kernel/git/stable/linux.git/arch/um, branch master

Merge tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-19T02:09:42+00:00

Pull x86 cpuid updates from Borislav Petkov: - Get rid of static_cpu_has() - one less API to care about testing CPU features - Unify the handling of CPU core types (performance, efficient, etc) by mapping the vendor-specific types to Linux ones - Continuation of the work of Ahmed Darwish to centralize CPUID leaf representation * tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU: Rename struct cpuid_read_output to struct cpuid_output x86/cpu/scattered: Sort it properly x86/cpu: Use parsed CPUID(0x1) x86/lib: Add CPUID(0x1) family and model calculation x86/cpu: Use parsed CPUID(0x0) x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities x86/topology: Add TOPO_CPU_TYPE_LOW_POWER x86/topology: Name the AMD core-type values x86/topo: Map vendor CPU types to generic Linux such types x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist x86/cpu: Hide and rename static_cpu_has()

Merge tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-19T01:11:25+00:00

Pull x86 alternatives update from Borislav Petkov: - Remove the smp_locks alternatives machinery which was used to patch out lock prefixes when running a SMP kernel on a uniprocessor machine * tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternative: Drop smp_locks glue

Merge tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18T22:58:29+00:00

Pull treewide timer related cleanups from Thomas Gleixner: - Remove the leftover CLOCK_TICK_RATE which has been scheduled for removal more than a decade ago along with some now empty asm/timex.h files. - Consolidate delay timer calibration The construct of having a define in a header requires that architectures provided asm/timex.h for no reason. Also the function name for reading the delay timer is confusing at best. Use a config switch to enable that functionality and rename the function to delay_read_timer() to make the purpose clear. This removes some more now empty asm/timex.h files as well. * tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: calibrate: Rework delay timer calibration treewide: Remove CLOCK_TICK_RATE x86: Use PIT_TICK_RATE instead of CLOCK_TICK_RATE

Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18T22:00:56+00:00

Pull generic entry code updates from Thomas Gleixner: - Make syscall user dispatching configurable Not all architectures can makes use of syscall user dispatching. Allow them to disable the feature completely. - Consolidate stack randomization for the generic entry code and the architectures using it. Stack randomization on syscall entry was sprinkled throughout the architecture specific low level entry code and in some cases at the wrong points, e.g. before establishing state, which violates the non-instrumentable constraints of that code. Clean this up by integrating stack randomization into the generic entry code helpers so that it is invoked at the earliest possible point right after establishing state and converting all generic entry code using architecture over. - Clean up the syscall number handling in the generic entry code. It works correctly for architectures which have a separate return value storage in pt_regs, but fails to distinguish the case where user space handed in -1 as syscall number from the case where the entry code rejects it by returning -1 to the callers. Aside of that the return value functionality of those interfaces is not really intuitive. Fix this by separating the decision to reject a syscall (user dispatch, ptrace, seccomp ...) from the potential modification of the syscall number through these mechanisms. This solves most of the problems for architectures which do not have a separate return value storage in pt_regs except for the case where a tracepoint has a BPF script or a probe attached which overwrite both the syscall number and the return value. But that's a problem which cannot be solved in the generic code, that only can be addressed by separating the storage model in the affected architectures. * tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution entry: Make return type of syscall_trace_enter() bool entry: Rework trace_syscall_enter() entry: Rework syscall_audit_enter() syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH entry: Fix seccomp bypass after ptrace with TSYNC x86/entry: Simplify the syscall number logic x86/entry: Get rid of the sys_ni_syscall() indirection x86/entry: Make syscall functions static ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry() seccomp, treewide: Rename and convert __secure_computing() to return boolean entry: Use syscall number instead of rereading it entry: Remove syscall_enter_from_user_mode() x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack() s390/syscall: Use enter_from_user_mode_randomize_stack() riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack() powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack() loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack() entry: Provide [syscall_]enter_from_user_mode_randomize_stack() randomize_kstack: Provide add_random_kstack_offset_irqsoff() ...

um: vector: fix use-after-free in vector_mmsg_rx()

2026-07-23T19:31:14+00:00

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication. Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Signed-off-by: Richard Weinberger

treewide: Remove CLOCK_TICK_RATE

2026-07-15T13:04:55+00:00

This has been scheduled for removal more than a decade ago and the comments related to it have been dutifully ignored. The last dependencies are gone. Remove it along with various now empty asm/timex.h files. Signed-off-by: Thomas Gleixner Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260410120317.910770161@kernel.org

x86/alternative: Drop smp_locks glue

2026-07-13T16:23:36+00:00

This was there to be able to patch out locking instructions when running a SMP kernel build on a UP CPU. The times are long gone when single-CPU x86 machines were relevant so drop that machinery and simplify the code considerably. LOCK_PREFIX needs to stay for when one wants to do a UP build for whatever reason. That'll go away when CONFIG_SMP becomes unconditional. Kill a bunch of leftover, unused prototypes while at it. Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Acked-by: Mike Rapoport (Microsoft) Link: https://lore.kernel.org/r/20260328081634.797552-1-rppt@kernel.org

ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry()

2026-07-12T10:38:02+00:00

The return value of that function is boolean and tells the caller whether to permit the syscall processing or not. Rename the function so the purpose is clear and make the return type bool. Signed-off-by: Thomas Gleixner Tested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Jinjie Ruan Reviewed-by: Radu Rendec Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Acked-by: Oleg Nesterov Acked-by: Magnus Lindholm Link: https://patch.msgid.link/20260707190254.280015701@kernel.org

seccomp, treewide: Rename and convert __secure_computing() to return boolean

2026-07-12T10:38:02+00:00

The return value of __secure_computing() currently uses 0 to indicate that a system call should be allowed, and -1 to indicate that it should be blocked/killed. This 0/-1 pattern is non-intuitive for a security check function and makes the control flow at the call sites less readable. Furthermore, any potential future changes to these return values would require a high-risk, error-prone audit of all its users across different architectures. Sanitize this logic by converting the return type of __secure_computing() to a proper boolean, where 'true' explicitly means 'allow' and 'false' means 'fail/deny'. Update all the two dozen or so call sites across the tree to align with this new boolean semantic. No functional changes are intended, as the callers still return -1 to the lower-level assembly entry code upon seccomp denial. Rename the function to __seccomp_permit_syscall() so that the purpose is entirely clear. [ tglx: Rename the function ] Suggested-by: Thomas Gleixner Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Signed-off-by: Thomas Gleixner Tested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Acked-by: Oleg Nesterov Link: https://patch.msgid.link/20260707190254.230735780@kernel.org

x86/cpu: Hide and rename static_cpu_has()

2026-07-07T04:34:26+00:00

cpu_feature_enabled() is the one to use to test feature flags so hide the static thing which doesn't pay attention to disabled mask bits anyway. Use the following command to do the replacement: $ git grep --files-with-matches -w static_cpu_has -- ':(exclude)*cpufeature.h' \ | xargs sed -i 's/static_cpu_has(/cpu_feature_enabled\(/g' There should be no functional changes resulting from this. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://patch.msgid.link/20260620015041.336288-1-bp@kernel.org