The linux-next integration testing tree https://git.landau.one/pub/scm/linux/kernel/git/next/linux-next.git/atom?h=master 2026-09-07T13:49:19+00:00 2026-09-07T13:49:19+00:00 Mark Brown broonie@kernel.org 2026-09-07T13:49:19+00:00 urn:sha1:317c288c0c89d1cfdb3572251b36f28012911428 # Conflicts: # net/ceph/osd_client.c 2026-09-07T13:48:27+00:00 Mark Brown broonie@kernel.org 2026-09-07T13:48:27+00:00 urn:sha1:c230f832291ae4dbebec3434e5b3c7495198e2b2 2026-09-07T13:27:35+00:00 Mark Brown broonie@kernel.org 2026-09-07T13:27:35+00:00 urn:sha1:8f104edba298ce5caf7dd7af424b9b50736cd20c 2026-09-07T13:27:33+00:00 Mark Brown broonie@kernel.org 2026-09-07T13:27:33+00:00 urn:sha1:f54b06f6b0f76eec21c6e5c34caaf695472a962b 2026-09-07T13:27:31+00:00 Mark Brown broonie@kernel.org 2026-09-07T13:27:31+00:00 urn:sha1:43208f9c83d6af9b026dfcddf7bc3bb658d75ae5 # Conflicts: # include/linux/ns/ns_common_types.h 2026-09-07T10:38:04+00:00 Mickaël Salaün mic@digikod.net 2026-09-07T10:36:08+00:00 urn:sha1:e1e60f71f54f2cdff687fc7a6ca3f35ad7b9c75d landlock_merge_ruleset() checks for a NULL ruleset after dereferencing it in lockdep_assert_held(). Move the assertion after the check so the defensive path remains effective. The mask-validation comment originated in landlock_add_fs_access_mask() to explain that its WARN_ON_ONCE() checked a caller invariant. It became self-referential when this helper and its network and scope counterparts were inlined into landlock_create_ruleset(). Restate the invariant without naming the caller. Keep both as defensive callee checks. Moving the assertion preserves the NULL check's ability to warn and return -EINVAL, while invalid masks remain warned about and masked. Reported-by: Günther Noack <gnoack@google.com> Closes: https://patch.msgid.link/aobYhIt3vcs2xN0b@google.com Closes: https://patch.msgid.link/aobasxUDQ8b7GYXl@google.com Link: https://patch.msgid.link/20260907103609.113325-1-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net> 2026-09-07T10:01:47+00:00 Norbert Szetei norbert@doyensec.com 2026-08-22T12:29:00+00:00 urn:sha1:2c6dc792538260a8087ac5b22c31b3b8e47c85d6 current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it. A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2): BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0 Take a reference on the dentry selected as the source parent, using dget() for the common-mount-root case and dget_parent() otherwise. Release it after the hierarchy walk and synchronous audit logging. Cc: stable@vger.kernel.org Fixes: b91c3e4ea756 ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER") Signed-off-by: Norbert Szetei <norbert@doyensec.com> Reviewed-by: Günther Noack <gnoack3000@gmail.com> Tested-by: Günther Noack <gnoack3000@gmail.com> Link: https://patch.msgid.link/E9CDD9E6-E960-4DE2-B1AC-5667D52ABB3E@doyensec.com [mic: Clarify the caller, reachability, and reference handling] Signed-off-by: Mickaël Salaün <mic@digikod.net> 2026-09-06T23:17:40+00:00 Alexei Starovoitov ast@kernel.org 2026-09-06T22:50:31+00:00 urn:sha1:1b7415bf70be95b9a1e7e87d544867881065613f Cross-merge BPF and other fixes after downstream PR. Conflicts: kernel/bpf/backtrack.c include/linux/bpf_verifier.h Signed-off-by: Alexei Starovoitov <ast@kernel.org> 2026-09-06T03:45:18+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-06T03:45:18+00:00 urn:sha1:1fc5a74b108fc90951890ec513ac81869f5eaff1 Pull kmalloc_obj conversions from Kees Cook: "Another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci" * tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: treewide: refresh kmalloc_obj() conversions drm/amd/display: Fix harmless type mismatch in allocation 2026-09-05T04:37:00+00:00 Kees Cook kees+treewide@kernel.org 2026-09-02T22:31:14+00:00 urn:sha1:3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>