf_sb_event() fails. Note that evlist__start_sb_thread() and evlist__stop_sb_thread() take ownership of the evlist and free it, so we must only free it if we fail before starting the thread. Also set top.sb_evlist to NULL to prevent use-after-free bugs. Apply the same fix to builtin-record.c to avoid leaking rec->sb_evlist and calling pthread_join on uninitialized threads in the error path. Assisted-by: Antigravity:gemini-3.1-pro Fixes: b38d85ef49cf ("perf bpf: Decouple creating the evlist from adding the SB event") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf stat: Fix evsel_list leak in cmd_statIan Rogers1-3/+6
Fix a memory leak in cmd_stat() where evsel_list is leaked if an error occurs while opening the output file. Assisted-by: Antigravity:gemini-3.1-pro Fixes: 361c99a661a7 ("perf evsel: Introduce perf_evlist") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09perf script: Fix metric_evlist leak in script_find_metricsIan Rogers1-1/+1
Fix a memory leak in script_find_metrics() where metric_evlist is leaked when returning early on error paths. Assisted-by: Antigravity:gemini-3.1-pro Fixes: 3622990efaab ("perf script: Change metric format to use json metrics") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-10Merge tag 'drm-rust-next-2026-08-08' of ↵Dave Airlie107-3468/+8787
https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.3-rc1 - I/O (shared from driver-core tree via signed tag rust-io-7.3-rc1): - Rework of I/O types: make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add copying methods (memcpy_{from,to}io). - Replace dma_read!/dma_write! with io_read!/io_write!; drop the old macros. - DRM: - RegistrationGuard and RegistrationData: - Rework DeviceContext typestates: rename Uninit to Normal, add an Ioctl context, restrict AlwaysRefCounted to Normal for both Device and GEM Object, and establish a Deref chain from Registered to Normal. - Introduce RegistrationGuard, a guard representing a drm_dev_enter/exit SRCU critical section that proves the DRM device is registered, which implies the parent bus device is still bound. - Add RegistrationData as a GAT on drm::Driver. The data does not outlive driver unbind, so it can capture lifetime-annotated device resources and references. Accessible through the guard via a closure with HRTB lifetime. - Wrap ioctl dispatch in RegistrationGuard (returning ENODEV if unplugged) and pass registration data to handlers. - Add Driver::ParentDevice associated type. - Fix unbounded lifetimes in ioctl handler arguments. - Fix a race in drm_dev_register() where a partial failure allowed in-flight ioctls to proceed while the error path tore down resources. - GEM shmem: add DmaResvGuard helper, vmap functions, and sg_table() accessor. - GPUVM: require Send + Sync for the driver's associated data, implement Send and Sync for GpuVaAlloc and GpuVmBo, add SmContext lifetime bound, update DriverGpuVm for DeviceContext. - Nova: - nova-core / nova-drm cross-crate dependency: - Build nova-core and nova-drm from drivers/gpu/Makefile for build ordering, export nova-core Rust symbols for nova-drm. Workaround until the build system supports Rust cross-crate dependencies natively. - GSP boot process consolidation: - Introduce GspBootContext to bundle common boot parameters, replacing per-argument threading. Separate context and GPU lifetimes to support mutable borrows of GPU subdevices. - Turn FWSEC execution into a HAL method, make FWSEC bootloader usage a property of the TU102 HAL (GA102+ gets its own instance with it disabled). Move firmware file selection to the GSP HAL. - Store the Fsp instance in Gpu (lifetime tied to the GPU, not just a single boot invocation). Move GSP state and unload bundle into a pinned subobject for reliable teardown on partial init failure. - Boot GSP with vGPU enabled: - Add PRC (Product Reconfiguration Control) protocol to query device configuration from the FSP. Read vGPU mode, detect and store vGPU state. - Set RMSetSriovMode registry entry and reserve the larger WPR2 heap required when vGPU is enabled. - Build SetRegistry entries dynamically. - TLV firmware image format: - Add a TLV (type-length-value) parser for the new firmware image format. TLV files use unversioned filenames with a .tlv suffix, start with "NVFW" magic, and contain tagged blocks with 4-byte aligned payloads. - Transition all firmware loading (booter, gsp, gen_bootloader, fsp) to TLV images. - Note: this requires a development firmware not in linux-firmware [1]; this is temporary and serves the transition to r615. - Hopper/Blackwell fixes and cleanups: - Correct FRTS vidmem offset calculation, split FbLayout into FSP and non-FSP versions, fix Blackwell flush address composition, use absolute FBHUB0 flush registers on Blackwell, use correct sysmem flush registers on Hopper. - Harden FSP messaging: limit receive allocation size, catch bogus queue pointers, ensure DMA allocation lifetimes for FMC boot and LibOS, wait for RISC-V HALTED on unload. - I/O projection adoption: - Use io_project!() for PTE array, message queues, and Falcon DMA transfer bounds checking. - Misc: - Keep unloading if FWSEC-SB fails during Turing/Ampere GSP reset. - Don't declare booter firmware for FSP chipsets. - Fix packed registry table size. - Extract and display usable FB regions from GSP. - Store bar and dev directly in Falcon, simplifying the API. - Parse VBIOS structs via zerocopy. - Convert to kernel bitfield macro, remove local one. - Move register definitions into sub-modules. - Add FSP and PRC protocol documentation. - Tyr: - Firmware loading and MCU boot: - Add a generic slot manager for dynamically allocating limited hardware slots to software seats, with lazy eviction under contention. - Add MMU support wrapping the slot manager for address-space slot allocation, with MAIR-to-MEMATTR translation. - Add GPU virtual memory (VM) support using drm_gpuvm with ARM64 LPAE Stage 1 page tables and 4KB/2MB page sizes. - Add a kernel buffer object type for internal driver allocations. - Add a parser for the Mali CSF firmware binary format. - Add MCU booting: load, parse, and map firmware sections into VM, then boot the MCU at probe(). - Cross-subsystem: - Add faux::Device type with AsBusDevice support. Allow retrieving a bound Device from a Registration. - Add device lifetime to IoPageTable. - Add Vec::zeroed method. - Add firmware::request_into_buf() to load firmware into a caller-provided buffer. - Rename dma_handle to dma_address in the DMA abstraction. - Change pci_sriov_get_totalvfs() return type to unsigned int; add Rust helper. [1] https://github.com/ttabi/linux-firmware-nova Signed-off-by: Dave Airlie <airlied@redhat.com> From: "Danilo Krummrich" <dakr@kernel.org> Link: https://patch.msgid.link/DKJQQUOS0PVO.3JPR3MYK4PDVZ@kernel.org
generated by cgit (git 2.54.0.dirty) at 2026-09-29 14:24:39 +0000