kernel/linux.git/arch/um, branch v6.12.107

um: vector: fix use-after-free in vector_mmsg_rx()

2026-08-09T18:23:15+00:00

commit af421e9aed3920c7ac88c24daa48606c7112feca upstream. When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication. Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman

um: Preserve errno within signal handler

2026-08-09T18:23:00+00:00

commit f68b2d5a907b53eed99cf2efcaaae116df73c298 upstream. We rely on errno to determine whether a syscall has failed, so we need to ensure that accessing errno is async-signal-safe. Currently, we preserve the errno in sig_handler_common(), but it doesn't cover every possible case. Let's do it in hard_handler() instead, which is the signal handler we actually register. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg [florian: hard_handler() in 6.12 retains the to_irq_stack/from_irq_stack loop from before the upstream SMP refactoring; errno save/restore is wrapped around that loop rather than replacing sig_handler_common's existing save/restore] Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

um: Set parent death signal for userspace process

2026-08-09T18:23:00+00:00

commit 801e00d3a1b78b7f71675fae79946ff4aa3ee070 upstream. Enable PR_SET_PDEATHSIG so that the UML userspace process will be killed when the kernel exits unexpectedly. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20240919124511.282088-4-benjamin@sipsolutions.net Signed-off-by: Johannes Berg [florian: upstream applies os_set_pdeathsig() in stub_exe.c, a file introduced in v6.13 that does not exist in 6.12; applied instead to userspace_tramp() in arch/um/os-Linux/skas/process.c, which is the equivalent entry-point for the userspace process in 6.12] Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

um: Set parent-death signal for write_sigio thread/process

2026-08-09T18:23:00+00:00

commit c6c4adee65969218b0b7b13f568fd2c6f2333373 upstream. The write_sigio thread is not really a traditional thread. Set the parent-death signal for it to ensure that it will be killed if the UML kernel dies unexpectedly without proper cleanup. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20241024142828.2612828-4-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

um: Set parent-death signal for ubd io thread/process

2026-08-09T18:23:00+00:00

commit 9b5e6c0f5a9199c69af81ac5bedc512ee7dc20b3 upstream. The ubd io thread is not really a traditional thread. Set the parent-death signal for it to ensure that it will be killed if the UML kernel dies unexpectedly without proper cleanup. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20241024142828.2612828-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

um: Use os_set_pdeathsig helper in winch thread/process

2026-08-09T18:23:00+00:00

commit 42b8b00c8ab1ac18fccde3f29ee589626a561ea7 upstream. Since we have a helper now, let's switch to using it. It will make the code slightly more consistent. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20241024142828.2612828-5-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

um: Set parent death signal for winch thread/process

2026-08-09T18:22:59+00:00

commit fdb2ecd35d327a1fc6bba69b97f85b494e1f4b6b upstream. The winch "thread" is really a separate process. Using prctl to set PR_SET_PDEATHSIG ensures that this separate thread will be killed if the UML kernel itself dies unexpectedly and does not perform proper cleanup. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20240919124511.282088-5-benjamin@sipsolutions.net Signed-off-by: Johannes Berg Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

um: Add os_set_pdeathsig helper function

2026-08-09T18:22:59+00:00

commit 4e5adbe447db382cc76e05613581f96aef4f91d2 upstream. This helper can be used to set the parent-death signal of the calling process to SIGKILL to ensure that the process will be killed if the UML kernel dies unexpectedly without proper cleanup. This helper will be used in the follow-up patches. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20241024142828.2612828-2-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-09T10:26:03+00:00

[ Upstream commit a494d3c8d5392bcdff83c2a593df0c160ff9f322 ] On real hardware, panic and machine reboot may not flush hardware cache to memory. This means the persistent ring buffer, which relies on a coherent state of memory, may not have its events written to the buffer and they may be lost. Moreover, there may be inconsistency with the counters which are used for validation of the integrity of the persistent ring buffer which may cause all data to be discarded. To avoid this issue, stop recording of the ring buffer on panic and flush the cache of the ring buffer's memory. Fixes: e645535a954a ("tracing: Add option to use memmapped memory for trace boot instance") Cc: stable@vger.kernel.org Cc: Will Deacon Cc: Mathieu Desnoyers Cc: Ian Rogers Link: https://patch.msgid.link/177751969602.2136606.12031934362587643488.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Acked-by: Catalin Marinas Acked-by: Geert Uytterhoeven Signed-off-by: Steven Rostedt Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

um: drivers: call kernel_strrchr() explicitly in cow_user.c

2026-05-07T04:09:26+00:00

commit 91e901c65b4da02a6fd543e3f0049829ae9645b7 upstream. Building ARCH=um on glibc >= 2.43 fails: arch/um/drivers/cow_user.c: error: implicit declaration of function 'strrchr' [-Wimplicit-function-declaration] glibc 2.43's C23 const-preserving strrchr() macro does not survive UML's global -Dstrrchr=kernel_strrchr remap from arch/um/Makefile. Call kernel_strrchr() directly in cow_user.c so the source no longer depends on the -D rewrite. Fixes: 2c51a4bc0233 ("um: fix strrchr() problems") Suggested-by: Johannes Berg Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260408070102.2325572-1-michael.bommarito@gmail.com [remove unnecessary 'extern'] Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman