From: Greg Kroah-Hartman Date: Wed, 22 Jul 2026 12:58:11 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=a993c3e11e56f8f783294025c712bd0c64ac79ca;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch --- diff --git a/queue-5.10/perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch b/queue-5.10/perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch deleted file mode 100644 index 9c8c46bec5..0000000000 --- a/queue-5.10/perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch +++ /dev/null @@ -1,45 +0,0 @@ -From f24ffe008f269a4be036e711195aae411289d58a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 8 Jun 2026 08:10:43 -0300 -Subject: perf bpf: Add NULL check for btf__type_by_id() in - synthesize_bpf_prog_name() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 903b0526dcf86d030c5970b4b0a67f9c227368e2 ] - -synthesize_bpf_prog_name() calls btf__type_by_id() and immediately -dereferences the result via t->name_off without checking for NULL. -btf__type_by_id() returns NULL when the type_id is invalid or out -of range. When processing perf.data files, finfo->type_id comes from -untrusted input, so an invalid ID causes a NULL pointer dereference. - -Fix by checking t for NULL before dereferencing. - -Reported-by: sashiko-bot -Fixes: fc462ac75b36daaa ("perf bpf: Extract logic to create program names from perf_event__synthesize_one_bpf_prog()") -Cc: Song Liu -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/bpf-event.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index 67295ca1d14b86..386afcefbc30dd 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -136,7 +136,8 @@ static int synthesize_bpf_prog_name(char *buf, int size, - if (btf) { - finfo = func_infos + sub_id * info->func_info_rec_size; - t = btf__type_by_id(btf, finfo->type_id); -- short_name = btf__name_by_offset(btf, t->name_off); -+ if (t) -+ short_name = btf__name_by_offset(btf, t->name_off); - } else if (sub_id == 0 && sub_prog_cnt == 1) { - /* no subprog */ - if (info->name[0]) --- -2.53.0 - diff --git a/queue-5.10/perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch b/queue-5.10/perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch deleted file mode 100644 index b95c750f48..0000000000 --- a/queue-5.10/perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch +++ /dev/null @@ -1,68 +0,0 @@ -From a058b62c592514cb3a66d3318e387e40b350b97d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 14:23:15 -0300 -Subject: perf bpf: Use scnprintf() in snprintf_hex() and - synthesize_bpf_prog_name() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit cab3a9331ed0b3f884dd61c8a25b3cf123705982 ] - -Both functions accumulate formatted output via ret += snprintf(buf + ret, -size - ret, ...). If the buffer is too small and snprintf() returns more -than the remaining space, ret exceeds size and the next 'size - ret' -underflows, causing snprintf() to write past the buffer end. - -Switch to scnprintf() which returns the actual number of bytes written, -making the accumulation safe. - -Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Song Liu -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/bpf-event.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index c4de19eba3880b..67295ca1d14b86 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -29,7 +29,7 @@ static int snprintf_hex(char *buf, size_t size, unsigned char *data, size_t len) - size_t i; - - for (i = 0; i < len; i++) -- ret += snprintf(buf + ret, size - ret, "%02x", data[i]); -+ ret += scnprintf(buf + ret, size - ret, "%02x", data[i]); - return ret; - } - -@@ -130,7 +130,7 @@ static int synthesize_bpf_prog_name(char *buf, int size, - const struct btf_type *t; - int name_len; - -- name_len = snprintf(buf, size, "bpf_prog_"); -+ name_len = scnprintf(buf, size, "bpf_prog_"); - name_len += snprintf_hex(buf + name_len, size - name_len, - prog_tags[sub_id], BPF_TAG_SIZE); - if (btf) { -@@ -143,9 +143,10 @@ static int synthesize_bpf_prog_name(char *buf, int size, - short_name = info->name; - } else - short_name = "F"; -- if (short_name) -- name_len += snprintf(buf + name_len, size - name_len, -- "_%s", short_name); -+ if (short_name) { -+ name_len += scnprintf(buf + name_len, size - name_len, -+ "_%s", short_name); -+ } - return name_len; - } - --- -2.53.0 - diff --git a/queue-5.10/perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch b/queue-5.10/perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch deleted file mode 100644 index 0b788209dd..0000000000 --- a/queue-5.10/perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 6cec4d81c1f8111ec5b9e6585b37d0231935c89b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 21:01:15 -0300 -Subject: perf bpf: Validate func_info_rec_size and sub_id in - synthesize_bpf_prog_name() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 10b3c3d63ecc17c6acb855bac5f40367f1115765 ] - -synthesize_bpf_prog_name() computes a pointer into the func_info array -using sub_id * info->func_info_rec_size without validating either value. -Both come from perf.data and are untrusted: - -- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means - the finfo pointer would reference a truncated entry, reading past it - into adjacent data. - -- A sub_id >= nr_func_info computes an offset past the func_info buffer, - causing an out-of-bounds read. - -Add bounds checks for both values before computing the pointer offset. -When validation fails, fall through to the non-BTF name path instead -of reading garbage. - -Reported-by: sashiko-bot -Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs") -Cc: Song Liu -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/bpf-event.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index 386afcefbc30dd..f4d35213c90502 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -133,7 +133,9 @@ static int synthesize_bpf_prog_name(char *buf, int size, - name_len = scnprintf(buf, size, "bpf_prog_"); - name_len += snprintf_hex(buf + name_len, size - name_len, - prog_tags[sub_id], BPF_TAG_SIZE); -- if (btf) { -+ if (btf && -+ info->func_info_rec_size >= sizeof(*finfo) && -+ sub_id < info->nr_func_info) { - finfo = func_infos + sub_id * info->func_info_rec_size; - t = btf__type_by_id(btf, finfo->type_id); - if (t) --- -2.53.0 - diff --git a/queue-5.10/perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch b/queue-5.10/perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch deleted file mode 100644 index fae171bd83..0000000000 --- a/queue-5.10/perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 15998fc4c8a850dd85ef269e6bae33cc7c29357e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 11:19:10 -0300 -Subject: perf c2c: Fix use-after-free in he__get_c2c_hists() error path - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 5e5e6196d737c5be03d20647428316b36621608d ] - -he__get_c2c_hists() assigns c2c_he->hists before calling -c2c_hists__init(). If init fails, the error path calls free(hists) -but leaves c2c_he->hists pointing to freed memory. On teardown, -c2c_he_free() finds the non-NULL pointer and calls -hists__delete_entries() on it, causing a use-after-free. - -Set c2c_he->hists to NULL before freeing so teardown skips the -already-freed allocation. - -Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries") -Reported-by: sashiko-bot -Cc: Jiri Olsa -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-c2c.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c -index fb7d01f3961b7e..d48b00a829dc66 100644 ---- a/tools/perf/builtin-c2c.c -+++ b/tools/perf/builtin-c2c.c -@@ -201,6 +201,7 @@ he__get_c2c_hists(struct hist_entry *he, - - ret = c2c_hists__init(hists, sort, nr_header_lines); - if (ret) { -+ c2c_he->hists = NULL; - free(hists); - return NULL; - } --- -2.53.0 - diff --git a/queue-5.10/perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch b/queue-5.10/perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch deleted file mode 100644 index 412821ca3b..0000000000 --- a/queue-5.10/perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 410c01c89f40b5a16c6855c0015e1be01a7f07f7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 28 May 2026 14:23:55 +0800 -Subject: perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - -From: Rui Qi - -[ Upstream commit 68018df3f55eba96a20dd703f5f276a6518f4963 ] - -In kallsyms__parse(), the loop reading symbol names iterates with i < -sizeof(symbol_name), which allows i to reach sizeof(symbol_name) upon -loop exit. The subsequent symbol_name[i] = '\0' then writes one byte -past the end of the stack-allocated symbol_name[] array. - -Fix this by changing the loop bound to KSYM_NAME_LEN, so the null -terminator always lands within the array. The overflow is triggerable by -a kallsyms entry with a symbol name of KSYM_NAME_LEN+1 or more -characters (e.g., long Rust mangled names or a malicious -/proc/kallsyms). - -Fixes: 53df2b9344128984 ("libsymbols kallsyms: Parse using io api") -Signed-off-by: Rui Qi -Acked-by: Namhyung Kim -Cc: Adrian Hunter -Cc: Alexander Shishkin -Cc: Ian Rogers -Cc: Ingo Molnar -Cc: James Clark -Cc: Jiri Olsa -Cc: Mark Rutland -Cc: Peter Zijlstra -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/lib/symbol/kallsyms.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/tools/lib/symbol/kallsyms.c b/tools/lib/symbol/kallsyms.c -index e335ac2b9e1972..d64bd9cc82a90e 100644 ---- a/tools/lib/symbol/kallsyms.c -+++ b/tools/lib/symbol/kallsyms.c -@@ -60,7 +60,7 @@ int kallsyms__parse(const char *filename, void *arg, - read_to_eol(&io); - continue; - } -- for (i = 0; i < sizeof(symbol_name); i++) { -+ for (i = 0; i < KSYM_NAME_LEN; i++) { - ch = io__get_char(&io); - if (ch < 0 || ch == '\n') - break; -@@ -68,6 +68,9 @@ int kallsyms__parse(const char *filename, void *arg, - } - symbol_name[i] = '\0'; - -+ if (i == KSYM_NAME_LEN) -+ read_to_eol(&io); -+ - err = process_symbol(arg, symbol_name, symbol_type, start); - if (err) - break; --- -2.53.0 - diff --git a/queue-5.10/perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch b/queue-5.10/perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch deleted file mode 100644 index 00c271d11c..0000000000 --- a/queue-5.10/perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 92a5fd2c3a25d542ac87f6d097b0b39d84228df7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 14:35:28 -0300 -Subject: perf hists: Fix snprintf() in hists__scnprintf_title() UID filter - path - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 227a8748742f0263f1fe3131449b44563b77a209 ] - -hists__scnprintf_title() accumulates formatted output into a buffer -using scnprintf() for all filter clauses except the UID filter, which -uses snprintf(). If the buffer fills up and snprintf() returns more -than the remaining space, printed exceeds size and the next 'size - -printed' underflows, causing later scnprintf() calls to write past -the buffer. - -Switch the UID filter clause to scnprintf() to match the rest of the -function. - -Fixes: 25c312dbf88ca402 ("perf hists: Move hists__scnprintf_title() away from the TUI code") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Arnaldo Carvalho de Melo -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/hist.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index 8a793e4c9400a7..97a9531e26ed5c 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -2728,9 +2728,10 @@ int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool sh - ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events); - - -- if (hists->uid_filter_str) -- printed += snprintf(bf + printed, size - printed, -- ", UID: %s", hists->uid_filter_str); -+ if (hists->uid_filter_str) { -+ printed += scnprintf(bf + printed, size - printed, -+ ", UID: %s", hists->uid_filter_str); -+ } - if (thread) { - if (hists__has(hists, thread)) { - printed += scnprintf(bf + printed, size - printed, --- -2.53.0 - diff --git a/queue-5.10/perf-machine-use-snprintf-for-guestmount-path-constr.patch b/queue-5.10/perf-machine-use-snprintf-for-guestmount-path-constr.patch deleted file mode 100644 index 5557be0688..0000000000 --- a/queue-5.10/perf-machine-use-snprintf-for-guestmount-path-constr.patch +++ /dev/null @@ -1,57 +0,0 @@ -From c463e73624c117f0d25643df691fe9fb788986b3 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 13 Jun 2026 13:59:39 -0300 -Subject: perf machine: Use snprintf() for guestmount path construction - -From: Arnaldo Carvalho de Melo - -[ Upstream commit fe63d3bca288c5bb983304efd5fc3a5ff3183403 ] - -machines__findnew() and machines__create_guest_kernel_maps() use -sprintf() to build paths by prepending symbol_conf.guestmount. -Both write into PATH_MAX stack buffers, but guestmount comes from -user configuration and is not length-checked. A guestmount path -at or near PATH_MAX causes a stack buffer overflow. - -Switch to snprintf() with sizeof() to prevent overflow. The -subsequent access()/fopen() calls will fail on a truncated path. - -Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") -Reported-by: sashiko-bot -Cc: Zhang, Yanmin -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/machine.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c -index 53adfad15be455..c0ba380023db67 100644 ---- a/tools/perf/util/machine.c -+++ b/tools/perf/util/machine.c -@@ -347,7 +347,7 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid) - if ((pid != HOST_KERNEL_ID) && - (pid != DEFAULT_GUEST_KERNEL_ID) && - (symbol_conf.guestmount)) { -- sprintf(path, "%s/%d", symbol_conf.guestmount, pid); -+ snprintf(path, sizeof(path), "%s/%d", symbol_conf.guestmount, pid); - if (access(path, R_OK)) { - static struct strlist *seen; - -@@ -1231,9 +1231,9 @@ int machines__create_guest_kernel_maps(struct machines *machines) - namelist[i]->d_name); - continue; - } -- sprintf(path, "%s/%s/proc/kallsyms", -- symbol_conf.guestmount, -- namelist[i]->d_name); -+ snprintf(path, sizeof(path), "%s/%s/proc/kallsyms", -+ symbol_conf.guestmount, -+ namelist[i]->d_name); - ret = access(path, R_OK); - if (ret) { - pr_debug("Can't access file %s\n", path); --- -2.53.0 - diff --git a/queue-5.10/perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch b/queue-5.10/perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch deleted file mode 100644 index 89007ba2c6..0000000000 --- a/queue-5.10/perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch +++ /dev/null @@ -1,62 +0,0 @@ -From d568af5f670a9f36ea3346fd6f3a979443b9162e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 11:03:29 -0300 -Subject: perf mmap: Fix NULL deref in aio cleanup on alloc failure - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 25627346b10e6a564610ea2c49dc6dd54812226d ] - -perf_mmap__aio_mmap() sets map->aio.nr_cblocks before allocating the -data array. If calloc() for aiocb or cblocks fails before the data -array is allocated, the return -1 path leads to perf_mmap__aio_munmap() -which loops nr_cblocks times calling perf_mmap__aio_free(). Both -versions of perf_mmap__aio_free() (NUMA and non-NUMA) dereference -map->aio.data[idx] without checking if data is NULL, causing a NULL -pointer dereference. - -Add NULL checks for map->aio.data at the top of both -perf_mmap__aio_free() variants so the cleanup path is safe when -allocation fails partway through perf_mmap__aio_mmap(). - -Fixes: d3d1af6f011a553a ("perf record: Enable asynchronous trace writing") -Reported-by: sashiko-bot -Cc: Alexey Budankov -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/mmap.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c -index ab7108d22428b5..35ca944970a957 100644 ---- a/tools/perf/util/mmap.c -+++ b/tools/perf/util/mmap.c -@@ -88,10 +88,10 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx) - - static void perf_mmap__aio_free(struct mmap *map, int idx) - { -- if (map->aio.data[idx]) { -- munmap(map->aio.data[idx], mmap__mmap_len(map)); -- map->aio.data[idx] = NULL; -- } -+ if (!map->aio.data || !map->aio.data[idx]) -+ return; -+ munmap(map->aio.data[idx], mmap__mmap_len(map)); -+ map->aio.data[idx] = NULL; - } - - static int perf_mmap__aio_bind(struct mmap *map, int idx, int cpu, int affinity) -@@ -134,6 +134,8 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx) - - static void perf_mmap__aio_free(struct mmap *map, int idx) - { -+ if (!map->aio.data) -+ return; - zfree(&(map->aio.data[idx])); - } - --- -2.53.0 - diff --git a/queue-5.10/perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch b/queue-5.10/perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch deleted file mode 100644 index e06c20a2fd..0000000000 --- a/queue-5.10/perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 68c98b5a0046743fc9e6f40a86df1a888a51b91c Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:03:13 -0300 -Subject: perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs - file -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 33035f7dd4e49f3f117e70c5e36c8c1ae88d37f2 ] - -perf_pmu__parse_scale() reads a PMU scale file then accesses -scale[sret - 1] to strip a trailing newline. Only sret < 0 is -guarded, so an empty file (sret == 0) causes scale[-1] — a stack -buffer underflow that reads and potentially writes out of bounds. - -perf_pmu__parse_unit() has the same pattern: alias->unit[sret - 1] -with sret == 0 accesses the byte before the struct member, which -may corrupt the adjacent pmu_name pointer field. - -Change both guards from sret < 0 to sret <= 0 so that empty files -are treated as read errors. - -Fixes: 410136f5dd96b601 ("tools/perf/stat: Add event unit and scale support") -Reported-by: sashiko-bot -Cc: Stephane Eranian -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/pmu.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index d322305bc18281..914375179b00e8 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -158,7 +158,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char * - goto error; - - sret = read(fd, scale, sizeof(scale)-1); -- if (sret < 0) -+ if (sret <= 0) - goto error; - - if (scale[sret - 1] == '\n') -@@ -185,7 +185,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n - return -1; - - sret = read(fd, alias->unit, UNIT_MAX_LEN); -- if (sret < 0) -+ if (sret <= 0) - goto error; - - close(fd); --- -2.53.0 - diff --git a/queue-5.10/perf-sched-add-missing-mmap2-handler-in-timehist.patch b/queue-5.10/perf-sched-add-missing-mmap2-handler-in-timehist.patch deleted file mode 100644 index a390775bc9..0000000000 --- a/queue-5.10/perf-sched-add-missing-mmap2-handler-in-timehist.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 3d43f82a3f68899c948f0c989276c440edc5022f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 5 May 2026 17:45:42 -0700 -Subject: perf sched: Add missing mmap2 handler in timehist - -From: Ian Rogers - -[ Upstream commit 91182741369b261c441e63e6678893032a6d7e4c ] - -perf_sched__timehist() registers event handlers for options using the -sched->tool struct. It registers handlers for MMAP, COMM, EXIT, FORK, etc. -but completely omits registering a handler for MMAP2 events. - -Failing to register both MMAP and MMAP2 handlers causes modern systems -(which primarily output MMAP2 records) to silently drop VMA map mappings. -This results in uninitialized machine/thread mapping structures, making it -impossible to resolve shared library instruction pointers (IPs) to dynamic -symbols/DSOs during timehist callchain analysis. - -Fix this by correctly registering perf_event__process_mmap2 in -sched->tool inside perf_sched__timehist(). - -Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command") -Assisted-by: Gemini-CLI:Google Gemini 3 -Signed-off-by: Ian Rogers -Cc: Adrian Hunter -Cc: David Ahern -Cc: Gabriel Marin -Cc: Ingo Molnar -Cc: James Clark -Cc: Jiri Olsa -Cc: Namhyung Kim -Cc: Peter Zijlstra -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index 4f8658f5f9deee..bff2158987b305 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -3001,6 +3001,7 @@ static int perf_sched__timehist(struct perf_sched *sched) - */ - sched->tool.sample = perf_timehist__process_sample; - sched->tool.mmap = perf_event__process_mmap; -+ sched->tool.mmap2 = perf_event__process_mmap2; - sched->tool.comm = perf_event__process_comm; - sched->tool.exit = perf_event__process_exit; - sched->tool.fork = perf_event__process_fork; --- -2.53.0 - diff --git a/queue-5.10/perf-sched-clean-up-idle_threads-entry-on-init-failu.patch b/queue-5.10/perf-sched-clean-up-idle_threads-entry-on-init-failu.patch deleted file mode 100644 index d9ee62b2ec..0000000000 --- a/queue-5.10/perf-sched-clean-up-idle_threads-entry-on-init-failu.patch +++ /dev/null @@ -1,54 +0,0 @@ -From e65eed1a55b70da421c8720eb5645acb3f609306 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 5 Jun 2026 11:12:08 -0300 -Subject: perf sched: Clean up idle_threads entry on init failure - -From: Arnaldo Carvalho de Melo - -[ Upstream commit cda5a94ad9181cd60cbf04be11d524201bf489a2 ] - -get_idle_thread() allocates a thread via thread__new() and stores it in -idle_threads[cpu], then calls init_idle_thread() to set up the private -data. If init_idle_thread() fails (e.g. OOM for the idle_thread_runtime -struct), the function returns NULL but leaves the partially initialized -thread in idle_threads[cpu]. - -On subsequent calls for the same CPU, get_idle_thread() finds a non-NULL -idle_threads[cpu], skips allocation, and returns thread__get() on a -thread that has no priv data. Callers then get a thread whose -thread__priv() returns NULL, leading to unexpected behavior. - -Release the thread and reset the slot to NULL on init failure so the -entry doesn't persist in a corrupted state. - -Fixes: 49394a2a24c7 ("perf sched timehist: Introduce timehist command") -Reported-by: sashiko-bot -Cc: David Ahern -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index bff2158987b305..735245be784886 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -2279,8 +2279,11 @@ static struct thread *get_idle_thread(int cpu) - idle_threads[cpu] = thread__new(0, 0); - - if (idle_threads[cpu]) { -- if (init_idle_thread(idle_threads[cpu]) < 0) -+ if (init_idle_thread(idle_threads[cpu]) < 0) { -+ /* clean up so next call doesn't find a half-initialized thread */ -+ thread__zput(idle_threads[cpu]); - return NULL; -+ } - } - } - --- -2.53.0 - diff --git a/queue-5.10/perf-sched-fix-idle-hist-callchain-display-using-wro.patch b/queue-5.10/perf-sched-fix-idle-hist-callchain-display-using-wro.patch deleted file mode 100644 index af6b1572a6..0000000000 --- a/queue-5.10/perf-sched-fix-idle-hist-callchain-display-using-wro.patch +++ /dev/null @@ -1,57 +0,0 @@ -From ddb1c994dc288b2c80bce181fee9d29e92fd1c8d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 21:49:16 -0300 -Subject: perf sched: Fix idle-hist callchain display using wrong rb_first - variant -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit d9b99dc8148e0c1f5da3942131b47e0d21187a32 ] - -timehist_print_idlehist_callchain() calls rb_first_cached() on -sorted_root, but the sort function (callchain_param.sort) populates it -via rb_insert_color() on the plain rb_root member — not the cached -variant. This means rb_leftmost is never set, so rb_first_cached() -always returns NULL and the entire callchain summary is silently -dropped from --idle-hist output. - -The original code in ba957ebb54893aca ("perf sched timehist: Show -callchains for idle stat") was correct — it used struct rb_root and -rb_first(). The bug was introduced when sorted_root was converted to -rb_root_cached without converting the sort insertion path to use -rb_insert_color_cached(). - -Use rb_first(&root->rb_root) to match how the tree was populated. - -Fixes: cb4c13a5137766c3 ("perf sched: Use cached rbtrees") -Reported-by: sashiko-bot -Cc: Davidlohr Bueso -Cc: Namhyung Kim -Acked-by: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index ef535cf8d77a4e..c5d31851a64d2c 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -2820,7 +2820,8 @@ static size_t timehist_print_idlehist_callchain(struct rb_root_cached *root) - size_t ret = 0; - FILE *fp = stdout; - struct callchain_node *chain; -- struct rb_node *rb_node = rb_first_cached(root); -+ /* sort() uses rb_insert_color() on rb_root, not rb_root_cached */ -+ struct rb_node *rb_node = rb_first(&root->rb_root); - - printf(" %16s %8s %s\n", "Idle time (msec)", "Count", "Callchains"); - printf(" %.16s %.8s %.50s\n", graph_dotted_line, graph_dotted_line, --- -2.53.0 - diff --git a/queue-5.10/perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch b/queue-5.10/perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch deleted file mode 100644 index 93cf9cc3e7..0000000000 --- a/queue-5.10/perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch +++ /dev/null @@ -1,121 +0,0 @@ -From c583128ecea44b728fe6a5aea6917ce8a9cb4887 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 5 Jun 2026 11:26:28 -0300 -Subject: perf sched: Replace BUG_ON and add NULL checks in replay event - helpers - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 75eafe4a3a93a0143a20c0cc286bfb9008ac1478 ] - -get_new_event() has three issues: - -1. The zalloc() result is dereferenced without a NULL check, crashing - on allocation failure. - -2. BUG_ON(!task->atoms) kills the process when realloc() fails. - Since perf.data is untrusted input, this should be a graceful error. - -3. The realloc pattern assigns directly to task->atoms, losing the old - pointer on failure. task->nr_events is also incremented before the - realloc, leaving corrupted state on failure. - -Fix get_new_event() to: - - Check the zalloc() result before dereferencing - - Use a temporary for realloc() to avoid losing the old pointer - - Increment nr_events only after successful realloc - - Return NULL instead of calling BUG_ON on failure - -Also fix add_sched_event_wakeup() where zalloc() for wait_sem is -passed to sem_init() without a NULL check. - -Update all callers (add_sched_event_run, add_sched_event_wakeup, -add_sched_event_sleep) to handle NULL returns by returning early. -The replay may produce incomplete output on OOM but will not crash. - -Fixes: ec156764d424 ("perf sched: Import schedbench.c") -Reported-by: sashiko-bot -Cc: Ingo Molnar -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/builtin-sched.c | 28 +++++++++++++++++++++++++--- - 1 file changed, 25 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index 735245be784886..ef535cf8d77a4e 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -361,14 +361,25 @@ get_new_event(struct task_desc *task, u64 timestamp) - struct sched_atom *event = zalloc(sizeof(*event)); - unsigned long idx = task->nr_events; - size_t size; -+ struct sched_atom **atoms_p; -+ -+ if (event == NULL) { -+ pr_err("ERROR: sched: failed to allocate event\n"); -+ return NULL; -+ } - - event->timestamp = timestamp; - event->nr = idx; - -+ size = sizeof(struct sched_atom *) * (task->nr_events + 1); -+ atoms_p = realloc(task->atoms, size); -+ if (!atoms_p) { -+ pr_err("ERROR: sched: failed to grow atoms array\n"); -+ free(event); -+ return NULL; -+ } -+ task->atoms = atoms_p; - task->nr_events++; -- size = sizeof(struct sched_atom *) * task->nr_events; -- task->atoms = realloc(task->atoms, size); -- BUG_ON(!task->atoms); - - task->atoms[idx] = event; - -@@ -399,6 +410,8 @@ static void add_sched_event_run(struct perf_sched *sched, struct task_desc *task - } - - event = get_new_event(task, timestamp); -+ if (event == NULL) -+ return; - - event->type = SCHED_EVENT_RUN; - event->duration = duration; -@@ -412,6 +425,8 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t - struct sched_atom *event, *wakee_event; - - event = get_new_event(task, timestamp); -+ if (event == NULL) -+ return; - event->type = SCHED_EVENT_WAKEUP; - event->wakee = wakee; - -@@ -426,6 +441,10 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t - } - - wakee_event->wait_sem = zalloc(sizeof(*wakee_event->wait_sem)); -+ if (!wakee_event->wait_sem) { -+ pr_err("ERROR: sched: failed to allocate semaphore\n"); -+ return; -+ } - sem_init(wakee_event->wait_sem, 0, 0); - wakee_event->specific_wait = 1; - event->wait_sem = wakee_event->wait_sem; -@@ -438,6 +457,9 @@ static void add_sched_event_sleep(struct perf_sched *sched, struct task_desc *ta - { - struct sched_atom *event = get_new_event(task, timestamp); - -+ if (event == NULL) -+ return; -+ - event->type = SCHED_EVENT_SLEEP; - - sched->nr_sleep_events++; --- -2.53.0 - diff --git a/queue-5.10/perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch b/queue-5.10/perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch deleted file mode 100644 index 5f43630433..0000000000 --- a/queue-5.10/perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 0e16b1648a93e97f1118a83bf69d34c1b8ff75cb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 8 Jun 2026 08:12:34 -0300 -Subject: perf symbols: Add bounds checks to elf_read_build_id() note iteration - -From: Arnaldo Carvalho de Melo - -[ Upstream commit acc56d3941fc2997a5a21ea9233a8ac3d87c4f2f ] - -elf_read_build_id() iterates ELF notes using pointer arithmetic -driven by n_namesz and n_descsz from the note headers. Neither -the note header read nor the subsequent name/desc advances are -checked against the section boundary. A malformed ELF file with -oversized note sizes causes out-of-bounds reads past the section -data buffer. - -Add two bounds checks: verify the note header fits within the -remaining section data, and verify that namesz + descsz (after -alignment) fits before advancing the pointer. - -Fixes: fd7a346ea292074e ("perf symbols: Filename__read_build_id should look at .notes section too") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 18 ++++++++++++++++-- - 1 file changed, 16 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index bf11448eb4177d..627a6206f48221 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -535,10 +535,24 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size) - ptr = data->d_buf; - while (ptr < (data->d_buf + data->d_size)) { - GElf_Nhdr *nhdr = ptr; -- size_t namesz = NOTE_ALIGN(nhdr->n_namesz), -- descsz = NOTE_ALIGN(nhdr->n_descsz); -+ size_t namesz, descsz, remaining; - const char *name; - -+ /* ensure the note header fits within the section */ -+ if (ptr + sizeof(*nhdr) > data->d_buf + data->d_size) -+ break; -+ -+ namesz = NOTE_ALIGN(nhdr->n_namesz); -+ descsz = NOTE_ALIGN(nhdr->n_descsz); -+ -+ /* validate individually to avoid size_t overflow on 32-bit */ -+ remaining = data->d_buf + data->d_size - ptr - sizeof(*nhdr); -+ if (namesz > remaining || descsz > remaining - namesz) { -+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n", -+ __func__, nhdr->n_namesz, nhdr->n_descsz); -+ break; -+ } -+ - ptr += sizeof(*nhdr); - name = ptr; - ptr += namesz; --- -2.53.0 - diff --git a/queue-5.10/perf-symbols-add-bounds-checks-to-read_build_id-note.patch b/queue-5.10/perf-symbols-add-bounds-checks-to-read_build_id-note.patch deleted file mode 100644 index da77c395b0..0000000000 --- a/queue-5.10/perf-symbols-add-bounds-checks-to-read_build_id-note.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 6b499746594df0cd4265f5871297e055bc6f048b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 16:09:45 -0300 -Subject: perf symbols: Add bounds checks to read_build_id() note iteration in - minimal build - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 52e582e316c48c53bb3082c29f7862ebc554087e ] - -symbol-minimal.c's read_build_id() iterates ELF notes with the same -pattern as symbol-elf.c's elf_read_build_id(): pointer arithmetic -driven by n_namesz and n_descsz from 32-bit note header fields, -without validating that the name and desc fit within the note section -data. A malformed ELF file with oversized note sizes causes -out-of-bounds reads past the section data buffer. - -Add the same bounds check as the libelf path: validate namesz and -descsz individually against remaining data before advancing the -pointer, avoiding size_t overflow on 32-bit. - -Fixes: b691f64360ecec49 ("perf symbols: Implement poor man's ELF parser") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-minimal.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/symbol-minimal.c b/tools/perf/util/symbol-minimal.c -index f9eb0bee7f157a..cd3bef5644a0b6 100644 ---- a/tools/perf/util/symbol-minimal.c -+++ b/tools/perf/util/symbol-minimal.c -@@ -1,3 +1,4 @@ -+#include "debug.h" - #include "dso.h" - #include "symbol.h" - #include "symsrc.h" -@@ -45,7 +46,7 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid, - ptr = note_data; - while (ptr < (note_data + note_len)) { - const char *name; -- size_t namesz, descsz; -+ size_t namesz, descsz, remaining; - - nhdr = ptr; - if (need_swap) { -@@ -57,6 +58,14 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid, - namesz = NOTE_ALIGN(nhdr->n_namesz); - descsz = NOTE_ALIGN(nhdr->n_descsz); - -+ /* validate individually to avoid size_t overflow on 32-bit */ -+ remaining = note_data + note_len - ptr - sizeof(*nhdr); -+ if (namesz > remaining || descsz > remaining - namesz) { -+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n", -+ __func__, nhdr->n_namesz, nhdr->n_descsz); -+ break; -+ } -+ - ptr += sizeof(*nhdr); - name = ptr; - ptr += namesz; --- -2.53.0 - diff --git a/queue-5.10/perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch b/queue-5.10/perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch deleted file mode 100644 index e65ccbcf0d..0000000000 --- a/queue-5.10/perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch +++ /dev/null @@ -1,59 +0,0 @@ -From a0e710f1233a24aeb6568aec3c17d8bc0cf12376 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:05:15 -0300 -Subject: perf symbols: Bounds-check .gnu_debuglink section data - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 9c74f0aab398cb32ab250401f323c0fdc9a3a496 ] - -filename__read_debuglink() copies .gnu_debuglink section data into a -caller-provided buffer via: - - strncpy(debuglink, data->d_buf, size); - -where size is PATH_MAX. If the ELF section is smaller than size and -lacks a null terminator, strncpy reads past data->d_buf into adjacent -memory. A malformed ELF file can trigger this, potentially causing a -segfault or leaking heap data. - -Additionally, strncpy does not guarantee null termination when the -source fills the buffer. - -Replace with an explicit memcpy bounded by both the output buffer -size and the actual section data size (data->d_size), followed by -explicit null termination. - -Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 907796a4699282..2ebceeff87c6f4 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -753,7 +753,14 @@ int filename__read_debuglink(const char *filename, char *debuglink, - goto out_elf_end; - - /* the start of this section is a zero-terminated string */ -- strncpy(debuglink, data->d_buf, size); -+ if (data->d_size > 0) { -+ size_t len = min(size - 1, data->d_size); -+ -+ memcpy(debuglink, data->d_buf, len); -+ debuglink[len] = '\0'; -+ } else { -+ debuglink[0] = '\0'; -+ } - - err = 0; - --- -2.53.0 - diff --git a/queue-5.10/perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch b/queue-5.10/perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch deleted file mode 100644 index 824bbdcff7..0000000000 --- a/queue-5.10/perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch +++ /dev/null @@ -1,57 +0,0 @@ -From d2c5b86ed8c233a622b79c6694198cb024f50f16 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 22:40:20 -0300 -Subject: perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU - fallback - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 1b4e9fbdeabc549965e70ac0cd8095d57ff6df06 ] - -When sysfs__read_build_id() matches NT_GNU_BUILD_ID with the right -namesz but the name content is not "GNU", it falls back to reading -descsz bytes into the stack buffer bf[BUFSIZ]: - - } else if (read(fd, bf, descsz) != (ssize_t)descsz) - -Unlike the else branch which validates namesz + descsz against -sizeof(bf), this path passes descsz directly to read() without any -bounds check. A crafted sysfs file with a large n_descsz overflows -the 8192-byte stack buffer. - -Add a descsz > sizeof(bf) check before the read, breaking out of -the loop on oversized values. - -Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 2ebceeff87c6f4..bf11448eb4177d 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -653,8 +653,13 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid) - err = 0; - break; - } -- } else if (read(fd, bf, descsz) != (ssize_t)descsz) -- break; -+ } else { -+ /* descsz from untrusted file — clamp to buffer */ -+ if (descsz > sizeof(bf)) -+ break; -+ if (read(fd, bf, descsz) != (ssize_t)descsz) -+ break; -+ } - } else { - size_t n; - --- -2.53.0 - diff --git a/queue-5.10/perf-symbols-break-infinite-loop-on-zero-filled-note.patch b/queue-5.10/perf-symbols-break-infinite-loop-on-zero-filled-note.patch deleted file mode 100644 index a9bc984365..0000000000 --- a/queue-5.10/perf-symbols-break-infinite-loop-on-zero-filled-note.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 3afa99c0276abea801d9b083ecd78c3f9a08201e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 19:32:22 -0300 -Subject: perf symbols: Break infinite loop on zero-filled notes in - sysfs__read_build_id() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 063c647b24f640657d6d9e2e90d620ea3ee19ae6 ] - -sysfs__read_build_id() iterates ELF note headers from sysfs files in a -while(1) loop. If the file contains a zero-filled note header (both -n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0 -and calls read(fd, bf, 0). read() with count 0 returns 0, which -matches the expected (ssize_t)n value, so the error check passes and -the loop repeats — reading the same zero bytes and spinning forever. - -This can happen with corrupted or zero-padded sysfs pseudo-files. - -Add a check for n == 0 before the read, since no valid ELF note has -both name and description of zero length. - -Reported-by: sashiko-bot -Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too") -Reviewed-by: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 627a6206f48221..8dd0f3a50a5b14 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -685,6 +685,9 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid) - } else { - n = namesz + descsz; - } -+ /* no valid note has both namesz and descsz zero */ -+ if (n == 0) -+ break; - if (read(fd, bf, n) != (ssize_t)n) - break; - } --- -2.53.0 - diff --git a/queue-5.10/perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch b/queue-5.10/perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch deleted file mode 100644 index 52f29d34b2..0000000000 --- a/queue-5.10/perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 88e587df8b2340e713e8c0e5a96c3069fd63167d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 21:04:50 -0300 -Subject: perf symbols: Fix signed overflow in sysfs__read_build_id() size - check -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 6eaa8ee3e2abe5112e80e94c27196bb175689469 ] - -sysfs__read_build_id() reads ELF note headers from sysfs files. The -note's namesz and descsz fields are used to compute the skip size: - - int n = namesz + descsz; - if (n > (int)sizeof(bf)) - -Both namesz and descsz are size_t from NOTE_ALIGN() of 32-bit note -header fields. Their sum can exceed INT_MAX, overflowing the signed -int n to a negative value. The check n > sizeof(bf) then evaluates -false (negative < positive in signed comparison), and read(fd, bf, n) -reinterprets the negative n as a huge size_t count — the kernel writes -up to MAX_RW_COUNT bytes into the 8192-byte stack buffer. - -In practice the overflow is bounded by the sysfs file's actual size, -so a real sysfs notes file won't trigger it organically. But crafted -input (e.g. via a mounted debugfs/sysfs image) could. - -Fix by validating namesz and descsz individually against the buffer -size before summing, and change n to size_t to avoid the signed -overflow entirely. - -Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too") -Reported-by: sashiko-bot -Cc: Namhyung Kim -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/symbol-elf.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index b171d134ce87aa..907796a4699282 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -656,14 +656,17 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid) - } else if (read(fd, bf, descsz) != (ssize_t)descsz) - break; - } else { -- int n = namesz + descsz; -+ size_t n; - -- if (n > (int)sizeof(bf)) { -+ /* int sum of namesz+descsz can overflow negative, bypassing size check */ -+ if (namesz > sizeof(bf) || descsz > sizeof(bf) - namesz) { - n = sizeof(bf); - pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n", - __func__, filename, nhdr.n_namesz, nhdr.n_descsz); -+ } else { -+ n = namesz + descsz; - } -- if (read(fd, bf, n) != n) -+ if (read(fd, bf, n) != (ssize_t)n) - break; - } - } --- -2.53.0 - diff --git a/queue-5.10/perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch b/queue-5.10/perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch deleted file mode 100644 index 01643eb9d5..0000000000 --- a/queue-5.10/perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 0cb0633470757744196f85d762739a7ab8b877b8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 20:37:52 -0300 -Subject: perf tools: Fix get_max_num() size_t underflow on empty sysfs file - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 0a012113bb3a44482c163f16f4db03ccaa37a339 ] - -get_max_num() reads a sysfs file (cpu/possible, cpu/present, or -node/possible) and scans backward from the end to find the last -number. If the file is empty, filename__read_str() returns num == 0. -The loop `while (--num)` decrements the size_t from 0 to SIZE_MAX, -reading backward across the heap until a comma or hyphen is found -or unmapped memory is hit. - -Add an early return for empty files before the backward scan. - -Fixes: 7780c25bae59fd04 ("perf tools: Allow ability to map cpus to nodes easily") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Don Zickus -Cc: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/cpumap.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c -index dc5c5e6fc502d5..9a9759df3e70f9 100644 ---- a/tools/perf/util/cpumap.c -+++ b/tools/perf/util/cpumap.c -@@ -280,6 +280,12 @@ static int get_max_num(char *path, int *max) - - buf[num] = '\0'; - -+ /* empty file — nothing to parse */ -+ if (num == 0) { -+ err = -1; -+ goto out; -+ } -+ - /* start on the right, to find highest node num */ - while (--num) { - if ((buf[num] == ',') || (buf[num] == '-')) { --- -2.53.0 - diff --git a/queue-5.10/perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch b/queue-5.10/perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch deleted file mode 100644 index 1a596bf3ab..0000000000 --- a/queue-5.10/perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 408865dcb52c75cba78de0e363eb977e34bbc89b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2026 22:37:55 -0300 -Subject: perf tools: Fix thread__set_comm_from_proc() on empty comm file -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 31d596054550f793508abe7dd593853ece47d428 ] - -thread__set_comm_from_proc() calls procfs__read_str() then strips -the trailing newline via comm[sz - 1] = '\0'. procfs__read_str() -allocates the buffer before reading, so on an empty /proc/pid/comm -(reachable during late exit teardown) it returns success with sz = 0 -and an unterminated heap buffer. - -The sz - 1 underflow was the original sashiko finding: it writes a -null byte before the allocation. But even with a sz > 0 guard on -the newline strip, the unterminated buffer would still be passed to -thread__set_comm() which calls strlen() — an unbounded heap read. - -Fix by treating sz == 0 as failure: free the buffer and return -1. -This is consistent with pmu.c's perf_pmu__parse_scale/unit which -already treat len == 0 from filename__read_str as an error. - -Fixes: 2f3027ac28bf6bc3 ("perf thread: Introduce method to set comm from /proc/pid/self") -Reported-by: sashiko-bot -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/thread.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c -index 665e5c0618ed3d..6840a2d357b6a6 100644 ---- a/tools/perf/util/thread.c -+++ b/tools/perf/util/thread.c -@@ -282,6 +282,11 @@ int thread__set_comm_from_proc(struct thread *thread) - if (!(snprintf(path, sizeof(path), "%d/task/%d/comm", - thread->pid_, thread->tid) >= (int)sizeof(path)) && - procfs__read_str(path, &comm, &sz) == 0) { -+ /* sz==0: read got nothing, e.g. race during exit teardown */ -+ if (sz == 0) { -+ free(comm); -+ return -1; -+ } - comm[sz - 1] = '\0'; - err = thread__set_comm(thread, comm, 0); - } --- -2.53.0 - diff --git a/queue-5.10/perf-tools-use-perf_env__get_cpu_topology-in-machine.patch b/queue-5.10/perf-tools-use-perf_env__get_cpu_topology-in-machine.patch deleted file mode 100644 index fe23a5c08b..0000000000 --- a/queue-5.10/perf-tools-use-perf_env__get_cpu_topology-in-machine.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 2a3a39baa76bf0293ba4ae047cd03e38bf4307f8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 6 Jun 2026 20:57:49 -0300 -Subject: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 5484b43a0ec8231c36fba6ead654cb72dbba8b8f ] - -machine__resolve() accesses env->cpu[al->cpu].socket_id after checking -al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu -against env->nr_cpus_avail. Since al->cpu comes from the untrusted -perf.data sample, a crafted file with a large CPU index causes an -out-of-bounds heap read. - -Use perf_env__get_cpu_topology() which validates both NULL and bounds. -Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): -without this, values like 65536 silently truncate to 0, bypassing the -accessor's internal check and returning CPU 0's topology. - -Fixes: 0c4c4debb0adda4c ("perf tools: Add processor socket info to hist_entry and addr_location") -Reported-by: sashiko-bot -Reviewed-by: Ian Rogers -Cc: Kan Liang -Cc: Ian Rogers -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/event.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c -index 7e440fa90c9383..50de291e528518 100644 ---- a/tools/perf/util/event.c -+++ b/tools/perf/util/event.c -@@ -12,6 +12,7 @@ - #include - #include "cpumap.h" - #include "dso.h" -+#include "env.h" - #include "event.h" - #include "debug.h" - #include "hist.h" -@@ -656,8 +657,18 @@ int machine__resolve(struct machine *machine, struct addr_location *al, - if (al->cpu >= 0) { - struct perf_env *env = machine->env; - -- if (env && env->cpu) -- al->socket = env->cpu[al->cpu].socket_id; -+ /* -+ * Bounds-check al->cpu (s32) before casting to struct perf_cpu -+ * (int16_t): without this, e.g. 65536 truncates to 0 and silently -+ * returns CPU 0's topology. Can go once perf_cpu.cpu is widened. -+ */ -+ if (env && al->cpu < env->nr_cpus_avail) { -+ struct cpu_topology_map *topo; -+ -+ topo = perf_env__get_cpu_topology(env, (struct perf_cpu){ al->cpu }); -+ if (topo) -+ al->socket = topo->socket_id; -+ } - } - - if (al->map) { --- -2.53.0 - diff --git a/queue-5.10/perf-tools-use-snprintf-for-root_dir-path-constructi.patch b/queue-5.10/perf-tools-use-snprintf-for-root_dir-path-constructi.patch deleted file mode 100644 index ae3070b144..0000000000 --- a/queue-5.10/perf-tools-use-snprintf-for-root_dir-path-constructi.patch +++ /dev/null @@ -1,58 +0,0 @@ -From bd4341d17d259a563f1c018d6f4282c35c60b6f6 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 10 Jun 2026 20:34:38 -0300 -Subject: perf tools: Use snprintf() for root_dir path construction - -From: Arnaldo Carvalho de Melo - -[ Upstream commit 7b0df6f4d498b1608afccfd6dffb264e6da91693 ] - -get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in -symbol.c use sprintf() to construct paths by prepending root_dir to -"/proc/version" and "/proc/kallsyms" respectively. Both write into -PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM -configuration and is not length-checked. A root_dir at or near -PATH_MAX causes a stack buffer overflow. - -Switch to snprintf() with sizeof(path) to prevent overflow. - -Reported-by: sashiko-bot -Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") -Cc: Zhang Yanmin -Assisted-by: Claude:claude-opus-4.6 -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Sasha Levin ---- - tools/perf/util/machine.c | 2 +- - tools/perf/util/symbol.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c -index eec926c313b131..53adfad15be455 100644 ---- a/tools/perf/util/machine.c -+++ b/tools/perf/util/machine.c -@@ -1309,7 +1309,7 @@ static char *get_kernel_version(const char *root_dir) - char *name, *tmp; - const char *prefix = "Linux version "; - -- sprintf(version, "%s/proc/version", root_dir); -+ snprintf(version, sizeof(version), "%s/proc/version", root_dir); - file = fopen(version, "r"); - if (!file) - return NULL; -diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c -index 40e2362096d8c6..bc59d217f79233 100644 ---- a/tools/perf/util/symbol.c -+++ b/tools/perf/util/symbol.c -@@ -2287,7 +2287,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map) - if (!kallsyms_filename) - return -1; - } else { -- sprintf(path, "%s/proc/kallsyms", machine->root_dir); -+ snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir); - kallsyms_filename = path; - } - --- -2.53.0 - diff --git a/queue-5.10/perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch b/queue-5.10/perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch deleted file mode 100644 index b16d05ce5c..0000000000 --- a/queue-5.10/perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 7ee7f48413c42b90230de4a8e40898b757bc8e82 Mon Sep 17 00:00:00 2001 -From: Florian Fainelli -Date: Wed, 13 May 2026 12:23:46 -0700 -Subject: perf trace beauty fcntl: Fix build with older kernel headers - -From: Florian Fainelli - -commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream. - -Toolchains with older kernel headers that do not include upstream commit -c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write -life time hints") will now fail to build perf due to missing definitions -for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT. - -Provide a fallback definition for these when they are not already -defined. - -Fixes: 9c47f66748381ecb ("perf trace beauty fcntl: Basic 'arg' beautifier") -Reviewed-by: Ian Rogers -Signed-off-by: Florian Fainelli -Cc: Adrian Hunter -Cc: Alexander Shishkin -Cc: Ingo Molnar -Cc: James Clark -Cc: Jiri Olsa -Cc: Mark Rutland -Cc: Markus Mayer -Cc: Namhyung Kim -Cc: Peter Zijlstra -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Greg Kroah-Hartman ---- - tools/perf/trace/beauty/fcntl.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - ---- a/tools/perf/trace/beauty/fcntl.c -+++ b/tools/perf/trace/beauty/fcntl.c -@@ -9,6 +9,22 @@ - #include - #include - -+#ifndef F_GET_RW_HINT -+#define F_GET_RW_HINT (F_LINUX_SPECIFIC_BASE + 11) -+#endif -+ -+#ifndef F_SET_RW_HINT -+#define F_SET_RW_HINT (F_LINUX_SPECIFIC_BASE + 12) -+#endif -+ -+#ifndef F_GET_FILE_RW_HINT -+#define F_GET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 13) -+#endif -+ -+#ifndef F_SET_FILE_RW_HINT -+#define F_SET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 14) -+#endif -+ - static size_t fcntl__scnprintf_getfd(unsigned long val, char *bf, size_t size, bool show_prefix) - { - return val ? scnprintf(bf, size, "%s", "0") : diff --git a/queue-5.10/perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch b/queue-5.10/perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch similarity index 77% rename from queue-5.10/perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch rename to queue-5.10/perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch index a85f942f66..9a14f38d5f 100644 --- a/queue-5.10/perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch +++ b/queue-5.10/perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch @@ -1,11 +1,11 @@ -From 49ed624d40848793c2cb945b4672efc20268e19a Mon Sep 17 00:00:00 2001 -From: Sasha Levin +From 73a4c02f94a98d94480c3e5c81450215a4da05ba Mon Sep 17 00:00:00 2001 +From: Sandipan Das Date: Mon, 1 Jun 2026 20:28:46 +0530 Subject: perf/x86/amd/core: Always use the NMI latency mitigation From: Sandipan Das -[ Upstream commit 73a4c02f94a98d94480c3e5c81450215a4da05ba ] +commit 73a4c02f94a98d94480c3e5c81450215a4da05ba upstream. Commit df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp") fixed handling of late-arriving NMIs but limited @@ -20,16 +20,14 @@ Fixes: df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation to use a t Signed-off-by: Sandipan Das Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/29a3c970da289ab8f24282933bdb36545c0403e8.1780325517.git.sandipan.das@amd.com -Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman --- - arch/x86/events/amd/core.c | 6 +++--- + arch/x86/events/amd/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c -index afc955340f81c4..1698cb2e8c0a34 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c -@@ -943,12 +943,12 @@ static int __init amd_core_pmu_init(void) +@@ -943,12 +943,12 @@ static int __init amd_core_pmu_init(void u64 even_ctr_mask = 0ULL; int i; @@ -45,6 +43,3 @@ index afc955340f81c4..1698cb2e8c0a34 100644 /* * If core performance counter extensions exists, we must use * MSR_F15H_PERF_CTL/MSR_F15H_PERF_CTR msrs. See also --- -2.53.0 - diff --git a/queue-5.10/series b/queue-5.10/series index 1be44b1724..409191fdde 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -7,7 +7,6 @@ nfsd-move-name-lookup-out-of-nfsd4_list_rec_dir.patch nfsd-change-nfs4_client_to_reclaim-to-allocate-data.patch mmc-renesas_sdhi-add-quirk-entry-for-rz-g2h-soc.patch kvm-replace-guest-triggerable-bug_on-in-ioeventfd-da.patch -perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch skmsg-convert-struct-sk_msg_sg-copy-to-a-bitmap.patch @@ -223,7 +222,6 @@ scsi-pm8001-fix-error-code-in-non_fatal_log_show.patch mm-fake-numa-fix-under-allocation-detection-in-unifo.patch lib-test_meminit-use-for-bools.patch bpftool-use-libbpf-error-code-for-flow-dissector-que.patch -perf-x86-amd-core-always-use-the-nmi-latency-mitigat.patch ocfs2-rebase-copied-fsdlm-lvb-pointers-in-locking_st.patch ocfs2-fix-buffer-head-management-in-ocfs2_read_block.patch ocfs2-reject-fitrim-ranges-shorter-than-a-cluster.patch @@ -281,7 +279,6 @@ staging-nvec-fix-use-after-free-in-nvec_rx_completed.patch coresight-cti-fix-dt-filter-signals-silently-ignored.patch x86-platform-olpc-xo15-drop-wakeup-source-on-driver-.patch platform-x86-xo15-ebook-fix-wakeup-source-and-gpe-ha.patch -perf-sched-add-missing-mmap2-handler-in-timehist.patch staging-most-video-avoid-double-free-on-video-regist.patch usb-host-max3421-fix-shift-out-of-bounds-in-max3421_.patch usb-host-max3421-reject-hub-port-requests-for-non-ex.patch @@ -291,11 +288,6 @@ iio-light-si1133-prevent-race-condition-on-timeout.patch iio-magnetometer-ak8975-fix-potential-kernel-stack-m.patch iio-accel-mma8452-handle-i2c-read-error-s-in-mma8452.patch hid-logitech-hidpp-remove-excess-kernel-doc-member-i.patch -perf-fix-off-by-one-stack-buffer-overflow-in-kallsym.patch -perf-sched-clean-up-idle_threads-entry-on-init-failu.patch -perf-sched-replace-bug_on-and-add-null-checks-in-rep.patch -perf-mmap-fix-null-deref-in-aio-cleanup-on-alloc-fai.patch -perf-c2c-fix-use-after-free-in-he__get_c2c_hists-err.patch dmaengine-fix-possible-use-after-free.patch clk-qcom-a53-corrected-frequency-multiplier-for-1152.patch pnfs-filelayout-fix-cheking-if-a-layout-is-striped.patch @@ -303,23 +295,10 @@ nfsv4-pnfs-defer-return_range-callbacks-until-after-.patch nfsv4-flexfiles-honor-ff_flags_no_io_thru_mds-on-fat.patch nfsv4-flexfiles-honor-ff_flags_no_io_thru_mds-in-pg_.patch pci-mediatek-fix-operator-precedence-in-pcie_fts_num.patch -perf-tools-fix-get_max_num-size_t-underflow-on-empty.patch -perf-tools-use-perf_env__get_cpu_topology-in-machine.patch pci-rcar-host-remove-unused-list_head-res.patch -perf-sched-fix-idle-hist-callchain-display-using-wro.patch -perf-bpf-use-scnprintf-in-snprintf_hex-and-synthesiz.patch -perf-hists-fix-snprintf-in-hists__scnprintf_title-ui.patch -perf-pmu-fix-perf_pmu__parse_scale-unit-oob-access-o.patch tools-lib-api-fix-missing-null-termination-in-filena.patch -perf-symbols-fix-signed-overflow-in-sysfs__read_buil.patch -perf-symbols-bounds-check-.gnu_debuglink-section-dat.patch -perf-tools-fix-thread__set_comm_from_proc-on-empty-c.patch -perf-symbols-bounds-check-descsz-in-sysfs__read_buil.patch tools-lib-api-fix-filename__write_int-writing-uninit.patch tools-lib-api-fix-mount_overload-snprintf-truncation.patch -perf-bpf-add-null-check-for-btf__type_by_id-in-synth.patch -perf-symbols-add-bounds-checks-to-elf_read_build_id-.patch -perf-symbols-add-bounds-checks-to-read_build_id-note.patch pci-mediatek-fix-possible-truncation-in-mtk_pcie_par.patch pci-mediatek-use-actual-physical-address-instead-of-.patch apparmor-check-label-build-before-no_new_privs-test.patch @@ -331,11 +310,7 @@ apparmor-put-secmark-label-after-secid-lookup.patch i3c-master-prevent-reuse-of-dynamic-address-on-devic.patch apparmor-fix-label-can-not-be-immediately-before-a-d.patch sparc-led-avoid-trimming-a-newline-from-empty-writes.patch -perf-symbols-break-infinite-loop-on-zero-filled-note.patch -perf-tools-use-snprintf-for-root_dir-path-constructi.patch -perf-bpf-validate-func_info_rec_size-and-sub_id-in-s.patch xfrm-validate-selector-family-and-prefixlen-during-m.patch -perf-machine-use-snprintf-for-guestmount-path-constr.patch octeontx2-pf-fix-leak-of-sq-timestamp-buffer-on-tear.patch net-psample-fix-info-leak-in-psample_attr_data.patch sctp-hold-socket-lock-when-dumping-endpoints-in-sctp.patch @@ -697,3 +672,4 @@ net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch +perf-x86-amd-core-always-use-the-nmi-latency-mitigation.patch