1. 15 Jul, 2024 1 commit
  2. 12 Jul, 2024 2 commits
  3. 05 Jul, 2024 1 commit
  4. 03 Jul, 2024 2 commits
    • Waiman Long's avatar
      cgroup: Protect css->cgroup write under css_set_lock · 57b56d16
      Waiman Long authored
      The writing of css->cgroup associated with the cgroup root in
      rebind_subsystems() is currently protected only by cgroup_mutex.
      However, the reading of css->cgroup in both proc_cpuset_show() and
      proc_cgroup_show() is protected just by css_set_lock. That makes the
      readers susceptible to racing problems like data tearing or caching.
      It is also a problem that can be reported by KCSAN.
      
      This can be fixed by using READ_ONCE() and WRITE_ONCE() to access
      css->cgroup. Alternatively, the writing of css->cgroup can be moved
      under css_set_lock as well which is done by this patch.
      Signed-off-by: default avatarWaiman Long <longman@redhat.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      57b56d16
    • Xiu Jianfeng's avatar
      cgroup/misc: Introduce misc.peak · 1028f391
      Xiu Jianfeng authored
      Introduce misc.peak to record the historical maximum usage of the
      resource, as in some scenarios the value of misc.max could be
      adjusted based on the peak usage of the resource.
      Signed-off-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      1028f391
  5. 02 Jul, 2024 1 commit
    • Randy Dunlap's avatar
      cgroup_misc: add kernel-doc comments for enum misc_res_type · 7a447968
      Randy Dunlap authored
      Fully document enum misc_res_type with kernel-doc comments to prevent
      kernel-doc warnings:
      
      misc_cgroup.h:12: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
       * Types of misc cgroup entries supported by the host.
      misc_cgroup.h:12: warning: missing initial short description on line:
       * Types of misc cgroup entries supported by the host.
      
      Fixes: a72232ea ("cgroup: Add misc cgroup controller")
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: cgroups@vger.kernel.org
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      7a447968
  6. 28 Jun, 2024 1 commit
    • Chen Ridong's avatar
      cgroup/cpuset: Prevent UAF in proc_cpuset_show() · 1be59c97
      Chen Ridong authored
      An UAF can happen when /proc/cpuset is read as reported in [1].
      
      This can be reproduced by the following methods:
      1.add an mdelay(1000) before acquiring the cgroup_lock In the
       cgroup_path_ns function.
      2.$cat /proc/<pid>/cpuset   repeatly.
      3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/
      $umount /sys/fs/cgroup/cpuset/   repeatly.
      
      The race that cause this bug can be shown as below:
      
      (umount)		|	(cat /proc/<pid>/cpuset)
      css_release		|	proc_cpuset_show
      css_release_work_fn	|	css = task_get_css(tsk, cpuset_cgrp_id);
      css_free_rwork_fn	|	cgroup_path_ns(css->cgroup, ...);
      cgroup_destroy_root	|	mutex_lock(&cgroup_mutex);
      rebind_subsystems	|
      cgroup_free_root 	|
      			|	// cgrp was freed, UAF
      			|	cgroup_path_ns_locked(cgrp,..);
      
      When the cpuset is initialized, the root node top_cpuset.css.cgrp
      will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will
      allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated
      &cgroup_root.cgrp. When the umount operation is executed,
      top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp.
      
      The problem is that when rebinding to cgrp_dfl_root, there are cases
      where the cgroup_root allocated by setting up the root for cgroup v1
      is cached. This could lead to a Use-After-Free (UAF) if it is
      subsequently freed. The descendant cgroups of cgroup v1 can only be
      freed after the css is released. However, the css of the root will never
      be released, yet the cgroup_root should be freed when it is unmounted.
      This means that obtaining a reference to the css of the root does
      not guarantee that css.cgrp->root will not be freed.
      
      Fix this problem by using rcu_read_lock in proc_cpuset_show().
      As cgroup_root is kfree_rcu after commit d23b5c57
      ("cgroup: Make operations on the cgroup root_list RCU safe"),
      css->cgroup won't be freed during the critical section.
      To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to
      replace task_get_css with task_css.
      
      [1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd
      
      Fixes: a79a908f ("cgroup: introduce cgroup namespaces")
      Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      1be59c97
  7. 24 Jun, 2024 2 commits
    • Linus Torvalds's avatar
      Merge tag 'input-for-v6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 55027e68
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
      
       - fixes for ili210x and elantech drivers
      
       - new products IDs added to xpad controller driver
      
       - a tweak to i8042 driver to always keep keyboard in Ayaneo Kun
         handheld in raw mode
      
       - populated "id_table" in ads7846 touchscreen driver to make sure
         non-OF instantiated devices can properly determine the model data.
      
      * tag 'input-for-v6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: ads7846 - use spi_device_id table
        Input: xpad - add support for ASUS ROG RAIKIRI PRO
        Input: ili210x - fix ili251x_read_touch_data() return value
        Input: i8042 - add Ayaneo Kun to i8042 quirk table
        Input: elantech - fix touchpad state on resume for Lenovo N24
      55027e68
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v6.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 626737a5
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
      
       - Use flag saving spinlocks in the Renesas rzg2l driver. This fixes up
         PREEMPT_RT problems.
      
       - Remove broken Qualcomm PM8008 that clearly was never working. A new
         version will arrive in the next merge window.
      
       - Add a quirk for LP8764 regmap that was missed and made the TI J7200
         board unusable.
      
       - Fix persistance on the BCM2835 GPIO outputs kernel parameter so this
         remains consisten across a booted kernel.
      
       - Fix a potential deadlock in create_pinctrl()
      
       - Fix some erroneous bitfields and pinmux reset in the Rockchip RK3328
         driver.
      
      * tag 'pinctrl-v6.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
        pinctrl: rockchip: use dedicated pinctrl type for RK3328
        pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
        pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
        pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
        pinctrl: bcm2835: Fix permissions of persist_gpio_outputs
        pinctrl: tps6594: add missing support for LP8764 PMIC
        dt-bindings: pinctrl: qcom,pmic-gpio: drop pm8008
        pinctrl: qcom: spmi-gpio: drop broken pm8008 support
        pinctrl: renesas: rzg2l: Use spin_{lock,unlock}_irq{save,restore}
      626737a5
  8. 23 Jun, 2024 8 commits
  9. 22 Jun, 2024 19 commits
  10. 21 Jun, 2024 3 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 35bb670d
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Two fixes: one in the ufs driver fixing an obvious memory leak and the
        other (with a core flag based update) trying to prevent USB crashes by
        stopping the core from issuing a request for the I/O Hints mode page"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: usb: uas: Do not query the IO Advice Hints Grouping mode page for USB/UAS devices
        scsi: core: Introduce the BLIST_SKIP_IO_HINTS flag
        scsi: ufs: core: Free memory allocated for model before reinit
      35bb670d
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2024-06-22' of https://gitlab.freedesktop.org/drm/kernel · d6c94157
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Still pretty quiet, two weeks worth of amdgpu fixes, with one i915 and
        one xe. I didn't get the drm-misc-fixes tree PR this week, but there
        was only one fix queued and I think it can wait another week, so seems
        pretty normal.
      
        xe:
         - Fix for invalid register access
      
        i915:
         - Fix conditions for joiner usage, it's not possible with eDP MSO
      
        amdgpu:
         - Fix display idle optimization race
         - Fix GPUVM TLB flush locking scope
         - IPS fix
         - GFX 9.4.3 harvesting fix
         - Runtime pm fix for shared buffers
         - DCN 3.5.x fixes
         - USB4 fix
         - RISC-V clang fix
         - Silence UBSAN warnings
         - MES11 fix
         - PSP 14.0.x fix"
      
      * tag 'drm-fixes-2024-06-22' of https://gitlab.freedesktop.org/drm/kernel:
        drm/xe/vf: Don't touch GuC irq registers if using memory irqs
        drm/amdgpu: init TA fw for psp v14
        drm/amdgpu: cleanup MES11 command submission
        drm/amdgpu: fix UBSAN warning in kv_dpm.c
        drm/radeon: fix UBSAN warning in kv_dpm.c
        drm/amd/display: Disable CONFIG_DRM_AMD_DC_FP for RISC-V with clang
        drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA
        drm/amd/display: change dram_clock_latency to 34us for dcn35
        drm/amd/display: Change dram_clock_latency to 34us for dcn351
        drm/amdgpu: revert "take runtime pm reference when we attach a buffer" v2
        drm/amdgpu: Indicate CU havest info to CP
        drm/amd/display: prevent register access while in IPS
        drm/amdgpu: fix locking scope when flushing tlb
        drm/amd/display: Remove redundant idle optimization check
        drm/i915/mso: using joiner is not possible with eDP MSO
      d6c94157
    • Linus Torvalds's avatar
      Merge tag 'ovl-fixes-6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs · 264efe48
      Linus Torvalds authored
      Pull overlayfs fixes from Miklos Szeredi:
       "Fix two bugs, one originating in this cycle and one from 6.6"
      
      * tag 'ovl-fixes-6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
        ovl: fix encoding fid for lower only root
        ovl: fix copy-up in tmpfile
      264efe48