Commit Graph

6029 Commits

Author SHA1 Message Date
e36fc5d468 UPSTREAM: bpf: Add a bpf_sock_from_file helper
While eBPF programs can check whether a file is a socket by file->f_op
== &socket_file_ops, they cannot convert the void private_data pointer
to a struct socket BTF pointer. In order to do this a new helper
wrapping sock_from_file is added.

This is useful to tracing programs but also other program types
inheriting this set of helpers such as iterators or LSM programs.

Change-Id: I4be02013a5096fee691584a29662aadeac986a85
Signed-off-by: Florent Revest <revest@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: KP Singh <kpsingh@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201204113609.1850150-2-revest@google.com
2026-05-31 11:15:44 +01:00
6219522ddc UPSTREAM: bpf: Allow to specify kernel module BTFs when attaching BPF programs
Add ability for user-space programs to specify non-vmlinux BTF when attaching
BTF-powered BPF programs: raw_tp, fentry/fexit/fmod_ret, LSM, etc. For this,
attach_prog_fd (now with the alias name attach_btf_obj_fd) should specify FD
of a module or vmlinux BTF object. For backwards compatibility reasons,
0 denotes vmlinux BTF. Only kernel BTF (vmlinux or module) can be specified.

Change-Id: I6d174e6e1c03b0b6bbf647d35b07f97fc2d558cc
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201203204634.1325171-11-andrii@kernel.org
2026-05-31 11:15:43 +01:00
00c4691305 UPSTREAM: bpf: Add a BPF helper for getting the IMA hash of an inode
Provide a wrapper function to get the IMA hash of an inode. This helper
is useful in fingerprinting files (e.g executables on execution) and
using these fingerprints in detections like an executable unlinking
itself.

Since the ima_inode_hash can sleep, it's only allowed for sleepable
LSM hooks.

Change-Id: Ic513bbccdb40acbac0bb6aadfa54d266b1bf6da4
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20201124151210.1081188-3-kpsingh@chromium.org
2026-05-31 11:15:42 +01:00
94a767b958 UPSTREAM: bpf: Add bpf_ktime_get_coarse_ns helper
The helper uses CLOCK_MONOTONIC_COARSE source of time that is less
accurate but more performant.

We have a BPF CGROUP_SKB firewall that supports event logging through
bpf_perf_event_output(). Each event has a timestamp and currently we use
bpf_ktime_get_ns() for it. Use of bpf_ktime_get_coarse_ns() saves ~15-20
ns in time required for event logging.

bpf_ktime_get_ns():
EgressLogByRemoteEndpoint                              113.82ns    8.79M

bpf_ktime_get_coarse_ns():
EgressLogByRemoteEndpoint                               95.40ns   10.48M

Change-Id: I63aee280613cf00335dd3e60a02448213a7a80a6
Signed-off-by: Dmitrii Banshchikov <me@ubique.spb.ru>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201117184549.257280-1-me@ubique.spb.ru
2026-05-31 11:15:42 +01:00
a214855f35 UPSTREAM: bpf: Add bpf_bprm_opts_set helper
The helper allows modification of certain bits on the linux_binprm
struct starting with the secureexec bit which can be updated using the
BPF_F_BPRM_SECUREEXEC flag.

secureexec can be set by the LSM for privilege gaining executions to set
the AT_SECURE auxv for glibc.  When set, the dynamic linker disables the
use of certain environment variables (like LD_PRELOAD).

Change-Id: I78b8a1a29bb5aa57e63c43cee71ad2a37364f24d
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201117232929.2156341-1-kpsingh@chromium.org
2026-05-31 11:15:42 +01:00
f87b7f1d1d UPSTREAM: bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO
Allocate ID for vmlinux BTF. This makes it visible when iterating over all BTF
objects in the system. To allow distinguishing vmlinux BTF (and later kernel
module BTF) from user-provided BTFs, expose extra kernel_btf flag, as well as
BTF name ("vmlinux" for vmlinux BTF, will equal to module's name for module
BTF).  We might want to later allow specifying BTF name for user-provided BTFs
as well, if that makes sense. But currently this is reserved only for
in-kernel BTFs.

Having in-kernel BTFs exposed IDs will allow to extend BPF APIs that require
in-kernel BTF type with ability to specify BTF types from kernel modules, not
just vmlinux BTF. This will be implemented in a follow up patch set for
fentry/fexit/fmod_ret/lsm/etc.

Change-Id: I3df5e8be24d2fc54310a8fb4d8d131b3326ee53a
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20201110011932.3201430-3-andrii@kernel.org
2026-05-31 11:15:41 +01:00
695fb76129 UPSTREAM: bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID
The currently available bpf_get_current_task returns an unsigned integer
which can be used along with BPF_CORE_READ to read data from
the task_struct but still cannot be used as an input argument to a
helper that accepts an ARG_PTR_TO_BTF_ID of type task_struct.

In order to implement this helper a new return type, RET_PTR_TO_BTF_ID,
is added. This is similar to RET_PTR_TO_BTF_ID_OR_NULL but does not
require checking the nullness of returned pointer.

Change-Id: I4affb95b77b781d7949a09ad9593570b99edca14
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201106103747.2780972-6-kpsingh@chromium.org
2026-05-31 11:15:41 +01:00
22d809d25e UPSTREAM: bpf: Implement task local storage
Similar to bpf_local_storage for sockets and inodes add local storage
for task_struct.

The life-cycle of storage is managed with the life-cycle of the
task_struct.  i.e. the storage is destroyed along with the owning task
with a callback to the bpf_task_storage_free from the task_free LSM
hook.

The BPF LSM allocates an __rcu pointer to the bpf_local_storage in
the security blob which are now stackable and can co-exist with other
LSMs.

The userspace map operations can be done by using a pid fd as a key
passed to the lookup, update and delete operations.

Change-Id: I7845e53a3c05561d4d44bbd6eee082d1ca8fa9eb
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201106103747.2780972-3-kpsingh@chromium.org
2026-05-31 11:15:41 +01:00
8ede132369 UPSTREAM: pidfd: add P_PIDFD to waitid()
This adds the P_PIDFD type to waitid().
One of the last remaining bits for the pidfd api is to make it possible
to wait on pidfds. With P_PIDFD added to waitid() the parts of userspace
that want to use the pidfd api to exclusively manage processes can do so
now.

One of the things this will unblock in the future is the ability to make
it possible to retrieve the exit status via waitid(P_PIDFD) for
non-parent processes if handed a _suitable_ pidfd that has this feature
set. This is similar to what you can do on FreeBSD with kqueue(). It
might even end up being possible to wait on a process as a non-parent if
an appropriate property is enabled on the pidfd.

With P_PIDFD no scoping of the process identified by the pidfd is
possible, i.e. it explicitly blocks things such as wait4(-1), wait4(0),
waitid(P_ALL), waitid(P_PGID) etc. It only allows for semantics
equivalent to wait4(pid), waitid(P_PID). Users that need scoping should
rely on pid-based wait*() syscalls for now.

Change-Id: I4cb094e2ac1af569361062b7286bde93a24858f7
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Andy Lutomirsky <luto@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lore.kernel.org/r/20190727222229.6516-2-christian@brauner.io
2026-05-31 11:15:41 +01:00
30beff131b UPSTREAM: dma-buf: heaps: Use _IOCTL_ for userspace IOCTL identifier
This is more consistent with the DMA and DRM frameworks convention. This
patch is only a name change, no logic is changed.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20191216133405.1001-2-afd@ti.com

Bug: 162857866
(cherry picked from commit b3b4346544b571c96d46be615b9db69a601ce4c8)
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Change-Id: I745294e2c01eaaa731c366ac0a8ef473fb8d7a28
2026-05-31 11:15:35 +01:00
faed0d4603 UPSTREAM: dma-buf: Add dma-buf heaps framework
This framework allows a unified userspace interface for dma-buf
exporters, allowing userland to allocate specific types of memory
for use in dma-buf sharing.

Each heap is given its own device node, which a user can allocate
a dma-buf fd from using the DMA_HEAP_IOC_ALLOC.

This code is an evoluiton of the Android ION implementation,
and a big thanks is due to its authors/maintainers over time
for their effort:
  Rebecca Schultz Zavin, Colin Cross, Benjamin Gaignard,
  Laura Abbott, and many other contributors!

Cc: Laura Abbott <labbott@redhat.com>
Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Liam Mark <lmark@codeaurora.org>
Cc: Pratik Patel <pratikp@codeaurora.org>
Cc: Brian Starkey <Brian.Starkey@arm.com>
Cc: Vincent Donnefort <Vincent.Donnefort@arm.com>
Cc: Sudipto Paul <Sudipto.Paul@arm.com>
Cc: Andrew F. Davis <afd@ti.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Chenbo Feng <fengc@google.com>
Cc: Alistair Strachan <astrachan@google.com>
Cc: Hridya Valsaraju <hridya@google.com>
Cc: Sandeep Patil <sspatil@google.com>
Cc: Hillf Danton <hdanton@sina.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Brian Starkey <brian.starkey@arm.com>
Acked-by: Sandeep Patil <sspatil@android.com>
Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20191203172641.66642-2-john.stultz@linaro.org

Bug: 162857866
(cherry picked from commit c02a81fba74fe3488ad6b08bfb5a1329005418f8)
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Change-Id: I4efff280bee0003e164d4ea4a3e327c1f1b5d433
2026-05-31 11:15:35 +01:00
2fadb0a6a4 UPSTREAM: Add udmabuf misc device
A driver to let userspace turn memfd regions into dma-bufs.

Use case:  Allows qemu create dmabufs for the vga framebuffer or
virtio-gpu ressources.  Then they can be passed around to display
those guest things on the host.  To spice client for classic full
framebuffer display, and hopefully some day to wayland server for
seamless guest window display.

qemu test branch:
  https://git.kraxel.org/cgit/qemu/log/?h=sirius/udmabuf

Cc: David Airlie <airlied@linux.ie>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Change-Id: I5cce2b2f4a968f27564ea8008ff1194338b6a775
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20180827093444.23623-1-kraxel@redhat.com
2026-05-31 11:15:33 +01:00
6982efdd89 UPSTREAM: nexthop: support for fdb ecmp nexthops
This patch introduces ecmp nexthops and nexthop groups
for mac fdb entries. In subsequent patches this is used
by the vxlan driver fdb entries. The use case is
E-VPN multihoming [1,2,3] which requires bridged vxlan traffic
to be load balanced to remote switches (vteps) belonging to
the same multi-homed ethernet segment (This is analogous to
a multi-homed LAG but over vxlan).

Changes include new nexthop flag NHA_FDB for nexthops
referenced by fdb entries. These nexthops only have ip.
This patch includes appropriate checks to avoid routes
referencing such nexthops.

example:
$ip nexthop add id 12 via 172.16.1.2 fdb
$ip nexthop add id 13 via 172.16.1.3 fdb
$ip nexthop add id 102 group 12/13 fdb

$bridge fdb add 02:02:00:00:00:13 dev vxlan1000 nhid 101 self

[1] E-VPN https://tools.ietf.org/html/rfc7432
[2] E-VPN VxLAN: https://tools.ietf.org/html/rfc8365
[3] LPC talk with mention of nexthop groups for L2 ecmp
http://vger.kernel.org/lpc_net2018_talks/scaling_bridge_fdb_database_slidesV3.pdf

v4 - fixed uninitialized variable reported by kernel test robot
Reported-by: kernel test robot <rong.a.chen@intel.com>

Change-Id: Ifcb70362fedda68775c879192a62b8cae8e574e0
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-05-31 11:15:32 +01:00
23ea704e18 Merge tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip132

* tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.10.254.
  x86/CPU: Fix FPDSS on Zen1
  seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  netfilter: nft_ct: fix use-after-free in timeout object destroy
  apparmor: fix differential encoding verification
  apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  ext4: convert inline data to extents when truncate exceeds inline size
  virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
  ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  crypto: authencesn - Fix src offset when decrypting in-place
  crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  crypto: authenc - use memcpy_sglist() instead of null skcipher
  crypto: algif_aead - snapshot IV for async AEAD requests
  crypto: algif_aead - Revert to operating out-of-place
  crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
  Buffer overflow in drivers/xen/sys-hypervisor.c
  xen/privcmd: fix double free via VMA splitting
  crypto: algif_aead - Fix minimum RX size check for decryption
  crypto: scatterwalk - Backport memcpy_sglist()
  batman-adv: avoid OGM aggregation when skb tailroom is insufficient
  device property: Check fwnode->secondary when finding properties
  device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
  device property: Retrieve fwnode from of_node via accessor
  media: device property: Return true in fwnode_device_is_available for NULL ops
  ext4: fix the might_sleep() warnings in kvfree()
  mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
  usb: gadget: f_hid: move list and spinlock inits from bind to alloc
  net: rfkill: prevent unlimited numbers of rfkill events from being created
  cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
  cpufreq: governor: Free dbs_data directly when gov->init() fails
  xen/privcmd: unregister xenstore notifier on module exit
  rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
  net: stmmac: fix integer underflow in chain mode
  net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
  mmc: vub300: fix NULL-deref on disconnect
  net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
  batman-adv: reject oversized global TT response buffers
  arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
  arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
  wifi: brcmsmac: Fix dma_free_coherent() size
  tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  apparmor: fix unprivileged local user can do privileged policy management
  apparmor: Fix double free of ns_name in aa_replace_profiles()
  apparmor: fix side-effect bug in match_char() macro usage
  apparmor: fix: limit the number of levels of policy namespaces
  apparmor: replace recursive profile removal with iterative approach
  apparmor: fix memory leak in verify_header
  apparmor: validate DFA start states are in bounds in unpack_pdb
  mm/rmap: fix two comments related to huge_pmd_unshare()
  mm/hugetlb: fix two comments related to huge_pmd_unshare()
  mm/hugetlb: make detecting shared pte more reliable
  Input: uinput - take event lock when submitting FF request "event"
  Input: uinput - fix circular locking dependency with ff-core
  xfrm_user: fix info leak in build_report()
  wifi: rt2x00usb: fix devres lifetime
  usb: gadget: f_uac1_legacy: validate control request size
  usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
  USB: dummy-hcd: Fix locking/synchronization error
  vxlan: validate ND option lengths in vxlan_na_create
  comedi: me4000: Fix potential overrun of firmware buffer
  comedi: me_daq: Fix potential overrun of firmware buffer
  comedi: ni_atmio16d: Fix invalid clean-up after failed attach
  comedi: Reinit dev->spinlock between attachments to low-level drivers
  comedi: dt2815: add hardware detection to prevent crash
  bridge: br_nd_send: validate ND option lengths
  usb: ulpi: fix double free in ulpi_register_interface() error path
  usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
  iio: gyro: mpu3050: Fix out-of-sequence free_irq()
  iio: gyro: mpu3050: Move iio_device_register() to correct location
  iio: gyro: mpu3050: Fix irq resource leak
  iio: gyro: mpu3050: Fix incorrect free_irq() variable
  Input: xpad - add support for Razer Wolverine V3 Pro
  USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
  USB: serial: option: add support for Rolling Wireless RW135R-GL
  USB: serial: io_edgeport: add support for Blackbox IC135A
  drm/ast: dp501: Fix initialization of SCU2C
  MIPS: Fix the GCC version check for `__multi3' workaround
  Bluetooth: SMP: force responder MITM requirements before building the pairing response
  Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  ALSA: ctxfi: Fix missing SPDIFI1 index handling
  ALSA: caiaq: fix stack out-of-bounds read in init_card
  USB: serial: option: add MeiG Smart SRM825WN
  drm/ioc32: stop speculation on the drm_compat_ioctl path
  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
  drm/vmwgfx: Add seqno waiter for sync_files
  Revert "drm/vmwgfx: Add seqno waiter for sync_files"
  ipv6: avoid overflows in ip6_datagram_send_ctl()
  net/sched: cls_flow: fix NULL pointer dereference on shared blocks
  net/sched: cls_fw: fix NULL pointer dereference on shared blocks
  net/x25: Fix overflow when accumulating packets
  net/x25: Fix potential double free of skb
  net: macb: properly unregister fixed rate clocks
  net: macb: fix clk handling on PCI glue driver removal
  Bluetooth: MGMT: validate LTK enc_size on load
  netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
  netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
  netfilter: nf_conntrack_helper: pass helper to expect cleanup
  netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
  netfilter: x_tables: ensure names are nul-terminated
  netfilter: nfnetlink_log: account for netlink header size
  net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  bpf: Fix regsafe() for pointers to packet
  net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
  ipv6: prevent possible UaF in addrconf_permanent_addr()
  net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
  bridge: br_nd_send: linearize skb before parsing ND options
  ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  tg3: Fix race for querying speed/duplex
  net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
  crypto: af-alg - fix NULL pointer dereference in scatterwalk
  HID: multitouch: Check to ensure report responses match the request
  atm: lec: fix use-after-free in sock_def_readable()
  HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
  dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
  dmaengine: xilinx_dma: Program interrupt delay timeout
  btrfs: fix lost error when running device stats on multiple devices fs
  btrfs: fix super block offset in error message in btrfs_validate_super()
  dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
  dmaengine: xilinx: xilinx_dma: Fix dma_device directions
  ext4: reject mount if bigalloc with s_first_data_block != 0
  ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
  ext4: make recently_deleted() properly work with lazy itable initialization
  scsi: ses: Handle positive SCSI error from ses_recv_diag()
  scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  alarmtimer: Fix argument order in alarm_timer_forward()
  cpufreq: conservative: Reset requested_freq on limits change
  s390/barrier: Make array_index_mask_nospec() __always_inline
  sysctl: fix uninitialized variable in proc_do_large_bitmap
  ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
  ACPICA: include/acpi/acpixf.h: Fix indentation
  drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
  scsi: scsi_transport_sas: Fix the maximum channel scanning issue
  RDMA/rw: Fall back to direct SGE on MR pool exhaustion
  net: macb: use the current queue number for stats
  netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
  netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
  Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
  net: fix fanout UAF in packet_release() via NETDEV_UP race
  rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
  openvswitch: validate MPLS set/set_masked payload length
  net: openvswitch: Avoid releasing netdev before teardown completes
  pinctrl: mediatek: common: Fix probe failure for devices without EINT
  Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
  Bluetooth: hci_ll: Fix firmware leak on error path
  Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
  af_key: validate families in pfkey_send_migrate()
  xfrm: call xdo_dev_state_delete during state update
  dma-buf: Include ioctl.h in UAPI header
  xen/privcmd: restrict usage in unprivileged domU
  i2c: fsi: Fix a potential leak in fsi_i2c_probe()
  icmp: fix NULL pointer dereference in icmp_tag_validation()
  nfnetlink_osf: validate individual option lengths in fingerprints
  net: bonding: fix NULL deref in bond_debug_rlb_hash_show
  udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
  net: macb: fix uninitialized rx_fs_lock
  wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
  wifi: mac80211: fix NULL deref in mesh_matches_local()
  PM: runtime: Fix a race condition related to device removal
  net: bcmgenet: increase WoL poll timeout
  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  netfilter: xt_time: use unsigned int for monthday bit shift
  netfilter: xt_CT: drop pending enqueued packets on template removal
  netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
  netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
  netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
  netfilter: ctnetlink: remove refcounting in expectation dumpers
  net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
  Bluetooth: HIDP: Fix possible UAF
  Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
  Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
  Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
  staging: rtl8723bs: fix null dereference in find_network
  net/tcp-md5: Fix MAC comparison to be constant-time
  ALSA: pcm: fix wait_time calculations
  can: gs_usb: gs_can_open(): always configure bitrates before starting device
  usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
  nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
  smb: client: fix iface port assignment in parse_server_interfaces
  iio: light: bh1780: fix PM runtime leak on error path
  tracing: Fix syscall events activation by ensuring refcount hits zero
  s390/xor: Fix xor_xc_2() inline assembly constraints
  drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
  smb: client: Don't log plaintext credentials in cifs_set_cifscreds
  wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
  wifi: libertas: fix use-after-free in lbs_free_adapter()
  ext4: fix dirtyclusters double decrement on fs shutdown
  ext4: drop extent cache when splitting extent fails
  drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
  net: Handle napi_schedule() calls from non-interrupt
  drm/radeon: apply state adjust rules to some additional HAINAN vairants
  serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
  Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  net: macb: fix use-after-free access to PTP clock
  nvdimm/bus: Fix potential use after free in asynchronous initialization
  iio: chemical: bme680: Fix measurement wait duration calculation
  iio: potentiometer: mcp4131: fix double application of wiper shift
  iio: dac: ds4424: reject -128 RAW value
  btrfs: abort transaction on failure to update root in the received subvol ioctl
  x86/apic: Disable x2apic on resume if the kernel expects so
  drm/amdgpu: Fix use-after-free race in VM acquire
  net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
  net: ncsi: fix skb leak in error paths
  parisc: Fix initial page table creation for boot
  nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
  parisc: Increase initial mapping to 64 MB with KALLSYMS
  batman-adv: Avoid double-rtnl_lock ELP metric worker
  media: dvb-net: fix OOB access in ULE extension header tables
  staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
  libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
  usb: image: mdc800: kill download URB on timeout
  usb: mdc800: handle signal and read racing
  usb: class: cdc-wdm: fix reordering issue in read code path
  USB: usbcore: Introduce usb_bulk_msg_killable()
  usb: misc: uss720: properly clean up reference in uss720_probe()
  usb: yurex: fix race in probe
  usb: xhci: Fix memory leak in xhci_disable_slot()
  usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
  net: usb: lan78xx: skip LTM configuration for LAN7850
  net: usb: lan78xx: fix silent drop of packets with checksum errors
  cgroup: fix race between task migration and iteration
  e1000/e1000e: Fix leak in DMA error cleanup
  i40e: fix src IP mask checks and memcpy argument names in cloud filter
  nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
  sched: idle: Make skipping governor callbacks more consistent
  netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
  netfilter: x_tables: guard option walkers against 1-byte tail reads
  can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
  serial: caif: hold tty->link reference in ldisc_open and ser_release
  net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
  powerpc: 83xx: km83xx: Fix keymile vendor prefix
  remoteproc: sysmon: Correct subsys_name_len type in QMI request
  powerpc/uaccess: Fix inline assembly for clang build on PPC32
  scsi: ses: Fix devices attaching to different hosts
  ACPI: OSI: Add DMI quirk for Acer Aspire One D255
  unshare: fix unshare_fs() handling
  ACPI: PM: Save NVS memory on Lenovo G70-35
  scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  nfc: rawsock: cancel tx_work before socket teardown
  nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
  nfc: nci: free skb on nci_transceive early error paths
  net: nfc: nci: Fix zero-length proprietary notifications
  amd-xgbe: fix sleep while atomic on suspend/resume
  xen/acpi-processor: fix _CST detection using undersized evaluation buffer
  wifi: wlcore: Fix a locking bug
  can: bcm: fix locking for bcm_op runtime updates
  atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
  platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
  drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
  Squashfs: check metadata block offset is within range
  wifi: radiotap: reject radiotap with unknown bits
  ALSA: usb-audio: Use correct version for UAC3 header validation
  can: ucan: Fix infinite loop from zero-length messages
  can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
  net: usb: pegasus: validate USB endpoints
  net: usb: kalmia: validate USB endpoints
  net: usb: kaweth: validate USB endpoints
  nfc: pn533: properly drop the usb interface reference on disconnect
  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  net: arcnet: com20020-pci: fix support for 2.5Mbit cards
  ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
  clk: tegra: tegra124-emc: fix device leak on set_rate()
  drm/tegra: dsi: fix device leak on probe
  ARM: omap2: Fix reference count leaks in omap_control_init()
  ARM: OMAP2+: add missing of_node_put before break and return
  ARM: clean up the memset64() C wrapper

Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f
2026-05-12 18:00:02 +01:00
77c55edd80 dma-buf: Include ioctl.h in UAPI header
[ Upstream commit a116bac87118903925108e57781bbfc7a7eea27b ]

include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define
its ioctl commands. However, it does not include ioctl.h itself. So,
if userspace source code tries to include the dma-buf.h file without
including ioctl.h, it can result in build failures.

Therefore, include ioctl.h in the dma-buf UAPI header.

Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260303002309.1401849-1-isaacmanjarres@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-05-07 10:55:20 +02:00
b0da80ea68 Merge tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip131

* tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip131 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.10.252.
  nfsd: fix return error code for nfsd_map_name_to_[ug]id
  net: usb: pegasus: enable basic endpoint checking
  Bluetooth: L2CAP: Fix not checking l2cap_chan security level
  Bluetooth: Enforce key size of 16 bytes on FIPS level
  xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
  netfilter: nf_conntrack: Add allow_clash to generic protocol handler
  ext4: don't cache extent during splitting extent
  NTB: ntb_transport: Fix too small buffer for debugfs_name
  net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
  fbdev: ffb: fix corrupted video output on Sun FFB1
  fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
  atm: fore200e: fix use-after-free in tasklets during device removal
  net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
  net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
  ceph: supply snapshot context in ceph_zero_partial_object()
  MIPS: rb532: Fix MMIO UART resource registration
  parisc: kernel: replace kfree() with put_device() in create_tree_node()
  drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  usb: dwc2: fix resume failure if dr_mode is host
  btrfs: continue trimming remaining devices on failure
  kexec: derive purgatory entry from symbol
  ocfs2: fix reflink preserve cleanup issue
  ocfs2: fix xattr array entry __counted_by error
  rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
  iio: gyro: itg3200: Fix unchecked return value in read_raw
  dm mpath: make pg_init_delay_msecs settable
  bus: fsl-mc: fix an error handling in fsl_mc_device_add()
  md/bitmap: fix GPF in write_page caused by resize race
  xfs: fix remote xattr valuelblk check
  xfs: fix freemap adjustments when adding xattrs to leaf blocks
  xfs: delete attr leaf freemap entries when empty
  xfs: mark data structures corrupt on EIO and ENODATA
  mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
  drm: of: drm_of_panel_bridge_remove(): fix device_node leak
  dm-unstripe: fix mapping bug when there are multiple targets in a table
  clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc()
  dm: clear cloned request bio pointer when last clone bio completes
  media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
  media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
  media: cx25821: Add missing unmap in snd_cx25821_hw_params()
  media: cx23885: Add missing unmap in snd_cx23885_hw_params()
  media: cx88: Add missing unmap in snd_cx88_hw_params()
  media: radio-keene: fix memory leak in error path
  HID: prodikeys: Check presence of pm->input_ep82
  HID: magicmouse: Do not crash on missing msc->input
  HID: hid-pl: handle probe errors
  media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
  dm-verity: correctly handle dm_bufio_client_create() failure
  fpga: dfl: use subsys_initcall to allow built-in drivers to be added
  rpmsg: core: fix race in driver_override_show() and use core helper
  netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
  net: consume xmit errors of GSO frames
  Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  Bluetooth: l2cap: Check encryption key size on incoming connection
  wifi: cfg80211: wext: fix IGTK key ID off-by-one
  net: usb: lan78xx: scan all MDIO addresses on LAN7801
  lan78xx: Fix memory allocation bug
  lan78xx: Fix race condition in disconnect handling
  lan78xx: Remove unused pause frame queue
  net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
  ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
  drm/radeon: Add HAINAN clock adjustment
  drm/amdgpu: Add HAINAN clock adjustment
  ARM: 9467/1: mm: Don't use %pK through printk
  include: uapi: netfilter_bridge.h: Cover for musl libc
  iio: magnetometer: Remove IRQF_ONESHOT
  Revert "mfd: da9052-spi: Change read-mask to write-mask"
  binder: don't use %pK through printk
  serial: 8250_dw: handle clock enable errors in runtime_resume
  m68k: nommu: fix memmove() with differently aligned src and dest for 68000
  clk: microchip: core: correct return value on *_get_parent()
  nfc: nxp-nci: remove interrupt trigger type
  myri10ge: avoid uninitialized variable use
  PCI: Mark Nvidia GB10 to avoid bus reset
  PCI: Fix pci_slot_lock () device locking
  PCI: Mark ASM1164 SATA controller to avoid bus reset
  net/rds: Clear reconnect pending bit
  vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
  net: usb: sr9700: remove code to drive nonexistent multicast filter
  Bluetooth: btusb: Add device ID for Realtek RTL8761BU
  Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
  ipv4: fib: Annotate access to struct fib_alias.fa_state.
  wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
  wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
  net/rds: No shortcut out of RDS_CONN_ERROR
  net: usb: r8152: fix transmit queue timeout
  openrisc: define arch-specific version of nop()
  netfilter: xt_tcpmss: check remaining length before reading optlen
  wifi: libertas: fix WARNING in usb_tx_block
  jfs: nlink overflow in jfs_rename
  jfs: Add missing set_freezable() for freezable kthread
  modpost: Amend ppc64 save/restfpr symnames for -Os build
  ASoC: es8328: Add error unwind in resume
  HID: multitouch: add eGalaxTouch EXC3188 support
  drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
  drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
  virt: vbox: uapi: Mark inner unions in packed structs as packed
  hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
  drm: Account property blob allocations to memcg
  media: cx25821: Fix a resource leak in cx25821_dev_setup()
  media: solo6x10: Check for out of bounds chip_id
  media: pvrusb2: fix URB leak in pvr2_send_request_ex
  media: adv7180: fix frame interval in progressive mode
  ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
  media: omap3isp: set initial format
  media: omap3isp: isppreview: always clamp in preview_try_format()
  media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
  media: dvb-core: dmxdevfilter must always flush bufs
  parisc: Prevent interrupts during reboot
  arm64: tegra: smaug: Add usb-role-switch support
  pstore: ram_core: fix incorrect success return when vmap() fails
  mailbox: bcm-ferxrm-mailbox: Use default primary handler
  clocksource/drivers/sh_tmu: Always leave device running after probe
  sparc: don't reference obsolete termio struct for TC* constants
  xenbus: Use .freeze/.thaw to handle xenbus devices
  ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
  EFI/CPER: don't go past the ARM processor CPER record buffer
  x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set
  s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
  tools/power cpupower: Reset errno before strtoull()
  minix: Add required sanity checking to minix_check_superblock()
  hfsplus: pretend special inodes as regular files
  audit: add missing syscalls to read class
  hfsplus: fix volume corruption issue for generic/498
  audit: add fchmodat2() to change attributes class
  rtc: interface: Alarm race handling should not discard preceding error
  SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
  SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
  ata: pata_ftide010: Fix some DMA timings
  ext4: fix memory leak in ext4_ext_shift_extents()
  MIPS: Work around LLVM bug when gp is used as global register variable
  apparmor: fix invalid deref of rawdata when export_binary is unset
  apparmor: fix rlimit for posix cpu timers
  apparmor: fix NULL sock in aa_sock_file_perm
  bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
  net/rds: rds_sendmsg should not discard payload_len
  xen-netback: reject zero-queue configuration from guest
  net: usb: catc: enable basic endpoint checking
  usbb: catc: use correct API for MAC addresses
  cpuidle: Skip governor when only one idle state is available
  pinctrl: single: fix refcount leak in pcs_add_gpio_func()
  iio: sca3000: Fix a resource leak in sca3000_probe()
  ovl: Fix uninit-value in ovl_fill_real
  drivers: iio: mpu3050: use dev_err_probe for regulator request
  mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure
  Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
  mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
  mmc: core: Initial support for SD express card/host
  serial: SH_SCI: improve "DMA support" prompt
  staging: greybus: lights: avoid NULL deref
  fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
  tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
  scsi: csiostor: Fix dereference of null pointer rn
  pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
  svcrdma: Remove queue-shortening warnings
  RDMA/core: Fix a couple of obvious typos in comments
  power: supply: wm97xx_battery: Convert to GPIO descriptor
  power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
  power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
  power: supply: rt9455: Fix use-after-free in power_supply_changed()
  power: supply: act8945a: Fix use-after-free in power_supply_changed()
  serial: caif: fix use-after-free in caif_serial ldisc_close()
  net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
  netfilter: nft_set_hash: fix get operation on big endian
  bonding: only set speed/duplex to unknown, if getting speed failed
  ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
  tcp: tcp_tx_timestamp() must look at the rtx queue
  fat: avoid parent link count underflow in rmdir
  PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
  netfilter: nf_conncount: fix tracking of connections from localhost
  netfilter: nf_conncount: increase the connection clean up limit to 64
  netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
  wifi: cfg80211: stop NAN and P2P in cfg80211_leave
  PCI/portdrv: Fix potential resource leak
  PCI: Do not attempt to set ExtTag for VFs
  PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
  Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  spi: tools: Add include folder to .gitignore
  regulator: Flag uncontrollable regulators as always_on
  regulator: core: Respect off_on_delay at startup
  smack: /smack/doi: accept previously used values
  smack: /smack/doi must be > 0
  arm64: dts: amlogic: gx: assign the MMC signal clocks
  ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
  EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
  EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
  pstore/ram: fix buffer overflow in persistent_ram_save_old()
  sched/rt: Skip currently executing CPU in rto_next_cpu()
  mfd: wm8350-core: Use IRQF_ONESHOT
  EDAC/altera: Remove IRQF_ONESHOT
  hrtimer: Fix trace oddity
  crypto: cavium - fix dma_free_coherent() size
  s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
  PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
  md/raid10: fix any_working flag handling in raid10_sync_request
  tpm: st33zp24: Fix missing cleanup on get_burstcount() error
  tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
  gfs2: Add metapath_dibh helper
  gfs2: Add wrapper for iomap_file_buffered_write
  fs: add <linux/init_task.h> for 'init_fs'
  hfsplus: return error when node already exists in hfs_bnode_create
  auxdisplay: arm-charlcd: fix release_mem_region() size
  RDMA/umad: Reject negative data_len in ib_umad_write

Change-Id: Ice1efa8b2faaaab14d1d1563e5aa6ae36549682b
2026-04-22 07:08:43 +01:00
a686f26bf5 include: uapi: netfilter_bridge.h: Cover for musl libc
[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]

Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
zero. To avoid struct redefinition errors, user space is therefore
supposed to include netinet/if_ether.h before (or instead of)
linux/if_ether.h. To relieve them from this burden, include the libc
header here if not building for kernel space.

Reported-by: Alyssa Ross <hi@alyssa.is>
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-04-12 13:56:48 +08:00
276459f34f virt: vbox: uapi: Mark inner unions in packed structs as packed
[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]

The unpacked unions within a packed struct generates alignment warnings
on clang for 32-bit ARM:

./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
  is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
  and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
  which can lead to unaligned accesses [-Werror,-Wunaligned-access]
     239 |         } u;
         |           ^

./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
  'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
  is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
  'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
  being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]

With the recent changes to compile-test the UAPI headers in more cases,
these warning in combination with CONFIG_WERROR breaks the build.

Fix the warnings.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Tested-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-04-12 13:56:47 +08:00
e1c5814fcf hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]

The unpacked union within a packed struct generates alignment warnings
on clang for 32-bit ARM:

./usr/include/linux/hyperv.h:361:2: error: field  within 'struct hv_kvp_exchg_msg_value'
  is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
  and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
  which can lead to unaligned accesses [-Werror,-Wunaligned-access]
     361 |         union {
         |         ^

With the recent changes to compile-test the UAPI headers in more cases,
this warning in combination with CONFIG_WERROR breaks the build.

Fix the warning.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
Tested-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-04-12 13:56:46 +08:00
56ce939ed0 UPSTREAM: geneve: Allow configuration of DF behaviour
draft-ietf-nvo3-geneve-08 says:

   It is strongly RECOMMENDED that Path MTU Discovery ([RFC1191],
   [RFC1981]) be used by setting the DF bit in the IP header when Geneve
   packets are transmitted over IPv4 (this is the default with IPv6).

Now that ICMP error handling is working for GENEVE, we can comply with
this recommendation.

Make this configurable, though, to avoid breaking existing setups. By
default, DF won't be set. It can be set or inherited from inner IPv4
packets. If it's configured to be inherited and we are encapsulating IPv6,
it will be set.

This only applies to non-lwt tunnels: if an external control plane is
used, tunnel key will still control the DF flag.

v2:
- DF behaviour configuration only applies for non-lwt tunnels, apply DF
  setting only if (!geneve->collect_md) in geneve_xmit_skb()
  (Stephen Hemminger)

Change-Id: I8c4148083e8ab7ecc7dd134d7f490f0738a04fb6
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-03-20 13:38:05 -04:00
33c2eed3f2 UPSTREAM: geneve: add ttl inherit support
Similar with commit 72f6d71e49 ("vxlan: add ttl inherit support"),
currently ttl == 0 means "use whatever default value" on geneve instead
of inherit inner ttl. To respect compatibility with old behavior, let's
add a new IFLA_GENEVE_TTL_INHERIT for geneve ttl inherit support.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jiri Benc <jbenc@redhat.com>
Change-Id: I6bdec79ff810c7609fca9be6eab5bcfed23547e4
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-03-20 13:38:05 -04:00
f2dc54176e UPSTREAM: ipv4: Add "offload" and "trap" indications to routes
When performing L3 offload, routes and nexthops are usually programmed
into two different tables in the underlying device. Therefore, the fact
that a nexthop resides in hardware does not necessarily mean that all
the associated routes also reside in hardware and vice-versa.

While the kernel can signal to user space the presence of a nexthop in
hardware (via 'RTNH_F_OFFLOAD'), it does not have a corresponding flag
for routes. In addition, the fact that a route resides in hardware does
not necessarily mean that the traffic is offloaded. For example,
unreachable routes (i.e., 'RTN_UNREACHABLE') are programmed to trap
packets to the CPU so that the kernel will be able to generate the
appropriate ICMP error packet.

This patch adds an "offload" and "trap" indications to IPv4 routes, so
that users will have better visibility into the offload process.

'struct fib_alias' is extended with two new fields that indicate if the
route resides in hardware or not and if it is offloading traffic from
the kernel or trapping packets to it. Note that the new fields are added
in the 6 bytes hole and therefore the struct still fits in a single
cache line [1].

Capable drivers are expected to invoke fib_alias_hw_flags_set() with the
route's key in order to set the flags.

The indications are dumped to user space via a new flags (i.e.,
'RTM_F_OFFLOAD' and 'RTM_F_TRAP') in the 'rtm_flags' field in the
ancillary header.

v2:
* Make use of 'struct fib_rt_info' in fib_alias_hw_flags_set()

[1]
struct fib_alias {
        struct hlist_node  fa_list;                      /*     0    16 */
        struct fib_info *          fa_info;              /*    16     8 */
        u8                         fa_tos;               /*    24     1 */
        u8                         fa_type;              /*    25     1 */
        u8                         fa_state;             /*    26     1 */
        u8                         fa_slen;              /*    27     1 */
        u32                        tb_id;                /*    28     4 */
        s16                        fa_default;           /*    32     2 */
        u8                         offload:1;            /*    34: 0  1 */
        u8                         trap:1;               /*    34: 1  1 */
        u8                         unused:6;             /*    34: 2  1 */

        /* XXX 5 bytes hole, try to pack */

        struct callback_head rcu __attribute__((__aligned__(8))); /*    40    16 */

        /* size: 56, cachelines: 1, members: 12 */
        /* sum members: 50, holes: 1, sum holes: 5 */
        /* sum bitfield members: 8 bits (1 bytes) */
        /* forced alignments: 1, forced holes: 1, sum forced holes: 5 */
        /* last cacheline: 56 bytes */
} __attribute__((__aligned__(8)));

Change-Id: I922ddc53c253a28de2132b32a091c3363605859b
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-03-20 13:38:05 -04:00
135eff3beb UPSTREAM: net: nexthop uapi
New UAPI for nexthops as standalone objects:
- defines netlink ancillary header, struct nhmsg
- RTM commands for nexthop objects, RTM_*NEXTHOP,
- RTNLGRP for nexthop notifications, RTNLGRP_NEXTHOP,
- Attributes for creating nexthops, NHA_*
- Attribute for route specs to specify a nexthop by id, RTA_NH_ID.

The nexthop attributes and semantics follow the route and RTA ones for
device, gateway and lwt encap. Unique to nexthop objects are a blackhole
and a group which contains references to other nexthop objects. With the
exception of blackhole and group, nexthop objects MUST contain a device.
Gateway and encap are optional. Nexthop groups can only reference other
pre-existing nexthops by id. If the NHA_ID attribute is present that id
is used for the nexthop. If not specified, one is auto assigned.

Dump requests can include attributes:
- NHA_GROUPS to return only nexthop groups,
- NHA_MASTER to limit dumps to nexthops with devices enslaved to the
  given master (e.g., VRF)
- NHA_OIF to limit dumps to nexthops using given device

nlmsg_route_perms in selinux code is updated for the new RTM comands.

Change-Id: If128ffc0daf4640aa9a7bdb07d9149675772125e
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-03-20 13:38:03 -04:00
a984488d32 Merge tag 'v4.19.325-cip130' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip130

* tag 'v4.19.325-cip130' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip130 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.10.251.
  f2fs: fix out-of-bounds access in sysfs attribute read/write
  USB: serial: option: add Telit FN920C04 RNDIS compositions
  f2fs: fix to avoid UAF in f2fs_write_end_io()
  fbdev: rivafb: fix divide error in nv3_arb()
  scsi: qla2xxx: Fix bsg_done() causing double free
  scsi: qla2xxx: Validate sp before freeing associated memory
  scsi: qla2xxx: Free sp in error path to fix system crash
  crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
  fs: dlm: fix invalid derefence of sb_lvbptr
  gpiolib: acpi: Fix gpio count with string references
  platform/x86: classmate-laptop: Add missing NULL pointer checks
  drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
  gpio: sprd: Change sprd_gpio lock to raw_spin_lock
  gpio: omap: do not register driver in probe()
  scsi: qla2xxx: Query FW again before proceeding with login
  scsi: qla2xxx: Delay module unload while fabric scan in progress
  nilfs2: Fix potential block overflow that cause system hang
  crypto: virtio - Add spinlock protection with virtqueue notification
  crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
  CIP: Bump version suffix to -cip129 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.10.250.
  fbdev: ssd1307fb: fix build failure
  macvlan: fix possible UAF in macvlan_forward_source()
  HID: uclogic: Correct devm device reference for hidinput input_dev name
  xfs: set max_agbno to allow sparse alloc of last full inode chunk
  l2tp: avoid one data-race in l2tp_tunnel_del_work()
  platform/x86: intel_telemetry: Fix swapped arrays in PSS output
  macvlan: fix error recovery in macvlan_common_newlink()
  net: liquidio: Initialize netdev pointer before queue setup
  platform/x86: intel_telemetry: Fix PSS event register mask
  platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
  scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
  wifi: cfg80211: Fix bitrate calculation overflow for HE rates
  wifi: mac80211: collect station statistics earlier when disconnect
  ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
  HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
  HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
  HID: intel-ish-hid: Reset enum_devices_done before enumeration
  HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
  net: usb: sr9700: support devices with virtual driver CD
  wifi: wlcore: ensure skb headroom before skb_push
  wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  ARM: 9468/1: fix memset64() on big-endian
  pinctrl: meson: mark the GPIO controller as sleeping
  writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
  netfilter: nf_tables: typo NULL check in _clone() function
  ipv6: sr: Fix MAC comparison to be constant-time
  of: platform: Use default match table for /firmware
  can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
  driver core: fix potential null-ptr-deref in device_add()
  mei: trace: treat reg parameter as string
  iio: adc: exynos_adc: fix OF populate on driver rebind
  scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
  dmaengine: stm32: dmamux: fix device leak on route allocation
  nvme-fc: rename free_ctrl callback to match name pattern
  net/sched: act_ife: convert comma to semicolon
  scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
  scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
  nfc: nci: Fix race between rfkill and nci_unregister_device().
  net/mlx5e: Report rx_discards_phy via rx_dropped
  rocker: fix memory leak in rocker_world_port_post_fini()
  Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
  can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
  can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
  can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
  can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
  perf/x86/intel: Do not enable BTS for guests
  netrom: fix double-free in nr_route_frame()
  slimbus: core: fix device reference leak on report present
  slimbus: core: fix runtime PM imbalance on report present
  wifi: rsi: Fix memory corruption due to not set vif driver data size
  wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
  wifi: ath10k: fix dma_free_coherent() pointer
  mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
  ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
  ALSA: ctxfi: Fix potential OOB access in audio mixer handling
  iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
  iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
  of: fix reference count leak in of_alias_scan()
  leds: led-class: Only Add LED to leds_list when it is fully ready
  net/sched: act_ife: avoid possible NULL deref
  be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
  drm/amd/pm: Don't clear SI SMC table when setting power limit
  usbnet: limit max_mtu based on device's hard_mtu
  mISDN: annotate data-race around dev->work
  ALSA: usb: Increase volume range that triggers a warning
  regmap: Fix race condition in hwspinlock irqsave routine
  iio: adc: ad7280a: handle spi_setup() errors in probe()
  Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
  w1: fix redundant counter decrement in w1_attach_slave_device()
  comedi: dmm32at: serialize use of paged registers
  crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  net/sched: Enforce that teql can only be used as root qdisc
  ipvlan: Make the addrs_lock be per port
  net: fou: rename the source for linking
  netlink: add a proto specification for FOU
  gue: Fix skb memleak with inner IP protocol 0.
  amd-xgbe: avoid misleading per-packet error log
  sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  sctp: sm_statefuns: Fix spelling mistakes
  net: usb: dm9601: remove broken SR9700 support
  macvlan: Fix leaking skb in source mode with nodst option
  btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
  dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
  dmaengine: lpc18xx-dmamux: fix device leak on route allocation
  dmaengine: bcm-sba-raid: fix device leak on probe
  dmaengine: at_hdmac: fix device leak on of_dma_xlate()
  drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
  drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
  EDAC/i3200: Fix a resource leak in i3200_probe1()
  EDAC/x38: Fix a resource leak in x38_probe1()
  USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
  USB: serial: option: add Telit LE910 MBIM composition
  USB: OHCI/UHCI: Add soft dependencies on ehci_platform
  ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
  HID: usbhid: paper over wrong bNumDescriptor field
  dmaengine: omap-dma: fix dma_pool resource leak in error paths
  phy: stm32-usphyc: Fix off by one in probe()
  dmaengine: tegra-adma: Fix use-after-free
  textsearch: describe @list member in ts_ops search
  net/sched: sch_qfq: do not free existing class in qfq_change_class()
  ipv4: ip_gre: make ipgre_header() robust
  macvlan: Use 'hash' iterators to simplify code
  macvlan: Add nodst option to macvlan type source
  pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()

Change-Id: I4b06f63aef42258de0c0415a055c47d8e60bba88
2026-03-20 15:21:00 +00:00
981eb73054 macvlan: Add nodst option to macvlan type source
[ Upstream commit 427f0c8c194b22edcafef1b0a42995ddc5c2227d ]

The default behavior for source MACVLAN is to duplicate packets to
appropriate type source devices, and then do the normal destination MACVLAN
flow. This patch adds an option to skip destination MACVLAN processing if
any matching source MACVLAN device has the option set.

This allows setting up a "catch all" device for source MACVLAN: create one
or more devices with type source nodst, and one device with e.g. type vepa,
and incoming traffic will be received on exactly one device.

v2: netdev wants non-standard line length

Signed-off-by: Jethro Beekman <kernel@jbeekman.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 7470a7a63dc1 ("macvlan: fix possible UAF in macvlan_forward_source()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-02-20 13:22:27 +08:00
16e1462480 UPSTREAM: net: netlink: rename NETLINK_DUMP_STRICT_CHK -> NETLINK_GET_STRICT_CHK
NETLINK_DUMP_STRICT_CHK can be used for all GET requests,
dumps as well as doit handlers.  Replace the DUMP in the
name with GET make that clearer.

Change-Id: I912fa2ee9b3caf975aefc8614d3ca59543d0f566
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-02-02 18:01:37 -05:00
c28685175d UPSTREAM: netlink: Add new socket option to enable strict checking on dumps
Add a new socket option, NETLINK_DUMP_STRICT_CHK, that userspace
can use via setsockopt to request strict checking of headers and
attributes on dump requests.

To get dump features such as kernel side filtering based on data in
the header or attributes appended to the dump request, userspace
must call setsockopt() for NETLINK_DUMP_STRICT_CHK and a non-zero
value. Since the netlink sock and its flags are private to the
af_netlink code, the strict checking flag is passed to dump handlers
via a flag in the netlink_callback struct.

For old userspace on new kernel there is no impact as all of the data
checks in later patches are wrapped in a check on the new strict flag.

For new userspace on old kernel, the setsockopt will fail and even if
new userspace sets data in the headers and appended attributes the
kernel will silently ignore it. Moving forward when the setsockopt
succeeds, the new userspace on old kernel means the dump request can
pass an attribute the kernel does not understand. The dump will then
fail as the older kernel does not understand it.

New userspace on new kernel setting the socket option gets the benefit
of the improved data dump.

Kernel side the NETLINK_DUMP_STRICT_CHK uapi is converted to a generic
NETLINK_F_STRICT_CHK flag which can potentially be leveraged for tighter
checking on the NEW, DEL, and SET commands.

Change-Id: I7a4c0edf096e6a49cf0d1b5b919908408ba8e1e4
Signed-off-by: David Ahern <dsahern@gmail.com>
Acked-by: Christian Brauner <christian@brauner.io>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-02-02 18:01:37 -05:00
4d9e209b46 UPSTREAM: fs, close_range: add flag CLOSE_RANGE_CLOEXEC
When the flag CLOSE_RANGE_CLOEXEC is set, close_range doesn't
immediately close the files but it sets the close-on-exec bit.

It is useful for e.g. container runtimes that usually install a
seccomp profile "as late as possible" before execv'ing the container
process itself.  The container runtime could either do:
  1                                  2
- install_seccomp_profile();       - close_range(MIN_FD, MAX_INT, 0);
- close_range(MIN_FD, MAX_INT, 0); - install_seccomp_profile();
- execve(...);                     - execve(...);

Both alternative have some disadvantages.

In the first variant the seccomp_profile cannot block the close_range
syscall, as well as opendir/read/close/... for the fallback on older
kernels.
In the second variant, close_range() can be used only on the fds
that are not going to be needed by the runtime anymore, and it must be
potentially called multiple times to account for the different ranges
that must be closed.

Using close_range(..., ..., CLOSE_RANGE_CLOEXEC) solves these issues.
The runtime is able to use the existing open fds, the seccomp profile
can block close_range() and the syscalls used for its fallback.

Change-Id: I1c84a733698c2853a0126cd22960ada25b229c5a
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Link: https://lore.kernel.org/r/20201118104746.873084-2-gscrivan@redhat.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2025-12-31 12:15:31 +02:00
e3ff5b0bc5 UPSTREAM: close_range: add CLOSE_RANGE_UNSHARE
One of the use-cases of close_range() is to drop file descriptors just before
execve(). This would usually be expressed in the sequence:

unshare(CLONE_FILES);
close_range(3, ~0U);

as pointed out by Linus it might be desirable to have this be a part of
close_range() itself under a new flag CLOSE_RANGE_UNSHARE.

This expands {dup,unshare)_fd() to take a max_fds argument that indicates the
maximum number of file descriptors to copy from the old struct files. When the
user requests that all file descriptors are supposed to be closed via
close_range(min, max) then we can cap via unshare_fd(min) and hence don't need
to do any of the heavy fput() work for everything above min.

The patch makes it so that if CLOSE_RANGE_UNSHARE is requested and we do in
fact currently share our file descriptor table we create a new private copy.
We then close all fds in the requested range and finally after we're done we
install the new fd table.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I0813045886501e40a45693ee1edad50bdf2b66e5
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2025-12-31 12:15:31 +02:00
1dd9f9066b Merge tag 'v4.19.325-cip126' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip126

* tag 'v4.19.325-cip126' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip126 after merge from cip/linux-4.19.y-st tree
  net: ravb: Ensure memory write completes before ringing TX doorbell
  Update localversion-st, tree is up-to-date with 5.4.301.
  net: ravb: Ensure memory write completes before ringing TX doorbell
  net/ip6_tunnel: Prevent perpetual tunnel growth
  tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
  rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  media: s5p-mfc: remove an unused/uninitialized variable
  NFSD: Fix last write offset handling in layoutcommit
  NFSD: Minor cleanup in layoutcommit processing
  KEYS: trusted_tpm1: Compare HMAC values in constant time
  NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  vfs: Don't leak disconnected dentries on umount
  ext4: detect invalid INLINE_DATA + EXTENTS flag combination
  drm/amdgpu: use atomic functions with memory barriers for vm fault info
  ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
  spi: cadence-quadspi: Flush posted register writes before DAC access
  spi: cadence-quadspi: Flush posted register writes before INDAC access
  memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  memory: samsung: exynos-srom: Correct alignment
  arm64: cputype: Add Neoverse-V3AE definitions
  comedi: fix divide-by-zero in comedi_buf_munge()
  binder: remove "invalid inc weak" check
  xhci: dbc: enable back DbC in resume if it was enabled before suspend
  usb/core/quirks: Add Huawei ME906S to wakeup quirk
  USB: serial: option: add Telit FN920C04 ECM compositions
  USB: serial: option: add Quectel RG255C
  USB: serial: option: add UNISOC UIS7720
  net: usb: rtl8150: Fix frame padding
  ocfs2: clear extent cache after moving/defragmenting extents
  MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
  Revert "cpuidle: menu: Avoid discarding useful information"
  sctp: avoid NULL dereference when chunk data buffer is missing
  arm64, mm: avoid always making PTE dirty in pte_mkwrite()
  net: add ndo_fdb_del_bulk
  net: netlink: add NLM_F_BULK delete request modifier
  net: rtnetlink: use BIT for flag values
  net: rtnetlink: add helper to extract msg type's kind
  net: rtnetlink: add msg kind names
  net: rtnetlink: remove redundant assignment to variable err
  m68k: bitops: Fix find_*_bit() signatures
  hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
  hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  dlm: check for defined force value in dlm_lockspace_release
  hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
  hfs: validate record offset in hfsplus_bmap_alloc
  hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  hfs: make proper initalization of struct hfs_find_data
  hfs: clear offset and space out of valid records in b-tree node
  exec: Fix incorrect type for ret
  hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
  tls: always set record_type in tls_process_cmsg
  tg3: prevent use of uninitialized remote_adv and local_adv variables
  amd-xgbe: Avoid spurious link down messages during interface toggle
  net: dlink: handle dma_map_single() failure properly
  net: dl2k: switch from 'pci_' to 'dma_' API
  xen/events: Update virq_to_irq on migration
  media: lirc: Fix error handling in lirc_register()
  media: rc: Directly use ida_free()
  drm/exynos: exynos7_drm_decon: remove ctx->suspended
  btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  pwm: berlin: Fix wrong register in suspend/resume
  media: cx18: Add missing check after DMA map
  xen/events: Cleanup find_virq() return codes
  cramfs: Verify inode mode when loading from disk
  pid: Add a judgment for ns null in pid_nr_ns
  minixfs: Verify inode mode when loading from disk
  mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  Squashfs: reject negative file sizes in squashfs_read_inode()
  Squashfs: add additional inode sanity checking
  mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  fs: udf: fix OOB read in lengthAllocDescs handling
  KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
  net/9p: fix double req put in p9_fd_cancelled
  ext4: guard against EA inode refcount underflow in xattr update
  ext4: correctly handle queries for metadata mappings
  ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
  x86/umip: Check that the instruction opcode is at least two bytes
  PCI/AER: Fix missing uevent on recovery when a reset is requested
  rtc: interface: Fix long-standing race when setting alarm
  mmc: core: SPI mode remove cmd7
  mtd: rawnand: fsmc: Default to autodetect buswidth
  sparc64: fix hugetlb for sun4u
  sctp: Fix MAC comparison to be constant-time
  scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  parisc: don't reference obsolete termio struct for TC* constants
  lib/genalloc: fix device leak in of_gen_pool_get()
  iio: frequency: adf4350: Fix prescaler usage.
  iio: dac: ad5421: use int type to store negative error codes
  iio: dac: ad5360: use int type to store negative error codes
  crypto: atmel - Fix dma_unmap_sg() direction
  drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  media: i2c: mt9v111: fix incorrect type for ret
  ACPI: debug: fix signedness issues in read/write helpers
  tools build: Align warning options with perf
  net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
  net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  perf session: Fix handling when buffer exceeds 2 GiB
  perf util: Fix compression checks returning -1 as bool
  iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  pinctrl: check the return value of pinmux_ops::get_function_name()
  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  mm: hugetlb: avoid soft lockup when mprotect to large memory area
  Squashfs: fix uninit-value in squashfs_get_parent
  net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  nfp: fix RSS hash key size when RSS is not supported
  drivers/base/node: fix double free in register_one_node()
  ocfs2: fix double free in user_cluster_connect()
  net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
  usb: vhci-hcd: Prevent suspending virtually attached devices
  scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  ipvs: Defer ip_vs_ftp unregister during netns cleanup
  NFSv4.1: fix backchannel max_resp_sz verification check
  remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
  IB/sa: Fix sa_local_svc_timeout_ms read race
  drivers/base/node: handle error properly in register_one_node()
  watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
  ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  pps: fix warning in pps_register_cdev when register device fail
  misc: genwqe: Fix incorrect cmd field being reported in error
  usb: gadget: configfs: Correctly set use_os_string at bind
  usb: phy: twl6030: Fix incorrect type for ret
  tcp: fix __tcp_close() to only send RST when required
  PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  wifi: mwifiex: send world regulatory domain to driver
  ALSA: lx_core: use int type to store negative error codes
  media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
  usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  drm/radeon/r600_cs: clean up of dead code in r600_cs
  i2c: designware: Add disabling clocks when probe fails
  i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  pwm: tiehrpwm: Fix corner case in clock divisor calculation
  block: use int to store blk_stack_limits() return value
  blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
  pinctrl: meson-gxl: add missing i2c_d pinmux
  soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  ACPI: processor: idle: Fix memory leak when register cpuidle device failed
  perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  staging: axis-fifo: fix maximum TX packet length check
  perf subcmd: avoid crash in exclude_cmds when excludes is empty
  dm-integrity: limit MAX_TAG_SIZE to 255
  wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  USB: serial: option: add SIMCom 8230C compositions
  media: rc: fix races with imon_disconnect()
  media: imon: grab lock earlier in imon_ir_change_protocol()
  media: imon: reorganize serialization
  media: rc: Add support for another iMON 0xffdc device
  media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  media: tuner: xc5000: Fix use-after-free in xc5000_release
  media: tunner: xc5000: Refactor firmware load
  udp: Fix memory accounting leak.
  media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
  scsi: target: target_core_configfs: Add length check to avoid buffer overflow

Change-Id: If7e75950e2cad63499e2cfffecac3dc9b432d06c
2025-11-21 22:57:50 +00:00
d02eedbb87 net: netlink: add NLM_F_BULK delete request modifier
[ Upstream commit 545528d788556c724eeb5400757f828ef27782a8 ]

Add a new delete request modifier called NLM_F_BULK which, when
supported, would cause the request to delete multiple objects. The flag
is a convenient way to signal that a multiple delete operation is
requested which can be gradually added to different delete requests. In
order to make sure older kernels will error out if the operation is not
supported instead of doing something unintended we have to break a
required condition when implementing support for this flag, f.e. for
neighbors we will omit the mandatory mac address attribute.
Initially it will be used to add flush with filtering support for bridge
fdbs, but it also opens the door to add similar support to others.

Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2025-11-17 10:36:43 +01:00
7eae4047ae BACKPORT: ANDROID: fuse-bpf: Use fuse_bpf_args in uapi
fuse_args is not suitable for use in the uapi - it is not stable, and
contains internal pointers. Replace with stable equivalent.

The end_offset values are currently unused and unset, but will be used
in a follow up patch by the verifier.

Test: fuse_test, atest ScopedStorageDeviceTest pass
Bug: 202785178
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Change-Id: Ic1c12f9706aeae233cc30a0d68ed2533030e485b
2025-10-16 21:01:13 +01:00
a7fdd9a651 UPSTREAM: ANDROID: fuse-bpf: Avoid reusing uint64_t for file
This moves the backing/fd files to their own space, instead of reusing
the userspace provided fds.

Bug: 222619123
Test: fuse_test passes, on cuttlefish CtsCameraTestCases passes
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Change-Id: I5d3b1ea8299f249ef5adc1ce2b7f45404a041208
2025-10-16 21:01:13 +01:00
e65cdbc4e7 BACKPORT: ANDROID: fuse-bpf v1
Bug: 202785178
Test: test_fuse passes on linux, feature works on cuttlefish
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Change-Id: I987684b799b07391ccde350e98fde7976f5601aa
2025-10-16 21:01:12 +01:00
7ed921f3d9 BACKPORT: ANDROID: fuse: Move functions in preparation for fuse-bpf
Contains squash of this commit:

Author: Nathan Chancellor <nathan@kernel.org>
Date:   Fri Jan 20 09:40:12 2023 -0700

    ANDROID: fuse: Restore upstream type of bitfields in fuse_args

    Commit 88b7179fcdb59 ("ANDROID: fuse: Move functions in preparation for
    fuse-bpf") changed the type of these bitfields from the upstream type of
    'bool' to 'int', which causes several warnings with recent versions of
    clang:

        /builds/linux/fs/fuse/dir.c:168:19: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bi
t-bitfield-constant-conversion]
                args->out_argvar = true;
                                 ^ ~~~~
        /builds/linux/fs/fuse/dir.c:492:18: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bi
t-bitfield-constant-conversion]
                args.out_argvar = 1;
                                ^ ~
        /builds/linux/fs/fuse/dir.c:1649:20: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-b
it-bitfield-constant-conversion]
                ap.args.out_pages = true;
                                  ^ ~~~~
        /builds/linux/fs/fuse/dir.c:1650:21: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-b
it-bitfield-constant-conversion]
                ap.args.out_argvar = true;
                                   ^ ~~~~
        /builds/linux/fs/fuse/dir.c:1651:23: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-b
it-bitfield-constant-conversion]
                ap.args.page_zeroing = true;
                                     ^ ~~~~
        5 errors generated.
    When fuse_args was moved back to the internal implementation in commit
    9a5023967b4d2 ("ANDROID: fuse-bpf: Use fuse_bpf_args in uapi"), the type
    was not restored. Do so now to fix the warnings and reduce the delta
    with upstream.

    Bug: 265200230
    Change-Id: I4d51f331d842a1faff9a937140f0275130e70d73
    Signed-off-by: Nathan Chancellor <nathan@kernel.org>

Bug: 202785178
Test: test_fuse passes on linux, feature works on cuttlefish
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Change-Id: Ie738893a821d1f5f252c4c6e86274d55a6f09965
2025-10-16 21:01:12 +01:00
0cfdec7866 UPSTREAM: fuse: add submount support to <uapi/linux/fuse.h>
- Add fuse_attr.flags

- Add FUSE_ATTR_SUBMOUNT

  This is a flag for fuse_attr.flags that indicates that the given entry
  resides on a different filesystem than the parent, and as such should
  have a different st_dev.

- Add FUSE_SUBMOUNTS

  The client sets this flag if it supports automounting directories.

Change-Id: Ibea2d75d0a93dc3c269555fdb7d0ee58af7860b4
Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:11 +01:00
ba8289c7e7 UPSTREAM: virtiofs: implement dax read/write operations
This patch implements basic DAX support. mmap() is not implemented
yet and will come in later patches. This patch looks into implemeting
read/write.

We make use of interval tree to keep track of per inode dax mappings.

Do not use dax for file extending writes, instead just send WRITE message
to daemon (like we do for direct I/O path). This will keep write and
i_size change atomic w.r.t crash.

Change-Id: Ia135d8554026720dc87e4ef5858b230e91533de8
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
Signed-off-by: Peng Tao <tao.peng@linux.alibaba.com>
Cc: Dave Chinner <david@fromorbit.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:11 +01:00
4c54ef663b UPSTREAM: virtiofs: introduce setupmapping/removemapping commands
Introduce two new fuse commands to setup/remove memory mappings. This
will be used to setup/tear down file mapping in dax window.

Change-Id: I9a5686146f83a72bdef0147bd1a96ec4dd1a278d
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Peng Tao <tao.peng@linux.alibaba.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:11 +01:00
42fcf61c88 UPSTREAM: virtiofs: implement FUSE_INIT map_alignment field
The device communicates FUSE_SETUPMAPPING/FUSE_REMOVMAPPING alignment
constraints via the FUST_INIT map_alignment field.  Parse this field and
ensure our DAX mappings meet the alignment constraints.

We don't actually align anything differently since our mappings are
already 2MB aligned.  Just check the value when the connection is
established.  If it becomes necessary to honor arbitrary alignments in
the future we'll have to adjust how mappings are sized.

The upshot of this commit is that we can be confident that mappings will
work even when emulating x86 on Power and similar combinations where the
host page sizes are different.

Change-Id: I8c7b002aa413dbdae43dc159d82cba672e671351
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:11 +01:00
be509850e3 UPSTREAM: virtiofs: set up virtio_fs dax_device
Setup a dax device.

Use the shm capability to find the cache entry and map it.

The DAX window is accessed by the fs/dax.c infrastructure and must have
struct pages (at least on x86).  Use devm_memremap_pages() to map the
DAX window PCI BAR and allocate struct page.

Change-Id: I46c5a56c7add5d3afb9799db8ab0f64d3ea3ee0f
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:10 +01:00
d0673c97a0 UPSTREAM: fuse: Add changelog entries for protocols 7.1 - 7.8
Retroactively add changelog entry for FUSE protocols 7.1 through 7.8.

Change-Id: Ic89a3685306d1de1ca283bbaa070476eaf94ab9d
Signed-off-by: Alan Somers <asomers@FreeBSD.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:09 +01:00
38bc31e39f UPSTREAM: virtio-fs: add virtiofs filesystem
Add a basic file system module for virtio-fs.  This does not yet contain
shared data support between host and guest or metadata coherency speedups.
However it is already significantly faster than virtio-9p.

Design Overview
===============

With the goal of designing something with better performance and local file
system semantics, a bunch of ideas were proposed.

 - Use fuse protocol (instead of 9p) for communication between guest and
   host.  Guest kernel will be fuse client and a fuse server will run on
   host to serve the requests.

 - For data access inside guest, mmap portion of file in QEMU address space
   and guest accesses this memory using dax.  That way guest page cache is
   bypassed and there is only one copy of data (on host).  This will also
   enable mmap(MAP_SHARED) between guests.

 - For metadata coherency, there is a shared memory region which contains
   version number associated with metadata and any guest changing metadata
   updates version number and other guests refresh metadata on next access.
   This is yet to be implemented.

How virtio-fs differs from existing approaches
==============================================

The unique idea behind virtio-fs is to take advantage of the co-location of
the virtual machine and hypervisor to avoid communication (vmexits).

DAX allows file contents to be accessed without communication with the
hypervisor.  The shared memory region for metadata avoids communication in
the common case where metadata is unchanged.

By replacing expensive communication with cheaper shared memory accesses,
we expect to achieve better performance than approaches based on network
file system protocols.  In addition, this also makes it easier to achieve
local file system semantics (coherency).

These techniques are not applicable to network file system protocols since
the communications channel is bypassed by taking advantage of shared memory
on a local machine.  This is why we decided to build virtio-fs rather than
focus on 9P or NFS.

Caching Modes
=============

Like virtio-9p, different caching modes are supported which determine the
coherency level as well.  The “cache=FOO” and “writeback” options control
the level of coherence between the guest and host filesystems.

 - cache=none
   metadata, data and pathname lookup are not cached in guest.  They are
   always fetched from host and any changes are immediately pushed to host.

 - cache=always
   metadata, data and pathname lookup are cached in guest and never expire.

 - cache=auto
   metadata and pathname lookup cache expires after a configured amount of
   time (default is 1 second).  Data is cached while the file is open
   (close to open consistency).

 - writeback/no_writeback
   These options control the writeback strategy.  If writeback is disabled,
   then normal writes will immediately be synchronized with the host fs.
   If writeback is enabled, then writes may be cached in the guest until
   the file is closed or an fsync(2) performed.  This option has no effect
   on mmap-ed writes or writes going through the DAX mechanism.

Change-Id: I2c64b98beb17e4c0bbf1c0e0234b956cbc2d25ef
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:08 +01:00
a45104f05b UPSTREAM: iommu: Add virtio-iommu driver
The virtio IOMMU is a para-virtualized device, allowing to send IOMMU
requests such as map/unmap over virtio transport without emulating page
tables. This implementation handles ATTACH, DETACH, MAP and UNMAP
requests.

The bulk of the code transforms calls coming from the IOMMU API into
corresponding virtio requests. Mappings are kept in an interval tree
instead of page tables. A little more work is required for modular and x86
support, so for the moment the driver depends on CONFIG_VIRTIO=y and
CONFIG_ARM64.

Tested-by: Bharat Bhushan <bharat.bhushan@nxp.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Change-Id: I54ee8ad06e95e3f2fbc6bb0f22d3f61bfa28248a
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-10-16 21:01:08 +01:00
206d3e0251 UPSTREAM: fuse: reserve byteswapped init opcodes
virtio fs tunnels fuse over a virtio channel.  One issue is two sides might
be speaking different endian-ness. To detects this, host side looks at the
opcode value in the FUSE_INIT command.  Works fine at the moment but might
fail if a future version of fuse will use such an opcode for
initialization.  Let's reserve this opcode so we remember and don't do
this.

Same for CUSE_INIT.

Change-Id: I619381322edf6ebb9306d01cf460581093bba17b
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:08 +01:00
d8592372fa UPSTREAM: fuse: reserve values for mapping protocol
SETUPMAPPING is a command for use with 'virtiofsd', a fuse-over-virtio
implementation; it may find use in other fuse impelementations as well in
which the kernel does not have access to the address space of the daemon
directly.

A SETUPMAPPING operation causes a section of a file to be mapped into a
memory window visible to the kernel.  The offsets in the file and the
window are defined by the kernel performing the operation.

The daemon may reject the request, for reasons including permissions and
limited resources.

When a request perfectly overlaps a previous mapping, the previous mapping
is replaced.  When a mapping partially overlaps a previous mapping, the
previous mapping is split into one or two smaller mappings.

REMOVEMAPPING is the complement to SETUPMAPPING; it unmaps a range of
mapped files from the window visible to the kernel.

The map_alignment field communicates the alignment constraint for
FUSE_SETUPMAPPING/FUSE_REMOVEMAPPING and allows the daemon to constrain the
addresses and file offsets chosen by the kernel.

Change-Id: I65309b76cfcab10c98855a011464648783fdff00
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:08 +01:00
e50c9e87c9 UPSTREAM: fuse: add FUSE_WRITE_KILL_PRIV
In the FOPEN_DIRECT_IO case the write path doesn't call file_remove_privs()
and that means setuid bit is not cleared if unpriviliged user writes to a
file with setuid bit set.

pjdfstest chmod test 12.t tests this and fails.

Fix this by adding a flag to the FUSE_WRITE message that requests clearing
privileges on the given file.  This needs

This better than just calling fuse_remove_privs(), because the attributes
may not be up to date, so in that case a write may miss clearing the
privileges.

Test case:

  $ passthrough_ll /mnt/pasthrough-mnt -o default_permissions,allow_other,cache=never
  $ mkdir /mnt/pasthrough-mnt/testdir
  $ cd /mnt/pasthrough-mnt/testdir
  $ prove -rv pjdfstests/tests/chmod/12.t

Reported-by: Vivek Goyal <vgoyal@redhat.com>
Change-Id: Ibbdc754c6c5c96f33dc87a8a906c6c58b68b414b
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Vivek Goyal <vgoyal@redhat.com>
2025-10-16 21:01:06 +01:00
ea32dcc39c UPSTREAM: fuse: Add ioctl flag for x32 compat ioctl
Currently, a CUSE server running on a 64-bit kernel can tell when an ioctl
request comes from a process running a 32-bit ABI, but cannot tell whether
the requesting process is using legacy IA32 emulation or x32 ABI.  In
particular, the server does not know the size of the client process's
`time_t` type.

For 64-bit kernels, the `FUSE_IOCTL_COMPAT` and `FUSE_IOCTL_32BIT` flags
are currently set in the ioctl input request (`struct fuse_ioctl_in` member
`flags`) for a 32-bit requesting process.  This patch defines a new flag
`FUSE_IOCTL_COMPAT_X32` and sets it if the 32-bit requesting process is
using the x32 ABI.  This allows the server process to distinguish between
requests coming from client processes using IA32 emulation or the x32 ABI
and so infer the size of the client process's `time_t` type and any other
IA32/x32 differences.

Change-Id: Ic3d8a59a29f351fd9f2f734209bb1836b3d3875d
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:06 +01:00
0a651a8c8f UPSTREAM: fuse: fix changelog entry for protocol 7.9
Retroactively add changelog entry for the atime and mtime "now" flags.
This was an oversight in commit 17637cbaba ("fuse: improve utimes
support").

Change-Id: I7600f6f0bc36f49f2aaeb483aff01cd1b963d42d
Signed-off-by: Alan Somers <asomers@FreeBSD.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:05 +01:00
9add8b1018 UPSTREAM: fuse: fix changelog entry for protocol 7.12
This was a mistake in the comment in commit e0a43ddcc0 ("fuse: allow
umask processing in userspace").

Change-Id: Ibd09829687718de6eb5e4bebd8ac4d4d5fb95719
Signed-off-by: Alan Somers <asomers@FreeBSD.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:05 +01:00
69ee941b53 UPSTREAM: fuse: document fuse_fsync_in.fsync_flags
The FUSE_FSYNC_DATASYNC flag was introduced by commit b6aeadeda2
("[PATCH] FUSE - file operations") as a magic number.  No new values have
been added to fsync_flags since.

Change-Id: I1f104ba24b929de613589ebe4f1f9bafb2c994b8
Signed-off-by: Alan Somers <asomers@FreeBSD.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-10-16 21:01:05 +01:00