linux-rng, branch master

random: vDSO: avoid call to memset() when zeroing reserved parameter

2026-10-02T10:12:13Z

After a recent change in LLVM [1], builds with the random vDSO implementation, such as PowerPC and RISC-V, fail when checking the vDSO: arch/powerpc/kernel/vdso/vdso32.so.dbg: dynamic relocations are not supported arch/riscv/kernel/vdso/vdso.so.dbg: dynamic relocations are not supported memset() is now generated when zeroing params->reserved for some builds because LLVM has an optimization (now run in more instances) that can recognize at compile time when it is assigning a static value to a contiguous area of memory and turn that into a call to memset(). Both clang and GCC assume memset() is always available [2]. Clang has an internal fiddly hook, -max-store-memset, which we can set to a high number, to disable generating out of line memset calls [3]. Similarly, GCC has -finline-stringops=memset to do the same [4], should this issue ever hit future version of GCC. While these options wouldn't make sense for normal kernel code, it is fine for the extremely limited and intentionally compact vDSO code. Link: https://github.com/llvm/llvm-project/commit/90cebef1411617fc3eedd359bdf00cb44b1c2439 [1] Link: https://gcc.gnu.org/onlinedocs/gcc-16.2.0/gcc/Standards.html#index-ffreestanding [2] Link: https://github.com/llvm/llvm-project/commit/b28eeb28bea39148738dc375e8a97072a1907e64 [3] Link: https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-finline-stringops [4] Closes: https://github.com/ClangBuiltLinux/linux/issues/2183 Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Nathan Chancellor Signed-off-by: Jason A. Donenfeld

random: fix vgetrandom_opaque_params kernel-doc

2026-09-16T09:52:34Z

struct vgetrandom_opaque_params contains size_of_opaque_state, but its kernel-doc describes size_per_opaque_state. This leaves the real member undescribed and adds a nonexistent member to the generated documentation. Use the member's actual name. Fixes: 4ad10a5f5f78 ("random: introduce generic vDSO getrandom() implementation") Signed-off-by: Karl Mehltretter Signed-off-by: Jason A. Donenfeld

random: vDSO: fix repeated word 'to' in comment

2026-09-16T09:51:39Z

Drop the second 'to', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Signed-off-by: Hemanth Selam Signed-off-by: Jason A. Donenfeld

siphash: clean up kernel-doc comments

2026-09-16T09:48:10Z

Use the correct function parameter names and add function return value descriptions to avoid kernel-doc warnings: Warning: include/linux/siphash.h:82 function parameter 'len' not described in 'siphash' Warning: include/linux/siphash.h:82 No description found for return value of 'siphash' Warning: include/linux/siphash.h:132 function parameter 'len' not described in 'hsiphash' Warning: include/linux/siphash.h:132 No description found for return value of 'hsiphash' Signed-off-by: Randy Dunlap Signed-off-by: Jason A. Donenfeld

virt: vmgenid: move to using dev_set/get_drvdata

2026-09-16T09:48:06Z

The prior commit moved the order of initializing driver_data around. In looking through the tree at what is normally done, it appears that actually few drivers set or get driver_data directly, but instead go through the dev_set/get_drvdata helpers, which are simple inline helpers that amount to the same exact code. So, for the sake of consistency, use the helpers. Signed-off-by: Jason A. Donenfeld

virt: vmgenid: set driver_data before registering notification handlers

2026-08-31T03:36:21Z

Both probe paths register their notification handler before assigning driver_data, which the handler dereferences. In the devicetree path, the notification IRQ can fire as soon as devm_request_irq() registers the handler: the interrupt may already be pending at probe time, for example when a VMM injects the generation-changed notification while restoring a guest from a snapshot that was taken before the driver had probed (Firecracker does exactly this on snapshot restore). The IRQ is also requested with IRQF_SHARED, so another device sharing the line can trigger the handler just as early. The handler then calls vmgenid_notify(), which dereferences the still-NULL driver_data and panics: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.38+ #1 PREEMPT(none) Hardware name: linux,dummy-virt (DT) pc : vmgenid_notify.isra.0+0x24/0x8c lr : vmgenid_of_irq_handler+0x14/0x34 Call trace: vmgenid_notify.isra.0+0x24/0x8c (P) vmgenid_of_irq_handler+0x14/0x34 __handle_irq_event_percpu+0x44/0x1bc handle_irq_event+0x4c/0xb4 handle_fasteoi_irq+0xf8/0x1f8 The ACPI path has the same ordering problem: the handler is installed with acpi_install_notify_handler() before driver_data is assigned. ACPI notifications are dispatched asynchronously from a workqueue, so the window is narrow, but a notification arriving between the two calls hits the same NULL dereference. Assign driver_data before registering the handlers. The state is fully initialized at that point, so the handlers are safe to run. Should registration fail, the probe error path leaves no dangling pointer behind: the driver core clears driver_data in device_unbind_cleanup(). Fixes: 7b1bcd6b50a6 ("virt: vmgenid: add support for devicetree bindings") Fixes: e07606713a90 ("virt: vmgenid: change implementation to use a platform driver") Cc: stable@vger.kernel.org Signed-off-by: Zhichen Wang Signed-off-by: Jason A. Donenfeld

virt: vmgenid: remap memory as decrypted

2026-08-31T03:32:34Z

It was found that AWS SEV-SNP enabled instances are not able to boot with commit 81256a50aa0f ("x86/mm: Make memremap(MEMREMAP_WB) map memory as encrypted by default") applied and the reason seems to be the vmgenid device which requires unencrypted writeable memory. A similar problem was previously fixed in DRM with commit 7dfede7d7edd ("drm/vmwgfx: Fix guests running with TDX/SEV"). Note, trusting vmgenid device in a Confidential VM is questionable: the malicious host may intentionally avoid notifying the guest when a copy is created. Fixes: 81256a50aa0f ("x86/mm: Make memremap(MEMREMAP_WB) map memory as encrypted by default") Signed-off-by: Vitaly Kuznetsov Cc: stable@vger.kernel.org # 6.15+ Signed-off-by: Jason A. Donenfeld

Linux 7.3-rc1

2026-08-30T20:34:40Z

Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

2026-08-30T17:53:24Z

Pull i2c fixes from Andi Shyti: "Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues: - fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock" * tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: core: fix debugfs UAF on adapter removal i2c: imx-lpi2c: avoid accessing target registers on master-only controllers i2c: qcom-cci: fix autosuspend cleanup i2c: designware: Enable interrupt mask workaround for HJMC3001 i2c: qcom-geni: update frequency table to fix timing parameters i2c: mux: Fix channel node leak on adapter add failure

Merge tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux

2026-08-30T17:42:40Z

Pull Coccinelle updates from Julia Lawall: - Clean up a number of the semantic patches in the scripts/coccinelle directory, particularly with respect to functions that no longer exist in the kernel (Sang-Heon Jeon) He and I have also done some reorganizations that improve performance. - Eliminate some false positives (me) - Fix an out of date URL (相浦彰) * tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: coccinelle: ifnulldev_put: update error message coccinelle: ifnulldev_put: update outdated helper names coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock coccinelle: kfree_mismatch: drop vmalloc_exec coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules coccinelle: zalloc-simple: drop the kmem_alloc rules coccinelle: alloc_cast: drop removed allocators coccinelle: remove obsolete pci_free_consistent.cocci scripts: coccinelle: devm_free: reduce false positives coccinelle: misc: struct_size: drop unneeded parentheses coccinelle: mini_lock: improve performance when searching loops coccinelle: api: check for macro context coccinelle: update Coccinelle website URL coccinelle: misc: minmax: avoid unhelpful isomorphisms coccinelle: misc: minmax: check for the presence of if cases coccinelle: misc: minmax: drop unneeded parentheses coccinelle: misc: minmax: improve performance when no candidate exists coccinelle: double_lock: improve performance when no double lock exists