Merge/sound upstream 20260828 - #5900
Open
bardliao wants to merge 702 commits into
Open
Conversation
show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one. A concurrent reader or writer can load a pointer to an old modelist entry before store_modes() frees it, then dereference freed memory or store a stale freed pointer in fb_info->mode. Take lock_fb_info() in show_mode(), show_modes(), and store_mode() to serialize with store_modes(). In show_mode(), copy the mode to the stack and format after dropping the lock. In store_mode(), split activate() into a _locked variant to avoid double-locking, and hold the locks for the modelist walk, mode conversion, activation, and fb_info->mode assignment together. Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the hardware 'src' pointer has already been eagerly advanced by the original chunk size. If the loop is allowed to continue, the read will resume from an incorrect, over-advanced offset. Since the remaining 'count' was only decremented by the successful bytes, this desynchronization causes the next iterations to execute more hardware reads than originally bounded, eventually leading to out-of-bounds I/O reads. Fix this by breaking out of the loop immediately upon a partial copy_to_user(). A partial copy indicates a faulty user buffer, making subsequent read attempts futile. Breaking out ensures we return the number of successfully read bytes without risking out-of-bounds hardware accesses in subsequent mismatched iterations. Fixes: 6121cd9 ("fbdev: Move I/O read and write code into helper functions") Cc: stable@vger.kernel.org Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Signed-off-by: Helge Deller <deller@gmx.de>
[BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in ccw_putcs+0x8bd/0xa80 Read of size 1 at addr ff11000110067100 by task bash/1209 CPU: 10 UID: 0 PID: 1209 Comm: bash Not tainted 7.2.0-rc3 thesofproject#69 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 ? ccw_putcs+0x8bd/0xa80 ccw_putcs+0x8bd/0xa80 ? __pfx_ccw_putcs+0x10/0x10 fbcon_putcs+0x338/0x410 ? __pfx_ccw_putcs+0x10/0x10 do_update_region+0x21d/0x450 invert_screen+0x29d/0x5e0 ? __kmalloc_noprof+0x493/0x640 ? vc_do_resize+0x17c/0xe50 clear_selection+0x4c/0x60 vc_do_resize+0xaee/0xe50 fbcon_modechanged+0x2bd/0x640 rotate_all_store+0x298/0x380 ... reproduce: 1) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 1 and op.height = 1, then a TIOCL_SETSEL ioctl 2) echo 2 > /sys/devices/virtual/graphics/fbcon/rotate_all 3) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 1, then a TIOCL_SETSEL ioctl 4) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all [CAUSE] The root cause is that fbcon_modechanged() first sets the current rotate's corresponding ops. Subsequently, during vc_resize(), it may trigger clear_selection(), and in fbcon_putcs->ccw_putcs[rotate=3], this can result in an out-of-bounds access to "src". This happens because par->rotated.buf is reallocated in fbcon_rotate_font(): 1) When rotate=2, its size is (width + 7) / 8 * height 2) When rotate=3, its size is (height + 7) / 8 * width And the call to fbcon_rotate_font() occurs after clear_selection(). In other words, the fontbuffer is allocated using the size calculated from the previous rotation 2, but before reallocating it with the new size, con_putcs is already using the new rotation 3: rotate_all_store fbcon_rotate_all fbcon_set_all_vcs fbcon_modechanged set_blitting_type ... par->bitops = &ccw_fbcon_bitops vc_resize ... clear_selection highlight ... do_update_region fbcon_putcs ... image.dy = vyres - ((xx + count) * vc->vc_font.width) [1] // overflow! ccw_putcs_aligned // old buf size is still being used during the read! src = par->rotated.buf + (scr_readw(s--) & charmask) * cellsize fb_pad_aligned_buffer----[src KASAN!!!] [2] info->fbops->fb_imageblit(info, image) sys_imageblit fb_imageblit fb_address_forward // offset: image->dy * bits_per_line + image->dx * bpp unsigned int bits = (unsigned int)adr->bits + offset adr->address += (bits & ~(BITS_PER_LONG - 1u)) / BITS_PER_BYTE [3] fb_bitmap_imageblit ... fb_read_offset // page fault! [4] update_screen redraw_screen ... ccw_cursor soft_cursor memcpy(src, image->data, dsize)----[src KASAN again!!!] [5] fbcon_switch fbcon_rotate_font font_data_rotate dst = kmalloc_array(charcount, d_cellsize, GFP_KERNEL) // the new size is allocated only here! par->rotated.buf = buf [6] [FIX] A fairly obvious approach is to follow fbcon_switch(): in fbcon_modechanged(), call rotate_font() before vc_resize() so that a correctly sized buffer is allocated in time, as done in [6]. This fix is necessary, but it is not sufficient on its own. In [1] it causes an image.dy overflow (ccw_putcs: vyres = 768, image.dy = 4294967040), because vc_cols has not been updated in time at this point (it is likewise only updated after clear_selection()). This allows (xx + count) * width to exceed vyres, causing image.dy to overflow. Subsequently, address in [3] is incremented by an even larger amount, which triggers a page fault at [4]. Therefore, a second fix is required in combination with the first: move clear_selection() earlier, before set_blitting_type() in fbcon_set_all_vcs(), to prevent the out-of-bounds access. fbcon_rotate() has a similar problem, so add the same clear there. Since vc_is_sel() is not exported, the fbdev side is currently forced to call clear_selection() unconditionally, causing the global selection to be cleared prematurely. And this will not cause any other significant impact. Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Signed-off-by: Helge Deller <deller@gmx.de>
bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer value comes directly from scr_readw() and may be larger than the current font's glyph count. Syzkaller triggers this via vcs_write(). The Call Trace shows vcs_write() in vc_screen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via vcs_scr_writew() without checking charcount. The stored value is later read in bit_cursor() in bitblit.c. When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access. BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970 Call Trace: soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 update_region+0x100/0x18c drivers/tty/vt/vt.c:669 vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685 bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index to vc_font.charcount. Apply the same clamp in bit_cursor() after extracting the attribute and masking, before indexing fontdata. The fix completes the bounds checking started in commit 18c4ef4 ("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed the cursor path. This change should be safe because the clamp reuses the existing contract from fbcon: charcount is maintained under console_lock in con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when switching from 512 to 256 glyphs. When stale screen data with high bits remains after a font switch, or when vcs_write() stores an arbitrary value, clamping the index to 0 prevents the out-of-bounds read without changing cursor semantics — the same fallback bit_putcs uses. Reported-by: syzbot+61b1db46218109869c14@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=61b1db46218109869c14 Link: https://lore.kernel.org/all/6a75205c.01d0871a.3a0d52.0032.GAE@google.com/ Fixes: 18c4ef4 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Cc: stable@vger.kernel.org Assisted-by: Hermes:muse-spark-1.2 syzkaller Signed-off-by: Rik van Riel <riel@surriel.com> Signed-off-by: Helge Deller <deller@gmx.de>
…l/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - A couple of fixes for a memory leak and a underflow case Thanks to George Wilson and R Nageswara Sastry * tag 'powerpc-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pseries: lparcfg - fix kbuf[] underflow powerpc/pseries: pci - logic bug powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
…kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - Fixes for information leaks and OOB accesses across several drivers, including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra - Improvements to the synaptics-rmi4 driver to properly handle F54 worker errors and prevent buffer overflows - Input validation fixes in the hynitron_cstxxx touchscreen driver to prevent issues with invalid finger IDs and touch counts - Fixes for use-after-free and initialization bugs in the byd mouse and psxpad-spi drivers - New quirks for the atkbd driver to make keyboard work on HONOR and Xiaomi laptops - Support for the ZENAIM LEVERLESS controller in the xpad driver. * tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: evdev - sanitize event type index when fetching event masks Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Input: synaptics-rmi4 - block s_input when F54 queue is busy Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Input: synaptics-rmi4 - zero report size on F54 work error Input: synaptics-rmi4 - fix F55 transmitter electrode count typo Input: hynitron_cstxxx - validate touch count and finger IDs Input: evdev - fix information leak in evdev_pass_values() fixp-arith: convert comments to kernel-doc format Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Input: atkbd - skip deactivate for HONOR ZQC-P Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Input: iforce - validate input packet lengths Input: psxpad-spi - set driver data before use Input: cs40l50-vibra - validate custom data from user space Input: xpad - add support for ZENAIM LEVERLESS Input: edt-ft5x06 - ignore contacts with an out-of-range slot id Input: byd - synchronize timer deletion before freeing private data
…/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix Rust build failure on s390 by gating ioremap() / iounmap() helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected doctests as well. - Add missing kernel-doc for show_const / store_const union members in struct device_attribute. * tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM driver core: add missing kernel-doc for union members
eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child. Cc: stable@vger.kernel.org Fixes: 43aa6f9 ("eventfs: Get rid of dentry pointers without refcounts") Link: https://patch.msgid.link/20260806022719.375354-1-shuangpeng.kernel@gmail.com Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260808094215.4252430d@robin Fixes: 704f960 ("eventfs: Read ei->entries before ei->children in eventfs_iterate()") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260806022719.375354-1-shuangpeng.kernel%40gmail.com Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
…ernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "A few patches for the core fbdev layer which stabilize or fix potential issues with text font rendering after screen rotation or after user initiated font changes and locking fixes for sysfb during modifications of the graphics mode database" * tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: bitblit: bound-check glyph index in bit_cursor() fbdev: Fix out-of-bounds access when rotating console after font resize fbdev: core: Fix pointer desynchronization in fb_io_read() fbdev: serialize mode sysfs access with lock_fb_info() fbdev: clear fb_info->mode before deleting a videomode fbdev: bound mode sysfs output to the sysfs buffer
Fix accessing the __rcu pointer direct_functions with RCU protection. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260730150411.88667-2-leon.hwang@linux.dev Fixes: d05cb47 ("ftrace: Fix modification of direct_function hash while in use") Acked-by: Jiri Olsa <jolsa@kernel.org> Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Fix accessing the __rcu pointer direct_functions with RCU protection. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260730150411.88667-3-leon.hwang@linux.dev Fixes: 8d2c123 ("ftrace: Add update_ftrace_direct_del function") Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Fix accessing the __rcu pointer direct_functions with RCU protection. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260730150411.88667-4-leon.hwang@linux.dev Fixes: e93672f ("ftrace: Add update_ftrace_direct_mod function") Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Drop the extra comma in "scoped_guard()" to cleanup the code. Link: https://patch.msgid.link/20260730150411.88667-5-leon.hwang@linux.dev Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
The recent fix for UAF in ump_to_endpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the endpoint has been already released. Add private_free to clear the associated data for avoiding the further dereference for delayed releases. Fixes: 4a05b2d ("ALSA: usb-audio: fix use-after-free in ump_to_endpoint()") Reported-by: syzbot+565b1138cfbe549d4422@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=565b1138cfbe549d4422 Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260808152009.1947835-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
The recent "sticky mixer" sanity check in USB-audio driver caused a regression on SteelSeries Arctis Nova 5 (1038:2232); because the firmware doesn't handle GET_CUR requests, some mixers are effectively disabled, leading to the too low / soft volumes: usb 5-1.1: 9:0: sticky mixer values (-19712/0/256 => 0), disabling usb 5-1.1: 10:0: sticky mixer values (-21248/0/256 => 0), disabling Restore the functionality by ignoring GET_CUR errors intentionally with MIXER_GET_CUR_BROKEN quirk. Fixes: 86aa1ea ("ALSA: usb-audio: Do not expose sticky mixers") Reported-by: Gert Burger <gertburger@gmail.com> Closes: https://lore.kernel.org/CAEQ1D3kdA3mkQx7ei9Kq0gwky0qroJqCLKrkvgfkqgTbeu086A@mail.gmail.com Link: https://bbs.archlinux.org/viewtopic.php?id=314220 Link: https://patch.msgid.link/20260808152258.1948767-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
…ernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
…nel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some more small staging driver fixes, just for the rtl8723bs driver, for some reported problems found with it now that people are starting to actually test the thing with "bad" networks. Nothing major, but good to have in the -final release. All of these have been in linux-next for over a week with no reported problems" * tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: validate monitor transmit frame lengths staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
…git/gregkh/tty Pull tty / serial / vt driver fixes from Greg KH: "Here are some small serial and vt tty driver fixes for 7.2-rc7 that resolve some reported problems. Included in here are: - two vt core fixes - amba-pl011 serial driver fixes - 8250_of and 8250_dma driver fixes - qcom-geni serial driver fix - sc16is7xx serial driver fix All of these have been in linux-next this week with no reported issues" * tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: amba-pl011: synchronize DMA teardown serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ serial: amba-pl011: fix indefinite RS485 post-send delay vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx serial: qcom-geni: fix TX DMA buffer flush serial: 8250_dma: Clear stale RX state on shutdown serial: sc16is7xx: enable THRI before filling TX FIFO
…git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that resolve some reported issues. Included in here are: - new quirk for some broken USB devices - thunderbolt device fixes for reported issues - usb gadget driver fix - usb atm driver fix - xhci driver fixes. - other minor USB driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask usb: quirks: Add ShanWan gamepad to quirk list usb: hub: Split announce_device() to log device identity before enumeration usb: core: Add quirk for 255-bytes initial config read usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg usb: gadget: f_ncm: Use unsigned int for ndp_index usb: cdnsp: fix incorrect endian conversions for APB timeout register thunderbolt: Initialize ->domain_released completion before it is being used thunderbolt: icm: Preserve USB4 proxy data-valid bit thunderbolt: Bound the DROM dual link port number before indexing sw->ports thunderbolt: Fix bandwidth group reservation indexing thunderbolt: stream: Unmap buffers with mapped size
…/linux/kernel/git/tip/tip Pull futex fix from Ingo Molnar: - Fix race in futex_pivot_pending() during private hash resize that can cause stuck tasks (Yao Kai) * tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Fix race in futex_pivot_pending() during private hash resize
…ux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Fix MCE CMCI discovery initialization ordering bug (Breno Leitao) * tag 'x86-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Set up the polling timer before CMCI discovery
The ring_buffer_swap_cpu() function currently checks the per-CPU
committing counter to determine if a buffer is actively being written to
before performing the swap. However, there exists a race window where
this check can be bypassed:
ring_buffer_lock_reserve
cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a
rb_reserve_next_event
rb_start_commit // inc committing
if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}
__rb_reserve_next
rb_move_tail
rb_end_commit(cpu_buffer); // dec committing => 0
/* interrupt hits here, successfully swaps! */
local_inc(&cpu_buffer->committing);
ring_buffer_unlock_commit
cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b
rb_commit
rb_end_commit
RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))
// triggers warning
The committing counter can temporarily drop to 0 during a single write
operation (within rb_move_tail), creating a window where swap can
succeed even though the write is still in progress. This leads to
inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().
Replace the committing counter check with current_context checks, which
are set at the entry of ring_buffer_lock_reserve() and remain valid
throughout the entire write operation, providing a reliable indicator of
buffer busy state during swap.
Cc: stable@vger.kernel.org
Fixes: 4239c38 ("ring-buffer: Process commits whenever moving to a new page.")
Link: https://patch.msgid.link/20260803005640.2445666-2-wutengda@huaweicloud.com
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
When a module's init text is freed, do_init_module() calls ftrace_free_mem() with a half-open [start, end) range. However the ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all its other users do, passing 'ip + size - 1'. So ftrace_free_mem() can delete a record sitting exactly at 'end', which is outside the freed range. For a kernel without CFI or IBT, the first record of a function is at the function start, which for the first function in a module is also the base of its text allocation. As the module allocator packs its regions, that address is often the 'end' passed by a neighboring module's do_init_module(), causing the first function's ftrace location to get disabled, preventing an attempt to livepatch it: livepatch: failed to find location for function 'pcspkr_probe' Convert the exclusive end to the inclusive 'end - 1' the comparator expects, and return early for an empty range to avoid the subtraction from underflowing when the init text size is zero. Cc: stable@vger.kernel.org Fixes: 42c269c ("ftrace: Allow for function tracing to record init functions on boot up") Link: https://patch.msgid.link/1b5ccfa8095bdb1277f84af1c2c2e2205aca03ae.1785992188.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Dynamically resizing a persistent ring buffer is not possible. Disable the feature. Cc: stable@vger.kernel.org Fixes: be68d63 ("ring-buffer: Add ring_buffer_alloc_range()") Link: https://patch.msgid.link/20260806211306.3704194-2-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour. Cc: stable@vger.kernel.org Fixes: f9b94da ("ring-buffer: Set new size of the ring buffer sub page") Link: https://patch.msgid.link/20260806211306.3704194-3-vdonnefort@google.com Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if when freed: free_buffer_page() relies on this value. Align the value with the actual allocation size (buffer::subbuf_order). Cc: stable@vger.kernel.org Fixes: f9b94da ("ring-buffer: Set new size of the ring buffer sub page") Link: https://patch.msgid.link/20260806211306.3704194-4-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
In test_ringbuffer()'s out_free cleanup loop, the check `!rb_threads[cpu]` only catches NULL entries and misses entries that hold an ERR_PTR. rb_threads[] is static, so unassigned slots are NULL. But when kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or -EINTR) in rb_threads[cpu] before the creation loop jumps to out_free. That entry is non-NULL, so the old `!ptr` check does not break, and the cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop() then dereferences the bogus pointer, crashing the kernel during the late_initcall self-test. crash logs: BUG: kernel NULL pointer dereference, address: 000000000000001c Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty thesofproject#7 PREEMPT(lazy) RIP: 0010:kthread_stop+0x2e/0x220 RBX: fffffffffffffff4 CR2: 000000000000001c Call Trace: <TASK> test_ringbuffer+0x1ec/0x650 do_one_initcall+0x6c/0x2c0 kernel_init_freeable+0x21d/0x420 kernel_init+0x15/0x1c0 ret_from_fork+0x21b/0x320 </TASK> Kernel panic - not syncing: Fatal exception Cc: stable@vger.kernel.org Fixes: 64ed3a0 ("ring-buffer: make use of the helper function kthread_run_on_cpu()") Link: https://patch.msgid.link/20260807154145.2846521-2-sh_def@163.com Signed-off-by: Hui Su <sh_def@163.com> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
…it/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix potential uninitialized memory reads and buffer overflows from malformed zcrypt CCA and EP11 requests by properly validating lengths and payloads - Fix possible out of bounds accesses in zcrypt EP11 domain handling by replacing fixed payload layout assumptions with parsing ASN.1 fields with bounds checks - Fix zcrypt CCA and EP11 request and reply buffer allocations missing required 4-byte padding, and scrub the full allocation on release - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes of memory by zeroing trailing alignment padding * tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Pad trailing CCA or EP11 message with zeros s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing s390/zcrypt: Improve EP11 CPRB length and overflow checks s390/zcrypt: Improve CCA CPRB length and overflow checks s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
…el/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix use-after-free in eventfs_remove_rec() The freeing of the eventfs_inode children used list_for_each_entry() where the child is freed via srcu, but there's still a chance that it gets freed. It should be using list_for_each_entry_safe(). - Fix eventfs_inode SRCU use of list in freeing The iterator uses an SRCU protected list walk on the eventfs inodes. The eventfs inode uses its "list" field in a union with the RCU list head. When the inode gets added to the SRCU list it immediately corrupts the list pointer and can cause an issue with the iterator. Move the RCU list head to be shared with the children list head which allows the iterator to check the parent inode if is freed before referencing the child. Have the iterator check the parent "is_freed" field and break out if it is set. Also add memory barriers to make sure the ordering is correct. - Fix various RCU synchronization issues with direct_functions Updates to direct_functions have some missing RCU protection and synchronization. Restructure the code a bit to make sure updates to the direct_functions are protected. - Remove an unneeded comma from a scope_guard() There's a spurious comma in a scope_guard(). Remove it. - Fix race in per CPU buffer swap in the ring buffer When a per CPU buffer swap happens, it must make sure that it doesn't occur while a writer is active. Instead it returns an -EBUSY. But there's a small race window when a writer moves from one sub-buffer to the next that it resets the "committing" counter. If a swap happens at that moment, the buffer used for the commit of an event will not match the buffer the event is actually on. Instead of using the "committing" counter, use the recursive detection counter that does not get reset when the writer crosses sub-buffers. - Fix off-by-one in ftrace_free_mem() The function ftrace_free_mem() gets an "end_ptr" as a parameter that is exclusive to the rang to be freed. But its value is used to search for the records that expects an inclusive value. Subtract one from the parameter to convert it to an inclusive range. - Disable resizing of the ring buffer for persistent buffers Resizing the persistent buffer has undefined behavior. Prevent it from being resized. - Disable changing ring buffer subbuf order when resizing is disabled The ring buffer subbuffer order can not be changed during resizing. Use that instead of just checking if the buffer is mapped as mapped buffers also have resizing disabled. - Initialize subbuf_order of reader pages when they are created In rb_allocate_cpu_buffer() the bpage->order is not updated to the current subbuf_order leaving it as zero. This value is used when the page is freed. - Fix test_ringbuffer() to test for ERR_PTR before calling kthread_stop() The rb_threads[] array is assigned the output of kthread_run_on_cpu() which could return an ERR_PTR. At the end of the test, all threads in the array are cleaned up by kthread_stop() passing in the value in the array if it isn't zero. But if the array contains an ERR_PTR, kthread_stop() will not be able to handle it properly. * tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix crash passing ERR_PTR to kthread_stop() ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() ring-buffer: Prevent subbuf order change when resizing is disabled ring-buffer: Prevent resizing of persistent ring buffer ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() ring-buffer: Use current_context for safe per-CPU buffer swap ftrace: Drop extra comma in trace_buffered_event_enable ftrace: Protect direct_functions in update_ftrace_direct_mod ftrace: Protect direct_functions in update_ftrace_direct_del ftrace: Protect direct_functions in ftrace_find_rec_direct eventfs: Use children field for rcu head and add memory barriers eventfs: Fix use-after-free in eventfs_remove_rec()
HP Laptop 15-fd0039nt (SSID 103c:8bb6) needs a quirk to control the speaker mute LED via VREF100 on NID 0x1a (active-high). This patch replaces the previous ALC236_FIXUP_HP_MICMUTE_LED_ONLY with ALC236_FIXUP_HP_15_FD0XXX, which covers both mic mute (GPIO0) and speaker mute (NID 0x1a) LEDs. Use spec->no_shutup_pins instead of a custom shutup hook, as suggested by Takashi Iwai. Fixes: e711ebf ("ALSA: hda/realtek: Add quirk for HP Laptop 15-fd0039nt") Tested-by: Habil Eren Türker <habilerenturker@hotmail.com> Signed-off-by: Habil Eren Türker <habilerenturker@hotmail.com> Link: https://patch.msgid.link/20260825084125.4103-1-habilerenturker@hotmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
This model requires an additional detection quirk to enable the internal microphone. Fixes: fa99148 ("ASoC: amd: add YC machine driver using dmic") Cc: stable@vger.kernel.org Assisted-by: OpenAI Codex Signed-off-by: Christopher Tolang <christophertolang@gmail.com> Link: https://patch.msgid.link/20260823113221.19744-1-christophertolang@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
Add DMI entry so the YC machine driver probes on this model and the internal DMIC works. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221485 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260824130302.553419-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
…rning While we attempted to work around the false-positive lockdep warning due to the nested mutex lock in rawmidi at the open path for a UMP legacy rawmidi, it didn't cover the similar locking at its close path, and this still caused another false-positive reports by syzkaller. Add a similar workaround to snd_rawmidi_kernel_release() as done in the former commit 9c04742 ("ALSA: rawmidi: Work around false-positive mutex lockdep warning") to cover completely. Reported-by: syzbot+7d1edf0ff6a05961020c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a8c7e4d.4d75e56a.c9a88.0052.GAE@google.com Link: https://patch.msgid.link/20260825134942.1289272-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
The DMA channel request code currently warns about legacy DMA failures when the channel name is not present in dma-names. This can report a firmware lookup failure as a legacy DMA failure. Furthermore, failures from the legacy DMA path are already reported by find_candidate(), making these warnings redundant. Only warn when the channel name is present in dma-names but the request fails, avoiding misleading and duplicate error messages. Fixes: 9167f26 ("ASoC: soc-generic-dmaengine: Handle DMA channel request failures correctly") Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://lore.kernel.org/all/aoyBuho270dTWYBL@jupiter.universe/ Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260825081949.55537-1-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
Add DMI match table entry for HUAWEI HVY-WXX9 board, product version M1060, a MateBook D16 2021 (Ryzen 5 4600H) revision not covered by the existing M1010/M1020/M1040 entries. This board uses the same FLAG_AMD_LEGACY / ACP_PCI_DEV_ID configuration as the other HVY-WXX9 variants. Signed-off-by: Mehmet Aysel <mehmet4ysel@gmail.com> Link: https://patch.msgid.link/20260825092432.56292-1-mehmet4ysel@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
Add matching DMI table entry for the ES83xx machine driver, so the HUAWEI HVY-WXX9 / M1060 board (MateBook D16 2021, Ryzen 5 4600H) can successfully probe its ES8316 codec via the acp3x-es83xx machine driver, consistent with the existing M1010/M1020/M1040 entries for the same board name. Signed-off-by: Mehmet Aysel <mehmet4ysel@gmail.com> Link: https://patch.msgid.link/20260825092432.56292-2-mehmet4ysel@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
The BIOS on the HP OmniBook X Flip 16-cc0xxx (board 8EA2) reports acp-audio-config-flag = FLAG_AMD_LEGACY_ONLY_DMIC. This binds the legacy ACP driver and registers a PDM-only card, so the SoundWire links are never scanned and the two TAS2783 speaker amplifiers and RT712-VB codec do not enumerate. Add a DMI entry for board 8EA2 to the ACP70 ACPI flag override table so the firmware-provided flag is overridden and snd_pci_ps probes instead. On the affected system, an otherwise identical upstream kernel without this entry binds snd_acp_pci, enumerates no SoundWire slave devices and exposes no internal speaker PCM. With the entry added, snd_pci_ps binds, both TAS2783 amplifiers and the RT712-VB enumerate over SoundWire, and the amd-soundwire card exposes the internal speaker playback PCM. Developed with AI assistance. ChatGPT helped analyze the ACP and SoundWire behavior, structure the controlled A/B testing, and draft the patch changelog. All hardware measurements, kernel builds, reboots and playback tests were performed by the submitter. The submitter has reviewed the change, understands it and takes responsibility for it. Assisted-by: ChatGPT:GPT-5.6 Sol Signed-off-by: Sehat Mahde <hskmahde@gmail.com> Link: https://patch.msgid.link/20260825224640.13662-1-hskmahde@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal to it. Both go on to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used >= there, and the snd_soc_put_enum_double() in soc-ops.c still does. Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off. Fixes: 3727b49 ("ASoC: dapm: Consolidate MUXs and value MUXs") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260825125745.932832-1-sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
Rename the function to cx_process_headset_detect_plug_type() to reflect that it only reports the detected plug type, and move the pin control write into cx_update_headset_mic_vref() so that node 0x19 is always set to enable the headset mic with the 80% VREF whenever the mic is present, regardless of the type detection result. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260826115344.2128835-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
Existing quirk doesn't cover all known existing FA401EA devices, so use "FA401EA" to cover all of them. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221310#c49 Fixes: 27d090f ("ASoC: amd: acp: add ACP70 DMI override for new ASUS TUF platforms") Signed-off-by: Shengyu Qu <wiagn@4d2.org> Link: https://patch.msgid.link/20260826172050.15686-1-wiagn@4d2.org Signed-off-by: Mark Brown <broonie@kernel.org>
The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller. For avoiding the Oops, add a sanity check of the kcontrol's info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer. Reported-by: syzbot+b7fe2760ea6f1ee44b4d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com Fixes: 22d8de6 ("ALSA: control - add generic LED trigger module as the new control layer") Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827113951.893291-1-tiwai@suse.de
…scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.3 A fairly big batch of fixes that came in during the merge window. There's a lot of quirks for x86 systems and a bunch of driver specific fixes, the most critical being the fixes for Tegra's register definitions. It turned out that they had been relying on the regmap default handling bugs that were fixed in v7.2 and so audio was fairly badly broken, unfortunately the issue wasn't noticed in time for release.
bardliao
requested review from
dbaluta,
kv2019i,
lgirdwood,
plbossart,
ranj063,
shumingfan,
singalsu and
ujfalusi
as code owners
August 28, 2026 03:12
Copilot stopped reviewing on behalf of
bardliao due to an error
August 28, 2026 03:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream merge