Merge tag 'driver-core-6.17-rc3' of... (52025b8f) · Commits · git / linux-net

Documentation/process/security-bugs.rst

+16 −9

Original line number	Diff line number	Diff line
		@@ -8,8 +8,22 @@ like to know when a security bug is found so that it can be fixed and
		disclosed as quickly as possible. Please report security bugs to the
		Linux kernel security team.

		Contact
		-------
		The security team and maintainers almost always require additional
		information beyond what was initially provided in a report and rely on
		active and efficient collaboration with the reporter to perform further
		testing (e.g., verifying versions, configuration options, mitigations, or
		patches). Before contacting the security team, the reporter must ensure
		they are available to explain their findings, engage in discussions, and
		run additional tests. Reports where the reporter does not respond promptly
		or cannot effectively discuss their findings may be abandoned if the
		communication does not quickly improve.

		As it is with any bug, the more information provided the easier it
		will be to diagnose and fix. Please review the procedure outlined in
		'Documentation/admin-guide/reporting-issues.rst' if you are unclear about what
		information is helpful. Any exploit code is very helpful and will not
		be released without consent from the reporter unless it has already been
		made public.

		The Linux kernel security team can be contacted by email at
		<security@kernel.org>. This is a private list of security officers
		@@ -19,13 +33,6 @@ that can speed up the process considerably. It is possible that the
		security team will bring in extra help from area maintainers to
		understand and fix the security vulnerability.

		As it is with any bug, the more information provided the easier it
		will be to diagnose and fix. Please review the procedure outlined in
		'Documentation/admin-guide/reporting-issues.rst' if you are unclear about what
		information is helpful. Any exploit code is very helpful and will not
		be released without consent from the reporter unless it has already been
		made public.

		Please send plain text emails without attachments where possible.
		It is much harder to have a context-quoted discussion about a complex
		issue if all the details are hidden away in attachments. Think of it like a

fs/debugfs/inode.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -183,6 +183,9 @@ static int debugfs_reconfigure(struct fs_context *fc)
		struct debugfs_fs_info *sb_opts = sb->s_fs_info;
		struct debugfs_fs_info *new_opts = fc->s_fs_info;

		if (!new_opts)
		return 0;

		sync_filesystem(sb);

		/* structure copy of new mount options to sb */
		@@ -282,10 +285,16 @@ static int debugfs_fill_super(struct super_block sb, struct fs_context fc)

		static int debugfs_get_tree(struct fs_context *fc)
		{
		int err;

		if (!(debugfs_allow & DEBUGFS_ALLOW_API))
		return -EPERM;

		return get_tree_single(fc, debugfs_fill_super);
		err = get_tree_single(fc, debugfs_fill_super);
		if (err)
		return err;

		return debugfs_reconfigure(fc);
		}

		static void debugfs_free_fc(struct fs_context *fc)

mm/vmscan.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -5772,9 +5772,9 @@ static int __init init_lru_gen(void)
		if (sysfs_create_group(mm_kobj, &lru_gen_attr_group))
		pr_err("lru_gen: failed to create sysfs group\n");

		debugfs_create_file_aux_num("lru_gen", 0644, NULL, NULL, 1,
		debugfs_create_file_aux_num("lru_gen", 0644, NULL, NULL, false,
		&lru_gen_rw_fops);
		debugfs_create_file_aux_num("lru_gen_full", 0444, NULL, NULL, 0,
		debugfs_create_file_aux_num("lru_gen_full", 0444, NULL, NULL, true,
		&lru_gen_ro_fops);

		return 0;

rust/kernel/device.rs

+184 −24

Original line number	Diff line number	Diff line
		@@ -15,23 +15,130 @@

		pub mod property;

		/// A reference-counted device.
		/// The core representation of a device in the kernel's driver model.
		///
		/// This structure represents the Rust abstraction for a C `struct device`. This implementation
		/// abstracts the usage of an already existing C `struct device` within Rust code that we get
		/// passed from the C side.
		/// This structure represents the Rust abstraction for a C `struct device`. A [`Device`] can either
		/// exist as temporary reference (see also [`Device::from_raw`]), which is only valid within a
		/// certain scope or as [`ARef<Device>`], owning a dedicated reference count.
		///
		/// An instance of this abstraction can be obtained temporarily or permanent.
		/// # Device Types
		///
		/// A temporary one is bound to the lifetime of the C `struct device` pointer used for creation.
		/// A permanent instance is always reference-counted and hence not restricted by any lifetime
		/// boundaries.
		/// A [`Device`] can represent either a bus device or a class device.
		///
		/// For subsystems it is recommended to create a permanent instance to wrap into a subsystem
		/// specific device structure (e.g. `pci::Device`). This is useful for passing it to drivers in
		/// `T::probe()`, such that a driver can store the `ARef<Device>` (equivalent to storing a
		/// `struct device` pointer in a C driver) for arbitrary purposes, e.g. allocating DMA coherent
		/// memory.
		/// ## Bus Devices
		///
		/// A bus device is a [`Device`] that is associated with a physical or virtual bus. Examples of
		/// buses include PCI, USB, I2C, and SPI. Devices attached to a bus are registered with a specific
		/// bus type, which facilitates matching devices with appropriate drivers based on IDs or other
		/// identifying information. Bus devices are visible in sysfs under `/sys/bus/<bus-name>/devices/`.
		///
		/// ## Class Devices
		///
		/// A class device is a [`Device`] that is associated with a logical category of functionality
		/// rather than a physical bus. Examples of classes include block devices, network interfaces, sound
		/// cards, and input devices. Class devices are grouped under a common class and exposed to
		/// userspace via entries in `/sys/class/<class-name>/`.
		///
		/// # Device Context
		///
		/// [`Device`] references are generic over a [`DeviceContext`], which represents the type state of
		/// a [`Device`].
		///
		/// As the name indicates, this type state represents the context of the scope the [`Device`]
		/// reference is valid in. For instance, the [`Bound`] context guarantees that the [`Device`] is
		/// bound to a driver for the entire duration of the existence of a [`Device<Bound>`] reference.
		///
		/// Other [`DeviceContext`] types besides [`Bound`] are [`Normal`], [`Core`] and [`CoreInternal`].
		///
		/// Unless selected otherwise [`Device`] defaults to the [`Normal`] [`DeviceContext`], which by
		/// itself has no additional requirements.
		///
		/// It is always up to the caller of [`Device::from_raw`] to select the correct [`DeviceContext`]
		/// type for the corresponding scope the [`Device`] reference is created in.
		///
		/// All [`DeviceContext`] types other than [`Normal`] are intended to be used with
		/// [bus devices](#bus-devices) only.
		///
		/// # Implementing Bus Devices
		///
		/// This section provides a guideline to implement bus specific devices, such as [`pci::Device`] or
		/// [`platform::Device`].
		///
		/// A bus specific device should be defined as follows.
		///
		/// ```ignore
		/// #[repr(transparent)]
		/// pub struct Device<Ctx: device::DeviceContext = device::Normal>(
		/// Opaque<bindings::bus_device_type>,
		/// PhantomData<Ctx>,
		/// );
		/// ```
		///
		/// Since devices are reference counted, [`AlwaysRefCounted`] should be implemented for `Device`
		/// (i.e. `Device<Normal>`). Note that [`AlwaysRefCounted`] must not be implemented for any other
		/// [`DeviceContext`], since all other device context types are only valid within a certain scope.
		///
		/// In order to be able to implement the [`DeviceContext`] dereference hierarchy, bus device
		/// implementations should call the [`impl_device_context_deref`] macro as shown below.
		///
		/// ```ignore
		/// // SAFETY: `Device` is a transparent wrapper of a type that doesn't depend on `Device`'s
		/// // generic argument.
		/// kernel::impl_device_context_deref!(unsafe { Device });
		/// ```
		///
		/// In order to convert from a any [`Device<Ctx>`] to [`ARef<Device>`], bus devices can implement
		/// the following macro call.
		///
		/// ```ignore
		/// kernel::impl_device_context_into_aref!(Device);
		/// ```
		///
		/// Bus devices should also implement the following [`AsRef`] implementation, such that users can
		/// easily derive a generic [`Device`] reference.
		///
		/// ```ignore
		/// impl<Ctx: device::DeviceContext> AsRef<device::Device<Ctx>> for Device<Ctx> {
		/// fn as_ref(&self) -> &device::Device<Ctx> {
		/// ...
		/// }
		/// }
		/// ```
		///
		/// # Implementing Class Devices
		///
		/// Class device implementations require less infrastructure and depend slightly more on the
		/// specific subsystem.
		///
		/// An example implementation for a class device could look like this.
		///
		/// ```ignore
		/// #[repr(C)]
		/// pub struct Device<T: class::Driver> {
		/// dev: Opaque<bindings::class_device_type>,
		/// data: T::Data,
		/// }
		/// ```
		///
		/// This class device uses the sub-classing pattern to embed the driver's private data within the
		/// allocation of the class device. For this to be possible the class device is generic over the
		/// class specific `Driver` trait implementation.
		///
		/// Just like any device, class devices are reference counted and should hence implement
		/// [`AlwaysRefCounted`] for `Device`.
		///
		/// Class devices should also implement the following [`AsRef`] implementation, such that users can
		/// easily derive a generic [`Device`] reference.
		///
		/// ```ignore
		/// impl<T: class::Driver> AsRef<device::Device> for Device<T> {
		/// fn as_ref(&self) -> &device::Device {
		/// ...
		/// }
		/// }
		/// ```
		///
		/// An example for a class device implementation is [`drm::Device`].
		///
		/// # Invariants
		///
		@@ -42,6 +149,12 @@
		///
		/// `bindings::device::release` is valid to be called from any thread, hence `ARef<Device>` can be
		/// dropped from any thread.
		///
		/// [`AlwaysRefCounted`]: kernel::types::AlwaysRefCounted
		/// [`drm::Device`]: kernel::drm::Device
		/// [`impl_device_context_deref`]: kernel::impl_device_context_deref
		/// [`pci::Device`]: kernel::pci::Device
		/// [`platform::Device`]: kernel::platform::Device
		#[repr(transparent)]
		pub struct Device<Ctx: DeviceContext = Normal>(Opaque<bindings::device>, PhantomData<Ctx>);

		@@ -311,28 +424,75 @@ unsafe impl Send for Device {}
		// synchronization in `struct device`.
		unsafe impl Sync for Device {}

		/// Marker trait for the context of a bus specific device.
		/// Marker trait for the context or scope of a bus specific device.
		///
		/// [`DeviceContext`] is a marker trait for types representing the context of a bus specific
		/// [`Device`].
		///
		/// The specific device context types are: [`CoreInternal`], [`Core`], [`Bound`] and [`Normal`].
		///
		/// Some functions of a bus specific device should only be called from a certain context, i.e. bus
		/// callbacks, such as `probe()`.
		/// [`DeviceContext`] types are hierarchical, which means that there is a strict hierarchy that
		/// defines which [`DeviceContext`] type can be derived from another. For instance, any
		/// [`Device<Core>`] can dereference to a [`Device<Bound>`].
		///
		/// This is the marker trait for structures representing the context of a bus specific device.
		/// The following enumeration illustrates the dereference hierarchy of [`DeviceContext`] types.
		///
		/// - [`CoreInternal`] => [`Core`] => [`Bound`] => [`Normal`]
		///
		/// Bus devices can automatically implement the dereference hierarchy by using
		/// [`impl_device_context_deref`].
		///
		/// Note that the guarantee for a [`Device`] reference to have a certain [`DeviceContext`] comes
		/// from the specific scope the [`Device`] reference is valid in.
		///
		/// [`impl_device_context_deref`]: kernel::impl_device_context_deref
		pub trait DeviceContext: private::Sealed {}

		/// The [`Normal`] context is the context of a bus specific device when it is not an argument of
		/// any bus callback.
		/// The [`Normal`] context is the default [`DeviceContext`] of any [`Device`].
		///
		/// The normal context does not indicate any specific context. Any `Device<Ctx>` is also a valid
		/// [`Device<Normal>`]. It is the only [`DeviceContext`] for which it is valid to implement
		/// [`AlwaysRefCounted`] for.
		///
		/// [`AlwaysRefCounted`]: kernel::types::AlwaysRefCounted
		pub struct Normal;

		/// The [`Core`] context is the context of a bus specific device when it is supplied as argument of
		/// any of the bus callbacks, such as `probe()`.
		/// The [`Core`] context is the context of a bus specific device when it appears as argument of
		/// any bus specific callback, such as `probe()`.
		///
		/// The core context indicates that the [`Device<Core>`] reference's scope is limited to the bus
		/// callback it appears in. It is intended to be used for synchronization purposes. Bus device
		/// implementations can implement methods for [`Device<Core>`], such that they can only be called
		/// from bus callbacks.
		pub struct Core;

		/// Semantically the same as [`Core`] but reserved for internal usage of the corresponding bus
		/// Semantically the same as [`Core`], but reserved for internal usage of the corresponding bus
		/// abstraction.
		///
		/// The internal core context is intended to be used in exactly the same way as the [`Core`]
		/// context, with the difference that this [`DeviceContext`] is internal to the corresponding bus
		/// abstraction.
		///
		/// This context mainly exists to share generic [`Device`] infrastructure that should only be called
		/// from bus callbacks with bus abstractions, but without making them accessible for drivers.
		pub struct CoreInternal;

		/// The [`Bound`] context is the context of a bus specific device reference when it is guaranteed to
		/// be bound for the duration of its lifetime.
		/// The [`Bound`] context is the [`DeviceContext`] of a bus specific device when it is guaranteed to
		/// be bound to a driver.
		///
		/// The bound context indicates that for the entire duration of the lifetime of a [`Device<Bound>`]
		/// reference, the [`Device`] is guaranteed to be bound to a driver.
		///
		/// Some APIs, such as [`dma::CoherentAllocation`] or [`Devres`] rely on the [`Device`] to be bound,
		/// which can be proven with the [`Bound`] device context.
		///
		/// Any abstraction that can guarantee a scope where the corresponding bus device is bound, should
		/// provide a [`Device<Bound>`] reference to its users for this scope. This allows users to benefit
		/// from optimizations for accessing device resources, see also [`Devres::access`].
		///
		/// [`Devres`]: kernel::devres::Devres
		/// [`Devres::access`]: kernel::devres::Devres::access
		/// [`dma::CoherentAllocation`]: kernel::dma::CoherentAllocation
		pub struct Bound;

		mod private {

rust/kernel/devres.rs

+18 −9

Original line number	Diff line number	Diff line
		@@ -115,10 +115,11 @@ pub struct Devres<T: Send> {
		/// Contains all the fields shared with [`Self::callback`].
		// TODO: Replace with `UnsafePinned`, once available.
		//
		// Subsequently, the `drop_in_place()` in `Devres::drop` and the explicit `Send` and `Sync'
		// impls can be removed.
		// Subsequently, the `drop_in_place()` in `Devres::drop` and `Devres::new` as well as the
		// explicit `Send` and `Sync' impls can be removed.
		#[pin]
		inner: Opaque<Inner<T>>,
		_add_action: (),
		}

		impl<T: Send> Devres<T> {
		@@ -140,7 +141,15 @@ pub fn new<'a, E>(
		dev: dev.into(),
		callback,
		// INVARIANT: `inner` is properly initialized.
		inner <- {
		inner <- Opaque::pin_init(try_pin_init!(Inner {
		devm <- Completion::new(),
		revoke <- Completion::new(),
		data <- Revocable::new(data),
		})),
		// TODO: Replace with "initializer code blocks" [1] once available.
		//
		// [1] https://github.com/Rust-for-Linux/pin-init/pull/69
		_add_action: {
		// SAFETY: `this` is a valid pointer to uninitialized memory.
		let inner = unsafe { &raw mut (*this.as_ptr()).inner };

		@@ -152,13 +161,13 @@ pub fn new<'a, E>(
		// live at least as long as the returned `impl PinInit<Self, Error>`.
		to_result(unsafe {
		bindings::devm_add_action(dev.as_raw(), Some(callback), inner.cast())
		})?;
		}).inspect_err(\|_\| {
		let inner = Opaque::cast_into(inner);

		Opaque::pin_init(try_pin_init!(Inner {
		devm <- Completion::new(),
		revoke <- Completion::new(),
		data <- Revocable::new(data),
		}))
		// SAFETY: `inner` is a valid pointer to an `Inner<T>` and valid for both reads
		// and writes.
		unsafe { core::ptr::drop_in_place(inner) };
		})?;
		},
		})
		}