kernel/git/stable/linux.git/arch/openrisc, branch master

Merge tag 'for-linus' of https://github.com/openrisc/linux

2026-08-30T16:26:54+00:00

Pull OpenRISC updates from Stafford Horne: "One small trivial macro cleanup and one bug fix. The bug fix is to fix an unchecked access in our or1k_atomic syscall, I am debating if we should just deprecate this as there is minimal need for it" * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall openrisc: drop unneeded semicolon

openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

2026-08-29T06:32:26+00:00

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne

Merge tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18T22:58:29+00:00

Pull treewide timer related cleanups from Thomas Gleixner: - Remove the leftover CLOCK_TICK_RATE which has been scheduled for removal more than a decade ago along with some now empty asm/timex.h files. - Consolidate delay timer calibration The construct of having a define in a header requires that architectures provided asm/timex.h for no reason. Also the function name for reading the delay timer is confusing at best. Use a config switch to enable that functionality and rename the function to delay_read_timer() to make the purpose clear. This removes some more now empty asm/timex.h files as well. * tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: calibrate: Rework delay timer calibration treewide: Remove CLOCK_TICK_RATE x86: Use PIT_TICK_RATE instead of CLOCK_TICK_RATE

Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18T22:00:56+00:00

Pull generic entry code updates from Thomas Gleixner: - Make syscall user dispatching configurable Not all architectures can makes use of syscall user dispatching. Allow them to disable the feature completely. - Consolidate stack randomization for the generic entry code and the architectures using it. Stack randomization on syscall entry was sprinkled throughout the architecture specific low level entry code and in some cases at the wrong points, e.g. before establishing state, which violates the non-instrumentable constraints of that code. Clean this up by integrating stack randomization into the generic entry code helpers so that it is invoked at the earliest possible point right after establishing state and converting all generic entry code using architecture over. - Clean up the syscall number handling in the generic entry code. It works correctly for architectures which have a separate return value storage in pt_regs, but fails to distinguish the case where user space handed in -1 as syscall number from the case where the entry code rejects it by returning -1 to the callers. Aside of that the return value functionality of those interfaces is not really intuitive. Fix this by separating the decision to reject a syscall (user dispatch, ptrace, seccomp ...) from the potential modification of the syscall number through these mechanisms. This solves most of the problems for architectures which do not have a separate return value storage in pt_regs except for the case where a tracepoint has a BPF script or a probe attached which overwrite both the syscall number and the return value. But that's a problem which cannot be solved in the generic code, that only can be addressed by separating the storage model in the affected architectures. * tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution entry: Make return type of syscall_trace_enter() bool entry: Rework trace_syscall_enter() entry: Rework syscall_audit_enter() syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH entry: Fix seccomp bypass after ptrace with TSYNC x86/entry: Simplify the syscall number logic x86/entry: Get rid of the sys_ni_syscall() indirection x86/entry: Make syscall functions static ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry() seccomp, treewide: Rename and convert __secure_computing() to return boolean entry: Use syscall number instead of rereading it entry: Remove syscall_enter_from_user_mode() x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack() s390/syscall: Use enter_from_user_mode_randomize_stack() riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack() powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack() loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack() entry: Provide [syscall_]enter_from_user_mode_randomize_stack() randomize_kstack: Provide add_random_kstack_offset_irqsoff() ...

Merge tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18T20:07:17+00:00

Pull locking updates from Ingo Molnar: "Futexes: - Use runtime constants for futex_hash computation (K Prateek Nayak, Peter Zijlstra) - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior) - Avoid private hash use-after-free on final put (Felix Hoffmann) - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra) Rust integration updates: - Implement refcounted interrupt disable and SpinLockIrq for Rust (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul) - Rust sync: add helpers for mb, dma_mb and friends; add generic memory barriers and use LKMM atomics instead of Rust atomics in the revocable code (Gary Guo) - Add abstraction and integrate synchronize_rcu() (Philipp Stanner) Lock debugging: - Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter Zijlstra) - Enable the printing of held locks of remote running tasks and print task CPU (Ingo Molnar) - percpu-rwsem: Annotate intentional data race in readers_active_check() (Sun Shaojie) Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song, Naveen Kumar Chaudhary and Thomas Huth" * tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits) rust: sync: Introduce SpinLockIrq::lock_with() and friends rust: sync: Add SpinLockIrq rust: sync: Use super::* in spinlock.rs rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers rust: Introduce interrupt module s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS sched: Avoid signed comparison of preempt_count() in __cant_migrate() sched: Remove the unused preempt_offset parameter of __cant_sleep() locking: Switch to _irq_{disable,enable}() variants in cleanup guards irq: Add KUnit test for refcounted interrupt enable/disable irq,spin_lock: Add counted interrupt disabling/enabling openrisc: Include in smp.h preempt: Introduce __preempt_count_{sub,add}_return() preempt: Introduce HARDIRQ_DISABLE_BITS preempt: Track NMI nesting to separate per-CPU counter futex: Tell kmemleak we're not leaking __futex_queues x86/paravirt: Trace contended_release on unlock tracing/lock: Use TRACE_EVENT_FN() for contended_release ...

openrisc: drop unneeded semicolon

2026-08-15T06:30:13+00:00

When a function-like macro expands to an expression, that expression doesn't need a semicolon after it. All uses have been verified to have their own semicolons. This was found using the following Coccinelle semantic patch: @r@ identifier i : script:ocaml() { String.lowercase_ascii i = i }; expression e; @@ *#define i(...) e; Signed-off-by: Julia Lawall Signed-off-by: Stafford Horne

openrisc: signal: do not restore privileged SR bits on sigreturn

2026-08-15T06:14:55+00:00

restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control. An unprivileged task can thus return from a signal handler through a crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the CPU performs no translation or protection on data accesses, so the task gains read and write access to arbitrary physical memory, a local privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH and the cache-enable bits are exposed the same way. The ptrace GPR regset already refuses any change to SR for exactly this reason. Restore only the arithmetic flag bits (F, CY, OV) from the signal frame and take every privileged control bit from the SR the kernel saved on signal entry. Verified with qemu-system-or1k -M or1k-sim: before this change an unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the same PoC receives SIGSEGV and physical memory is unchanged. Fixes: ac689eb7f9d4 ("OpenRISC: Signal handling") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne

openrisc: Include in smp.h

2026-08-08T20:44:06+00:00

While OpenRISC currently doesn't fail to build upstream, it appears that including in the right headers is enough to break that - primarily because OpenRISC's asm/smp.h header doesn't actually provide any definition for struct cpumask. Which means the only reason we aren't failing to build the kernel is because we've been lucky enough that every spot including asm/smp.h already has definitions for struct cpumask pulled in. This became evident when trying to work on a patch series for adding ref-counted interrupt enable/disable to the kernel, where introducing a new interrupt_rc.h header suddenly introduced a build error on OpenRISC: In file included from include/linux/interrupt_rc.h:17, from include/linux/spinlock.h:60, from include/linux/mmzone.h:8, from include/linux/gfp.h:7, from include/linux/mm.h:7, from arch/openrisc/include/asm/pgalloc.h:20, from arch/openrisc/include/asm/io.h:18, from include/linux/io.h:12, from drivers/irqchip/irq-ompic.c:61: arch/openrisc/include/asm/smp.h:21:59: warning: 'struct cpumask' declared inside parameter list will not be visible outside of this definition or declaration 21 | extern void arch_send_call_function_ipi_mask(const struct cpumask *mask); | ^~~~~~~ arch/openrisc/include/asm/smp.h:23:54: warning: 'struct cpumask' declared inside parameter list will not be visible outside of this definition or declaration 23 | extern void set_smp_cross_call(void (*)(const struct cpumask *, unsigned int)); | ^~~~~~~ drivers/irqchip/irq-ompic.c: In function 'ompic_of_init': >> drivers/irqchip/irq-ompic.c:191:28: error: passing argument 1 of 'set_smp_cross_call' from incompatible pointer type [-Werror=incompatible-pointer-types] 191 | set_smp_cross_call(ompic_raise_softirq); | ^~~~~~~~~~~~~~~~~~~ | | | void (*)(const struct cpumask *, unsigned int) arch/openrisc/include/asm/smp.h:23:32: note: expected 'void (*)(const struct cpumask *, unsigned int)' but argument is of type 'void (*)(const struct cpumask *, unsigned int)' 23 | extern void set_smp_cross_call(void (*)(const struct cpumask *, unsigned int)); To fix this, let's take an example from the smp.h headers of other architectures (x86, hexagon, arm64, probably more): just include linux/cpumask.h at the top. Signed-off-by: Lyude Paul Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Acked-by: Stafford Horne Link: https://patch.msgid.link/20260804161447.84806-5-boqun@kernel.org

calibrate: Rework delay timer calibration

2026-07-15T13:04:55+00:00

The header define in asm/timex,h and the naming of the function to read the delay timer are confusing at best. Convert it to a config switch selected by the archictures which provide the functionality and rename the function to delay_read_timer(), which makes the purpose clear. Move the declaration to linux/delay.h where it belongs. Remove the resulting empty asm/timex.h files as well. No functional change. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260410120317.978403520@kernel.org

treewide: Remove CLOCK_TICK_RATE

2026-07-15T13:04:55+00:00

This has been scheduled for removal more than a decade ago and the comments related to it have been dutifully ignored. The last dependencies are gone. Remove it along with various now empty asm/timex.h files. Signed-off-by: Thomas Gleixner Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260410120317.910770161@kernel.org