From: Greg Kroah-Hartman Date: Wed, 22 Jul 2026 12:58:40 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=96a679498c4a6fffaec2952e38b20469b6af70b5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch --- diff --git a/queue-5.15/perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch b/queue-5.15/perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch deleted file mode 100644 index 3f0150d2c0..0000000000 --- a/queue-5.15/perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch +++ /dev/null @@ -1,45 +0,0 @@ -From ba3b200475fe7da3e4aa11e046d720ea4f4c177f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 8 Jun 2026 08:10:43 -0300 -Subject: perf bpf: Add NULL check for btf__type_by_id() in - synthesize_bpf_prog_name() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 903b0526dcf86d030c5970b4b0a67f9c227368e2 ] - -synthesize_bpf_prog_name() calls btf__type_by_id() and immediately -dereferences the result via t->name_off without checking for NULL. -btf__type_by_id() returns NULL when the type_id is invalid or out -of range. When processing perf.data files, finfo->type_id comes from -untrusted input, so an invalid ID causes a NULL pointer dereference. - -Fix by checking t for NULL before dereferencing. - -Reported-by: sashiko-bot -Fixes: fc462ac75b36daaa ("perf bpf: Extract logic to create program names from perf_event__synthesize_one_bpf_prog()") -Cc: Song Liu -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/bpf-event.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index 56ab0d85931e36..1c597ac08ae926 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -149,7 +149,8 @@ static int synthesize_bpf_prog_name(char *buf, int size, - if (btf) { - finfo = func_infos + sub_id * info->func_info_rec_size; - t = btf__type_by_id(btf, finfo->type_id); -- short_name = btf__name_by_offset(btf, t->name_off); -+ if (t) -+ short_name = btf__name_by_offset(btf, t->name_off); - } else if (sub_id == 0 && sub_prog_cnt == 1) { - /* no subprog */ - if (info->name[0]) --- -2.53.0 - diff --git a/queue-5.15/perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch b/queue-5.15/perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch deleted file mode 100644 index eb3e440ad1..0000000000 --- a/queue-5.15/perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch +++ /dev/null @@ -1,68 +0,0 @@ -From ea28c6b9d2ec652b0b6da477df6d31ee5a3683bb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 14:23:15 -0300 -Subject: perf bpf: Use scnprintf() in snprintf_hex() and - synthesize_bpf_prog_name() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit cab3a9331ed0b3f884dd61c8a25b3cf123705982 ] - -Both functions accumulate formatted output via ret += snprintf(buf + ret, -size - ret, ...). If the buffer is too small and snprintf() returns more -than the remaining space, ret exceeds size and the next 'size - ret' -underflows, causing snprintf() to write past the buffer end. - -Switch to scnprintf() which returns the actual number of bytes written, -making the accumulation safe. - -Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Song Liu -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/bpf-event.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index e96a7fdfe283b5..56ab0d85931e36 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -42,7 +42,7 @@ static int snprintf_hex(char *buf, size_t size, unsigned char *data, size_t len) - size_t i; - - for (i = 0; i < len; i++) -- ret += snprintf(buf + ret, size - ret, "%02x", data[i]); -+ ret += scnprintf(buf + ret, size - ret, "%02x", data[i]); - return ret; - } - -@@ -143,7 +143,7 @@ static int synthesize_bpf_prog_name(char *buf, int size, - const struct btf_type *t; - int name_len; - -- name_len = snprintf(buf, size, "bpf_prog_"); -+ name_len = scnprintf(buf, size, "bpf_prog_"); - name_len += snprintf_hex(buf + name_len, size - name_len, - prog_tags[sub_id], BPF_TAG_SIZE); - if (btf) { -@@ -156,9 +156,10 @@ static int synthesize_bpf_prog_name(char *buf, int size, - short_name = info->name; - } else - short_name = "F"; -- if (short_name) -- name_len += snprintf(buf + name_len, size - name_len, -- "_%s", short_name); -+ if (short_name) { -+ name_len += scnprintf(buf + name_len, size - name_len, -+ "_%s", short_name); -+ } - return name_len; - } - --- -2.53.0 - diff --git a/queue-5.15/perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch b/queue-5.15/perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch deleted file mode 100644 index 5b746add23..0000000000 --- a/queue-5.15/perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 5868cf35cbc97d551478056aba4ac483eb1e3333 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 21:01:15 -0300 -Subject: perf bpf: Validate func_info_rec_size and sub_id in - synthesize_bpf_prog_name() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 10b3c3d63ecc17c6acb855bac5f40367f1115765 ] - -synthesize_bpf_prog_name() computes a pointer into the func_info array -using sub_id * info->func_info_rec_size without validating either value. -Both come from perf.data and are untrusted: - -- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means - the finfo pointer would reference a truncated entry, reading past it - into adjacent data. - -- A sub_id >= nr_func_info computes an offset past the func_info buffer, - causing an out-of-bounds read. - -Add bounds checks for both values before computing the pointer offset. -When validation fails, fall through to the non-BTF name path instead -of reading garbage. - -Reported-by: sashiko-bot -Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs") -Cc: Song Liu -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/bpf-event.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index 1c597ac08ae926..ff2ee6b0e3342a 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -146,7 +146,9 @@ static int synthesize_bpf_prog_name(char *buf, int size, - name_len = scnprintf(buf, size, "bpf_prog_"); - name_len += snprintf_hex(buf + name_len, size - name_len, - prog_tags[sub_id], BPF_TAG_SIZE); -- if (btf) { -+ if (btf && -+ info->func_info_rec_size >= sizeof(*finfo) && -+ sub_id < info->nr_func_info) { - finfo = func_infos + sub_id * info->func_info_rec_size; - t = btf__type_by_id(btf, finfo->type_id); - if (t) --- -2.53.0 - diff --git a/queue-5.15/perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch b/queue-5.15/perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch deleted file mode 100644 index e5bd18b79b..0000000000 --- a/queue-5.15/perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 6995b1bd8e69f39dd4b03180852d2f708f2fa683 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 11:19:10 -0300 -Subject: perf c2c: Fix use-after-free in he__get_c2c_hists() error path - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 5e5e6196d737c5be03d20647428316b36621608d ] - -he__get_c2c_hists() assigns c2c_he->hists before calling -c2c_hists__init(). If init fails, the error path calls free(hists) -but leaves c2c_he->hists pointing to freed memory. On teardown, -c2c_he_free() finds the non-NULL pointer and calls -hists__delete_entries() on it, causing a use-after-free. - -Set c2c_he->hists to NULL before freeing so teardown skips the -already-freed allocation. - -Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries") -Reported-by: sashiko-bot -Cc: Jiri Olsa -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-c2c.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c -index e6f900c3accb0f..cfa5a53abf2082 100644 ---- a/tools/perf/builtin-c2c.c -+++ b/tools/perf/builtin-c2c.c -@@ -203,6 +203,7 @@ he__get_c2c_hists(struct hist_entry *he, - - ret = c2c_hists__init(hists, sort, nr_header_lines); - if (ret) { -+ c2c_he->hists = NULL; - free(hists); - return NULL; - } --- -2.53.0 - diff --git a/queue-5.15/perf-core-detach-event-groups-during-remove_on_exec.patch b/queue-5.15/perf-core-detach-event-groups-during-remove_on_exec.patch deleted file mode 100644 index b4668fb46f..0000000000 --- a/queue-5.15/perf-core-detach-event-groups-during-remove_on_exec.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 3badcf0525a192bdf080670715b14358a443ff6b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 9 Jul 2026 23:31:45 +0900 -Subject: perf/core: Detach event groups during remove_on_exec - -From: Taeyang Lee <0wn@theori.io> - -[ Upstream commit 037a3c43edfb597665dd34457cd22b14692f2ba3 ] - -perf_event_remove_on_exec() removes events by calling -perf_event_exit_event(). For top-level events, this removes the event from -the context without DETACH_GROUP. - -This can leave inconsistent group state when a removed event is a group -leader and the group contains siblings without remove_on_exec. If the group -was active, the surviving siblings can remain active and attached to the -removed leader's sibling list, but are no longer represented by a valid -group leader on the PMU context active lists. - -A later close of the removed leader uses DETACH_GROUP and can promote the -still-active siblings from this stale group state. The next schedule-in can -then add an already-linked active_list entry again, corrupting the PMU -context active list. - -With DEBUG_LIST enabled, this is caught as a list_add double-add in -merge_sched_in(). - -Fix this by detaching group relationships when remove_on_exec removes an -event. This preserves the existing task-exit behavior, while ensuring -surviving siblings are ungrouped before the removed event leaves the context. - -Fixes: 2e498d0a74e5 ("perf: Add support for event removal on exec") -Signed-off-by: Taeyang Lee <0wn@theori.io> -Signed-off-by: Peter Zijlstra (Intel) -Link: https://patch.msgid.link/ai65GgZcC0LAlWLG@Taeyangs-MacBook-Pro.local -Signed-off-by: Sasha Levin ---- - kernel/events/core.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 156221bd56615c..9b01cfeb3a0663 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -4422,7 +4422,8 @@ static void perf_event_enable_on_exec(int ctxn) - - static void perf_remove_from_owner(struct perf_event *event); - static void perf_event_exit_event(struct perf_event *event, -- struct perf_event_context *ctx); -+ struct perf_event_context *ctx, -+ unsigned long detach_flags); - - /* - * Removes all events from the current task that have been marked -@@ -4454,7 +4455,7 @@ static void perf_event_remove_on_exec(int ctxn) - - modified = true; - -- perf_event_exit_event(event, ctx); -+ perf_event_exit_event(event, ctx, DETACH_GROUP); - } - - raw_spin_lock_irqsave(&ctx->lock, flags); -@@ -13024,10 +13025,11 @@ static void sync_child_event(struct perf_event *child_event) - } - - static void --perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx) -+perf_event_exit_event(struct perf_event *event, -+ struct perf_event_context *ctx, -+ unsigned long detach_flags) - { - struct perf_event *parent_event = event->parent; -- unsigned long detach_flags = 0; - - if (parent_event) { - /* -@@ -13042,7 +13044,7 @@ perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx) - * Do destroy all inherited groups, we don't care about those - * and being thorough is better. - */ -- detach_flags = DETACH_GROUP | DETACH_CHILD; -+ detach_flags |= DETACH_GROUP | DETACH_CHILD; - mutex_lock(&parent_event->child_mutex); - } - -@@ -13127,7 +13129,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn) - perf_event_task(child, child_ctx, 0); - - list_for_each_entry_safe(child_event, next, &child_ctx->event_list, event_entry) -- perf_event_exit_event(child_event, child_ctx); -+ perf_event_exit_event(child_event, child_ctx, 0); - - mutex_unlock(&child_ctx->mutex); - --- -2.53.0 - diff --git a/queue-5.15/perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch b/queue-5.15/perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch deleted file mode 100644 index 48e26429cc..0000000000 --- a/queue-5.15/perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 1b6511b74adb1a44df8e6afb5642e6ca169234cb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 28 May 2026 14:23:55 +0800 -Subject: perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - -From: Rui Qi - -[ Upstream commit 68018df3f55eba96a20dd703f5f276a6518f4963 ] - -In kallsyms__parse(), the loop reading symbol names iterates with i < -sizeof(symbol_name), which allows i to reach sizeof(symbol_name) upon -loop exit. The subsequent symbol_name[i] = '\0' then writes one byte -past the end of the stack-allocated symbol_name[] array. - -Fix this by changing the loop bound to KSYM_NAME_LEN, so the null -terminator always lands within the array. The overflow is triggerable by -a kallsyms entry with a symbol name of KSYM_NAME_LEN+1 or more -characters (e.g., long Rust mangled names or a malicious -/proc/kallsyms). - -Fixes: 53df2b9344128984 ("libsymbols kallsyms: Parse using io api") -Signed-off-by: Rui Qi -Acked-by: Namhyung Kim -Cc: Adrian Hunter -Cc: Alexander Shishkin -Cc: Ian Rogers -Cc: Ingo Molnar -Cc: James Clark -Cc: Jiri Olsa -Cc: Mark Rutland -Cc: Peter Zijlstra -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/lib/symbol/kallsyms.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/tools/lib/symbol/kallsyms.c b/tools/lib/symbol/kallsyms.c -index e335ac2b9e1972..d64bd9cc82a90e 100644 ---- a/tools/lib/symbol/kallsyms.c -+++ b/tools/lib/symbol/kallsyms.c -@@ -60,7 +60,7 @@ int kallsyms__parse(const char *filename, void *arg, - read_to_eol(&io); - continue; - } -- for (i = 0; i < sizeof(symbol_name); i++) { -+ for (i = 0; i < KSYM_NAME_LEN; i++) { - ch = io__get_char(&io); - if (ch < 0 || ch == '\n') - break; -@@ -68,6 +68,9 @@ int kallsyms__parse(const char *filename, void *arg, - } - symbol_name[i] = '\0'; - -+ if (i == KSYM_NAME_LEN) -+ read_to_eol(&io); -+ - err = process_symbol(arg, symbol_name, symbol_type, start); - if (err) - break; --- -2.53.0 - diff --git a/queue-5.15/perf-header-sanity-check-header_event_desc-attr.size.patch b/queue-5.15/perf-header-sanity-check-header_event_desc-attr.size.patch deleted file mode 100644 index 865e76ac81..0000000000 --- a/queue-5.15/perf-header-sanity-check-header_event_desc-attr.size.patch +++ /dev/null @@ -1,140 +0,0 @@ -From e219aa1d9a76f2f2e404d442014f74d12aab55f0 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 2 May 2026 14:37:39 -0300 -Subject: perf header: Sanity check HEADER_EVENT_DESC attr.size before swap -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 944f65c8b8231d26d4db6be67bcb641142603cb4 ] - -read_event_desc() reads nre (event count), sz (attr size), and nr -(IDs per event) from the file and uses them to control allocations -and loops without validating them against the section size. - -A crafted perf.data could trigger large allocations or many loop -iterations before __do_read() eventually rejects the reads. - -Add bounds checks in read_event_desc(): -- Reject sz smaller than PERF_ATTR_SIZE_VER0. -- Require at least one event (nre > 0). -- Check that nre events fit in the remaining section, using the - minimum per-event footprint of sz + sizeof(u32). -- Pre-swap attr->size to native byte order, then reject values - below PERF_ATTR_SIZE_VER0 or above sz before calling - perf_event__attr_swap() to prevent heap out-of-bounds access. -- Handle ABI0 (attr.size == 0): substitute PERF_ATTR_SIZE_VER0, - and on native-endian files write the value back so - free_event_desc() does not treat the zero as its end-of-array - sentinel (it iterates while attr.size != 0). The swap path - skips the write-back — perf_event__attr_swap() has its own - ABI0 fallback that sets VER0 after swapping. -- Check that nr IDs fit in the remaining section before allocating. - -Fixes: b30b61729246 ("perf tools: Fix a problem when opening old perf.data with different byte order") -Reported-by: sashiko-bot@kernel.org # Running on a local machine -Reviewed-by: Ian Rogers -Cc: Jiri Olsa -Cc: Namhyung Kim -Cc: Wang Nan -Assisted-by: Claude:claude-opus-4.6-1m -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/header.c | 54 ++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 54 insertions(+) - -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index 3e18acb7193249..d5b381eead06e6 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -1826,9 +1826,28 @@ static struct evsel *read_event_desc(struct feat_fd *ff) - if (do_read_u32(ff, &nre)) - goto error; - -+ /* Size of each of the nre attributes. */ - if (do_read_u32(ff, &sz)) - goto error; - -+ /* -+ * Require at least one event with an attr no smaller than the -+ * first published struct, and reject sz values where -+ * sz + sizeof(u32) would overflow size_t (possible on 32-bit) -+ * or nre == UINT32_MAX where nre + 1 wraps to 0 in the calloc. -+ * -+ * The minimum section footprint per event is sz bytes for the -+ * attr plus a u32 for the id count, check that nre events fit. -+ */ -+ if (!nre || sz < PERF_ATTR_SIZE_VER0 || -+ sz > ff->size || (size_t)sz > SIZE_MAX - sizeof(u32) || -+ nre == UINT32_MAX || -+ nre > (ff->size - ff->offset) / (sz + sizeof(u32))) { -+ pr_err("Invalid HEADER_EVENT_DESC: nre=%u sz=%u (min %d)\n", -+ nre, sz, PERF_ATTR_SIZE_VER0); -+ goto error; -+ } -+ - /* buffer to hold on file attr struct */ - buf = malloc(sz); - if (!buf) -@@ -1844,6 +1863,9 @@ static struct evsel *read_event_desc(struct feat_fd *ff) - msz = sz; - - for (i = 0, evsel = events; i < nre; evsel++, i++) { -+ struct perf_event_attr *attr = buf; -+ u32 attr_size; -+ - evsel->core.idx = i; - - /* -@@ -1853,6 +1875,32 @@ static struct evsel *read_event_desc(struct feat_fd *ff) - if (__do_read(ff, buf, sz)) - goto error; - -+ /* Reject before attr_swap to prevent OOB via bswap_safe() */ -+ attr_size = ff->ph->needs_swap ? bswap_32(attr->size) : attr->size; -+ /* ABI0: size == 0 means the producer didn't set it */ -+ if (!attr_size) { -+ attr_size = PERF_ATTR_SIZE_VER0; -+ /* -+ * Write back so free_event_desc() doesn't -+ * treat this event as the end-of-array sentinel -+ * (it iterates while attr.size != 0). -+ * -+ * Only for native — the swap path must NOT -+ * write native-endian VER0 here because -+ * perf_event__attr_swap() would re-swap it -+ * to 0x40000000, defeating bswap_safe() bounds. -+ * perf_event__attr_swap() has its own ABI0 -+ * fallback that sets VER0 after swapping. -+ */ -+ if (!ff->ph->needs_swap) -+ attr->size = attr_size; -+ } -+ if (attr_size < PERF_ATTR_SIZE_VER0 || attr_size > sz) { -+ pr_err("Event %d attr.size (%u) invalid (min: %d, max: %u)\n", -+ i, attr_size, PERF_ATTR_SIZE_VER0, sz); -+ goto error; -+ } -+ - if (ff->ph->needs_swap) - perf_event__attr_swap(buf); - -@@ -1874,6 +1922,12 @@ static struct evsel *read_event_desc(struct feat_fd *ff) - if (!nr) - continue; - -+ /* Prevent oversized allocation from crafted nr */ -+ if (nr > (ff->size - ff->offset) / sizeof(*id)) { -+ pr_err("Event %d: id count %u exceeds remaining section\n", i, nr); -+ goto error; -+ } -+ - id = calloc(nr, sizeof(*id)); - if (!id) - goto error; --- -2.53.0 - diff --git a/queue-5.15/perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch b/queue-5.15/perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch deleted file mode 100644 index cb35df8d7e..0000000000 --- a/queue-5.15/perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 0d910eea9bec04592ceeae2d4bc11a147dc34cea Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 14:35:28 -0300 -Subject: perf hists: Fix snprintf() in hists__scnprintf_title() UID filter - path - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 227a8748742f0263f1fe3131449b44563b77a209 ] - -hists__scnprintf_title() accumulates formatted output into a buffer -using scnprintf() for all filter clauses except the UID filter, which -uses snprintf(). If the buffer fills up and snprintf() returns more -than the remaining space, printed exceeds size and the next 'size - -printed' underflows, causing later scnprintf() calls to write past -the buffer. - -Switch the UID filter clause to scnprintf() to match the rest of the -function. - -Fixes: 25c312dbf88ca402 ("perf hists: Move hists__scnprintf_title() away from the TUI code") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Arnaldo Carvalho de Melo -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/hist.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index 4c9d7858943673..72a1f7afbcac6b 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -2755,9 +2755,10 @@ int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool sh - ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events); - - -- if (hists->uid_filter_str) -- printed += snprintf(bf + printed, size - printed, -- ", UID: %s", hists->uid_filter_str); -+ if (hists->uid_filter_str) { -+ printed += scnprintf(bf + printed, size - printed, -+ ", UID: %s", hists->uid_filter_str); -+ } - if (thread) { - if (hists__has(hists, thread)) { - printed += scnprintf(bf + printed, size - printed, --- -2.53.0 - diff --git a/queue-5.15/perf-intel-pt-fix-snprintf-size-tracking-bug-in-insn.patch b/queue-5.15/perf-intel-pt-fix-snprintf-size-tracking-bug-in-insn.patch deleted file mode 100644 index fcd3f5f7c3..0000000000 --- a/queue-5.15/perf-intel-pt-fix-snprintf-size-tracking-bug-in-insn.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 74f3f30f06c710b998267f35b201c273b80cf60f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:06:54 -0300 -Subject: perf intel-pt: Fix snprintf size tracking bug in insn decoder - -From: Arnaldo Carvalho de Melo - -[ Upstream commit b6bb3b005dcdd960b8e0b7f9d6869132b3de08d5 ] - -dump_insn() tracks remaining buffer space with a 'left' variable, -but the loop subtracts the cumulative offset 'n' each iteration -instead of just the per-iteration delta: - - n += snprintf(x->out + n, left, "%02x ", inbuf[i]); - left -= n; /* BUG: n is cumulative, not the delta */ - -After two iterations left goes massively negative, wrapping to a -huge value when passed as size_t to snprintf(), disabling all bounds -checking for the rest of the loop. - -Switch to scnprintf() accumulation using sizeof(x->out) - n as the -remaining space, which is always correct and eliminates the separate -'left' variable entirely. - -Fixes: 48d02a1d5c137d36 ("perf script: Add 'brstackinsn' for branch stacks") -Reported-by: sashiko-bot -Cc: Adrian Hunter -Cc: Andi Kleen -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - .../util/intel-pt-decoder/intel-pt-insn-decoder.c | 11 +++-------- - 1 file changed, 3 insertions(+), 8 deletions(-) - -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c -index 9f29cf7210773b..1c377f2454b06e 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c -@@ -198,7 +198,6 @@ const char *dump_insn(struct perf_insn *x, uint64_t ip __maybe_unused, - { - struct insn insn; - int n, i, ret; -- int left; - - ret = insn_decode(&insn, inbuf, inlen, - x->is64bit ? INSN_MODE_64 : INSN_MODE_32); -@@ -207,13 +206,9 @@ const char *dump_insn(struct perf_insn *x, uint64_t ip __maybe_unused, - return ""; - if (lenp) - *lenp = insn.length; -- left = sizeof(x->out); -- n = snprintf(x->out, left, "insn: "); -- left -= n; -- for (i = 0; i < insn.length; i++) { -- n += snprintf(x->out + n, left, "%02x ", inbuf[i]); -- left -= n; -- } -+ n = scnprintf(x->out, sizeof(x->out), "insn: "); -+ for (i = 0; i < insn.length; i++) -+ n += scnprintf(x->out + n, sizeof(x->out) - n, "%02x ", inbuf[i]); - return x->out; - } - --- -2.53.0 - diff --git a/queue-5.15/perf-machine-use-snprintf-for-guestmount-path-constr.patch b/queue-5.15/perf-machine-use-snprintf-for-guestmount-path-constr.patch deleted file mode 100644 index c48fab3f00..0000000000 --- a/queue-5.15/perf-machine-use-snprintf-for-guestmount-path-constr.patch +++ /dev/null @@ -1,57 +0,0 @@ -From e2aaf12fcabf004a0ffa5f915d790975477e0d7b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 13 Jun 2026 13:59:39 -0300 -Subject: perf machine: Use snprintf() for guestmount path construction - -From: Arnaldo Carvalho de Melo - -[ Upstream commit fe63d3bca288c5bb983304efd5fc3a5ff3183403 ] - -machines__findnew() and machines__create_guest_kernel_maps() use -sprintf() to build paths by prepending symbol_conf.guestmount. -Both write into PATH_MAX stack buffers, but guestmount comes from -user configuration and is not length-checked. A guestmount path -at or near PATH_MAX causes a stack buffer overflow. - -Switch to snprintf() with sizeof() to prevent overflow. The -subsequent access()/fopen() calls will fail on a truncated path. - -Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") -Reported-by: sashiko-bot -Cc: Zhang, Yanmin -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/machine.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c -index 7e7c63fcd14068..9a78261cffec9b 100644 ---- a/tools/perf/util/machine.c -+++ b/tools/perf/util/machine.c -@@ -348,7 +348,7 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid) - if ((pid != HOST_KERNEL_ID) && - (pid != DEFAULT_GUEST_KERNEL_ID) && - (symbol_conf.guestmount)) { -- sprintf(path, "%s/%d", symbol_conf.guestmount, pid); -+ snprintf(path, sizeof(path), "%s/%d", symbol_conf.guestmount, pid); - if (access(path, R_OK)) { - static struct strlist *seen; - -@@ -1260,9 +1260,9 @@ int machines__create_guest_kernel_maps(struct machines *machines) - namelist[i]->d_name); - continue; - } -- sprintf(path, "%s/%s/proc/kallsyms", -- symbol_conf.guestmount, -- namelist[i]->d_name); -+ snprintf(path, sizeof(path), "%s/%s/proc/kallsyms", -+ symbol_conf.guestmount, -+ namelist[i]->d_name); - ret = access(path, R_OK); - if (ret) { - pr_debug("Can't access file %s\n", path); --- -2.53.0 - diff --git a/queue-5.15/perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch b/queue-5.15/perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch deleted file mode 100644 index 395f40238e..0000000000 --- a/queue-5.15/perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 7311a7c7413be8788b3638cd146165fd405ddd1b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 11:03:29 -0300 -Subject: perf mmap: Fix NULL deref in aio cleanup on alloc failure - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 25627346b10e6a564610ea2c49dc6dd54812226d ] - -perf_mmap__aio_mmap() sets map->aio.nr_cblocks before allocating the -data array. If calloc() for aiocb or cblocks fails before the data -array is allocated, the return -1 path leads to perf_mmap__aio_munmap() -which loops nr_cblocks times calling perf_mmap__aio_free(). Both -versions of perf_mmap__aio_free() (NUMA and non-NUMA) dereference -map->aio.data[idx] without checking if data is NULL, causing a NULL -pointer dereference. - -Add NULL checks for map->aio.data at the top of both -perf_mmap__aio_free() variants so the cleanup path is safe when -allocation fails partway through perf_mmap__aio_mmap(). - -Fixes: d3d1af6f011a553a ("perf record: Enable asynchronous trace writing") -Reported-by: sashiko-bot -Cc: Alexey Budankov -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/mmap.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c -index f642018a8926c0..ff637d5ce900e2 100644 ---- a/tools/perf/util/mmap.c -+++ b/tools/perf/util/mmap.c -@@ -88,10 +88,10 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx) - - static void perf_mmap__aio_free(struct mmap *map, int idx) - { -- if (map->aio.data[idx]) { -- munmap(map->aio.data[idx], mmap__mmap_len(map)); -- map->aio.data[idx] = NULL; -- } -+ if (!map->aio.data || !map->aio.data[idx]) -+ return; -+ munmap(map->aio.data[idx], mmap__mmap_len(map)); -+ map->aio.data[idx] = NULL; - } - - static int perf_mmap__aio_bind(struct mmap *map, int idx, int cpu, int affinity) -@@ -140,6 +140,8 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx) - - static void perf_mmap__aio_free(struct mmap *map, int idx) - { -+ if (!map->aio.data) -+ return; - zfree(&(map->aio.data[idx])); - } - --- -2.53.0 - diff --git a/queue-5.15/perf-mmap-guard-cpu__get_node-return-in-aio_bind.patch b/queue-5.15/perf-mmap-guard-cpu__get_node-return-in-aio_bind.patch deleted file mode 100644 index 977f40504e..0000000000 --- a/queue-5.15/perf-mmap-guard-cpu__get_node-return-in-aio_bind.patch +++ /dev/null @@ -1,57 +0,0 @@ -From d28a8b32dc8f1c4cf6b6518ec19ef03b5eea4dca Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 5 Jun 2026 10:56:33 -0300 -Subject: perf mmap: Guard cpu__get_node() return in aio_bind() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit f32dc302a090f48893477ef297a888db109ec0bd ] - -perf_mmap__aio_bind() passes the cpu__get_node() return value directly -to an unsigned long variable (node_index). When cpu__get_node() returns --1 for an unknown CPU, the implicit int-to-unsigned-long conversion -sign-extends it to ULONG_MAX. - -This causes bitmap_zalloc(ULONG_MAX + 1) which wraps to -bitmap_zalloc(0), returning a zero-sized allocation. The subsequent -__set_bit(ULONG_MAX, node_mask) then writes massively out of bounds. - -Check the return value in a signed temporary before assigning to -node_index, and skip the NUMA binding when the node is unknown. - -Fixes: c44a8b44ca9f ("perf record: Bind the AIO user space buffers to nodes") -Reported-by: sashiko-bot -Cc: Alexey Budankov -Cc: Jiri Olsa -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/mmap.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c -index 512dc8b9c1685c..f642018a8926c0 100644 ---- a/tools/perf/util/mmap.c -+++ b/tools/perf/util/mmap.c -@@ -103,9 +103,15 @@ static int perf_mmap__aio_bind(struct mmap *map, int idx, int cpu, int affinity) - int err = 0; - - if (affinity != PERF_AFFINITY_SYS && cpu__max_node() > 1) { -+ int node; -+ - data = map->aio.data[idx]; - mmap_len = mmap__mmap_len(map); -- node_index = cpu__get_node(cpu); -+ node = cpu__get_node(cpu); -+ /* -1 sign-extends to ULONG_MAX, wrapping bitmap_zalloc(0) and OOB __set_bit */ -+ if (node < 0) -+ return 0; -+ node_index = node; - node_mask = bitmap_zalloc(node_index + 1); - if (!node_mask) { - pr_err("Failed to allocate node mask for mbind: error %m\n"); --- -2.53.0 - diff --git a/queue-5.15/perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch b/queue-5.15/perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch deleted file mode 100644 index 60edef055f..0000000000 --- a/queue-5.15/perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 8c2ddb957f250d44af0619085f6fe7e1b9e3ed95 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:03:13 -0300 -Subject: perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs - file -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 33035f7dd4e49f3f117e70c5e36c8c1ae88d37f2 ] - -perf_pmu__parse_scale() reads a PMU scale file then accesses -scale[sret - 1] to strip a trailing newline. Only sret < 0 is -guarded, so an empty file (sret == 0) causes scale[-1] — a stack -buffer underflow that reads and potentially writes out of bounds. - -perf_pmu__parse_unit() has the same pattern: alias->unit[sret - 1] -with sret == 0 accesses the byte before the struct member, which -may corrupt the adjacent pmu_name pointer field. - -Change both guards from sret < 0 to sret <= 0 so that empty files -are treated as read errors. - -Fixes: 410136f5dd96b601 ("tools/perf/stat: Add event unit and scale support") -Reported-by: sashiko-bot -Cc: Stephane Eranian -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/pmu.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index ce577e5393f92f..4cc27aa8aec723 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -162,7 +162,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char * - goto error; - - sret = read(fd, scale, sizeof(scale)-1); -- if (sret < 0) -+ if (sret <= 0) - goto error; - - if (scale[sret - 1] == '\n') -@@ -189,7 +189,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n - return -1; - - sret = read(fd, alias->unit, UNIT_MAX_LEN); -- if (sret < 0) -+ if (sret <= 0) - goto error; - - close(fd); --- -2.53.0 - diff --git a/queue-5.15/perf-pmu-fix-pmu_id-heap-underwrite-on-empty-identif.patch b/queue-5.15/perf-pmu-fix-pmu_id-heap-underwrite-on-empty-identif.patch deleted file mode 100644 index 0b03b4593a..0000000000 --- a/queue-5.15/perf-pmu-fix-pmu_id-heap-underwrite-on-empty-identif.patch +++ /dev/null @@ -1,46 +0,0 @@ -From acf0b8c6f8388689c4e1b3efe424be5bcfac373d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:01:43 -0300 -Subject: perf pmu: Fix pmu_id() heap underwrite on empty identifier file - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 836455e6dbd34eb3d12eeab5e2d2b9a7f1512459 ] - -pmu_id() calls filename__read_str() then strips the trailing newline -via str[len - 1] = 0. If the PMU identifier file is empty, -filename__read_str() succeeds with len = 0. len - 1 underflows -size_t to SIZE_MAX, writing a null byte before the heap allocation. - -Add a len == 0 check before the newline stripping. - -Fixes: 51d548471510843e ("perf pmu: Add pmu_id()") -Reported-by: sashiko-bot -Cc: John Garry -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/pmu.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index eafd80be66076c..ce577e5393f92f 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -666,6 +666,12 @@ static char *pmu_id(const char *name) - if (sysfs__read_str(path, &str, &len) < 0) - return NULL; - -+ /* empty identifier file — nothing useful */ -+ if (len == 0) { -+ free(str); -+ return NULL; -+ } -+ - str[len - 1] = 0; /* remove line feed */ - - return str; --- -2.53.0 - diff --git a/queue-5.15/perf-sched-add-missing-mmap2-handler-in-timehist.patch b/queue-5.15/perf-sched-add-missing-mmap2-handler-in-timehist.patch deleted file mode 100644 index e69ad4f6b3..0000000000 --- a/queue-5.15/perf-sched-add-missing-mmap2-handler-in-timehist.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 015ac4228df26c2da2b1957be81aa342bb68d7f8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 5 May 2026 17:45:42 -0700 -Subject: perf sched: Add missing mmap2 handler in timehist - -From: Ian Rogers - -[ Upstream commit 91182741369b261c441e63e6678893032a6d7e4c ] - -perf_sched__timehist() registers event handlers for options using the -sched->tool struct. It registers handlers for MMAP, COMM, EXIT, FORK, etc. -but completely omits registering a handler for MMAP2 events. - -Failing to register both MMAP and MMAP2 handlers causes modern systems -(which primarily output MMAP2 records) to silently drop VMA map mappings. -This results in uninitialized machine/thread mapping structures, making it -impossible to resolve shared library instruction pointers (IPs) to dynamic -symbols/DSOs during timehist callchain analysis. - -Fix this by correctly registering perf_event__process_mmap2 in -sched->tool inside perf_sched__timehist(). - -Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command") -Assisted-by: Gemini-CLI:Google Gemini 3 -Signed-off-by: Ian Rogers -Cc: Adrian Hunter -Cc: David Ahern -Cc: Gabriel Marin -Cc: Ingo Molnar -Cc: James Clark -Cc: Jiri Olsa -Cc: Namhyung Kim -Cc: Peter Zijlstra -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index 95a549fdabe0c0..35cc5339ede517 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -3011,6 +3011,7 @@ static int perf_sched__timehist(struct perf_sched *sched) - */ - sched->tool.sample = perf_timehist__process_sample; - sched->tool.mmap = perf_event__process_mmap; -+ sched->tool.mmap2 = perf_event__process_mmap2; - sched->tool.comm = perf_event__process_comm; - sched->tool.exit = perf_event__process_exit; - sched->tool.fork = perf_event__process_fork; --- -2.53.0 - diff --git a/queue-5.15/perf-sched-clean-up-idle_threads-entry-on-init-failu.patch b/queue-5.15/perf-sched-clean-up-idle_threads-entry-on-init-failu.patch deleted file mode 100644 index db6fe49f68..0000000000 --- a/queue-5.15/perf-sched-clean-up-idle_threads-entry-on-init-failu.patch +++ /dev/null @@ -1,54 +0,0 @@ -From d72872777ff3f377d76935129049ff44a70fc5ce Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 5 Jun 2026 11:12:08 -0300 -Subject: perf sched: Clean up idle_threads entry on init failure - -From: Arnaldo Carvalho de Melo - -[ Upstream commit cda5a94ad9181cd60cbf04be11d524201bf489a2 ] - -get_idle_thread() allocates a thread via thread__new() and stores it in -idle_threads[cpu], then calls init_idle_thread() to set up the private -data. If init_idle_thread() fails (e.g. OOM for the idle_thread_runtime -struct), the function returns NULL but leaves the partially initialized -thread in idle_threads[cpu]. - -On subsequent calls for the same CPU, get_idle_thread() finds a non-NULL -idle_threads[cpu], skips allocation, and returns thread__get() on a -thread that has no priv data. Callers then get a thread whose -thread__priv() returns NULL, leading to unexpected behavior. - -Release the thread and reset the slot to NULL on init failure so the -entry doesn't persist in a corrupted state. - -Fixes: 49394a2a24c7 ("perf sched timehist: Introduce timehist command") -Reported-by: sashiko-bot -Cc: David Ahern -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index 35cc5339ede517..6264a2cded514f 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -2289,8 +2289,11 @@ static struct thread *get_idle_thread(int cpu) - idle_threads[cpu] = thread__new(0, 0); - - if (idle_threads[cpu]) { -- if (init_idle_thread(idle_threads[cpu]) < 0) -+ if (init_idle_thread(idle_threads[cpu]) < 0) { -+ /* clean up so next call doesn't find a half-initialized thread */ -+ thread__zput(idle_threads[cpu]); - return NULL; -+ } - } - } - --- -2.53.0 - diff --git a/queue-5.15/perf-sched-fix-idle-hist-callchain-display-using-wro.patch b/queue-5.15/perf-sched-fix-idle-hist-callchain-display-using-wro.patch deleted file mode 100644 index d7c5e1c0bb..0000000000 --- a/queue-5.15/perf-sched-fix-idle-hist-callchain-display-using-wro.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 49fe1b16ddb56002f1cbf498f5c91d64d1eb5662 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 21:49:16 -0300 -Subject: perf sched: Fix idle-hist callchain display using wrong rb_first - variant -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit d9b99dc8148e0c1f5da3942131b47e0d21187a32 ] - -timehist_print_idlehist_callchain() calls rb_first_cached() on -sorted_root, but the sort function (callchain_param.sort) populates it -via rb_insert_color() on the plain rb_root member — not the cached -variant. This means rb_leftmost is never set, so rb_first_cached() -always returns NULL and the entire callchain summary is silently -dropped from --idle-hist output. - -The original code in ba957ebb54893aca ("perf sched timehist: Show -callchains for idle stat") was correct — it used struct rb_root and -rb_first(). The bug was introduced when sorted_root was converted to -rb_root_cached without converting the sort insertion path to use -rb_insert_color_cached(). - -Use rb_first(&root->rb_root) to match how the tree was populated. - -Fixes: cb4c13a5137766c3 ("perf sched: Use cached rbtrees") -Reported-by: sashiko-bot -Cc: Davidlohr Bueso -Cc: Namhyung Kim -Acked-by: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index 9c312b8e5870d9..1844640333aada 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -2830,7 +2830,8 @@ static size_t timehist_print_idlehist_callchain(struct rb_root_cached *root) - size_t ret = 0; - FILE *fp = stdout; - struct callchain_node *chain; -- struct rb_node *rb_node = rb_first_cached(root); -+ /* sort() uses rb_insert_color() on rb_root, not rb_root_cached */ -+ struct rb_node *rb_node = rb_first(&root->rb_root); - - printf(" %16s %8s %s\n", "Idle time (msec)", "Count", "Callchains"); - printf(" %.16s %.8s %.50s\n", graph_dotted_line, graph_dotted_line, --- -2.53.0 - diff --git a/queue-5.15/perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch b/queue-5.15/perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch deleted file mode 100644 index 23d6562f48..0000000000 --- a/queue-5.15/perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 8be8d7565089c50e93bd3297e00c2ee097216a88 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 5 Jun 2026 11:26:28 -0300 -Subject: perf sched: Replace BUG_ON and add NULL checks in replay event - helpers - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 75eafe4a3a93a0143a20c0cc286bfb9008ac1478 ] - -get_new_event() has three issues: - -1. The zalloc() result is dereferenced without a NULL check, crashing - on allocation failure. - -2. BUG_ON(!task->atoms) kills the process when realloc() fails. - Since perf.data is untrusted input, this should be a graceful error. - -3. The realloc pattern assigns directly to task->atoms, losing the old - pointer on failure. task->nr_events is also incremented before the - realloc, leaving corrupted state on failure. - -Fix get_new_event() to: - - Check the zalloc() result before dereferencing - - Use a temporary for realloc() to avoid losing the old pointer - - Increment nr_events only after successful realloc - - Return NULL instead of calling BUG_ON on failure - -Also fix add_sched_event_wakeup() where zalloc() for wait_sem is -passed to sem_init() without a NULL check. - -Update all callers (add_sched_event_run, add_sched_event_wakeup, -add_sched_event_sleep) to handle NULL returns by returning early. -The replay may produce incomplete output on OOM but will not crash. - -Fixes: ec156764d424 ("perf sched: Import schedbench.c") -Reported-by: sashiko-bot -Cc: Ingo Molnar -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 28 +++++++++++++++++++++++++--- - 1 file changed, 25 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index 6264a2cded514f..9c312b8e5870d9 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -361,14 +361,25 @@ get_new_event(struct task_desc *task, u64 timestamp) - struct sched_atom *event = zalloc(sizeof(*event)); - unsigned long idx = task->nr_events; - size_t size; -+ struct sched_atom **atoms_p; -+ -+ if (event == NULL) { -+ pr_err("ERROR: sched: failed to allocate event\n"); -+ return NULL; -+ } - - event->timestamp = timestamp; - event->nr = idx; - -+ size = sizeof(struct sched_atom *) * (task->nr_events + 1); -+ atoms_p = realloc(task->atoms, size); -+ if (!atoms_p) { -+ pr_err("ERROR: sched: failed to grow atoms array\n"); -+ free(event); -+ return NULL; -+ } -+ task->atoms = atoms_p; - task->nr_events++; -- size = sizeof(struct sched_atom *) * task->nr_events; -- task->atoms = realloc(task->atoms, size); -- BUG_ON(!task->atoms); - - task->atoms[idx] = event; - -@@ -399,6 +410,8 @@ static void add_sched_event_run(struct perf_sched *sched, struct task_desc *task - } - - event = get_new_event(task, timestamp); -+ if (event == NULL) -+ return; - - event->type = SCHED_EVENT_RUN; - event->duration = duration; -@@ -412,6 +425,8 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t - struct sched_atom *event, *wakee_event; - - event = get_new_event(task, timestamp); -+ if (event == NULL) -+ return; - event->type = SCHED_EVENT_WAKEUP; - event->wakee = wakee; - -@@ -426,6 +441,10 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t - } - - wakee_event->wait_sem = zalloc(sizeof(*wakee_event->wait_sem)); -+ if (!wakee_event->wait_sem) { -+ pr_err("ERROR: sched: failed to allocate semaphore\n"); -+ return; -+ } - sem_init(wakee_event->wait_sem, 0, 0); - wakee_event->specific_wait = 1; - event->wait_sem = wakee_event->wait_sem; -@@ -438,6 +457,9 @@ static void add_sched_event_sleep(struct perf_sched *sched, struct task_desc *ta - { - struct sched_atom *event = get_new_event(task, timestamp); - -+ if (event == NULL) -+ return; -+ - event->type = SCHED_EVENT_SLEEP; - - sched->nr_sleep_events++; --- -2.53.0 - diff --git a/queue-5.15/perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch b/queue-5.15/perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch deleted file mode 100644 index 0f3ffbae92..0000000000 --- a/queue-5.15/perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 8fa067299ea55f450f6c124dc01700dfd00fca8c Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 8 Jun 2026 08:12:34 -0300 -Subject: perf symbols: Add bounds checks to elf_read_build_id() note iteration - -From: Arnaldo Carvalho de Melo - -[ Upstream commit acc56d3941fc2997a5a21ea9233a8ac3d87c4f2f ] - -elf_read_build_id() iterates ELF notes using pointer arithmetic -driven by n_namesz and n_descsz from the note headers. Neither -the note header read nor the subsequent name/desc advances are -checked against the section boundary. A malformed ELF file with -oversized note sizes causes out-of-bounds reads past the section -data buffer. - -Add two bounds checks: verify the note header fits within the -remaining section data, and verify that namesz + descsz (after -alignment) fits before advancing the pointer. - -Fixes: fd7a346ea292074e ("perf symbols: Filename__read_build_id should look at .notes section too") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 18 ++++++++++++++++-- - 1 file changed, 16 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 7029c71c57780a..d3bfa278df8141 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -540,10 +540,24 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size) - ptr = data->d_buf; - while (ptr < (data->d_buf + data->d_size)) { - GElf_Nhdr *nhdr = ptr; -- size_t namesz = NOTE_ALIGN(nhdr->n_namesz), -- descsz = NOTE_ALIGN(nhdr->n_descsz); -+ size_t namesz, descsz, remaining; - const char *name; - -+ /* ensure the note header fits within the section */ -+ if (ptr + sizeof(*nhdr) > data->d_buf + data->d_size) -+ break; -+ -+ namesz = NOTE_ALIGN(nhdr->n_namesz); -+ descsz = NOTE_ALIGN(nhdr->n_descsz); -+ -+ /* validate individually to avoid size_t overflow on 32-bit */ -+ remaining = data->d_buf + data->d_size - ptr - sizeof(*nhdr); -+ if (namesz > remaining || descsz > remaining - namesz) { -+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n", -+ __func__, nhdr->n_namesz, nhdr->n_descsz); -+ break; -+ } -+ - ptr += sizeof(*nhdr); - name = ptr; - ptr += namesz; --- -2.53.0 - diff --git a/queue-5.15/perf-symbols-add-bounds-checks-to-read_build_id-note.patch b/queue-5.15/perf-symbols-add-bounds-checks-to-read_build_id-note.patch deleted file mode 100644 index c3af748b88..0000000000 --- a/queue-5.15/perf-symbols-add-bounds-checks-to-read_build_id-note.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 4c00a39b240f1a41be0399401f6ff839a6e52a05 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 16:09:45 -0300 -Subject: perf symbols: Add bounds checks to read_build_id() note iteration in - minimal build - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 52e582e316c48c53bb3082c29f7862ebc554087e ] - -symbol-minimal.c's read_build_id() iterates ELF notes with the same -pattern as symbol-elf.c's elf_read_build_id(): pointer arithmetic -driven by n_namesz and n_descsz from 32-bit note header fields, -without validating that the name and desc fit within the note section -data. A malformed ELF file with oversized note sizes causes -out-of-bounds reads past the section data buffer. - -Add the same bounds check as the libelf path: validate namesz and -descsz individually against remaining data before advancing the -pointer, avoiding size_t overflow on 32-bit. - -Fixes: b691f64360ecec49 ("perf symbols: Implement poor man's ELF parser") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-minimal.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/symbol-minimal.c b/tools/perf/util/symbol-minimal.c -index f9eb0bee7f157a..cd3bef5644a0b6 100644 ---- a/tools/perf/util/symbol-minimal.c -+++ b/tools/perf/util/symbol-minimal.c -@@ -1,3 +1,4 @@ -+#include "debug.h" - #include "dso.h" - #include "symbol.h" - #include "symsrc.h" -@@ -45,7 +46,7 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid, - ptr = note_data; - while (ptr < (note_data + note_len)) { - const char *name; -- size_t namesz, descsz; -+ size_t namesz, descsz, remaining; - - nhdr = ptr; - if (need_swap) { -@@ -57,6 +58,14 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid, - namesz = NOTE_ALIGN(nhdr->n_namesz); - descsz = NOTE_ALIGN(nhdr->n_descsz); - -+ /* validate individually to avoid size_t overflow on 32-bit */ -+ remaining = note_data + note_len - ptr - sizeof(*nhdr); -+ if (namesz > remaining || descsz > remaining - namesz) { -+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n", -+ __func__, nhdr->n_namesz, nhdr->n_descsz); -+ break; -+ } -+ - ptr += sizeof(*nhdr); - name = ptr; - ptr += namesz; --- -2.53.0 - diff --git a/queue-5.15/perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch b/queue-5.15/perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch deleted file mode 100644 index 33ef0f3d11..0000000000 --- a/queue-5.15/perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 3403d8bd26498483b4b60e938fdf717f4b49e984 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:05:15 -0300 -Subject: perf symbols: Bounds-check .gnu_debuglink section data - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 9c74f0aab398cb32ab250401f323c0fdc9a3a496 ] - -filename__read_debuglink() copies .gnu_debuglink section data into a -caller-provided buffer via: - - strncpy(debuglink, data->d_buf, size); - -where size is PATH_MAX. If the ELF section is smaller than size and -lacks a null terminator, strncpy reads past data->d_buf into adjacent -memory. A malformed ELF file can trigger this, potentially causing a -segfault or leaking heap data. - -Additionally, strncpy does not guarantee null termination when the -source fills the buffer. - -Replace with an explicit memcpy bounded by both the output buffer -size and the actual section data size (data->d_size), followed by -explicit null termination. - -Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index e3ae6c30b6e74e..7a9b6d8a551f2e 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -791,7 +791,14 @@ int filename__read_debuglink(const char *filename, char *debuglink, - goto out_elf_end; - - /* the start of this section is a zero-terminated string */ -- strncpy(debuglink, data->d_buf, size); -+ if (data->d_size > 0) { -+ size_t len = min(size - 1, data->d_size); -+ -+ memcpy(debuglink, data->d_buf, len); -+ debuglink[len] = '\0'; -+ } else { -+ debuglink[0] = '\0'; -+ } - - err = 0; - --- -2.53.0 - diff --git a/queue-5.15/perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch b/queue-5.15/perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch deleted file mode 100644 index b95212b1c5..0000000000 --- a/queue-5.15/perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch +++ /dev/null @@ -1,57 +0,0 @@ -From b16f355d55e3babf1501c67c8af241e0d80799ee Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 22:40:20 -0300 -Subject: perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU - fallback - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 1b4e9fbdeabc549965e70ac0cd8095d57ff6df06 ] - -When sysfs__read_build_id() matches NT_GNU_BUILD_ID with the right -namesz but the name content is not "GNU", it falls back to reading -descsz bytes into the stack buffer bf[BUFSIZ]: - - } else if (read(fd, bf, descsz) != (ssize_t)descsz) - -Unlike the else branch which validates namesz + descsz against -sizeof(bf), this path passes descsz directly to read() without any -bounds check. A crafted sysfs file with a large n_descsz overflows -the 8192-byte stack buffer. - -Add a descsz > sizeof(bf) check before the read, breaking out of -the loop on oversized values. - -Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 7a9b6d8a551f2e..7029c71c57780a 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -691,8 +691,13 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid) - err = 0; - break; - } -- } else if (read(fd, bf, descsz) != (ssize_t)descsz) -- break; -+ } else { -+ /* descsz from untrusted file — clamp to buffer */ -+ if (descsz > sizeof(bf)) -+ break; -+ if (read(fd, bf, descsz) != (ssize_t)descsz) -+ break; -+ } - } else { - size_t n; - --- -2.53.0 - diff --git a/queue-5.15/perf-symbols-break-infinite-loop-on-zero-filled-note.patch b/queue-5.15/perf-symbols-break-infinite-loop-on-zero-filled-note.patch deleted file mode 100644 index efcac2d536..0000000000 --- a/queue-5.15/perf-symbols-break-infinite-loop-on-zero-filled-note.patch +++ /dev/null @@ -1,52 +0,0 @@ -From aa2c5855f359228e69e0c56c9554a6c039e49570 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 19:32:22 -0300 -Subject: perf symbols: Break infinite loop on zero-filled notes in - sysfs__read_build_id() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 063c647b24f640657d6d9e2e90d620ea3ee19ae6 ] - -sysfs__read_build_id() iterates ELF note headers from sysfs files in a -while(1) loop. If the file contains a zero-filled note header (both -n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0 -and calls read(fd, bf, 0). read() with count 0 returns 0, which -matches the expected (ssize_t)n value, so the error check passes and -the loop repeats — reading the same zero bytes and spinning forever. - -This can happen with corrupted or zero-padded sysfs pseudo-files. - -Add a check for n == 0 before the read, since no valid ELF note has -both name and description of zero length. - -Reported-by: sashiko-bot -Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too") -Reviewed-by: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index d3bfa278df8141..fffe097fba9eda 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -723,6 +723,9 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid) - } else { - n = namesz + descsz; - } -+ /* no valid note has both namesz and descsz zero */ -+ if (n == 0) -+ break; - if (read(fd, bf, n) != (ssize_t)n) - break; - } --- -2.53.0 - diff --git a/queue-5.15/perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch b/queue-5.15/perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch deleted file mode 100644 index a60d11d1e9..0000000000 --- a/queue-5.15/perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 0894377c2bfb9c97090f83ec4ffc279b09190f47 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:04:50 -0300 -Subject: perf symbols: Fix signed overflow in sysfs__read_build_id() size - check -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 6eaa8ee3e2abe5112e80e94c27196bb175689469 ] - -sysfs__read_build_id() reads ELF note headers from sysfs files. The -note's namesz and descsz fields are used to compute the skip size: - - int n = namesz + descsz; - if (n > (int)sizeof(bf)) - -Both namesz and descsz are size_t from NOTE_ALIGN() of 32-bit note -header fields. Their sum can exceed INT_MAX, overflowing the signed -int n to a negative value. The check n > sizeof(bf) then evaluates -false (negative < positive in signed comparison), and read(fd, bf, n) -reinterprets the negative n as a huge size_t count — the kernel writes -up to MAX_RW_COUNT bytes into the 8192-byte stack buffer. - -In practice the overflow is bounded by the sysfs file's actual size, -so a real sysfs notes file won't trigger it organically. But crafted -input (e.g. via a mounted debugfs/sysfs image) could. - -Fix by validating namesz and descsz individually against the buffer -size before summing, and change n to size_t to avoid the signed -overflow entirely. - -Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index bbc3a150597a47..e3ae6c30b6e74e 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -694,14 +694,17 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid) - } else if (read(fd, bf, descsz) != (ssize_t)descsz) - break; - } else { -- int n = namesz + descsz; -+ size_t n; - -- if (n > (int)sizeof(bf)) { -+ /* int sum of namesz+descsz can overflow negative, bypassing size check */ -+ if (namesz > sizeof(bf) || descsz > sizeof(bf) - namesz) { - n = sizeof(bf); - pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n", - __func__, filename, nhdr.n_namesz, nhdr.n_descsz); -+ } else { -+ n = namesz + descsz; - } -- if (read(fd, bf, n) != n) -+ if (read(fd, bf, n) != (ssize_t)n) - break; - } - } --- -2.53.0 - diff --git a/queue-5.15/perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch b/queue-5.15/perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch deleted file mode 100644 index ad7e50fac7..0000000000 --- a/queue-5.15/perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 34237e6358684f77602babff239aad191cf8fcaa Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 20:37:52 -0300 -Subject: perf tools: Fix get_max_num() size_t underflow on empty sysfs file - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 0a012113bb3a44482c163f16f4db03ccaa37a339 ] - -get_max_num() reads a sysfs file (cpu/possible, cpu/present, or -node/possible) and scans backward from the end to find the last -number. If the file is empty, filename__read_str() returns num == 0. -The loop `while (--num)` decrements the size_t from 0 to SIZE_MAX, -reading backward across the heap until a comma or hyphen is found -or unmapped memory is hit. - -Add an early return for empty files before the backward scan. - -Fixes: 7780c25bae59fd04 ("perf tools: Allow ability to map cpus to nodes easily") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Don Zickus -Cc: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/cpumap.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c -index 87d3eca9b872d8..e80dacb3607772 100644 ---- a/tools/perf/util/cpumap.c -+++ b/tools/perf/util/cpumap.c -@@ -307,6 +307,12 @@ static int get_max_num(char *path, int *max) - - buf[num] = '\0'; - -+ /* empty file — nothing to parse */ -+ if (num == 0) { -+ err = -1; -+ goto out; -+ } -+ - /* start on the right, to find highest node num */ - while (--num) { - if ((buf[num] == ',') || (buf[num] == '-')) { --- -2.53.0 - diff --git a/queue-5.15/perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch b/queue-5.15/perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch deleted file mode 100644 index 8ccd3cc2f7..0000000000 --- a/queue-5.15/perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 4889849cfd84f1a226490705d90330b75803b006 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 22:37:55 -0300 -Subject: perf tools: Fix thread__set_comm_from_proc() on empty comm file -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 31d596054550f793508abe7dd593853ece47d428 ] - -thread__set_comm_from_proc() calls procfs__read_str() then strips -the trailing newline via comm[sz - 1] = '\0'. procfs__read_str() -allocates the buffer before reading, so on an empty /proc/pid/comm -(reachable during late exit teardown) it returns success with sz = 0 -and an unterminated heap buffer. - -The sz - 1 underflow was the original sashiko finding: it writes a -null byte before the allocation. But even with a sz > 0 guard on -the newline strip, the unterminated buffer would still be passed to -thread__set_comm() which calls strlen() — an unbounded heap read. - -Fix by treating sz == 0 as failure: free the buffer and return -1. -This is consistent with pmu.c's perf_pmu__parse_scale/unit which -already treat len == 0 from filename__read_str as an error. - -Fixes: 2f3027ac28bf6bc3 ("perf thread: Introduce method to set comm from /proc/pid/self") -Reported-by: sashiko-bot -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/thread.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c -index 665e5c0618ed3d..6840a2d357b6a6 100644 ---- a/tools/perf/util/thread.c -+++ b/tools/perf/util/thread.c -@@ -282,6 +282,11 @@ int thread__set_comm_from_proc(struct thread *thread) - if (!(snprintf(path, sizeof(path), "%d/task/%d/comm", - thread->pid_, thread->tid) >= (int)sizeof(path)) && - procfs__read_str(path, &comm, &sz) == 0) { -+ /* sz==0: read got nothing, e.g. race during exit teardown */ -+ if (sz == 0) { -+ free(comm); -+ return -1; -+ } - comm[sz - 1] = '\0'; - err = thread__set_comm(thread, comm, 0); - } --- -2.53.0 - diff --git a/queue-5.15/perf-tools-use-perf_env__get_cpu_topology-in-machine.patch b/queue-5.15/perf-tools-use-perf_env__get_cpu_topology-in-machine.patch deleted file mode 100644 index 300e6e3b55..0000000000 --- a/queue-5.15/perf-tools-use-perf_env__get_cpu_topology-in-machine.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 6e8109619c55d0f384c3640c4c09798159e0c93b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 20:57:49 -0300 -Subject: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 5484b43a0ec8231c36fba6ead654cb72dbba8b8f ] - -machine__resolve() accesses env->cpu[al->cpu].socket_id after checking -al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu -against env->nr_cpus_avail. Since al->cpu comes from the untrusted -perf.data sample, a crafted file with a large CPU index causes an -out-of-bounds heap read. - -Use perf_env__get_cpu_topology() which validates both NULL and bounds. -Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): -without this, values like 65536 silently truncate to 0, bypassing the -accessor's internal check and returning CPU 0's topology. - -Fixes: 0c4c4debb0adda4c ("perf tools: Add processor socket info to hist_entry and addr_location") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Kan Liang -Cc: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/event.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c -index ac706304afe9ff..8a488910504349 100644 ---- a/tools/perf/util/event.c -+++ b/tools/perf/util/event.c -@@ -12,6 +12,7 @@ - #include - #include "cpumap.h" - #include "dso.h" -+#include "env.h" - #include "event.h" - #include "debug.h" - #include "hist.h" -@@ -688,8 +689,18 @@ int machine__resolve(struct machine *machine, struct addr_location *al, - if (al->cpu >= 0) { - struct perf_env *env = machine->env; - -- if (env && env->cpu) -- al->socket = env->cpu[al->cpu].socket_id; -+ /* -+ * Bounds-check al->cpu (s32) before casting to struct perf_cpu -+ * (int16_t): without this, e.g. 65536 truncates to 0 and silently -+ * returns CPU 0's topology. Can go once perf_cpu.cpu is widened. -+ */ -+ if (env && al->cpu < env->nr_cpus_avail) { -+ struct cpu_topology_map *topo; -+ -+ topo = perf_env__get_cpu_topology(env, (struct perf_cpu){ al->cpu }); -+ if (topo) -+ al->socket = topo->socket_id; -+ } - } - - if (al->map) { --- -2.53.0 - diff --git a/queue-5.15/perf-tools-use-snprintf-for-root_dir-path-constructi.patch b/queue-5.15/perf-tools-use-snprintf-for-root_dir-path-constructi.patch deleted file mode 100644 index ccf86fd79c..0000000000 --- a/queue-5.15/perf-tools-use-snprintf-for-root_dir-path-constructi.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 3c550371a13e122fb572274ecef16a351fcb879d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 20:34:38 -0300 -Subject: perf tools: Use snprintf() for root_dir path construction - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 7b0df6f4d498b1608afccfd6dffb264e6da91693 ] - -get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in -symbol.c use sprintf() to construct paths by prepending root_dir to -"/proc/version" and "/proc/kallsyms" respectively. Both write into -PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM -configuration and is not length-checked. A root_dir at or near -PATH_MAX causes a stack buffer overflow. - -Switch to snprintf() with sizeof(path) to prevent overflow. - -Reported-by: sashiko-bot -Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") -Cc: Zhang Yanmin -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/machine.c | 2 +- - tools/perf/util/symbol.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c -index a0df9d24b2cb47..7e7c63fcd14068 100644 ---- a/tools/perf/util/machine.c -+++ b/tools/perf/util/machine.c -@@ -1338,7 +1338,7 @@ static char *get_kernel_version(const char *root_dir) - char *name, *tmp; - const char *prefix = "Linux version "; - -- sprintf(version, "%s/proc/version", root_dir); -+ snprintf(version, sizeof(version), "%s/proc/version", root_dir); - file = fopen(version, "r"); - if (!file) - return NULL; -diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c -index b48d237124e121..51e86e3d2e674a 100644 ---- a/tools/perf/util/symbol.c -+++ b/tools/perf/util/symbol.c -@@ -2313,7 +2313,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map) - if (!kallsyms_filename) - return -1; - } else { -- sprintf(path, "%s/proc/kallsyms", machine->root_dir); -+ snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir); - kallsyms_filename = path; - } - --- -2.53.0 - diff --git a/queue-5.15/perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch b/queue-5.15/perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch deleted file mode 100644 index b16d05ce5c..0000000000 --- a/queue-5.15/perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 7ee7f48413c42b90230de4a8e40898b757bc8e82 Mon Sep 17 00:00:00 2001 -From: Florian Fainelli -Date: Wed, 13 May 2026 12:23:46 -0700 -Subject: perf trace beauty fcntl: Fix build with older kernel headers - -From: Florian Fainelli - -commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream. - -Toolchains with older kernel headers that do not include upstream commit -c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write -life time hints") will now fail to build perf due to missing definitions -for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT. - -Provide a fallback definition for these when they are not already -defined. - -Fixes: 9c47f66748381ecb ("perf trace beauty fcntl: Basic 'arg' beautifier") -Reviewed-by: Ian Rogers -Signed-off-by: Florian Fainelli -Cc: Adrian Hunter -Cc: Alexander Shishkin -Cc: Ingo Molnar -Cc: James Clark -Cc: Jiri Olsa -Cc: Mark Rutland -Cc: Markus Mayer -Cc: Namhyung Kim -Cc: Peter Zijlstra -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Greg Kroah-Hartman ---- - tools/perf/trace/beauty/fcntl.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - ---- a/tools/perf/trace/beauty/fcntl.c -+++ b/tools/perf/trace/beauty/fcntl.c -@@ -9,6 +9,22 @@ - #include - #include - -+#ifndef F_GET_RW_HINT -+#define F_GET_RW_HINT (F_LINUX_SPECIFIC_BASE + 11) -+#endif -+ -+#ifndef F_SET_RW_HINT -+#define F_SET_RW_HINT (F_LINUX_SPECIFIC_BASE + 12) -+#endif -+ -+#ifndef F_GET_FILE_RW_HINT -+#define F_GET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 13) -+#endif -+ -+#ifndef F_SET_FILE_RW_HINT -+#define F_SET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 14) -+#endif -+ - static size_t fcntl__scnprintf_getfd(unsigned long val, char *bf, size_t size, bool show_prefix) - { - return val ? scnprintf(bf, size, "%s", "0") : diff --git a/queue-5.15/perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch b/queue-5.15/perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch similarity index 77% rename from queue-5.15/perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch rename to queue-5.15/perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch index bbfa88891e..9a14f38d5f 100644 --- a/queue-5.15/perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch +++ b/queue-5.15/perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch @@ -1,11 +1,11 @@ -From 23739e739b4b8a488005888ace0a3f003cf6effb Mon Sep 17 00:00:00 2001 -From: Sasha Levin +From 73a4c02f94a98d94480c3e5c81450215a4da05ba Mon Sep 17 00:00:00 2001 +From: Sandipan Das Date: Mon, 1 Jun 2026 20:28:46 +0530 Subject: perf/x86/amd/core: Always use the NMI latency mitigation From: Sandipan Das -[ Upstream commit 73a4c02f94a98d94480c3e5c81450215a4da05ba ] +commit 73a4c02f94a98d94480c3e5c81450215a4da05ba upstream. Commit df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp") fixed handling of late-arriving NMIs but limited @@ -20,16 +20,14 @@ Fixes: df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation to use a t Signed-off-by: Sandipan Das Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/29a3c970da289ab8f24282933bdb36545c0403e8.1780325517.git.sandipan.das@amd.com -Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman --- - arch/x86/events/amd/core.c | 6 +++--- + arch/x86/events/amd/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c -index 4ebedc7e1188b3..128055d6d3299a 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c -@@ -943,12 +943,12 @@ static int __init amd_core_pmu_init(void) +@@ -943,12 +943,12 @@ static int __init amd_core_pmu_init(void u64 even_ctr_mask = 0ULL; int i; @@ -45,6 +43,3 @@ index 4ebedc7e1188b3..128055d6d3299a 100644 /* * If core performance counter extensions exists, we must use * MSR_F15H_PERF_CTL/MSR_F15H_PERF_CTR msrs. See also --- -2.53.0 - diff --git a/queue-5.15/perf-x86-intel-uncore-defer-adl-global-pmon-enable-to-enable_box.patch b/queue-5.15/perf-x86-intel-uncore-defer-adl-global-pmon-enable-to-enable_box.patch deleted file mode 100644 index 0323173555..0000000000 --- a/queue-5.15/perf-x86-intel-uncore-defer-adl-global-pmon-enable-to-enable_box.patch +++ /dev/null @@ -1,57 +0,0 @@ -From stable+bounces-276819-greg=kroah.com@vger.kernel.org Thu Jul 16 21:14:38 2026 -From: Sasha Levin -Date: Thu, 16 Jul 2026 15:14:28 -0400 -Subject: perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() -To: stable@vger.kernel.org -Cc: Zide Chen , "Peter Zijlstra (Intel)" , Dapeng Mi , Sasha Levin -Message-ID: <20260716191428.1077510-1-sashal@kernel.org> - -From: Zide Chen - -[ Upstream commit 9a0bb848a37150aeccc10088e141339917d995dc ] - -On some Raptor Cove CPUs, enabling uncore PMON globally at driver init -may increase power consumption even when no perf events are in use. - -Drop adl_uncore_msr_init_box() and defer programming the global control -register to enable_box(), so it is only set when a box is actually used. - -IMC and IMC freerunning counters use a separate control path and are -unaffected. - -Fixes: 772ed05f3c5c ("perf/x86/intel/uncore: Add Alder Lake support") -Signed-off-by: Zide Chen -Signed-off-by: Peter Zijlstra (Intel) -Reviewed-by: Dapeng Mi -Cc: stable@vger.kernel.org -Link: https://patch.msgid.link/20260602144908.263680-5-zide.chen@intel.com -[ deleted adl_uncore_msr_init_box() in its 6.12 wrmsrl() spelling since the tree predates the wrmsrq() rename ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - arch/x86/events/intel/uncore_snb.c | 7 ------- - 1 file changed, 7 deletions(-) - ---- a/arch/x86/events/intel/uncore_snb.c -+++ b/arch/x86/events/intel/uncore_snb.c -@@ -445,12 +445,6 @@ void tgl_uncore_cpu_init(void) - skl_uncore_msr_ops.init_box = rkl_uncore_msr_init_box; - } - --static void adl_uncore_msr_init_box(struct intel_uncore_box *box) --{ -- if (box->pmu->pmu_idx == 0) -- wrmsrl(ADL_UNC_PERF_GLOBAL_CTL, SNB_UNC_GLOBAL_CTL_EN); --} -- - static void adl_uncore_msr_enable_box(struct intel_uncore_box *box) - { - wrmsrl(ADL_UNC_PERF_GLOBAL_CTL, SNB_UNC_GLOBAL_CTL_EN); -@@ -469,7 +463,6 @@ static void adl_uncore_msr_exit_box(stru - } - - static struct intel_uncore_ops adl_uncore_msr_ops = { -- .init_box = adl_uncore_msr_init_box, - .enable_box = adl_uncore_msr_enable_box, - .disable_box = adl_uncore_msr_disable_box, - .exit_box = adl_uncore_msr_exit_box, diff --git a/queue-5.15/series b/queue-5.15/series index 34a6416876..3c46735c48 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -14,7 +14,6 @@ slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch nfsd-move-name-lookup-out-of-nfsd4_list_rec_dir.patch nfsd-change-nfs4_client_to_reclaim-to-allocate-data.patch kvm-replace-guest-triggerable-bug_on-in-ioeventfd-da.patch -perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch netfilter-nf_tables-restore-set-elements-when-delete-set-fails.patch skmsg-convert-struct-sk_msg_sg-copy-to-a-bitmap.patch net-skmsg-preserve-sg.copy-across-sg-transforms.patch @@ -40,7 +39,6 @@ i2c-core-fix-adapter-registration-race.patch fbdev-fbcon-fix-out-of-bounds-read-in-err_out-of-fbcon_do_set_font.patch nfsv4-flexfiles-reject-zero-filehandle-version-count.patch ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch -perf-core-detach-event-groups-during-remove_on_exec.patch rtmutex-use-waiter-task-instead-of-current-in-remove.patch locking-rtmutex-skip-remove_waiter-when-waiter-is-no.patch usb-gadget-function-rndis-add-length-check-to-response-query.patch @@ -292,7 +290,6 @@ mm-fake-numa-fix-under-allocation-detection-in-unifo.patch lib-test_meminit-use-for-bools.patch configfs_lookup-don-t-leave-s_dentry-dangling-on-fai.patch bpftool-use-libbpf-error-code-for-flow-dissector-que.patch -perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch ocfs2-rebase-copied-fsdlm-lvb-pointers-in-locking_st.patch ocfs2-fix-buffer-head-management-in-ocfs2_read_block.patch ocfs2-reject-fitrim-ranges-shorter-than-a-cluster.patch @@ -375,25 +372,17 @@ coresight-cti-fix-dt-filter-signals-silently-ignored.patch coresight-etm4x-correct-trcvmidcctlr1-save-and-resto.patch x86-platform-olpc-xo15-drop-wakeup-source-on-driver-.patch platform-x86-xo15-ebook-fix-wakeup-source-and-gpe-ha.patch -perf-sched-add-missing-mmap2-handler-in-timehist.patch phy-phy-can-transceiver-check-driver-match-and-drive.patch staging-most-video-avoid-double-free-on-video-regist.patch usb-host-max3421-fix-shift-out-of-bounds-in-max3421_.patch usb-host-max3421-reject-hub-port-requests-for-non-ex.patch char-tlclk-fix-use-after-free-in-tlclk_cleanup.patch -perf-header-sanity-check-header_event_desc-attr.size.patch iio-light-si1133-reset-counter-to-prevent-race-condi.patch iio-light-si1133-prevent-race-condition-on-timeout.patch iio-magnetometer-ak8975-fix-potential-kernel-stack-m.patch iio-accel-mma8452-handle-i2c-read-error-s-in-mma8452.patch hid-logitech-hidpp-remove-excess-kernel-doc-member-i.patch drm-amd-display-add-missing-kdoc-for-allm-parameters.patch -perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch -perf-mmap-guard-cpu__get_node-return-in-aio_bind.patch -perf-sched-clean-up-idle_threads-entry-on-init-failu.patch -perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch -perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch -perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch dmaengine-qcom-gpi-set-dma_private-capability.patch dmaengine-fix-possible-use-after-free.patch clk-qcom-a53-corrected-frequency-multiplier-for-1152.patch @@ -402,26 +391,11 @@ nfsv4-pnfs-defer-return_range-callbacks-until-after-.patch nfsv4-flexfiles-honor-ff_flags_no_io_thru_mds-on-fat.patch nfsv4-flexfiles-honor-ff_flags_no_io_thru_mds-in-pg_.patch pci-mediatek-fix-operator-precedence-in-pcie_fts_num.patch -perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch -perf-tools-use-perf_env__get_cpu_topology-in-machine.patch pci-rcar-host-remove-unused-list_head-res.patch -perf-sched-fix-idle-hist-callchain-display-using-wro.patch -perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch -perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch xprtrdma-fix-bcall-rep-leak-and-unbounded-peek.patch -perf-pmu-fix-pmu_id-heap-underwrite-on-empty-identif.patch -perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch tools-lib-api-fix-missing-null-termination-in-filena.patch -perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch -perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch -perf-intel-pt-fix-snprintf-size-tracking-bug-in-insn.patch -perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch -perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch tools-lib-api-fix-filename__write_int-writing-uninit.patch tools-lib-api-fix-mount_overload-snprintf-truncation.patch -perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch -perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch -perf-symbols-add-bounds-checks-to-read_build_id-note.patch pci-mediatek-fix-possible-truncation-in-mtk_pcie_par.patch pci-mediatek-use-actual-physical-address-instead-of-.patch apparmor-check-label-build-before-no_new_privs-test.patch @@ -433,11 +407,7 @@ apparmor-put-secmark-label-after-secid-lookup.patch i3c-master-prevent-reuse-of-dynamic-address-on-devic.patch apparmor-fix-label-can-not-be-immediately-before-a-d.patch sparc-led-avoid-trimming-a-newline-from-empty-writes.patch -perf-symbols-break-infinite-loop-on-zero-filled-note.patch -perf-tools-use-snprintf-for-root_dir-path-constructi.patch -perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch xfrm-validate-selector-family-and-prefixlen-during-m.patch -perf-machine-use-snprintf-for-guestmount-path-constr.patch octeontx2-pf-fix-leak-of-sq-timestamp-buffer-on-tear.patch net-psample-fix-info-leak-in-psample_attr_data.patch sctp-hold-socket-lock-when-dumping-endpoints-in-sctp.patch @@ -787,7 +757,6 @@ ksmbd-fix-mechtoken-leak-when-spnego-decode-fails-after-token-alloc.patch ksmbd-destroy-async_ida-in-ksmbd_conn_free.patch ksmbd-centralize-ksmbd_conn-final-release-to-plug-transport-leak.patch ksmbd-track-the-connection-owning-a-byte-range-lock.patch -perf-x86-intel-uncore-defer-adl-global-pmon-enable-to-enable_box.patch x.509-fix-validation-of-asn.1-certificate-header.patch proc-use-generic-setattr-for-proc-pid-net.patch proc-move-fdinfo-ptrace_mode_read-check-into-the-inode-.permission-operation.patch @@ -841,3 +810,4 @@ alsa-seq-skip-event-type-filtering-for-ump-events.patch alsa-seq-check-ump-support-for-midi_version-change.patch iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch +perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch