fs/iomap/buffered-io.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
Hi Miklos and Joanne,
I am reporting two latent data-integrity defects in the FUSE iomap
read integration introduced in Linux 7.2. Both defects are unreachable
in stock 7.2.2 today, but activate the moment partially-uptodate
folios exist in FUSE — which is precisely what the announced "fuse:
support large folios" series (Joanne) and any sub-page-blocksize
invalidation semantics will create. I'm reporting now, before that
series merges, so the fixes can land alongside or before the
enablement.
Full report, suggested fixes patch, PoC source, and runtime evidence
logs are attached as plain text files.
Summary:
The 7.2 series "fuse: use iomap for buffered reads + readahead"
introduced, for the first time, FUSE read paths where a folio read can
be a sub-range of that folio (desc.offset > 0 and/or desc.length <
folio_size). Two legacy helpers were not adapted:
Defect A — fuse_copy_folio() whole-folio zeroing (fs/fuse/dev.c):
When zeroing is set and count < folio_size, the function calls
folio_zero_range(folio, 0, size) — zeroing the ENTIRE folio before
copying the reply at [offset, offset+count). With sub-folio read
ranges this destroys valid, cached, uptodate data located before the
requested range in the same folio. Demonstrated end-to-end: 1024 bytes
of valid cached data silently replaced by zeros.
Suggested fix (one line):
- folio_zero_range(folio, 0, size);
+ folio_zero_range(folio, offset, size - offset);
Defect B — fuse_send_readpages() ignores descs[0].offset (fs/fuse/file.c):
The readahead sender computes the FUSE_READ request start as
folio_pos(ap->folios[0]), ignoring ap->descs[0].offset. If the first
folio of a batch is prefix-partial, the kernel asks the server for
data beginning at the folio start instead of the first invalid block.
The reply is copied at the wrong position — every byte of the batch is
silently shifted. Both sibling paths handle this correctly:
- writeback: folio_pos(folio) + offset (fuse_writepage_args_setup)
- sync read: folio_pos(folio) + off (fuse_do_readfolio)
The readahead path is the odd one out.
Suggested fix (one line):
- loff_t pos = folio_pos(ap->folios[0]);
+ loff_t pos = folio_pos(ap->folios[0]) + ap->descs[0].offset;
Reachability today (why latent):
Stock 7.2.2 cannot construct a partially-uptodate folio in FUSE —
order-0 folios only, no code path clears per-block uptodate bits, and
the VFS readahead core only hands freshly-allocated fully-non-uptodate
folios to ->readahead(). Both defects activate exactly when the
large-folio series lands or any sub-page invalidation semantics are
introduced.
Runtime verification:
Full reproduction in a User-Mode-Linux build of unmodified Linux 7.2.2
(KASAN enabled) with a raw /dev/fuse server:
- Pristine control run (poc-run16-pristine.log): all 16384 bytes
correct — confirms defects are latent in stock 7.2.2
- Precondition demonstration run (poc-run15-precondition.log): with a
minimal 19-line patch that drops per-block uptodate bits on
invalidation (the semantics the large-folio series requires), Defect A
reproduces: 1024 of 16384 bytes silently corrupted, first mismatch at
file offset 0x1000
- No KASAN splat — this is a logic/data-integrity bug, not memory unsafety
Connection to the writeback fix:
This is the read-side analogue of commit c3880a7b10e4 ("fuse: fix
writeback array overflow when max_pages is one", 7.1), which hardened
the writeback path after the same class of sub-folio desc issue was
found there. The read path has two equivalent unadapted sites
remaining.
Attached plain text files:
1) VENDOR-REPORT-fuse-7.2.2.md — full write-up with root cause,
reachability analysis, runtime evidence, audit scope
2) 0001-suggested-fixes.patch — two one-line fixes plus optional
capacity-guard hardening
3) 0000-demo-precondition-uptodate-invalidation.patch — minimal
19-line precondition patch used to demonstrate Defect A
4) fusepoc.c — raw /dev/fuse server + fuseblk mounter + trigger
5) init.c — minimal UML guest init
6) poc-run16-pristine.log — pristine 7.2.2 control run
7) poc-run15-precondition.log — precondition demonstration run (Defect
A reproduced)
8) poc-run13.log — intermediate instrumentation run
9) build-fuse.log — kernel build log
10) config-um-fuse — UML kernel config used
11) run-instructions.txt — end-to-end reproduction steps
I would suggest fixing both sites before or together with the
large-folio enablement to avoid the fixes needing to chase the feature
into stable series after the fact — the same pattern that produced
c3880a7b10e4 on the writeback side.
One additional request: once the large-folio series merges into
mainline and these defects become reachable, could you let me know? At
that point I would like to request a CVE for both defects through the
appropriate channel, referencing the prior disclosure date and the fix
commits. If the fixes land before or with the large-folio series that
would be the cleaner outcome for everyone.
Happy to answer any questions or provide additional detail.
Best regards,
Kanishka De Silva (HEXER / H3X4R)
Independent Security Researcher — HEXERLAB
kpskanna1915@gmail.com
hexer.is-a.dev
GitHub: hexer365
// fusepoc.c — PoC for Linux 7.2.2 FUSE readahead wrong-offset defect
// (fuse_send_readpages() ignores ap->descs[0].offset; live for sub-page
// blocksize fuseblk mounts once partially-uptodate folios exist —
// demonstrated via a minimal precondition patch mirroring the announced
// FUSE large-folio support)
//
// One binary, two roles (fork model, like fusermount):
// child = raw /dev/fuse protocol server (no libfuse), serves one file
// "target": each 16-byte record at offset R contains 16-char hex
// of R; punched ranges are zeros (hole semantics)
// parent = sets up a loop device, mounts it as fuseblk (blksize=512 or
// 4096) with the inherited /dev/fuse fd, then runs the trigger:
// T1: read whole file (all folios cached uptodate)
// T2: punch [0,4096) -> folio 0 fully dropped
// punch [5120,8192) -> folio 1 becomes prefix-partial
// (blocks 0..1 uptodate, 2..7 not,
// with sub-page uptodate tracking)
// T3: pread(0,16384) -> readahead fires (folio 0 missing)
// correct kernel: FUSE_READ(5120, 12288) [plus 4096 read]
// buggy kernel: FUSE_READ(4096, 12288) <- 1024 too low
// T4: byte-exact verification against expected content
//
// Build: gcc -static -O2 -o fusepoc fusepoc.c
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <stdint.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <signal.h>
#include <sys/mount.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/statvfs.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <linux/loop.h>
/* ---------------- FUSE protocol (uapi/linux/fuse.h, v7.2) ---------------- */
struct fuse_in_header {
uint32_t len, opcode;
uint64_t unique, nodeid;
uint32_t uid, gid, pid;
uint16_t total_extlen, padding;
};
struct fuse_out_header { uint32_t len; int32_t error; uint64_t unique; };
enum {
FUSE_LOOKUP = 1, FUSE_FORGET = 2, FUSE_GETATTR = 3, FUSE_SETATTR = 4,
FUSE_OPEN = 14, FUSE_READ = 15, FUSE_STATFS = 17, FUSE_RELEASE = 18,
FUSE_FLUSH = 25, FUSE_INIT = 26, FUSE_DESTROY = 38, FUSE_FALLOCATE = 43,
};
struct fuse_attr {
uint64_t ino, size, blocks, atime, mtime, ctime;
uint32_t atimensec, mtimensec, ctimensec, mode, nlink, uid, gid, rdev, blksize, flags;
};
struct fuse_attr_out { uint64_t attr_valid; uint32_t attr_valid_nsec, dummy; struct fuse_attr attr; };
struct fuse_entry_out {
uint64_t nodeid, generation, entry_valid, attr_valid;
uint32_t entry_valid_nsec, attr_valid_nsec;
struct fuse_attr attr;
};
struct fuse_forget_in { uint64_t nlookup; };
struct fuse_init_in { uint32_t major, minor, max_readahead, flags, flags2, unused[11]; };
struct fuse_init_out {
uint32_t major, minor, max_readahead, flags;
uint16_t max_background, congestion_threshold;
uint32_t max_write, time_gran;
uint16_t max_pages, map_alignment;
uint32_t flags2, max_stack_depth;
uint16_t request_timeout, unused[11];
};
struct fuse_open_in { uint32_t flags, open_flags; };
struct fuse_open_out { uint64_t fh; uint32_t open_flags; int32_t backing_id; };
struct fuse_read_in { uint64_t fh, offset; uint32_t size, read_flags; uint64_t lock_owner; uint32_t flags, padding; };
struct fuse_setattr_in {
uint32_t valid, padding; uint64_t fh, size, lock_owner, atime, mtime, ctime;
uint32_t atimensec, mtimensec, ctimensec, mode, unused4, uid, gid, unused5;
};
struct fuse_fallocate_in { uint64_t fh, offset, length; uint32_t mode, padding; };
#define FUSE_KERNEL_VERSION 7
#define FUSE_ASYNC_READ (1 << 0)
#define FUSE_BIG_WRITES (1 << 5)
#define FUSE_MAX_PAGES (1 << 22)
#define FATTR_SIZE (1 << 3)
#define FOPEN_KEEP_CACHE (1 << 1)
/* ---------------- server ---------------- */
#define TGT_NODEID 2
static uint64_t g_size = 16384;
static int g_srv_fd;
static FILE *g_log;
static const char *g_tag;
/* server-side file state: up to 8 punch ranges zeroed (hole semantics) */
#define MAX_PZ 8
static struct { uint64_t s, e; } g_pz[MAX_PZ];
static int g_npz;
static void pz_add(uint64_t s, uint64_t e)
{
for (int k = 0; k < g_npz; k++) { /* merge/extend */
if (s <= g_pz[k].e && e >= g_pz[k].s) {
if (s < g_pz[k].s) g_pz[k].s = s;
if (e > g_pz[k].e) g_pz[k].e = e;
return;
}
}
if (g_npz < MAX_PZ) { g_pz[g_npz].s = s; g_pz[g_npz].e = e; g_npz++; }
}
static int pz_is_zero(uint64_t f)
{
for (int k = 0; k < g_npz; k++)
if (f >= g_pz[k].s && f < g_pz[k].e) return 1;
return 0;
}
/* pattern: each 16-byte aligned record holds 16-char hex of its own offset;
* punched ranges read back as zeros (hole semantics) */
static void pattern_fill(char *buf, uint64_t off, uint32_t len)
{
for (uint32_t i = 0; i < len; i++) {
uint64_t f = off + i;
if (pz_is_zero(f)) {
buf[i] = 0;
continue;
}
uint64_t rec = f & ~15ULL;
if ((f & 15) == 0 && i + 16 <= len) {
snprintf(buf + i, 17, "%016llx", (unsigned long long)rec);
i += 15;
continue;
}
buf[i] = '.';
}
}
static void slog(const char *fmt, ...)
{
va_list ap;
fprintf(g_log, "[%s] ", g_tag);
va_start(ap, fmt);
vfprintf(g_log, fmt, ap);
va_end(ap);
fputc('\n', g_log);
fflush(g_log);
}
static void reply(const void *hdr_plus, uint32_t total_len)
{
if (write(g_srv_fd, hdr_plus, total_len) != (ssize_t)total_len) {
slog("write reply failed: %s", strerror(errno));
exit(1);
}
}
/* @err is the final (negative) errno, or 0 for success */
static void reply_err(uint64_t unique, int err)
{
struct { struct fuse_out_header h; } r;
memset(&r, 0, sizeof(r));
r.h.len = sizeof(r); r.h.error = err; r.h.unique = unique;
reply(&r, sizeof(r));
}
static void fill_attr(struct fuse_attr *a)
{
memset(a, 0, sizeof(*a));
a->ino = TGT_NODEID;
a->size = g_size;
a->blocks = (g_size + 511) / 512;
a->atime = a->mtime = a->ctime = 1000000;
a->mode = 0100644;
a->nlink = 1;
a->blksize = 512;
}
struct read_reply {
struct fuse_out_header h;
char data[1 << 20];
};
static void server_loop(void)
{
static char inbuf[1 << 20];
static char outbuf[1 << 20];
for (;;) {
ssize_t n = read(g_srv_fd, inbuf, sizeof(inbuf));
if (n < 0) {
if (errno == EINTR) continue;
if (errno == EPERM) {
/* 7.2: read before mount returns EPERM unless
* sync_init — retry until the mount happens */
usleep(10000);
continue;
}
slog("server read err %s", strerror(errno));
exit(1);
}
if (n == 0) { slog("server: EOF (device closed)"); exit(0); }
struct fuse_in_header *ih = (struct fuse_in_header *)inbuf;
if ((size_t)n < sizeof(*ih)) continue;
switch (ih->opcode) {
case FUSE_INIT: {
struct fuse_init_in *ia = (struct fuse_init_in *)(inbuf + sizeof(*ih));
struct { struct fuse_out_header h; struct fuse_init_out o; } r;
memset(&r, 0, sizeof(r));
r.h.len = sizeof(r); r.h.error = 0; r.h.unique = ih->unique;
r.o.major = FUSE_KERNEL_VERSION;
r.o.minor = ia->minor;
r.o.max_readahead = 131072;
r.o.flags = FUSE_ASYNC_READ | FUSE_BIG_WRITES | FUSE_MAX_PAGES;
r.o.max_background = 16;
r.o.congestion_threshold = 12;
r.o.max_write = 131072;
r.o.max_pages = 256;
slog("REQ INIT minor=%u flags=%#x", ia->minor, ia->flags);
reply(&r, sizeof(r));
break;
}
case FUSE_LOOKUP: {
const char *name = inbuf + sizeof(*ih);
slog("REQ LOOKUP nodeid=%llu name=\"%s\"",
(unsigned long long)ih->nodeid, name);
if (ih->nodeid == 1 && strcmp(name, "target") == 0) {
struct { struct fuse_out_header h; struct fuse_entry_out e; } r;
memset(&r, 0, sizeof(r));
r.h.len = sizeof(r); r.h.unique = ih->unique;
r.e.nodeid = TGT_NODEID;
r.e.generation = 1;
r.e.entry_valid = 1; r.e.attr_valid = 1;
fill_attr(&r.e.attr);
reply(&r, sizeof(r));
} else {
reply_err(ih->unique, -ENOENT);
}
break;
}
case FUSE_GETATTR: {
slog("REQ GETATTR nodeid=%llu", (unsigned long long)ih->nodeid);
struct { struct fuse_out_header h; struct fuse_attr_out o; } r;
memset(&r, 0, sizeof(r));
r.h.len = sizeof(r); r.h.unique = ih->unique;
r.o.attr_valid = 1;
fill_attr(&r.o.attr);
reply(&r, sizeof(r));
break;
}
case FUSE_SETATTR: {
struct fuse_setattr_in *sa = (struct fuse_setattr_in *)(inbuf + sizeof(*ih));
if (sa->valid & FATTR_SIZE && ih->nodeid == TGT_NODEID) {
g_size = sa->size;
slog("REQ SETATTR nodeid=%llu -> size=%llu",
(unsigned long long)ih->nodeid,
(unsigned long long)g_size);
} else {
slog("REQ SETATTR nodeid=%llu valid=%#x",
(unsigned long long)ih->nodeid, sa->valid);
}
struct { struct fuse_out_header h; struct fuse_attr_out o; } r;
memset(&r, 0, sizeof(r));
r.h.len = sizeof(r); r.h.unique = ih->unique;
r.o.attr_valid = 1;
fill_attr(&r.o.attr);
reply(&r, sizeof(r));
break;
}
case FUSE_OPEN: {
slog("REQ OPEN nodeid=%llu", (unsigned long long)ih->nodeid);
struct { struct fuse_out_header h; struct fuse_open_out o; } r;
memset(&r, 0, sizeof(r));
r.h.len = sizeof(r); r.h.unique = ih->unique;
r.o.fh = 1;
r.o.open_flags = FOPEN_KEEP_CACHE;
reply(&r, sizeof(r));
break;
}
case FUSE_READ: {
struct fuse_read_in *ri = (struct fuse_read_in *)(inbuf + sizeof(*ih));
slog("REQ READ nodeid=%llu offset=%llu size=%u",
(unsigned long long)ih->nodeid,
(unsigned long long)ri->offset, ri->size);
uint64_t off = ri->offset;
uint32_t sz = ri->size;
if (off >= g_size) sz = 0;
else if (off + sz > g_size) sz = (uint32_t)(g_size - off);
struct read_reply *r = (struct read_reply *)outbuf;
r->h.len = sizeof(struct fuse_out_header) + sz;
r->h.error = 0;
r->h.unique = ih->unique;
pattern_fill(r->data, off, sz);
reply(r, r->h.len);
break;
}
case FUSE_FALLOCATE: {
struct fuse_fallocate_in *fa = (struct fuse_fallocate_in *)(inbuf + sizeof(*ih));
slog("REQ FALLOCATE nodeid=%llu offset=%llu length=%llu mode=%#x",
(unsigned long long)ih->nodeid,
(unsigned long long)fa->offset,
(unsigned long long)fa->length, fa->mode);
if (ih->nodeid == TGT_NODEID && (fa->mode & 0x2 /*PUNCH_HOLE*/))
pz_add(fa->offset, fa->offset + fa->length);
reply_err(ih->unique, 0);
break;
}
case FUSE_FLUSH: {
slog("REQ FLUSH nodeid=%llu", (unsigned long long)ih->nodeid);
reply_err(ih->unique, 0);
break;
}
case FUSE_RELEASE: {
slog("REQ RELEASE nodeid=%llu", (unsigned long long)ih->nodeid);
reply_err(ih->unique, 0);
break;
}
case FUSE_FORGET: {
struct fuse_forget_in *fi = (struct fuse_forget_in *)(inbuf + sizeof(*ih));
slog("REQ FORGET nodeid=%llu n=%llu (no reply)",
(unsigned long long)ih->nodeid,
(unsigned long long)fi->nlookup);
break; /* no reply */
}
case FUSE_DESTROY: {
slog("REQ DESTROY");
reply_err(ih->unique, 0);
break;
}
default:
slog("REQ opcode=%u nodeid=%llu -> ENOSYS",
ih->opcode, (unsigned long long)ih->nodeid);
reply_err(ih->unique, -ENOSYS);
break;
}
}
}
/* ---------------- mounter + trigger ---------------- */
/* the two punch ranges used by the trigger (also enforced server-side) */
#define PZ1_S 0ULL
#define PZ1_E 4096ULL
#define PZ2_S 5120ULL
#define PZ2_E 8192ULL
/* client-side expected content: pattern with punched zeros */
static char expected_byte(uint64_t f)
{
if (pz_is_zero(f)) return 0;
if ((f & 15) == 0) return '0'; /* records are hex digits; enough for compare */
{
char hex[17];
snprintf(hex, sizeof(hex), "%016llx", (unsigned long long)(f & ~15ULL));
return hex[f & 15];
}
}
static int make_loop_dev(char *loop_path, size_t psz)
{
int ctl = open("/dev/loop-control", O_RDWR);
if (ctl >= 0) {
int idx = ioctl(ctl, LOOP_CTL_GET_FREE);
close(ctl);
if (idx >= 0) {
snprintf(loop_path, psz, "/dev/loop%d", idx);
return open(loop_path, O_RDWR);
}
}
for (int i = 0; i < 8; i++) {
snprintf(loop_path, psz, "/dev/loop%d", i);
int fd = open(loop_path, O_RDWR);
if (fd >= 0) return fd;
}
return -1;
}
static int run_test(const char *mnt, const char *blksize, const char *tag)
{
char loop_path[64];
int fusefd, loopfd, imgfd, status;
pid_t srv;
char mntdata[256];
char path[256];
static char buf[1 << 20];
printf("=============== TEST %s (blksize=%s) ===============\n", tag, blksize);
fusefd = open("/dev/fuse", O_RDWR);
if (fusefd < 0) { perror("open /dev/fuse"); return 1; }
g_srv_fd = fusefd;
g_tag = tag;
g_size = 16384;
g_npz = 0;
unlink("/tmp/disk.img");
imgfd = open("/tmp/disk.img", O_CREAT | O_RDWR, 0600);
if (imgfd < 0) { perror("create disk.img"); return 1; }
if (ftruncate(imgfd, 1 << 20) < 0) { perror("ftruncate img"); return 1; }
loopfd = make_loop_dev(loop_path, sizeof(loop_path));
if (loopfd < 0) { printf("FAIL: no loop device available\n"); return 1; }
if (ioctl(loopfd, LOOP_SET_FD, imgfd) < 0) {
perror("LOOP_SET_FD");
return 1;
}
printf("[MNT] loop device: %s\n", loop_path);
srv = fork();
if (srv == 0) {
char logpath[256];
snprintf(logpath, sizeof(logpath), "/tmp/server-%s.log", tag);
g_log = fopen(logpath, "w");
if (!g_log) g_log = stderr;
close(imgfd); close(loopfd);
server_loop();
_exit(0);
}
/* parent keeps fusefd open: mount data "fd=%d" is fget()ed in mounter */
usleep(200000);
snprintf(mntdata, sizeof(mntdata),
"fd=%d,rootmode=040755,user_id=0,group_id=0,blksize=%s",
fusefd, blksize);
if (mount(loop_path, mnt, "fuseblk", 0, mntdata) < 0) {
printf("FAIL: mount(fuseblk): %s\n", strerror(errno));
kill(srv, SIGKILL); waitpid(srv, &status, 0);
ioctl(loopfd, LOOP_CLR_FD, 0);
return 1;
}
printf("[MNT] mounted %s on %s (fd=%d, blksize=%s)\n",
loop_path, mnt, fusefd, blksize);
{
struct statvfs sv;
if (statvfs(mnt, &sv) == 0)
printf("[MNT] statvfs: f_bsize=%lu f_frsize=%lu\n",
(unsigned long)sv.f_bsize,
(unsigned long)sv.f_frsize);
}
snprintf(path, sizeof(path), "%s/target", mnt);
/* ---- T1: full read -> all folios cached uptodate ---- */
int fd = open(path, O_RDWR);
if (fd < 0) { printf("FAIL: open target: %s\n", strerror(errno)); goto out; }
ssize_t r = pread(fd, buf, 16384, 0);
printf("[T1 ] pread(0, 16384) = %zd (expected 16384)\n", r);
if (r != 16384) { printf("FAIL: short read in T1\n"); goto out; }
close(fd);
/* ---- T2: punch [0,4096) (drops folio 0) and [5120,8192)
* (makes folio 1 prefix-partial with sub-page uptodate tracking:
* blocks 0..1 = [4096,5120) stay uptodate,
* blocks 2..7 = [5120,8192) invalidated) ---- */
fd = open(path, O_RDWR);
if (fd < 0) { printf("FAIL: open for punch: %s\n", strerror(errno)); goto out; }
if (fallocate(fd, 0x02 /*PUNCH_HOLE*/ | 0x01 /*KEEP_SIZE*/, PZ1_S, PZ1_E - PZ1_S) < 0) {
printf("FAIL: fallocate#1: %s\n", strerror(errno));
goto out;
}
if (fallocate(fd, 0x02 /*PUNCH_HOLE*/ | 0x01 /*KEEP_SIZE*/, PZ2_S, PZ2_E - PZ2_S) < 0) {
printf("FAIL: fallocate#2: %s\n", strerror(errno));
goto out;
}
printf("[T2 ] fallocate(PUNCH [0,4096) + [5120,8192)) ok\n");
/* ---- T3: pread(0, 16384) ----
* folio 0 is missing -> generic readahead fires over [0,4) and the rac
* includes the prefix-partial folio 1. Correct request for the second
* readahead batch: FUSE_READ(5120, 12288).
* Defect: fuse_send_readpages() uses folio_pos(folios[0]) == 4096 and
* ignores descs[0].offset == 512 -> FUSE_READ(4096, 12288).
*/
r = pread(fd, buf, 16384, 0);
printf("[T3 ] pread(0, 16384) = %zd (expected 16384)\n", r);
if (r != 16384) { printf("FAIL: short read in T3\n"); goto out; }
/* ---- T4: byte-exact verification ---- */
{
/* mirror the server-side punch ranges in the client check */
g_npz = 0;
pz_add(PZ1_S, PZ1_E);
pz_add(PZ2_S, PZ2_E);
uint32_t bad = 0, first_bad = 0, i;
char got_rec[17] = {0}, want_rec[17] = {0};
for (i = 0; i < 16384; i++) {
char want = expected_byte(i);
if (buf[i] != want) {
if (bad == 0) {
first_bad = i;
memcpy(got_rec, buf + (i & ~15), 16);
memcpy(want_rec, buf + (i & ~15), 0);
{
char hex[17];
snprintf(hex, sizeof(hex), "%016llx",
(unsigned long long)(i & ~15ULL));
memcpy(want_rec, hex, 16);
}
}
bad++;
}
}
if (bad == 0) {
printf("[T4 ] VERIFY: all 16384 bytes CORRECT\n");
} else {
printf("[T4 ] VERIFY: DATA CORRUPT — %u of 16384 bytes wrong!\n", bad);
printf("[T4 ] first mismatch at file offset %#x\n", first_bad);
printf("[T4 ] got record \"%s\" (content of file offset %s)\n",
got_rec, got_rec);
printf("[T4 ] want record \"%s\"\n", want_rec);
printf("[T4 ] data is shifted: kernel copied data beginning at the "
"folio start instead of the partially-uptodate folio's "
"first invalid block\n");
}
}
close(fd);
out:
if (fusefd >= 0) close(fusefd);
if (umount2(mnt, MNT_FORCE) == 0) printf("[MNT] unmounted\n");
else printf("[MNT] umount: %s\n", strerror(errno));
usleep(300000);
kill(srv, SIGKILL);
waitpid(srv, &status, 0);
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd); close(imgfd);
{
char logpath[256];
snprintf(logpath, sizeof(logpath), "/tmp/server-%s.log", tag);
FILE *f = fopen(logpath, "r");
if (f) {
printf("---- server log (%s) ----\n", tag);
char line[512];
while (fgets(line, sizeof(line), f)) printf(" %s", line);
fclose(f);
}
}
printf("=============== END %s ===============\n\n", tag);
return 0;
}
int main(int argc, char **argv)
{
if (argc > 1 && strcmp(argv[1], "server") == 0) {
g_srv_fd = atoi(argv[2]);
g_tag = "srv";
g_log = stderr;
server_loop();
return 0;
}
mkdir("/mnt1", 0755);
mkdir("/mnt2", 0755);
/* MAIN: default fuseblk blksize (512) — sub-page blocksize regime */
run_test("/mnt1", "512", "bs512");
/* CONTROL: blksize=4096 — no sub-page uptodate tracking */
run_test("/mnt2", "4096", "bs4096");
printf("PoC finished.\n");
return 0;
}
From: Security research ( kernel audit, Linux 7.2.2)
Subject: [SUGGESTED FIX] fuse: handle folio-relative sub-ranges in the iomap
read path (readahead request offset + sub-folio zeroing)
Suggested minimal fixes for the two defects described in the accompanying
report. Not tested beyond the reproducer in this package; maintainers should
validate against the large-folio series.
Defect B — fuse_send_readpages() must honour ap->descs[0].offset, exactly like
the writeback path (fuse_writepage_args_setup() uses folio_pos(folio)+offset)
and the synchronous path (fuse_do_readfolio() uses folio_pos(folio)+off):
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1057,7 +1057,8 @@ static void fuse_send_readpages(struct f
struct fuse_file *ff = file->private_data;
struct fuse_mount *fm = ff->fm;
struct fuse_args_pages *ap = &ia->ap;
- loff_t pos = folio_pos(ap->folios[0]);
+ /* first desc may start mid-folio (partially uptodate folio) */
+ loff_t pos = folio_pos(ap->folios[0]) + ap->descs[0].offset;
ssize_t res;
int err;
Defect A — fuse_copy_folio() pre-zeroing must not wipe the beginning of the
folio when the requested range starts mid-folio. Zeroing from `offset`
preserves the legacy whole-folio behaviour (offset == 0) while keeping valid,
cached, uptodate data before the range intact:
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1251,7 +1251,7 @@ int fuse_copy_folio(struct fuse_copy_stat
if (folio) {
size = folio_size(folio);
if (zeroing && count < size)
- folio_zero_range(folio, 0, size);
+ folio_zero_range(folio, offset, size - offset);
}
Hardening (optional) — fuse_handle_readahead() appends one folio slot per
adjusted range but the send guard only checks ap->num_folios against
fc->max_pages, not against the allocated capacity
(min(fc->max_pages, readahead_count(rac))). Today each folio in a readahead
batch contributes exactly one range, but any future change that produces
multiple ranges per folio in one batch (e.g. adopting readahead_expand(), or
the large-folio follow-up series) would overflow the folios/descs arrays.
Add a capacity guard analogous to the writeback path's fuse_pages_realloc().
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -942,7 +942,8 @@ static int fuse_handle_readahead(struct
if (!ia) {
...
nr_pages = min(fc->max_pages, readahead_count(rac));
+ /* append guard must also consider nr_pages (array capacity) */
data->ia = fuse_io_alloc(NULL, nr_pages);
From: Security research ( kernel audit, Linux 7.2.2)
Subject: [NOT FOR UPSTREAM] DEMO PRECONDITION: drop per-block uptodate state on
partial folio invalidation (iomap)
This patch is NOT a proposed upstream fix. It is a minimal, self-contained
*precondition* used to demonstrate two latent defects in the FUSE iomap read
path of Linux 7.2.2 (fs/fuse/file.c: fuse_send_readpages() /
fuse_do_readfolio() consumers):
* Defect A — fs/fuse/dev.c fuse_copy_folio(): when a sub-folio read range is
requested (desc.offset > 0, desc.length < folio_size) with page_zeroing,
the whole folio is zeroed, destroying valid, cached, uptodate data in the
same folio.
* Defect B — fs/fuse/file.c fuse_send_readpages(): the FUSE_READ request
offset is computed as folio_pos(ap->folios[0]), ignoring
ap->descs[0].offset, so a readahead batch whose first folio is partially
uptodate reads from the wrong file offset.
Both code paths only receive folio-relative sub-ranges once *partially
uptodate* folios exist. In stock 7.2.2 (order-0 folios, no per-block uptodate
clearing) such folios cannot arise; the announced follow-up series
"fuse: support large folios" (Joanne Koong, LWN 1021311) and any sub-page
blocksize invalidation semantics create exactly this state.
This patch makes iomap_invalidate_folio() drop the per-block uptodate bits of
the invalidated range (mirroring what correct sub-page invalidation must do,
and what the dirty-bit half already does), which is enough to create
prefix-partial folios on a fuseblk mount with blksize=512 and reproduce
Defect A end-to-end (silent destruction of 1024 bytes of valid cached data;
see evidence logs in this package).
Revert this patch before building the final pristine kernel.
Signed-off-by: n/a (research demonstration)
---
fs/iomap/buffered-io.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -838,6 +838,25 @@ void iomap_invalidate_folio(struct folio
} else {
iomap_clear_range_dirty(folio, offset, len);
}
+ /* DEMO-PRECONDITION (not for upstream): also drop per-block uptodate
+ * state for the invalidated sub-page-block range.
+ */
+ {
+ struct iomap_folio_state *ifs = folio->private;
+ if (ifs) {
+ struct inode *inode = folio->mapping->host;
+ unsigned int blks = i_blocks_per_folio(inode, folio);
+ unsigned int first = offset >> inode->i_blkbits;
+ unsigned int last = (offset + len - 1) >> inode->i_blkbits;
+ unsigned long flags;
+
+ if (first >= blks) first = blks - 1;
+ if (last >= blks) last = blks - 1;
+ spin_lock_irqsave(&ifs->state_lock, flags);
+ bitmap_clear(ifs->state, first, last - first + 1);
+ spin_unlock_irqrestore(&ifs->state_lock, flags);
+ if (!bitmap_full(ifs->state, blks))
+ folio_clear_uptodate(folio);
+ }
+ }
}
EXPORT_SYMBOL_GPL(iomap_invalidate_folio);
// init.c — minimal UML guest init for the FUSE readahead offset bug PoC
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/reboot.h>
#include <sys/wait.h>
#include <sys/sysmacros.h>
static void mount_or_die(const char *src, const char *dst, const char *type)
{
if (mount(src, dst, type, 0, NULL) < 0)
fprintf(stderr, "[init] mount %s on %s: %s (continuing)\n",
type, dst, strerror(errno));
}
static void mknod_if_missing(const char *path, int maj, int min, mode_t mode)
{
struct stat st;
if (stat(path, &st) == 0) return;
if (mknod(path, mode | 0600, makedev(maj, min)) < 0)
fprintf(stderr, "[init] mknod %s: %s\n", path, strerror(errno));
}
int main(void)
{
setsid();
setvbuf(stdout, NULL, _IONBF, 0);
setvbuf(stderr, NULL, _IONBF, 0);
printf("[init] Linux FUSE readahead-offset PoC guest booting\n");
printf("[init] kernel: %s\n", "Linux 7.2.2 (UML, KASAN)");
mount_or_die("proc", "/proc", "proc");
mount_or_die("sysfs", "/sys", "sysfs");
mount_or_die("devtmpfs", "/dev", "devtmpfs");
/* make sure required device nodes exist (devtmpfs usually has them) */
mknod_if_missing("/dev/fuse", 10, 229, S_IFCHR);
mknod_if_missing("/dev/loop-control", 10, 237, S_IFCHR);
mknod_if_missing("/dev/loop0", 7, 0, S_IFBLK);
mknod_if_missing("/dev/loop1", 7, 1, S_IFBLK);
mkdir("/dev/shm", 0755);
mount_or_die("tmpfs", "/dev/shm", "tmpfs");
printf("[init] kernel cmdline: ");
{
char buf[2048] = "";
int fd = open("/proc/cmdline", O_RDONLY);
if (fd >= 0) {
read(fd, buf, sizeof(buf) - 1);
close(fd);
printf("%s", buf);
}
}
/* run the PoC (direct execve — no shell in guest) */
printf("[init] ===== running /poc/fusepoc =====\n");
{
pid_t p = fork();
if (p == 0) {
char *cargv[] = { "/poc/fusepoc", NULL };
char *cenvp[] = { "HOME=/", "PATH=/bin", NULL };
execve("/poc/fusepoc", cargv, cenvp);
fprintf(stderr, "[init] execve failed: %s\n", strerror(errno));
_exit(127);
}
int st = 0;
waitpid(p, &st, 0);
printf("[init] fusepoc exit status: %d (signal %d)\n",
WIFEXITED(st) ? WEXITSTATUS(st) : -1,
WIFSIGNALED(st) ? WTERMSIG(st) : 0);
}
sync();
printf("[init] powering off\n");
reboot(RB_POWER_OFF);
return 0;
}
Core dump limits :
soft - 0
hard - NONE
Checking environment variables for a tempdir.../home/z/my-project/kernel-audit/staging
Checking if /home/z/my-project/kernel-audit/staging is on tmpfs...no
Warning: tempdir /home/z/my-project/kernel-audit/staging is not on tmpfs
Checking PROT_EXEC mmap in /home/z/my-project/kernel-audit/staging...OK
Checking that ptrace can change system call numbers...OK
Checking syscall emulation for ptrace...OK
Adding 2822144 bytes to physical memory to account for exec-shield gap
Linux version 7.2.2 (z@c-6a9371bd-145d6674-828d0ae13905) (gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #9 Sun Aug 30 03:46:35 UTC 2026
random: crng init done
Zone ranges:
Normal [mem 0x0000000000000000-0x00000000a02b0fff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000000000000-0x00000000402b0fff]
Initmem setup node 0 [mem 0x0000000000000000-0x00000000402b0fff]
On node 0, zone Normal: 335 pages in unavailable ranges
Kernel command line: rootfstype=hostfs rootflags=/home/z/my-project/kernel-audit/staging rw init=/init con0=fd:0,fd:1 con=none root=98:0 console=tty0
printk: log buffer data + meta data: 16384 + 57344 = 73728 bytes
Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
Sorting __ex_table...
KernelAddressSanitizer initialized (generic)
Built 1 zonelists, mobility grouping on. Total pages: 262833
mem auto-init: stack:all(zero), heap alloc:off, heap free:off
stackdepot: allocating hash table via alloc_large_system_hash
stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear)
stackdepot: allocating space for 8192 stack pools via memblock
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 64
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
clocksource: timer: mask: 0xffffffffffffffff max_cycles: 0x1cd42e205, max_idle_ns: 881590404426 ns
Calibrating delay loop... 7072.97 BogoMIPS (lpj=35364864)
Checking that host ptys support output SIGIO...Yes
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
VFS: Finished mounting rootfs on nullfs
Memory: 1000732K/1051332K available (7713K kernel code, 2735K rwdata, 2812K rodata, 238K init, 389K bss, 49080K reserved, 0K cma-reserved)
devtmpfs: initialized
Could not create executable memfd, using temporary file!
posixtimers hash table entries: 512 (order: 0, 4096 bytes, linear)
futex hash table entries: 256 (6144 bytes on 1 NUMA nodes, total 6 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
clocksource: Switched to clocksource timer
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 512 (4096 bytes)
NET: Registered PF_INET protocol family
IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
TCP: Hash tables configured (established 8192 bind 8192)
UDP hash table entries: 512 (order: 3, 32768 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
printk: legacy console [stderr0] disabled
mconsole (version 2) initialized on /home/z/.uml/WQvwyj/mconsole
Checking host MADV_REMOVE support...OK
workingset: timestamp_bits=62 (anon: 57) max_order=18 bucket_order=0 (anon: 0)
fuse: init (API version 7.45)
io scheduler mq-deadline registered
io scheduler kyber registered
loop: module loaded
NET: Registered PF_INET6 protocol family
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
NET: Registered PF_PACKET protocol family
Initialized stdio console driver
setup_one_line failed for device 1 : configured as 'none'
setup_one_line failed for device 2 : configured as 'none'
setup_one_line failed for device 3 : configured as 'none'
setup_one_line failed for device 4 : configured as 'none'
setup_one_line failed for device 5 : configured as 'none'
setup_one_line failed for device 6 : configured as 'none'
setup_one_line failed for device 7 : configured as 'none'
setup_one_line failed for device 8 : configured as 'none'
setup_one_line failed for device 9 : configured as 'none'
setup_one_line failed for device 10 : configured as 'none'
setup_one_line failed for device 11 : configured as 'none'
setup_one_line failed for device 12 : configured as 'none'
setup_one_line failed for device 13 : configured as 'none'
setup_one_line failed for device 14 : configured as 'none'
setup_one_line failed for device 15 : configured as 'none'
Console initialized on /dev/tty0
printk: legacy console [tty0] enabled
Initializing software serial port version 1
printk: legacy console [mc-1] enabled
Failed to initialize ubd device 0 :Couldn't determine size of device's file
kmemleak: Kernel memory leak detector initialized (mem pool available: 15844)
kmemleak: Automatic memory scanning thread started
epollctl add err fd 1, Operation not permitted
epollctl add err fd 0, Operation not permitted
VFS: Mounted root (hostfs filesystem) on device 0:16.
devtmpfs: mounted
VFS: Pivoted into new rootfs
Run /init as init process
[init] Linux FUSE readahead-offset PoC guest booting
[init] kernel: Linux 7.2.2 (UML, KASAN)
[init] mount devtmpfs on /dev: Device or resource busy (continuing)
[init] kernel cmdline: rootfstype=hostfs rootflags=/home/z/my-project/kernel-audit/staging rw init=/init con0=fd:0,fd:1 con=none root=98:0 console=tty0
[init] ===== running /poc/fusepoc =====
=============== TEST bs512 (blksize=512) ===============
loop0: detected capacity change from 0 to 2048
[MNT] loop device: /dev/loop0
[MNT] mounted /dev/loop0 on /mnt1 (fd=3, blksize=512)
[MNT] stat(target): size=16384 blksize=512
KDBG-READ-ITER: folio=0 pos=0 len=16384 uptodate=0 private=ifs
fuse: KDBG-RA: alloc ia folio=0 pos=0 len=4096 blkbits=9 ifs=yes count=4 cap=4
KDBG-READ-ITER: folio=1 pos=4096 len=12288 uptodate=0 private=ifs
KDBG-READ-ITER: folio=2 pos=8192 len=8192 uptodate=0 private=ifs
KDBG-READ-ITER: folio=3 pos=12288 len=4096 uptodate=0 private=ifs
fuse: KDBG-SEND: nfolios=4 d0off=0 d0len=4096 folio0=0 => FUSE_READ(pos=0 size=16384)
[T1 ] pread(0, 16384) = 16384 (expected 16384)
[T1 ] verify: 0 wrong records (expected 0)
KDBG-TRUNC-PARTIAL: folio=0 off=1024 len=3072 uptodate=1 private=ifs
[T2 ] fallocate(PUNCH_HOLE, 1024, 15360) ok
KDBG-READ-ITER: folio=1 pos=4096 len=12288 uptodate=0 private=ifs
fuse: KDBG-RA: alloc ia folio=1 pos=4096 len=4096 blkbits=9 ifs=yes count=3 cap=3
KDBG-READ-ITER: folio=2 pos=8192 len=8192 uptodate=0 private=ifs
KDBG-READ-ITER: folio=3 pos=12288 len=4096 uptodate=0 private=ifs
fuse: KDBG-SEND: nfolios=3 d0off=0 d0len=4096 folio0=1 => FUSE_READ(pos=4096 size=12288)
[T3 ] pread(1024, 15360) = 15360 (expected 15360)
[T3 ] VERIFY: hole reads as zeros — data CORRECT
[MNT] unmounted
---- server log (bs512) ----
[bs512] REQ INIT minor=45 flags=0x73fffffb
[bs512] REQ opcode=17 nodeid=1 -> ENOSYS
[bs512] REQ LOOKUP nodeid=1 name="target"
[bs512] REQ OPEN nodeid=2
[bs512] REQ READ nodeid=2 offset=0 size=16384
[bs512] REQ FLUSH nodeid=2
[bs512] REQ RELEASE nodeid=2
[bs512] REQ OPEN nodeid=2
[bs512] REQ opcode=22 nodeid=2 -> ENOSYS
[bs512] REQ FALLOCATE nodeid=2 offset=1024 length=15360 mode=0x3
[bs512] REQ READ nodeid=2 offset=4096 size=12288
[bs512] REQ FLUSH nodeid=2
[bs512] server read err No such device
=============== END bs512 ===============
=============== TEST bs4096 (blksize=4096) ===============
loop0: detected capacity change from 0 to 2048
[MNT] loop device: /dev/loop0
[MNT] mounted /dev/loop0 on /mnt2 (fd=3, blksize=4096)
[MNT] stat(target): size=16384 blksize=512
KDBG-READ-ITER: folio=0 pos=0 len=16384 uptodate=0 private=none
fuse: KDBG-RA: alloc ia folio=0 pos=0 len=4096 blkbits=12 ifs=no count=4 cap=4
KDBG-READ-ITER: folio=1 pos=4096 len=12288 uptodate=0 private=none
KDBG-READ-ITER: folio=2 pos=8192 len=8192 uptodate=0 private=none
KDBG-READ-ITER: folio=3 pos=12288 len=4096 uptodate=0 private=none
fuse: KDBG-SEND: nfolios=4 d0off=0 d0len=4096 folio0=0 => FUSE_READ(pos=0 size=16384)
[T1 ] pread(0, 16384) = 16384 (expected 16384)
[T1 ] verify: 0 wrong records (expected 0)
KDBG-TRUNC-PARTIAL: folio=0 off=1024 len=3072 uptodate=1 private=none
[T2 ] fallocate(PUNCH_HOLE, 1024, 15360) ok
KDBG-READ-ITER: folio=1 pos=4096 len=12288 uptodate=0 private=none
fuse: KDBG-RA: alloc ia folio=1 pos=4096 len=4096 blkbits=12 ifs=no count=3 cap=3
KDBG-READ-ITER: folio=2 pos=8192 len=8192 uptodate=0 private=none
KDBG-READ-ITER: folio=3 pos=12288 len=4096 uptodate=0 private=none
fuse: KDBG-SEND: nfolios=3 d0off=0 d0len=4096 folio0=1 => FUSE_READ(pos=4096 size=12288)
[T3 ] pread(1024, 15360) = 15360 (expected 15360)
[T3 ] VERIFY: hole reads as zeros — data CORRECT
[MNT] unmounted
---- server log (bs4096) ----
[bs4096] REQ INIT minor=45 flags=0x73fffffb
[bs4096] REQ opcode=17 nodeid=1 -> ENOSYS
[bs4096] REQ LOOKUP nodeid=1 name="target"
[bs4096] REQ OPEN nodeid=2
[bs4096] REQ READ nodeid=2 offset=0 size=16384
[bs4096] REQ FLUSH nodeid=2
[bs4096] REQ RELEASE nodeid=2
[bs4096] REQ OPEN nodeid=2
[bs4096] REQ opcode=22 nodeid=2 -> ENOSYS
[bs4096] REQ FALLOCATE nodeid=2 offset=1024 length=15360 mode=0x3
[bs4096] REQ READ nodeid=2 offset=4096 size=12288
[bs4096] REQ FLUSH nodeid=2
[bs4096] server read err No such device
=============== END bs4096 ===============
PoC finished.
[init] fusepoc exit status: 0 (signal 0)
[init] powering off
reboot: Power down
Core dump limits :
soft - 0
hard - NONE
Checking environment variables for a tempdir.../home/z/my-project/kernel-audit/staging
Checking if /home/z/my-project/kernel-audit/staging is on tmpfs...no
Warning: tempdir /home/z/my-project/kernel-audit/staging is not on tmpfs
Checking PROT_EXEC mmap in /home/z/my-project/kernel-audit/staging...OK
Checking that ptrace can change system call numbers...OK
Checking syscall emulation for ptrace...OK
Adding 2822144 bytes to physical memory to account for exec-shield gap
Linux version 7.2.2 (z@c-6a9371bd-145d6674-828d0ae13905) (gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #11 Sun Aug 30 03:58:04 UTC 2026
random: crng init done
Zone ranges:
Normal [mem 0x0000000000000000-0x00000000a02b0fff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000000000000-0x00000000402b0fff]
Initmem setup node 0 [mem 0x0000000000000000-0x00000000402b0fff]
On node 0, zone Normal: 335 pages in unavailable ranges
Kernel command line: rootfstype=hostfs rootflags=/home/z/my-project/kernel-audit/staging rw init=/init con0=fd:0,fd:1 con=none root=98:0 console=tty0
printk: log buffer data + meta data: 16384 + 57344 = 73728 bytes
Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
Sorting __ex_table...
KernelAddressSanitizer initialized (generic)
Built 1 zonelists, mobility grouping on. Total pages: 262833
mem auto-init: stack:all(zero), heap alloc:off, heap free:off
stackdepot: allocating hash table via alloc_large_system_hash
stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear)
stackdepot: allocating space for 8192 stack pools via memblock
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 64
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
clocksource: timer: mask: 0xffffffffffffffff max_cycles: 0x1cd42e205, max_idle_ns: 881590404426 ns
Calibrating delay loop... 6793.62 BogoMIPS (lpj=33968128)
Checking that host ptys support output SIGIO...Yes
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
VFS: Finished mounting rootfs on nullfs
Memory: 1000732K/1051332K available (7713K kernel code, 2734K rwdata, 2812K rodata, 238K init, 389K bss, 49080K reserved, 0K cma-reserved)
devtmpfs: initialized
Could not create executable memfd, using temporary file!
posixtimers hash table entries: 512 (order: 0, 4096 bytes, linear)
futex hash table entries: 256 (6144 bytes on 1 NUMA nodes, total 6 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
clocksource: Switched to clocksource timer
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 512 (4096 bytes)
NET: Registered PF_INET protocol family
IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
TCP: Hash tables configured (established 8192 bind 8192)
UDP hash table entries: 512 (order: 3, 32768 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
printk: legacy console [stderr0] disabled
mconsole (version 2) initialized on /home/z/.uml/wAWmgB/mconsole
Checking host MADV_REMOVE support...OK
workingset: timestamp_bits=62 (anon: 57) max_order=18 bucket_order=0 (anon: 0)
fuse: init (API version 7.45)
io scheduler mq-deadline registered
io scheduler kyber registered
loop: module loaded
NET: Registered PF_INET6 protocol family
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
NET: Registered PF_PACKET protocol family
Initialized stdio console driver
setup_one_line failed for device 1 : configured as 'none'
setup_one_line failed for device 2 : configured as 'none'
setup_one_line failed for device 3 : configured as 'none'
setup_one_line failed for device 4 : configured as 'none'
setup_one_line failed for device 5 : configured as 'none'
setup_one_line failed for device 6 : configured as 'none'
setup_one_line failed for device 7 : configured as 'none'
setup_one_line failed for device 8 : configured as 'none'
setup_one_line failed for device 9 : configured as 'none'
setup_one_line failed for device 10 : configured as 'none'
setup_one_line failed for device 11 : configured as 'none'
setup_one_line failed for device 12 : configured as 'none'
setup_one_line failed for device 13 : configured as 'none'
setup_one_line failed for device 14 : configured as 'none'
setup_one_line failed for device 15 : configured as 'none'
Console initialized on /dev/tty0
printk: legacy console [tty0] enabled
Initializing software serial port version 1
printk: legacy console [mc-1] enabled
Failed to initialize ubd device 0 :Couldn't determine size of device's file
kmemleak: Kernel memory leak detector initialized (mem pool available: 15844)
kmemleak: Automatic memory scanning thread started
epollctl add err fd 1, Operation not permitted
epollctl add err fd 0, Operation not permitted
VFS: Mounted root (hostfs filesystem) on device 0:16.
devtmpfs: mounted
VFS: Pivoted into new rootfs
Run /init as init process
[init] Linux FUSE readahead-offset PoC guest booting
[init] kernel: Linux 7.2.2 (UML, KASAN)
[init] mount devtmpfs on /dev: Device or resource busy (continuing)
[init] kernel cmdline: rootfstype=hostfs rootflags=/home/z/my-project/kernel-audit/staging rw init=/init con0=fd:0,fd:1 con=none root=98:0 console=tty0
[init] ===== running /poc/fusepoc =====
=============== TEST bs512 (blksize=512) ===============
loop0: detected capacity change from 0 to 2048
[MNT] loop device: /dev/loop0
[MNT] mounted /dev/loop0 on /mnt1 (fd=3, blksize=512)
[T1 ] pread(0, 16384) = 16384 (expected 16384)
[T2 ] fallocate(PUNCH [0,4096) + [5120,8192)) ok
[T3 ] pread(0, 16384) = 16384 (expected 16384)
[T4 ] VERIFY: all 16384 bytes CORRECT
[MNT] unmounted
---- server log (bs512) ----
[bs512] REQ INIT minor=45 flags=0x73fffffb
[bs512] REQ opcode=17 nodeid=1 -> ENOSYS
[bs512] REQ LOOKUP nodeid=1 name="target"
[bs512] REQ OPEN nodeid=2
[bs512] REQ READ nodeid=2 offset=0 size=16384
[bs512] REQ FLUSH nodeid=2
[bs512] REQ RELEASE nodeid=2
[bs512] REQ OPEN nodeid=2
[bs512] REQ opcode=22 nodeid=2 -> ENOSYS
[bs512] REQ FALLOCATE nodeid=2 offset=0 length=4096 mode=0x3
[bs512] REQ FALLOCATE nodeid=2 offset=5120 length=3072 mode=0x3
[bs512] REQ READ nodeid=2 offset=0 size=4096
[bs512] REQ FLUSH nodeid=2
[bs512] server read err No such device
=============== END bs512 ===============
=============== TEST bs4096 (blksize=4096) ===============
loop0: detected capacity change from 0 to 2048
[MNT] loop device: /dev/loop0
[MNT] mounted /dev/loop0 on /mnt2 (fd=3, blksize=4096)
[T1 ] pread(0, 16384) = 16384 (expected 16384)
[T2 ] fallocate(PUNCH [0,4096) + [5120,8192)) ok
[T3 ] pread(0, 16384) = 16384 (expected 16384)
[T4 ] VERIFY: all 16384 bytes CORRECT
[MNT] unmounted
---- server log (bs4096) ----
[bs4096] REQ INIT minor=45 flags=0x73fffffb
[bs4096] REQ opcode=17 nodeid=1 -> ENOSYS
[bs4096] REQ LOOKUP nodeid=1 name="target"
[bs4096] REQ OPEN nodeid=2
[bs4096] REQ READ nodeid=2 offset=0 size=16384
[bs4096] REQ FLUSH nodeid=2
[bs4096] REQ RELEASE nodeid=2
[bs4096] REQ OPEN nodeid=2
[bs4096] REQ opcode=22 nodeid=2 -> ENOSYS
[bs4096] REQ FALLOCATE nodeid=2 offset=0 length=4096 mode=0x3
[bs4096] REQ FALLOCATE nodeid=2 offset=5120 length=3072 mode=0x3
[bs4096] REQ READ nodeid=2 offset=0 size=4096
[bs4096] REQ FLUSH nodeid=2
[bs4096] server read err No such device
=============== END bs4096 ===============
PoC finished.
[init] fusepoc exit status: 0 (signal 0)
[init] powering off
reboot: Power down
Core dump limits :
soft - 0
hard - NONE
Checking environment variables for a tempdir.../home/z/my-project/kernel-audit/staging
Checking if /home/z/my-project/kernel-audit/staging is on tmpfs...no
Warning: tempdir /home/z/my-project/kernel-audit/staging is not on tmpfs
Checking PROT_EXEC mmap in /home/z/my-project/kernel-audit/staging...OK
Checking that ptrace can change system call numbers...OK
Checking syscall emulation for ptrace...OK
Adding 2822144 bytes to physical memory to account for exec-shield gap
Linux version 7.2.2 (z@c-6a9371bd-145d6674-828d0ae13905) (gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #10 Sun Aug 30 03:52:25 UTC 2026
random: crng init done
Zone ranges:
Normal [mem 0x0000000000000000-0x00000000a02b0fff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000000000000-0x00000000402b0fff]
Initmem setup node 0 [mem 0x0000000000000000-0x00000000402b0fff]
On node 0, zone Normal: 335 pages in unavailable ranges
Kernel command line: rootfstype=hostfs rootflags=/home/z/my-project/kernel-audit/staging rw init=/init con0=fd:0,fd:1 con=none root=98:0 console=tty0
printk: log buffer data + meta data: 16384 + 57344 = 73728 bytes
Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
Sorting __ex_table...
KernelAddressSanitizer initialized (generic)
Built 1 zonelists, mobility grouping on. Total pages: 262833
mem auto-init: stack:all(zero), heap alloc:off, heap free:off
stackdepot: allocating hash table via alloc_large_system_hash
stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear)
stackdepot: allocating space for 8192 stack pools via memblock
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 64
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
clocksource: timer: mask: 0xffffffffffffffff max_cycles: 0x1cd42e205, max_idle_ns: 881590404426 ns
Calibrating delay loop... 7064.78 BogoMIPS (lpj=35323904)
Checking that host ptys support output SIGIO...Yes
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
VFS: Finished mounting rootfs on nullfs
Memory: 1000732K/1051332K available (7713K kernel code, 2734K rwdata, 2812K rodata, 238K init, 389K bss, 49080K reserved, 0K cma-reserved)
devtmpfs: initialized
Could not create executable memfd, using temporary file!
posixtimers hash table entries: 512 (order: 0, 4096 bytes, linear)
futex hash table entries: 256 (6144 bytes on 1 NUMA nodes, total 6 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
clocksource: Switched to clocksource timer
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 512 (4096 bytes)
NET: Registered PF_INET protocol family
IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
TCP: Hash tables configured (established 8192 bind 8192)
UDP hash table entries: 512 (order: 3, 32768 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
printk: legacy console [stderr0] disabled
mconsole (version 2) initialized on /home/z/.uml/BgMtUZ/mconsole
Checking host MADV_REMOVE support...OK
workingset: timestamp_bits=62 (anon: 57) max_order=18 bucket_order=0 (anon: 0)
fuse: init (API version 7.45)
io scheduler mq-deadline registered
io scheduler kyber registered
loop: module loaded
NET: Registered PF_INET6 protocol family
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
NET: Registered PF_PACKET protocol family
Initialized stdio console driver
setup_one_line failed for device 1 : configured as 'none'
setup_one_line failed for device 2 : configured as 'none'
setup_one_line failed for device 3 : configured as 'none'
setup_one_line failed for device 4 : configured as 'none'
setup_one_line failed for device 5 : configured as 'none'
setup_one_line failed for device 6 : configured as 'none'
setup_one_line failed for device 7 : configured as 'none'
setup_one_line failed for device 8 : configured as 'none'
setup_one_line failed for device 9 : configured as 'none'
setup_one_line failed for device 10 : configured as 'none'
setup_one_line failed for device 11 : configured as 'none'
setup_one_line failed for device 12 : configured as 'none'
setup_one_line failed for device 13 : configured as 'none'
setup_one_line failed for device 14 : configured as 'none'
setup_one_line failed for device 15 : configured as 'none'
Console initialized on /dev/tty0
printk: legacy console [tty0] enabled
Initializing software serial port version 1
printk: legacy console [mc-1] enabled
Failed to initialize ubd device 0 :Couldn't determine size of device's file
kmemleak: Kernel memory leak detector initialized (mem pool available: 15844)
kmemleak: Automatic memory scanning thread started
epollctl add err fd 1, Operation not permitted
epollctl add err fd 0, Operation not permitted
VFS: Mounted root (hostfs filesystem) on device 0:16.
devtmpfs: mounted
VFS: Pivoted into new rootfs
Run /init as init process
[init] Linux FUSE readahead-offset PoC guest booting
[init] kernel: Linux 7.2.2 (UML, KASAN)
[init] mount devtmpfs on /dev: Device or resource busy (continuing)
[init] kernel cmdline: rootfstype=hostfs rootflags=/home/z/my-project/kernel-audit/staging rw init=/init con0=fd:0,fd:1 con=none root=98:0 console=tty0
[init] ===== running /poc/fusepoc =====
=============== TEST bs512 (blksize=512) ===============
loop0: detected capacity change from 0 to 2048
[MNT] loop device: /dev/loop0
[MNT] mounted /dev/loop0 on /mnt1 (fd=3, blksize=512)
[T1 ] pread(0, 16384) = 16384 (expected 16384)
[T2 ] fallocate(PUNCH [0,4096) + [5120,8192)) ok
[T3 ] pread(0, 16384) = 16384 (expected 16384)
[T4 ] VERIFY: DATA CORRUPT — 1024 of 16384 bytes wrong!
[T4 ] first mismatch at file offset 0x1000
[T4 ] got record "" (content of file offset )
[T4 ] want record "0000000000001000"
[T4 ] data is shifted: kernel copied data beginning at the folio start instead of the partially-uptodate folio's first invalid block
[MNT] unmounted
---- server log (bs512) ----
[bs512] REQ INIT minor=45 flags=0x73fffffb
[bs512] REQ opcode=17 nodeid=1 -> ENOSYS
[bs512] REQ LOOKUP nodeid=1 name="target"
[bs512] REQ OPEN nodeid=2
[bs512] REQ READ nodeid=2 offset=0 size=16384
[bs512] REQ FLUSH nodeid=2
[bs512] REQ RELEASE nodeid=2
[bs512] REQ OPEN nodeid=2
[bs512] REQ opcode=22 nodeid=2 -> ENOSYS
[bs512] REQ FALLOCATE nodeid=2 offset=0 length=4096 mode=0x3
[bs512] REQ FALLOCATE nodeid=2 offset=5120 length=3072 mode=0x3
[bs512] REQ READ nodeid=2 offset=0 size=4096
[bs512] REQ READ nodeid=2 offset=5120 size=3072
[bs512] REQ FLUSH nodeid=2
[bs512] server read err No such device
=============== END bs512 ===============
=============== TEST bs4096 (blksize=4096) ===============
loop0: detected capacity change from 0 to 2048
[MNT] loop device: /dev/loop0
[MNT] mounted /dev/loop0 on /mnt2 (fd=3, blksize=4096)
[T1 ] pread(0, 16384) = 16384 (expected 16384)
[T2 ] fallocate(PUNCH [0,4096) + [5120,8192)) ok
[T3 ] pread(0, 16384) = 16384 (expected 16384)
[T4 ] VERIFY: all 16384 bytes CORRECT
[MNT] unmounted
---- server log (bs4096) ----
[bs4096] REQ INIT minor=45 flags=0x73fffffb
[bs4096] REQ opcode=17 nodeid=1 -> ENOSYS
[bs4096] REQ LOOKUP nodeid=1 name="target"
[bs4096] REQ OPEN nodeid=2
[bs4096] REQ READ nodeid=2 offset=0 size=16384
[bs4096] REQ FLUSH nodeid=2
[bs4096] REQ RELEASE nodeid=2
[bs4096] REQ OPEN nodeid=2
[bs4096] REQ opcode=22 nodeid=2 -> ENOSYS
[bs4096] REQ FALLOCATE nodeid=2 offset=0 length=4096 mode=0x3
[bs4096] REQ FALLOCATE nodeid=2 offset=5120 length=3072 mode=0x3
[bs4096] REQ READ nodeid=2 offset=0 size=4096
[bs4096] REQ FLUSH nodeid=2
[bs4096] server read err No such device
=============== END bs4096 ===============
PoC finished.
[init] fusepoc exit status: 0 (signal 0)
[init] powering off
reboot: Power down
CC arch/um/kernel/asm-offsets.s
CC kernel/sched/rq-offsets.s
LDS scripts/module.lds
CC init/main.o
QUOTE arch/um/kernel/config.tmp
CC arch/um/kernel/exec.o
CC arch/um/kernel/exitcode.o
CC arch/um/kernel/irq.o
CC init/do_mounts.o
CC arch/um/kernel/mem.o
CC arch/um/kernel/physmem.o
CC init/noinitramfs.o
CC arch/um/kernel/process.o
CC init/init_task.o
CC arch/um/kernel/ptrace.o
CC init/version.o
CC arch/um/kernel/reboot.o
AR init/built-in.a
CC arch/x86/um/signal.o
CC arch/um/kernel/signal.o
CC arch/x86/um/../kernel/module.o
CC arch/um/kernel/sysrq.o
CC arch/x86/um/mem_64.o
CC arch/um/kernel/time.o
CC arch/x86/um/syscalls_64.o
CC arch/um/kernel/tlb.o
CC arch/x86/um/vdso/vma.o
CC arch/um/kernel/trap.o
AR arch/x86/um/vdso/built-in.a
CC arch/x86/um/ptrace_64.o
CC arch/um/kernel/um_arch.o
AR arch/x86/um/built-in.a
CC kernel/fork.o
CC arch/um/kernel/skas/mmu.o
CC arch/um/kernel/skas/process.o
CC arch/um/kernel/skas/syscall.o
CC arch/um/kernel/skas/uaccess.o
CC kernel/exec_domain.o
AR arch/um/kernel/skas/built-in.a
CC arch/um/kernel/load_file.o
CC kernel/panic.o
CC arch/um/kernel/stacktrace.o
QUOTE arch/um/kernel/config.c
CC arch/um/kernel/config.o
AR arch/um/kernel/built-in.a
CC kernel/cpu.o
CC arch/um/drivers/stdio_console.o
CC arch/um/drivers/chan_kern.o
CC kernel/exit.o
CC arch/um/drivers/line.o
CC arch/um/drivers/ssl.o
CC arch/um/drivers/mconsole_kern.o
CC kernel/softirq.o
CC kernel/resource.o
CC arch/um/drivers/ubd_kern.o
CC kernel/sysctl.o
CC arch/um/drivers/random.o
AR arch/um/drivers/built-in.a
AR arch/um/built-in.a
CC mm/filemap.o
CC kernel/capability.o
CC kernel/ptrace.o
CC kernel/user.o
CC kernel/signal.o
CC mm/mempool.o
CC mm/oom_kill.o
CC mm/fadvise.o
CC kernel/sys.o
CC mm/maccess.o
CC mm/page-writeback.o
CC kernel/umh.o
CC mm/folio-compat.o
CC kernel/workqueue.o
CC mm/readahead.o
CC mm/swap.o
CC mm/truncate.o
CC kernel/pid.o
CC mm/vmscan.o
CC kernel/task_work.o
CC kernel/extable.o
CC kernel/params.o
CC mm/shrinker.o
CC mm/shmem.o
CC kernel/kthread.o
CC kernel/nsproxy.o
CC mm/util.o
CC kernel/nstree.o
CC mm/mmzone.o
CC kernel/nscommon.o
CC mm/vmstat.o
CC kernel/notifier.o
CC kernel/ksysfs.o
CC mm/backing-dev.o
CC kernel/cred.o
CC mm/mm_init.o
CC kernel/reboot.o
CC mm/percpu.o
CC kernel/ksyms_common.o
CC kernel/groups.o
CC mm/slab_common.o
CC kernel/sched/core.o
CC mm/compaction.o
CC mm/show_mem.o
CC mm/interval_tree.o
CC mm/list_lru.o
CC kernel/sched/fair.o
CC mm/workingset.o
CC mm/debug.o
CC mm/gup.o
CC mm/mmap_lock.o
CC kernel/sched/build_policy.o
CC mm/vma_init.o
CC mm/highmem.o
CC mm/memory.o
CC kernel/sched/build_utility.o
CC mm/mincore.o
CC mm/mlock.o
CC mm/mmap.o
AR kernel/sched/built-in.a
CC kernel/locking/semaphore.o
CC mm/mmu_gather.o
AR kernel/locking/built-in.a
CC kernel/power/qos.o
CC mm/mprotect.o
CC kernel/power/main.o
CC mm/mremap.o
CC kernel/power/process.o
CC kernel/power/suspend.o
CC mm/msync.o
CC mm/page_vma_mapped.o
AR kernel/power/built-in.a
CC kernel/printk/printk.o
CC mm/pagewalk.o
CC mm/pgtable-generic.o
CC mm/rmap.o
CC kernel/printk/printk_safe.o
AR kernel/printk/built-in.a
CC kernel/irq/proc.o
CC kernel/irq/pm.o
CC mm/vmalloc.o
AR kernel/irq/built-in.a
CC kernel/rcu/update.o
CC kernel/rcu/tiny.o
AR kernel/rcu/built-in.a
CC kernel/dma/remap.o
AR kernel/dma/built-in.a
CC kernel/module/main.o
CC mm/vma.o
CC kernel/module/strict_rwx.o
CC kernel/module/kmod.o
CC mm/vma_exec.o
CC kernel/module/debug_kmemleak.o
CC mm/process_vm_access.o
CC kernel/module/kallsyms.o
CC mm/mseal.o
CC kernel/module/procfs.o
CC mm/page_alloc.o
CC kernel/module/sysfs.o
AR kernel/module/built-in.a
CC kernel/freezer.o
CC kernel/stacktrace.o
CC kernel/time/time.o
CC mm/page_frag_cache.o
CC kernel/time/timer.o
CC mm/init-mm.o
CC mm/memblock.o
CC kernel/time/hrtimer.o
CC mm/slub.o
CC kernel/time/timekeeping.o
CC kernel/time/ntp.o
CC kernel/time/timer_list.o
CC kernel/time/alarmtimer.o
CC kernel/time/posix-timers.o
CC mm/madvise.o
CC kernel/time/posix-cpu-timers.o
CC mm/page_io.o
CC kernel/time/posix-clock.o
CC mm/swap_state.o
CC kernel/time/itimer.o
CC kernel/time/tick-common.o
CC mm/swapfile.o
CC kernel/time/tick-sched.o
CC kernel/time/timekeeping_debug.o
CC kernel/time/namespace.o
AR kernel/time/built-in.a
CC kernel/futex/core.o
CC mm/kasan/common.o
CC mm/kasan/report.o
CC kernel/futex/syscalls.o
CC mm/kasan/init.o
CC kernel/futex/pi.o
CC mm/kasan/generic.o
CC kernel/futex/requeue.o
CC mm/kasan/report_generic.o
CC kernel/futex/waitwake.o
CC mm/kasan/shadow.o
CC mm/kasan/quarantine.o
AR kernel/futex/built-in.a
CC kernel/uid16.o
AR mm/kasan/built-in.a
CC mm/kmemleak.o
CC kernel/kallsyms.o
CC mm/memfd.o
CC kernel/acct.o
CC mm/execmem.o
CC kernel/vmcore_info.o
AR mm/built-in.a
CC fs/open.o
CC kernel/elfcorehdr.o
CC kernel/cgroup/cgroup.o
CC fs/read_write.o
CC fs/file_table.o
CC fs/super.o
CC kernel/cgroup/rstat.o
CC kernel/cgroup/namespace.o
CC fs/char_dev.o
CC kernel/cgroup/cgroup-v1.o
CC fs/stat.o
CC kernel/cgroup/freezer.o
CC fs/exec.o
CC kernel/cgroup/legacy_freezer.o
AR kernel/cgroup/built-in.a
CC kernel/utsname.o
UPD kernel/config_data
CC kernel/seccomp.o
CC fs/pipe.o
CC fs/namei.o
CC kernel/bpf/core.o
AR kernel/bpf/built-in.a
GZIP kernel/config_data.gz
CC kernel/configs.o
AR kernel/built-in.a
CC ipc/util.o
CC fs/fcntl.o
CC ipc/msgutil.o
CC fs/ioctl.o
CC ipc/msg.o
CC fs/readdir.o
CC ipc/sem.o
CC fs/select.o
CC ipc/shm.o
CC fs/dcache.o
CC ipc/syscall.o
CC ipc/mqueue.o
CC fs/inode.o
CC ipc/namespace.o
AR ipc/built-in.a
CC security/commoncap.o
CC fs/attr.o
CC security/min_addr.o
CC fs/bad_inode.o
CC fs/file.o
CC security/device_cgroup.o
AR security/built-in.a
CC crypto/api.o
CC fs/filesystems.o
CC crypto/cipher.o
CC fs/namespace.o
CC crypto/algapi.o
CC crypto/scatterwalk.o
CC crypto/proc.o
CC crypto/aead.o
CC crypto/lskcipher.o
CC fs/seq_file.o
CC crypto/skcipher.o
CC fs/xattr.o
CC crypto/ahash.o
CC fs/libfs.o
CC crypto/shash.o
CC crypto/algboss.o
CC fs/fs-writeback.o
CC crypto/testmgr.o
CC crypto/gcm.o
CC fs/pnode.o
CC crypto/ccm.o
CC fs/splice.o
AR crypto/built-in.a
CC block/bdev.o
CC fs/sync.o
CC block/fops.o
CC fs/utimes.o
CC block/bio.o
CC fs/d_path.o
CC fs/stack.o
CC fs/fs_struct.o
CC block/elevator.o
CC fs/statfs.o
CC fs/fs_pin.o
CC block/blk-core.o
CC fs/nsfs.o
CC block/blk-sysfs.o
CC fs/fs_context.o
CC block/blk-flush.o
CC fs/fs_parser.o
CC block/blk-settings.o
CC fs/fsopen.o
CC block/blk-ioc.o
CC fs/init.o
CC fs/kernel_read_file.o
CC block/blk-map.o
CC fs/mnt_idmapping.o
CC block/blk-merge.o
CC fs/remap_range.o
CC fs/pidfs.o
CC block/blk-timeout.o
CC block/blk-lib.o
CC fs/file_attr.o
CC block/blk-mq.o
CC fs/fserror.o
CC fs/nullfs.o
CC fs/buffer.o
CC block/blk-mq-tag.o
CC fs/mpage.o
CC block/blk-mq-dma.o
CC block/blk-stat.o
CC fs/proc_namespace.o
CC block/blk-mq-sysfs.o
CC fs/notify/fsnotify.o
CC block/blk-mq-cpumap.o
CC block/blk-mq-sched.o
CC fs/notify/notification.o
CC fs/notify/group.o
CC block/ioctl.o
CC fs/notify/mark.o
CC fs/notify/fdinfo.o
CC block/genhd.o
CC fs/notify/dnotify/dnotify.o
AR fs/notify/dnotify/built-in.a
CC fs/notify/inotify/inotify_fsnotify.o
CC block/ioprio.o
CC fs/notify/inotify/inotify_user.o
CC block/partitions/core.o
AR fs/notify/inotify/built-in.a
AR fs/notify/built-in.a
CC fs/eventpoll.o
CC block/partitions/msdos.o
CC block/partitions/efi.o
AR block/partitions/built-in.a
CC block/blk-rq-qos.o
CC fs/anon_inodes.o
CC block/disk-events.o
CC fs/signalfd.o
CC block/blk-ia-ranges.o
CC fs/timerfd.o
CC block/early-lookup.o
CC fs/eventfd.o
CC block/blk-cgroup.o
CC fs/aio.o
CC block/blk-cgroup-rwstat.o
CC fs/locks.o
CC block/mq-deadline.o
CC block/kyber-iosched.o
CC fs/binfmt_script.o
CC fs/binfmt_elf.o
CC block/blk-mq-debugfs.o
CC block/blk-pm.o
CC fs/backing-file.o
CC [M] block/bfq-iosched.o
CC fs/mbcache.o
CC fs/posix_acl.o
CC fs/coredump.o
CC [M] block/bfq-wf2q.o
CC [M] block/bfq-cgroup.o
CC fs/drop_caches.o
CC fs/fhandle.o
AR block/built-in.a
LD [M] block/bfq.o
CC io_uring/io_uring.o
CC fs/iomap/trace.o
CC fs/iomap/iter.o
CC fs/iomap/buffered-io.o
CC io_uring/opdef.o
CC fs/iomap/direct-io.o
CC io_uring/kbuf.o
CC fs/iomap/ioend.o
CC io_uring/rsrc.o
CC fs/iomap/fiemap.o
CC fs/iomap/seek.o
CC fs/iomap/bio.o
CC io_uring/notif.o
CC fs/iomap/swapfile.o
CC io_uring/tctx.o
AR fs/iomap/built-in.a
CC fs/quota/dquot.o
CC io_uring/filetable.o
CC io_uring/rw.o
CC fs/quota/quota.o
CC io_uring/poll.o
CC fs/quota/kqid.o
AR fs/quota/built-in.a
CC fs/proc/task_mmu.o
CC io_uring/tw.o
CC io_uring/wait.o
CC fs/proc/inode.o
CC fs/proc/root.o
CC io_uring/eventfd.o
CC fs/proc/base.o
CC io_uring/uring_cmd.o
CC io_uring/openclose.o
CC io_uring/sqpoll.o
CC fs/proc/generic.o
CC fs/proc/array.o
CC io_uring/xattr.o
CC fs/proc/fd.o
CC io_uring/nop.o
CC io_uring/fs.o
CC fs/proc/proc_tty.o
CC fs/proc/cmdline.o
CC io_uring/splice.o
CC fs/proc/consoles.o
CC io_uring/sync.o
CC fs/proc/cpuinfo.o
CC fs/proc/devices.o
CC io_uring/msg_ring.o
CC fs/proc/loadavg.o
CC io_uring/advise.o
CC fs/proc/meminfo.o
CC io_uring/statx.o
CC fs/proc/stat.o
CC fs/proc/uptime.o
CC io_uring/timeout.o
CC fs/proc/util.o
CC fs/proc/version.o
CC io_uring/cancel.o
CC fs/proc/softirqs.o
CC fs/proc/namespaces.o
CC io_uring/waitid.o
CC fs/proc/self.o
CC io_uring/register.o
CC fs/proc/thread_self.o
CC fs/proc/proc_sysctl.o
CC io_uring/truncate.o
CC fs/proc/proc_net.o
CC io_uring/memmap.o
CC io_uring/alloc_cache.o
CC fs/proc/kcore.o
CC io_uring/query.o
CC fs/proc/kmsg.o
CC io_uring/loop.o
CC fs/proc/page.o
CC io_uring/io-wq.o
AR fs/proc/built-in.a
CC fs/kernfs/mount.o
CC fs/kernfs/inode.o
CC io_uring/futex.o
CC fs/kernfs/dir.o
CC io_uring/epoll.o
CC io_uring/napi.o
CC fs/kernfs/file.o
CC fs/kernfs/symlink.o
CC io_uring/net.o
AR fs/kernfs/built-in.a
CC fs/sysfs/file.o
CC fs/sysfs/dir.o
CC fs/sysfs/symlink.o
CC io_uring/cmd_net.o
CC fs/sysfs/mount.o
CC io_uring/fdinfo.o
CC fs/sysfs/group.o
AR fs/sysfs/built-in.a
CC fs/devpts/inode.o
CC io_uring/bpf_filter.o
AR fs/devpts/built-in.a
CC fs/ext4/balloc.o
AR io_uring/built-in.a
CC lib/buildid.o
CC lib/dump_stack.o
CC fs/ext4/bitmap.o
CC lib/kobject_uevent.o
CC fs/ext4/block_validity.o
CC fs/ext4/dir.o
CC lib/logic_pio.o
CC lib/nmi_backtrace.o
CC fs/ext4/ext4_jbd2.o
CC lib/seq_buf.o
CC lib/sys_info.o
CC fs/ext4/extents.o
CC lib/vsprintf.o
CC lib/bust_spinlocks.o
CC lib/scatterlist.o
CC fs/ext4/extents_status.o
CC lib/iov_iter.o
CC fs/ext4/file.o
CC lib/bsearch.o
CC fs/ext4/fsmap.o
CC lib/kfifo.o
CC lib/percpu-refcount.o
CC fs/ext4/fsync.o
CC lib/rhashtable.o
CC fs/ext4/hash.o
CC fs/ext4/ialloc.o
CC lib/bucket_locks.o
CC lib/bitmap-str.o
CC lib/string_helpers.o
CC fs/ext4/indirect.o
CC lib/crypto/md5.o
AR lib/crypto/built-in.a
CC lib/syscall.o
CC fs/ext4/inline.o
CC lib/nlattr.o
CC lib/dynamic_queue_limits.o
CC fs/ext4/inode.o
CC lib/dim/net_dim.o
AR lib/dim/built-in.a
CC lib/net_utils.o
CC lib/stackdepot.o
CC lib/sbitmap.o
AR lib/lib.a
AR lib/built-in.a
CC fs/ext4/ioctl.o
CC drivers/tty/tty_io.o
CC fs/ext4/mballoc.o
CC drivers/tty/n_tty.o
CC drivers/tty/tty_ioctl.o
CC drivers/tty/tty_ldisc.o
CC drivers/tty/tty_buffer.o
CC fs/ext4/migrate.o
CC drivers/tty/tty_port.o
CC drivers/tty/tty_mutex.o
CC fs/ext4/mmp.o
CC drivers/tty/tty_ldsem.o
CC fs/ext4/move_extent.o
CC drivers/tty/tty_baudrate.o
CC drivers/tty/tty_jobctrl.o
CC fs/ext4/namei.o
CC drivers/tty/n_null.o
CC drivers/tty/pty.o
CC drivers/tty/sysrq.o
CC fs/ext4/page-io.o
AR drivers/tty/built-in.a
CC drivers/char/mem.o
CC fs/ext4/readpage.o
CC drivers/char/random.o
CC fs/ext4/resize.o
CC drivers/char/misc.o
CC drivers/char/hw_random/core.o
CC fs/ext4/super.o
AR drivers/char/hw_random/built-in.a
AR drivers/char/built-in.a
CC drivers/iommu/iommu-pages.o
AR drivers/iommu/built-in.a
CC drivers/base/component.o
CC drivers/base/core.o
CC fs/ext4/symlink.o
CC drivers/base/dd.o
CC fs/ext4/sysfs.o
CC drivers/base/syscore.o
CC fs/ext4/xattr.o
CC drivers/base/class.o
CC drivers/base/platform.o
CC fs/ext4/xattr_hurd.o
CC drivers/base/init.o
CC drivers/base/topology.o
CC fs/ext4/xattr_trusted.o
CC drivers/base/property.o
CC fs/ext4/xattr_user.o
CC fs/ext4/fast_commit.o
CC drivers/base/devtmpfs.o
CC drivers/base/power/qos.o
CC fs/ext4/orphan.o
CC drivers/base/power/main.o
AR fs/ext4/built-in.a
CC fs/jbd2/transaction.o
CC drivers/base/power/wakeup.o
CC fs/jbd2/commit.o
AR drivers/base/power/built-in.a
CC drivers/base/firmware_loader/main.o
CC fs/jbd2/recovery.o
AR drivers/base/firmware_loader/built-in.a
AR drivers/base/built-in.a
CC drivers/block/loop.o
CC fs/jbd2/checkpoint.o
CC [M] drivers/block/nbd.o
CC fs/jbd2/revoke.o
CC fs/jbd2/journal.o
AR drivers/block/built-in.a
CC drivers/net/loopback.o
AR fs/jbd2/built-in.a
CC fs/ramfs/inode.o
CC fs/ramfs/file-mmu.o
CC [M] drivers/net/dummy.o
AR fs/ramfs/built-in.a
CC fs/exportfs/expfs.o
AR fs/exportfs/built-in.a
CC [M] drivers/net/tun.o
CC fs/nls/nls_ucs2_utils.o
AR fs/nls/built-in.a
CC fs/smb/server/unicode.o
CC fs/smb/server/auth.o
CC fs/smb/server/vfs.o
CC [M] drivers/net/ppp/ppp_generic.o
CC fs/smb/server/vfs_cache.o
CC [M] drivers/net/slip/slip.o
CC fs/smb/server/server.o
CC [M] drivers/net/slip/slhc.o
CC fs/smb/server/ndr.o
CC fs/smb/server/misc.o
AR drivers/net/built-in.a
CC drivers/input/serio/serport.o
CC drivers/input/serio/libps2.o
CC fs/smb/server/oplock.o
AR drivers/input/serio/built-in.a
CC drivers/input/input.o
CC drivers/input/input-compat.o
CC fs/smb/server/connection.o
CC drivers/input/input-mt.o
CC drivers/input/input-poller.o
CC drivers/input/ff-core.o
CC fs/smb/server/ksmbd_work.o
CC drivers/input/touchscreen.o
CC drivers/input/touch-overlay.o
CC fs/smb/server/crypto_ctx.o
CC drivers/input/keyboard/atkbd.o
CC fs/smb/server/mgmt/ksmbd_ida.o
CC fs/smb/server/mgmt/user_config.o
CC fs/smb/server/mgmt/share_config.o
AR drivers/input/keyboard/built-in.a
CC drivers/input/mouse/psmouse-base.o
CC fs/smb/server/mgmt/tree_connect.o
CC drivers/input/mouse/synaptics.o
CC fs/smb/server/mgmt/user_session.o
CC drivers/input/mouse/focaltech.o
CC drivers/input/mouse/alps.o
CC fs/smb/server/smb_common.o
CC drivers/input/mouse/byd.o
CC fs/smb/server/transport_tcp.o
CC drivers/input/mouse/logips2pp.o
CC drivers/input/mouse/trackpoint.o
CC drivers/input/mouse/cypress_ps2.o
CC fs/smb/server/transport_ipc.o
AR drivers/input/mouse/built-in.a
AR drivers/input/built-in.a
CC fs/smb/server/smbacl.o
CC drivers/pps/pps.o
CC drivers/pps/kapi.o
CC fs/smb/server/smb2pdu.o
AR drivers/pps/built-in.a
CC drivers/ptp/ptp_clock.o
CC drivers/ptp/ptp_chardev.o
CC drivers/ptp/ptp_sysfs.o
CC drivers/ptp/ptp_vclock.o
AR drivers/ptp/built-in.a
CC drivers/hid/hid-core.o
CC drivers/hid/hid-input.o
CC fs/smb/server/smb2ops.o
CC fs/smb/server/smb2misc.o
CC drivers/hid/hid-quirks.o
CC fs/smb/server/asn1.o
CC drivers/hid/hid-debug.o
CC fs/smb/server/compress.o
CC drivers/hid/hid-generic.o
AR drivers/hid/built-in.a
AR drivers/built-in.a
CC net/devres.o
CC fs/smb/server/proc.o
AR fs/smb/server/built-in.a
AR fs/smb/built-in.a
CC fs/fuse/trace.o
CC net/socket.o
CC fs/fuse/dev.o
CC fs/fuse/dir.o
CC net/core/sock.o
CC fs/fuse/file.o
CC net/core/skbuff.o
CC fs/fuse/inode.o
CC fs/fuse/control.o
CC fs/fuse/xattr.o
CC fs/fuse/acl.o
CC fs/fuse/readdir.o
CC fs/fuse/ioctl.o
CC fs/fuse/req_timeout.o
CC net/core/datagram.o
CC fs/fuse/req.o
CC fs/fuse/poll.o
CC fs/fuse/notify.o
CC net/core/stream.o
CC fs/fuse/iomode.o
CC fs/fuse/passthrough.o
CC net/core/scm.o
CC fs/fuse/backing.o
CC fs/fuse/sysctl.o
CC net/core/gen_stats.o
CC fs/fuse/dev_uring.o
CC net/core/gen_estimator.o
CC [M] fs/fuse/cuse.o
CC net/core/net_namespace.o
AR fs/fuse/built-in.a
CC fs/hostfs/hostfs_kern.o
AR fs/hostfs/built-in.a
CC fs/debugfs/inode.o
CC net/core/secure_seq.o
CC fs/debugfs/file.o
CC net/core/flow_dissector.o
AR fs/debugfs/built-in.a
CC [M] fs/binfmt_misc.o
CC [M] fs/isofs/namei.o
CC net/core/sysctl_net_core.o
CC [M] fs/isofs/inode.o
CC net/core/dev.o
CC [M] fs/isofs/dir.o
CC [M] fs/isofs/util.o
CC [M] fs/isofs/rock.o
CC [M] fs/isofs/export.o
CC [M] fs/isofs/joliet.o
LD [M] fs/isofs/isofs.o
CC [M] fs/autofs/init.o
CC [M] fs/autofs/inode.o
CC [M] fs/autofs/root.o
CC [M] fs/autofs/symlink.o
CC [M] fs/autofs/waitq.o
CC net/core/dev_api.o
CC [M] fs/autofs/expire.o
CC net/core/dev_addr_lists.o
CC [M] fs/autofs/dev-ioctl.o
LD [M] fs/autofs/autofs4.o
AR fs/built-in.a
CC net/core/dst.o
CC net/ethernet/eth.o
CC net/core/netevent.o
AR net/ethernet/built-in.a
CC net/sched/sch_generic.o
CC net/core/neighbour.o
CC net/sched/sch_mq.o
CC net/sched/sch_frag.o
CC net/core/rtnetlink.o
AR net/sched/built-in.a
CC net/netlink/af_netlink.o
CC net/netlink/genetlink.o
CC net/core/utils.o
CC net/netlink/policy.o
CC net/core/link_watch.o
AR net/netlink/built-in.a
CC net/ethtool/ioctl.o
CC net/core/filter.o
CC net/ethtool/common.o
CC net/ethtool/netlink.o
CC net/ethtool/bitset.o
CC net/ethtool/strset.o
CC net/ethtool/linkinfo.o
CC net/core/sock_diag.o
CC net/ethtool/linkmodes.o
CC net/core/dev_ioctl.o
CC net/ethtool/rss.o
CC net/core/tso.o
CC net/ethtool/linkstate.o
CC net/core/sock_reuseport.o
CC net/ethtool/debug.o
CC net/core/fib_notifier.o
CC net/ethtool/wol.o
CC net/core/xdp.o
CC net/ethtool/features.o
CC net/ethtool/privflags.o
CC net/core/flow_offload.o
CC net/ethtool/rings.o
CC net/core/gro.o
CC net/ethtool/channels.o
CC net/ethtool/coalesce.o
CC net/core/netdev-genl.o
CC net/ethtool/pause.o
CC net/ethtool/eee.o
CC net/core/netdev-genl-gen.o
CC net/core/netdev_work.o
CC net/ethtool/tsinfo.o
CC net/core/gso.o
CC net/ethtool/cabletest.o
CC net/core/net-sysfs.o
CC net/ethtool/tunnels.o
CC net/ethtool/fec.o
CC net/core/hotdata.o
CC net/ethtool/eeprom.o
CC net/core/netdev_config.o
CC net/ethtool/stats.o
CC net/core/netdev_rx_queue.o
CC net/core/netdev_queues.o
CC net/ethtool/phc_vclocks.o
CC net/ethtool/mm.o
CC net/core/net-procfs.o
CC net/ethtool/module.o
CC net/core/ptp_classifier.o
CC net/ethtool/cmis_fw_update.o
CC net/core/dst_cache.o
CC net/ethtool/cmis_cdb.o
CC net/core/gro_cells.o
AR net/core/built-in.a
CC net/ethtool/pse-pd.o
CC net/ipv4/route.o
CC net/ethtool/plca.o
CC net/ethtool/phy.o
CC net/ethtool/tsconfig.o
CC net/ipv4/inetpeer.o
CC net/ethtool/mse.o
CC net/ipv4/protocol.o
AR net/ethtool/built-in.a
CC net/ipv4/ip_input.o
CC net/ipv4/ip_fragment.o
CC net/ipv4/ip_forward.o
CC net/ipv4/ip_options.o
CC net/ipv4/ip_output.o
CC net/unix/af_unix.o
CC net/ipv4/ip_sockglue.o
CC net/unix/garbage.o
CC net/ipv4/inet_hashtables.o
CC net/unix/sysctl_net_unix.o
AR net/unix/built-in.a
CC net/ipv6/af_inet6.o
CC net/ipv4/inet_timewait_sock.o
CC net/ipv6/anycast.o
CC net/ipv4/inet_connection_sock.o
CC net/ipv6/ip6_output.o
CC net/ipv4/tcp.o
CC net/ipv6/ip6_input.o
CC net/ipv6/addrconf.o
CC net/ipv4/tcp_input.o
CC net/ipv6/addrlabel.o
CC net/ipv6/route.o
CC net/ipv4/tcp_output.o
CC net/ipv4/tcp_timer.o
CC net/ipv6/ip6_fib.o
CC net/ipv4/tcp_ipv4.o
CC net/ipv6/ipv6_sockglue.o
CC net/ipv6/ndisc.o
CC net/ipv4/tcp_minisocks.o
CC net/ipv4/tcp_cong.o
CC net/ipv6/udp.o
CC net/ipv4/tcp_metrics.o
CC net/ipv6/raw.o
CC net/ipv4/tcp_fastopen.o
CC net/ipv4/tcp_recovery.o
CC net/ipv6/icmp.o
CC net/ipv4/tcp_ulp.o
CC net/ipv6/mcast.o
CC net/ipv4/tcp_offload.o
CC net/ipv4/tcp_plb.o
CC net/ipv6/reassembly.o
CC net/ipv4/datagram.o
CC net/ipv4/raw.o
CC net/ipv6/tcp_ipv6.o
CC net/ipv4/udp.o
CC net/ipv6/ping.o
CC net/ipv6/exthdrs.o
CC net/ipv4/udp_offload.o
CC net/ipv6/datagram.o
CC net/ipv4/arp.o
CC net/ipv6/ip6_flowlabel.o
CC net/ipv4/icmp.o
CC net/ipv6/inet6_connection_sock.o
CC net/ipv6/udp_offload.o
CC net/ipv4/devinet.o
CC net/ipv6/seg6.o
CC net/ipv6/fib6_notifier.o
CC net/ipv4/af_inet.o
CC net/ipv6/rpl.o
CC net/ipv6/ioam6.o
CC net/ipv4/igmp.o
CC net/ipv6/sysctl_net_ipv6.o
CC net/ipv6/proc.o
CC net/ipv4/fib_frontend.o
CC net/ipv6/addrconf_core.o
CC net/ipv6/exthdrs_core.o
CC net/ipv4/fib_semantics.o
CC net/ipv6/ip6_checksum.o
CC net/ipv6/ip6_icmp.o
CC net/ipv4/fib_trie.o
CC net/ipv6/output_core.o
CC net/ipv6/protocol.o
CC net/ipv6/ip6_offload.o
CC net/ipv4/fib_notifier.o
CC net/ipv4/inet_fragment.o
CC net/ipv6/exthdrs_offload.o
CC net/ipv6/inet6_hashtables.o
CC net/ipv4/ping.o
CC net/ipv6/mcast_snoop.o
CC net/ipv4/ip_tunnel_core.o
CC [M] net/ipv6/sit.o
CC net/ipv4/gre_offload.o
AR net/ipv6/built-in.a
CC net/packet/af_packet.o
CC net/ipv4/metrics.o
CC net/ipv4/netlink.o
CC net/ipv4/nexthop.o
AR net/packet/built-in.a
CC net/ipv4/udp_tunnel_stub.o
CC net/ipv4/sysctl_net_ipv4.o
CC net/ipv4/proc.o
CC net/ipv4/inet_diag.o
CC net/sysctl_net.o
CC net/ipv4/tcp_diag.o
CC net/ipv4/tcp_cubic.o
CC [M] net/ipv4/ip_tunnel.o
CC [M] net/ipv4/tunnel4.o
AR net/ipv4/built-in.a
AR net/built-in.a
AR built-in.a
AR built-in-fixup.a
COPY vmlinux.a
LD vmlinux.o
MODPOST Module.symvers
CC [M] fs/fuse/cuse.mod.o
CC .vmlinux.export.o
CC [M] .module-common.o
CC [M] fs/binfmt_misc.mod.o
UPD include/generated/utsversion.h
CC init/version-timestamp.o
CC [M] fs/isofs/isofs.mod.o
CC [M] fs/autofs/autofs4.mod.o
KSYMS .tmp_vmlinux0.kallsyms.S
AS .tmp_vmlinux0.kallsyms.o
LD .tmp_vmlinux1
CC [M] block/bfq.mod.o
CC [M] drivers/block/nbd.mod.o
CC [M] drivers/net/dummy.mod.o
NM .tmp_vmlinux1.syms
CC [M] drivers/net/tun.mod.o
KSYMS .tmp_vmlinux1.kallsyms.S
CC [M] drivers/net/ppp/ppp_generic.mod.o
AS .tmp_vmlinux1.kallsyms.o
CC [M] drivers/net/slip/slip.mod.o
LD .tmp_vmlinux2
CC [M] drivers/net/slip/slhc.mod.o
CC [M] net/ipv4/ip_tunnel.mod.o
CC [M] net/ipv4/tunnel4.mod.o
NM .tmp_vmlinux2.syms
KSYMS .tmp_vmlinux2.kallsyms.S
CC [M] net/ipv6/sit.mod.o
AS .tmp_vmlinux2.kallsyms.o
LD [M] fs/fuse/cuse.ko
LD [M] fs/binfmt_misc.ko
LD [M] fs/isofs/isofs.ko
LD [M] fs/autofs/autofs4.ko
LD [M] block/bfq.ko
LD [M] drivers/block/nbd.ko
LD [M] drivers/net/dummy.ko
LD [M] drivers/net/tun.ko
LD [M] drivers/net/ppp/ppp_generic.ko
LD [M] drivers/net/slip/slip.ko
LD [M] drivers/net/slip/slhc.ko
LD [M] net/ipv4/ip_tunnel.ko
LD [M] net/ipv4/tunnel4.ko
LD [M] net/ipv6/sit.ko
LD vmlinux.unstripped
NM System.map
OBJCOPY vmlinux
GEN modules.builtin.modinfo
GEN modules.builtin
LINK linux
End-to-end reproduction instructions
Linux 7.2.2 FUSE iomap read-path audit — runtime verification harness
======================================================================
Prerequisites
-------------
1. Linux 7.2.2 source: linux-7.2.2.tar.xz from cdn.kernel.org
2. A UML-capable build environment (gcc, flex, bison, bc)
3. The kernel config from ../kernel/config-um-fuse (ARCH=um, KASAN,
FUSE_FS=y, BLK_DEV_LOOP=y, HOSTFS root)
Kernel build
------------
tar xf linux-7.2.2.tar.xz && cd linux-7.2.2
cp <path>/config-um-fuse .config
make ARCH=um -j$(nproc) # tools: flex/bison/bc needed on PATH
Guest staging tree
------------------
mkdir -p staging/poc staging/tmp staging/dev staging/proc staging/sys
cp <path>/poc/fusepoc staging/poc/
cp <path>/poc/init staging/init
Run (pristine control)
----------------------
cd linux-7.2.2
TMPDIR=<abs path to staging> ./linux rootfstype=hostfs \
rootflags=<abs path to staging> rw init=/init \
con0=fd:0,fd:1 con=none mem=1024M < /dev/null \
> pristine.log 2>&1
Expected (see logs/poc-run16-pristine.log):
TEST bs512 -> [T4] VERIFY: all 16384 bytes CORRECT
TEST bs4096 -> [T4] VERIFY: all 16384 bytes CORRECT
(both defects latent in stock 7.2.2)
Run (precondition demonstration — Defect A)
-------------------------------------------
cd linux-7.2.2
patch -p1 < <path>/0000-demo-precondition-uptodate-invalidation.patch
make ARCH=um -j$(nproc)
# run as above -> see logs/poc-run15-precondition.log
# Expected:
# TEST bs512: [T4] VERIFY: DATA CORRUPT — 1024 of 16384 bytes wrong!
# first mismatch at file offset 0x1000
# server log: REQ READ offset=5120 size=3072 (correct sub-folio read)
# TEST bs4096: all bytes CORRECT (control)
patch -R -p1 < <path>/0000-demo-precondition-uptodate-invalidation.patch
make ARCH=um -j$(nproc) # restore pristine
What the PoC does
-----------------
- fusepoc (fork model, like fusermount):
child = raw /dev/fuse protocol server (INIT/LOOKUP/GETATTR/SETATTR/
OPEN/READ/FALLOCATE/FLUSH/RELEASE/FORGET/DESTROY); serves one
16384-byte file "target" of 16-byte offset-hex records; punched
ranges are holes (zeros); every request is logged.
parent = creates a loop device, mounts it as fuseblk (blksize=512 /
blksize=4096), runs the T1..T4 trigger (see report section 5)
and verifies the returned data byte-for-byte.
- init: minimal guest init (proc/sys/devtmpfs, device nodes, execve of the
PoC, poweroff).
Notes
-----
- /dev/shm in the build container is noexec; UML needs TMPDIR pointing at an
exec-able directory (the staging tree works).
- The server replies FOPEN_KEEP_CACHE so the page cache survives close (the
default close-time cache drop would mask the trigger).
- The 7.2 fuse_get_dev() change returns EPERM for pre-mount reads of
/dev/fuse (non-sync_init); the PoC server retries until the mount completes.
#
# Automatically generated file; DO NOT EDIT.
# Linux/um 7.2.2 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="gcc (Debian 14.2.0-19) 14.2.0"
CONFIG_CC_IS_GCC=y
CONFIG_GCC_VERSION=140200
CONFIG_CLANG_VERSION=0
CONFIG_AS_IS_GNU=y
CONFIG_AS_VERSION=24400
CONFIG_LD_IS_BFD=y
CONFIG_LD_VERSION=24400
CONFIG_LLD_VERSION=0
CONFIG_RUSTC_VERSION=0
CONFIG_RUSTC_LLVM_VERSION=0
CONFIG_RUSTC_LLVM_MAJOR_VERSION=0
CONFIG_CC_CAN_LINK=y
CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
CONFIG_TOOLS_SUPPORT_RELR=y
CONFIG_CC_HAS_ASM_INLINE=y
CONFIG_CC_HAS_ASSUME=y
CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
CONFIG_PAHOLE_VERSION=0
CONFIG_CONSTRUCTORS=y
CONFIG_IRQ_WORK=y
CONFIG_THREAD_INFO_IN_TASK=y
#
# General setup
#
CONFIG_BROKEN_ON_SMP=y
CONFIG_INIT_ENV_ARG_LIMIT=128
# CONFIG_WERROR is not set
CONFIG_LOCALVERSION=""
CONFIG_LOCALVERSION_AUTO=y
CONFIG_BUILD_SALT=""
CONFIG_DEFAULT_INIT=""
CONFIG_DEFAULT_HOSTNAME="(none)"
CONFIG_SYSVIPC=y
CONFIG_SYSVIPC_SYSCTL=y
CONFIG_POSIX_MQUEUE=y
CONFIG_POSIX_MQUEUE_SYSCTL=y
# CONFIG_WATCH_QUEUE is not set
CONFIG_CROSS_MEMORY_ATTACH=y
# CONFIG_AUDIT is not set
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
#
# IRQ subsystem
#
CONFIG_GENERIC_IRQ_SHOW=y
CONFIG_SPARSE_IRQ=y
# CONFIG_GENERIC_IRQ_DEBUGFS is not set
# end of IRQ subsystem
CONFIG_GENERIC_CLOCKEVENTS=y
#
# Timers subsystem
#
CONFIG_TICK_ONESHOT=y
CONFIG_NO_HZ_COMMON=y
# CONFIG_HZ_PERIODIC is not set
CONFIG_NO_HZ_IDLE=y
CONFIG_NO_HZ=y
CONFIG_HIGH_RES_TIMERS=y
# CONFIG_POSIX_AUX_CLOCKS is not set
# end of Timers subsystem
CONFIG_BPF=y
#
# BPF subsystem
#
# CONFIG_BPF_SYSCALL is not set
# end of BPF subsystem
CONFIG_PREEMPT_VOLUNTARY_BUILD=y
CONFIG_PREEMPT_VOLUNTARY=y
# CONFIG_PREEMPT is not set
#
# CPU/Task time and stats accounting
#
CONFIG_TICK_CPU_ACCOUNTING=y
CONFIG_BSD_PROCESS_ACCT=y
# CONFIG_BSD_PROCESS_ACCT_V3 is not set
# CONFIG_TASKSTATS is not set
# CONFIG_PSI is not set
# end of CPU/Task time and stats accounting
#
# RCU Subsystem
#
CONFIG_TINY_RCU=y
# CONFIG_RCU_EXPERT is not set
CONFIG_TINY_SRCU=y
# end of RCU Subsystem
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
# CONFIG_IKHEADERS is not set
CONFIG_LOG_BUF_SHIFT=14
# CONFIG_PRINTK_INDEX is not set
#
# Scheduler features
#
# end of Scheduler features
CONFIG_CC_HAS_INT128=y
CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
CONFIG_CC_MS_EXTENSIONS="-fms-extensions"
CONFIG_GCC10_NO_ARRAY_BOUNDS=y
CONFIG_CC_NO_ARRAY_BOUNDS=y
CONFIG_GCC_NO_STRINGOP_OVERFLOW=y
CONFIG_CC_NO_STRINGOP_OVERFLOW=y
CONFIG_CGROUPS=y
# CONFIG_CGROUP_FAVOR_DYNMODS is not set
# CONFIG_MEMCG is not set
CONFIG_BLK_CGROUP=y
CONFIG_CGROUP_SCHED=y
CONFIG_GROUP_SCHED_WEIGHT=y
CONFIG_FAIR_GROUP_SCHED=y
# CONFIG_CFS_BANDWIDTH is not set
# CONFIG_RT_GROUP_SCHED is not set
# CONFIG_CGROUP_PIDS is not set
# CONFIG_CGROUP_RDMA is not set
# CONFIG_CGROUP_DMEM is not set
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
# CONFIG_CGROUP_MISC is not set
# CONFIG_CGROUP_DEBUG is not set
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_TIME_NS=y
CONFIG_IPC_NS=y
# CONFIG_USER_NS is not set
# CONFIG_PID_NS is not set
CONFIG_NET_NS=y
# CONFIG_CHECKPOINT_RESTORE is not set
# CONFIG_SCHED_AUTOGROUP is not set
# CONFIG_RELAY is not set
# CONFIG_BLK_DEV_INITRD is not set
# CONFIG_BOOT_CONFIG is not set
CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=1021
# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
CONFIG_SYSCTL=y
CONFIG_HAVE_UID16=y
# CONFIG_SYSFS_SYSCALL is not set
# CONFIG_EXPERT is not set
CONFIG_UID16=y
CONFIG_MULTIUSER=y
CONFIG_FHANDLE=y
CONFIG_POSIX_TIMERS=y
CONFIG_PRINTK=y
CONFIG_BUG=y
CONFIG_ELF_CORE=y
CONFIG_FUTEX=y
CONFIG_FUTEX_PI=y
CONFIG_FUTEX_PRIVATE_HASH=y
CONFIG_EPOLL=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EVENTFD=y
CONFIG_SHMEM=y
CONFIG_AIO=y
CONFIG_IO_URING=y
CONFIG_ADVISE_SYSCALLS=y
CONFIG_MEMBARRIER=y
CONFIG_CACHESTAT_SYSCALL=y
CONFIG_KALLSYMS=y
# CONFIG_KALLSYMS_SELFTEST is not set
# CONFIG_KALLSYMS_ALL is not set
#
# Kernel Performance Events And Counters
#
# end of Kernel Performance Events And Counters
# CONFIG_PROFILING is not set
#
# Kexec and crash features
#
CONFIG_VMCORE_INFO=y
# end of Kexec and crash features
#
# Live Update and Kexec HandOver
#
# end of Live Update and Kexec HandOver
# end of General setup
#
# UML-specific options
#
CONFIG_UML=y
CONFIG_MMU=y
CONFIG_NO_IOMEM=y
CONFIG_LOCKDEP_SUPPORT=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_GENERIC_CALIBRATE_DELAY=y
CONFIG_HZ=100
CONFIG_UML_SUBARCH_SUPPORTS_SMP=y
# CONFIG_SMP is not set
CONFIG_NR_CPUS_RANGE_BEGIN=1
CONFIG_NR_CPUS_RANGE_END=1
CONFIG_NR_CPUS_DEFAULT=1
CONFIG_NR_CPUS=1
#
# Host processor type and features
#
CONFIG_CC_HAS_MARCH_NATIVE=y
# CONFIG_X86_NATIVE_CPU is not set
CONFIG_X86_INTERNODE_CACHE_SHIFT=6
CONFIG_X86_L1_CACHE_SHIFT=6
CONFIG_X86_TSC=y
CONFIG_X86_HAVE_PAE=y
CONFIG_X86_CX8=y
CONFIG_X86_CMOV=y
CONFIG_X86_MINIMUM_CPU_FAMILY=64
CONFIG_IA32_FEAT_CTL=y
CONFIG_X86_VMX_FEATURE_NAMES=y
CONFIG_CPU_SUP_INTEL=y
CONFIG_CPU_SUP_AMD=y
CONFIG_CPU_SUP_HYGON=y
CONFIG_CPU_SUP_CENTAUR=y
CONFIG_CPU_SUP_ZHAOXIN=y
CONFIG_BROADCAST_TLB_FLUSH=y
# end of Host processor type and features
CONFIG_UML_X86=y
CONFIG_64BIT=y
CONFIG_X86_64=y
CONFIG_GENERIC_HWEIGHT=y
# CONFIG_STATIC_LINK is not set
CONFIG_LD_SCRIPT_DYN=y
CONFIG_LD_SCRIPT_DYN_RPATH=y
CONFIG_HOSTFS=y
CONFIG_MCONSOLE=y
CONFIG_MAGIC_SYSRQ=y
CONFIG_KERNEL_STACK_ORDER=2
CONFIG_PGTABLE_LEVELS=4
# CONFIG_UML_TIME_TRAVEL_SUPPORT is not set
CONFIG_KASAN_SHADOW_OFFSET=0x100000000000
# end of UML-specific options
#
# UML Character Devices
#
CONFIG_STDERR_CONSOLE=y
CONFIG_SSL=y
CONFIG_NULL_CHAN=y
CONFIG_PORT_CHAN=y
CONFIG_PTY_CHAN=y
CONFIG_TTY_CHAN=y
CONFIG_XTERM_CHAN=y
CONFIG_XTERM_CHAN_DEFAULT_EMULATOR="xterm"
CONFIG_CON_ZERO_CHAN="fd:0,fd:1"
CONFIG_CON_CHAN="pts"
CONFIG_SSL_CHAN="pts"
# end of UML Character Devices
#
# UML Network Devices
#
# CONFIG_UML_NET_VECTOR is not set
# end of UML Network Devices
# CONFIG_VIRTIO_UML is not set
# CONFIG_UML_PCI_OVER_VFIO is not set
CONFIG_ARCH_SUSPEND_POSSIBLE=y
#
# Power management options
#
CONFIG_SUSPEND=y
CONFIG_SUSPEND_FREEZER=y
CONFIG_PM_SLEEP=y
# CONFIG_PM_AUTOSLEEP is not set
# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
# CONFIG_PM_WAKELOCKS is not set
CONFIG_PM=y
# CONFIG_PM_DEBUG is not set
# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
# end of Power management options
CONFIG_CPU_MITIGATIONS=y
#
# General architecture-dependent options
#
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
CONFIG_TRACE_IRQFLAGS_SUPPORT=y
CONFIG_HAVE_ARCH_TRACEHOOK=y
CONFIG_GENERIC_SMP_IDLE_THREAD=y
CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y
CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
CONFIG_HAVE_ASM_MODVERSIONS=y
CONFIG_HAVE_RUST=y
CONFIG_MMU_GATHER_TABLE_FREE=y
CONFIG_MMU_GATHER_RCU_TABLE_FREE=y
CONFIG_MMU_LAZY_TLB_REFCOUNT=y
CONFIG_HAVE_ARCH_SECCOMP=y
CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
# CONFIG_SECCOMP_CACHE_DEBUG is not set
CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
CONFIG_LTO_NONE=y
CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
CONFIG_MODULES_USE_ELF_RELA=y
CONFIG_HAVE_PAGE_SIZE_4KB=y
CONFIG_PAGE_SIZE_4KB=y
CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
CONFIG_PAGE_SHIFT=12
# CONFIG_COMPAT_32BIT_TIME is not set
CONFIG_HAVE_ARCH_VMAP_STACK=y
CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
CONFIG_STRICT_KERNEL_RWX=y
# CONFIG_LOCK_EVENT_COUNTS is not set
#
# GCOV-based kernel profiling
#
# CONFIG_GCOV_KERNEL is not set
CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
# end of GCOV-based kernel profiling
CONFIG_HAVE_GCC_PLUGINS=y
CONFIG_FUNCTION_ALIGNMENT=0
CONFIG_CC_HAS_MIN_FUNCTION_ALIGNMENT=y
CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y
# end of General architecture-dependent options
CONFIG_RT_MUTEXES=y
CONFIG_MODULES=y
# CONFIG_MODULE_DEBUG is not set
# CONFIG_MODULE_FORCE_LOAD is not set
CONFIG_MODULE_UNLOAD=y
# CONFIG_MODULE_FORCE_UNLOAD is not set
# CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set
# CONFIG_MODVERSIONS is not set
# CONFIG_MODULE_SRCVERSION_ALL is not set
# CONFIG_MODULE_SIG is not set
# CONFIG_MODULE_COMPRESS is not set
# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
CONFIG_MODPROBE_PATH="/sbin/modprobe"
# CONFIG_TRIM_UNUSED_KSYMS is not set
CONFIG_BLOCK=y
CONFIG_BLOCK_LEGACY_AUTOLOAD=y
CONFIG_BLK_CGROUP_RWSTAT=y
CONFIG_BLK_ICQ=y
# CONFIG_BLK_DEV_BSGLIB is not set
# CONFIG_BLK_DEV_INTEGRITY is not set
CONFIG_BLK_DEV_WRITE_MOUNTED=y
# CONFIG_BLK_DEV_ZONED is not set
# CONFIG_BLK_DEV_THROTTLING is not set
# CONFIG_BLK_WBT is not set
# CONFIG_BLK_CGROUP_IOLATENCY is not set
# CONFIG_BLK_CGROUP_IOCOST is not set
# CONFIG_BLK_CGROUP_IOPRIO is not set
CONFIG_BLK_DEBUG_FS=y
# CONFIG_BLK_INLINE_ENCRYPTION is not set
#
# Partition Types
#
# CONFIG_PARTITION_ADVANCED is not set
CONFIG_MSDOS_PARTITION=y
CONFIG_EFI_PARTITION=y
# end of Partition Types
CONFIG_BLK_PM=y
# CONFIG_BLK_ERROR_INJECTION is not set
#
# IO Schedulers
#
CONFIG_MQ_IOSCHED_DEADLINE=y
CONFIG_MQ_IOSCHED_KYBER=y
CONFIG_IOSCHED_BFQ=m
CONFIG_BFQ_GROUP_IOSCHED=y
# CONFIG_BFQ_CGROUP_DEBUG is not set
# end of IO Schedulers
CONFIG_ASN1=y
CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
CONFIG_INLINE_READ_UNLOCK=y
CONFIG_INLINE_READ_UNLOCK_IRQ=y
CONFIG_INLINE_WRITE_UNLOCK=y
CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
CONFIG_FREEZER=y
#
# Executable file formats
#
CONFIG_BINFMT_ELF=y
CONFIG_ELFCORE=y
CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
CONFIG_BINFMT_SCRIPT=y
CONFIG_BINFMT_MISC=m
CONFIG_COREDUMP=y
# end of Executable file formats
#
# Memory Management options
#
CONFIG_SWAP=y
# CONFIG_ZSWAP is not set
#
# Slab allocator options
#
CONFIG_SLUB=y
CONFIG_SLAB_MERGE_DEFAULT=y
# CONFIG_SLAB_FREELIST_RANDOM is not set
# CONFIG_SLAB_FREELIST_HARDENED is not set
# CONFIG_SLAB_BUCKETS is not set
# CONFIG_SLUB_STATS is not set
# CONFIG_KMALLOC_PARTITION_CACHES is not set
# end of Slab allocator options
# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set
CONFIG_COMPAT_BRK=y
CONFIG_FLATMEM=y
# CONFIG_COMPACTION is not set
# CONFIG_PAGE_REPORTING is not set
CONFIG_PCP_BATCH_SCALE_MAX=5
CONFIG_PHYS_ADDR_T_64BIT=y
# CONFIG_KSM is not set
CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
CONFIG_PAGE_MAPCOUNT=y
CONFIG_NEED_PER_CPU_KM=y
# CONFIG_CMA is not set
CONFIG_PAGE_BLOCK_MAX_ORDER=10
# CONFIG_IDLE_PAGE_TRACKING is not set
CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
CONFIG_VM_EVENT_COUNTERS=y
# CONFIG_PERCPU_STATS is not set
# CONFIG_GUP_TEST is not set
CONFIG_MEMFD_CREATE=y
# CONFIG_ANON_VMA_NAME is not set
# CONFIG_USERFAULTFD is not set
# CONFIG_LRU_GEN is not set
CONFIG_EXECMEM=y
CONFIG_PT_RECLAIM=y
#
# Data Access Monitoring
#
# CONFIG_DAMON is not set
# end of Data Access Monitoring
# end of Memory Management options
CONFIG_NET=y
#
# Networking options
#
CONFIG_PACKET=y
# CONFIG_PACKET_DIAG is not set
# CONFIG_INET_PSP is not set
CONFIG_UNIX=y
CONFIG_AF_UNIX_OOB=y
# CONFIG_UNIX_DIAG is not set
# CONFIG_TLS is not set
# CONFIG_XFRM_USER is not set
# CONFIG_NET_KEY is not set
# CONFIG_DIBS is not set
CONFIG_INET=y
# CONFIG_IP_MULTICAST is not set
# CONFIG_IP_ADVANCED_ROUTER is not set
# CONFIG_IP_PNP is not set
# CONFIG_NET_IPIP is not set
# CONFIG_NET_IPGRE_DEMUX is not set
CONFIG_NET_IP_TUNNEL=m
# CONFIG_SYN_COOKIES is not set
# CONFIG_NET_IPVTI is not set
# CONFIG_NET_FOU is not set
# CONFIG_NET_FOU_IP_TUNNELS is not set
# CONFIG_INET_AH is not set
# CONFIG_INET_ESP is not set
# CONFIG_INET_IPCOMP is not set
CONFIG_INET_TABLE_PERTURB_ORDER=16
CONFIG_INET_TUNNEL=m
CONFIG_INET_DIAG=y
CONFIG_INET_TCP_DIAG=y
# CONFIG_INET_UDP_DIAG is not set
# CONFIG_INET_RAW_DIAG is not set
# CONFIG_INET_DIAG_DESTROY is not set
# CONFIG_TCP_CONG_ADVANCED is not set
CONFIG_TCP_CONG_CUBIC=y
CONFIG_DEFAULT_TCP_CONG="cubic"
# CONFIG_TCP_AO is not set
# CONFIG_TCP_MD5SIG is not set
CONFIG_IPV6=y
# CONFIG_IPV6_ROUTER_PREF is not set
# CONFIG_IPV6_OPTIMISTIC_DAD is not set
# CONFIG_INET6_AH is not set
# CONFIG_INET6_ESP is not set
# CONFIG_INET6_IPCOMP is not set
# CONFIG_IPV6_MIP6 is not set
# CONFIG_IPV6_VTI is not set
CONFIG_IPV6_SIT=m
# CONFIG_IPV6_SIT_6RD is not set
CONFIG_IPV6_NDISC_NODETYPE=y
# CONFIG_IPV6_TUNNEL is not set
# CONFIG_IPV6_MULTIPLE_TABLES is not set
# CONFIG_IPV6_MROUTE is not set
# CONFIG_IPV6_SEG6_LWTUNNEL is not set
# CONFIG_IPV6_SEG6_HMAC is not set
# CONFIG_IPV6_RPL_LWTUNNEL is not set
# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
# CONFIG_MPTCP is not set
# CONFIG_NETWORK_SECMARK is not set
CONFIG_NET_PTP_CLASSIFY=y
# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
# CONFIG_NETFILTER is not set
# CONFIG_IP_SCTP is not set
# CONFIG_RDS is not set
# CONFIG_TIPC is not set
# CONFIG_ATM is not set
# CONFIG_L2TP is not set
# CONFIG_BRIDGE is not set
# CONFIG_NET_DSA is not set
# CONFIG_VLAN_8021Q is not set
# CONFIG_LLC2 is not set
# CONFIG_X25 is not set
# CONFIG_LAPB is not set
# CONFIG_PHONET is not set
# CONFIG_6LOWPAN is not set
# CONFIG_IEEE802154 is not set
# CONFIG_NET_SCHED is not set
# CONFIG_DCB is not set
# CONFIG_BATMAN_ADV is not set
# CONFIG_OPENVSWITCH is not set
# CONFIG_VSOCKETS is not set
# CONFIG_NETLINK_DIAG is not set
# CONFIG_MPLS is not set
# CONFIG_NET_NSH is not set
# CONFIG_HSR is not set
# CONFIG_NET_SWITCHDEV is not set
# CONFIG_NET_L3_MASTER_DEV is not set
# CONFIG_QRTR is not set
# CONFIG_NET_NCSI is not set
CONFIG_MAX_SKB_FRAGS=17
# CONFIG_CGROUP_NET_PRIO is not set
# CONFIG_CGROUP_NET_CLASSID is not set
CONFIG_NET_RX_BUSY_POLL=y
CONFIG_BQL=y
#
# Network testing
#
# CONFIG_NET_PKTGEN is not set
# end of Network testing
# end of Networking options
# CONFIG_CAN is not set
# CONFIG_BT is not set
# CONFIG_AF_RXRPC is not set
# CONFIG_AF_KCM is not set
# CONFIG_MCTP is not set
CONFIG_WIRELESS=y
# CONFIG_CFG80211 is not set
#
# CFG80211 needs to be enabled for MAC80211
#
CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
# CONFIG_RFKILL is not set
# CONFIG_NET_9P is not set
# CONFIG_CEPH_LIB is not set
# CONFIG_NFC is not set
# CONFIG_PSAMPLE is not set
# CONFIG_NET_IFE is not set
# CONFIG_LWTUNNEL is not set
CONFIG_DST_CACHE=y
CONFIG_GRO_CELLS=y
# CONFIG_FAILOVER is not set
CONFIG_ETHTOOL_NETLINK=y
#
# Device Drivers
#
# CONFIG_PCCARD is not set
#
# Generic Driver Options
#
# CONFIG_UEVENT_HELPER is not set
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
# CONFIG_DEVTMPFS_SAFE is not set
CONFIG_DRIVER_DEFERRED_PROBE_TIMEOUT=10
CONFIG_STANDALONE=y
CONFIG_PREVENT_FIRMWARE_BUILD=y
#
# Firmware loader
#
CONFIG_FW_LOADER=y
CONFIG_EXTRA_FIRMWARE=""
# CONFIG_FW_LOADER_USER_HELPER is not set
# CONFIG_FW_LOADER_COMPRESS is not set
CONFIG_FW_CACHE=y
# CONFIG_FW_UPLOAD is not set
# end of Firmware loader
CONFIG_ALLOW_DEV_COREDUMP=y
# CONFIG_DEBUG_DRIVER is not set
# CONFIG_DEBUG_DEVRES is not set
# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
CONFIG_GENERIC_CPU_DEVICES=y
# CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set
# end of Generic Driver Options
#
# Bus devices
#
# CONFIG_MHI_BUS is not set
# CONFIG_MHI_BUS_EP is not set
# end of Bus devices
# CONFIG_CONNECTOR is not set
#
# Firmware Drivers
#
#
# ARM System Control and Management Interface Protocol
#
# end of ARM System Control and Management Interface Protocol
# CONFIG_GOOGLE_FIRMWARE is not set
#
# Qualcomm firmware drivers
#
# end of Qualcomm firmware drivers
#
# Tegra firmware driver
#
# end of Tegra firmware driver
# end of Firmware Drivers
# CONFIG_FWCTL is not set
# CONFIG_GNSS is not set
# CONFIG_MTD is not set
# CONFIG_OF is not set
CONFIG_BLK_DEV=y
# CONFIG_BLK_DEV_NULL_BLK is not set
# CONFIG_ZRAM is not set
CONFIG_BLK_DEV_UBD=y
# CONFIG_BLK_DEV_UBD_SYNC is not set
CONFIG_BLK_DEV_COW_COMMON=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
# CONFIG_BLK_DEV_DRBD is not set
CONFIG_BLK_DEV_NBD=m
# CONFIG_BLK_DEV_RAM is not set
# CONFIG_ATA_OVER_ETH is not set
# CONFIG_BLK_DEV_RBD is not set
# CONFIG_BLK_DEV_UBLK is not set
#
# NVME Support
#
# CONFIG_NVME_TCP is not set
# CONFIG_NVME_TARGET is not set
# end of NVME Support
#
# Misc devices
#
# CONFIG_DUMMY_IRQ is not set
# CONFIG_RPMB is not set
# CONFIG_ENCLOSURE_SERVICES is not set
# CONFIG_NTSYNC is not set
# CONFIG_C2PORT is not set
#
# EEPROM support
#
# CONFIG_EEPROM_93CX6 is not set
# end of EEPROM support
#
# Altera FPGA firmware download module (requires I2C)
#
# CONFIG_PVPANIC is not set
# end of Misc devices
#
# SCSI device support
#
CONFIG_SCSI_MOD=y
# CONFIG_RAID_ATTRS is not set
# CONFIG_SCSI is not set
# end of SCSI device support
# CONFIG_MD is not set
# CONFIG_TARGET_CORE is not set
CONFIG_NETDEVICES=y
CONFIG_NET_CORE=y
# CONFIG_BONDING is not set
CONFIG_DUMMY=m
# CONFIG_WIREGUARD is not set
# CONFIG_OVPN is not set
# CONFIG_EQUALIZER is not set
# CONFIG_NET_TEAM is not set
# CONFIG_MACVLAN is not set
# CONFIG_IPVLAN is not set
# CONFIG_VXLAN is not set
# CONFIG_GENEVE is not set
# CONFIG_BAREUDP is not set
# CONFIG_GTP is not set
# CONFIG_PFCP is not set
# CONFIG_MACSEC is not set
# CONFIG_NETCONSOLE is not set
CONFIG_TUN=m
# CONFIG_TUN_VNET_CROSS_LE is not set
# CONFIG_VETH is not set
# CONFIG_NLMON is not set
CONFIG_ETHERNET=y
CONFIG_NET_VENDOR_ALACRITECH=y
CONFIG_NET_VENDOR_ALIBABA=y
CONFIG_NET_VENDOR_AMAZON=y
CONFIG_NET_VENDOR_AQUANTIA=y
CONFIG_NET_VENDOR_ARC=y
CONFIG_NET_VENDOR_ASIX=y
CONFIG_NET_VENDOR_CAVIUM=y
CONFIG_NET_VENDOR_CORTINA=y
CONFIG_NET_VENDOR_DAVICOM=y
CONFIG_NET_VENDOR_ENGLEDER=y
CONFIG_NET_VENDOR_EZCHIP=y
CONFIG_NET_VENDOR_FUNGIBLE=y
CONFIG_NET_VENDOR_GOOGLE=y
CONFIG_NET_VENDOR_HUAWEI=y
CONFIG_NET_VENDOR_I825XX=y
CONFIG_NET_VENDOR_INTEL=y
CONFIG_NET_VENDOR_LITEX=y
CONFIG_NET_VENDOR_MARVELL=y
CONFIG_NET_VENDOR_META=y
CONFIG_NET_VENDOR_MICROCHIP=y
# CONFIG_VCAP is not set
CONFIG_NET_VENDOR_MICROSEMI=y
CONFIG_NET_VENDOR_MICROSOFT=y
CONFIG_NET_VENDOR_MUCSE=y
CONFIG_NET_VENDOR_NI=y
CONFIG_NET_VENDOR_NATSEMI=y
CONFIG_NET_VENDOR_NETRONOME=y
CONFIG_NET_VENDOR_8390=y
CONFIG_NET_VENDOR_PENSANDO=y
CONFIG_NET_VENDOR_QUALCOMM=y
# CONFIG_RMNET is not set
CONFIG_NET_VENDOR_RENESAS=y
CONFIG_NET_VENDOR_ROCKER=y
CONFIG_NET_VENDOR_SAMSUNG=y
CONFIG_NET_VENDOR_SOLARFLARE=y
CONFIG_NET_VENDOR_SOCIONEXT=y
CONFIG_NET_VENDOR_SYNOPSYS=y
CONFIG_NET_VENDOR_VERTEXCOM=y
CONFIG_NET_VENDOR_VIA=y
CONFIG_NET_VENDOR_WANGXUN=y
CONFIG_NET_VENDOR_WIZNET=y
CONFIG_NET_VENDOR_XILINX=y
# CONFIG_PHYLIB is not set
#
# PCS device drivers
#
# CONFIG_PCS_XPCS is not set
# end of PCS device drivers
CONFIG_PPP=m
# CONFIG_PPP_BSDCOMP is not set
# CONFIG_PPP_DEFLATE is not set
# CONFIG_PPP_FILTER is not set
# CONFIG_PPP_MPPE is not set
# CONFIG_PPP_MULTILINK is not set
# CONFIG_PPPOE is not set
CONFIG_PPPOE_HASH_BITS=4
# CONFIG_PPP_ASYNC is not set
# CONFIG_PPP_SYNC_TTY is not set
CONFIG_SLIP=m
CONFIG_SLHC=m
# CONFIG_SLIP_COMPRESSED is not set
# CONFIG_SLIP_SMART is not set
# CONFIG_SLIP_MODE_SLIP6 is not set
#
# Host-side USB support is needed for USB Network Adapter support
#
CONFIG_WLAN=y
CONFIG_WLAN_VENDOR_ADMTEK=y
CONFIG_WLAN_VENDOR_ATH=y
# CONFIG_ATH_DEBUG is not set
CONFIG_WLAN_VENDOR_ATMEL=y
CONFIG_WLAN_VENDOR_BROADCOM=y
CONFIG_WLAN_VENDOR_INTEL=y
CONFIG_WLAN_VENDOR_INTERSIL=y
CONFIG_WLAN_VENDOR_MARVELL=y
CONFIG_WLAN_VENDOR_MEDIATEK=y
CONFIG_WLAN_VENDOR_MICROCHIP=y
CONFIG_WLAN_VENDOR_PURELIFI=y
CONFIG_WLAN_VENDOR_RALINK=y
CONFIG_WLAN_VENDOR_REALTEK=y
CONFIG_WLAN_VENDOR_RSI=y
CONFIG_WLAN_VENDOR_SILABS=y
CONFIG_WLAN_VENDOR_ST=y
CONFIG_WLAN_VENDOR_TI=y
CONFIG_WLAN_VENDOR_ZYDAS=y
CONFIG_WLAN_VENDOR_QUANTENNA=y
# CONFIG_WAN is not set
#
# Wireless WAN
#
# CONFIG_WWAN is not set
# end of Wireless WAN
# CONFIG_NETDEVSIM is not set
# CONFIG_NET_FAILOVER is not set
#
# Input device support
#
CONFIG_INPUT=y
# CONFIG_INPUT_FF_MEMLESS is not set
# CONFIG_INPUT_SPARSEKMAP is not set
# CONFIG_INPUT_MATRIXKMAP is not set
CONFIG_INPUT_VIVALDIFMAP=y
#
# Userland interfaces
#
# CONFIG_INPUT_MOUSEDEV is not set
# CONFIG_INPUT_JOYDEV is not set
# CONFIG_INPUT_EVDEV is not set
#
# Input Device Drivers
#
CONFIG_INPUT_KEYBOARD=y
CONFIG_KEYBOARD_ATKBD=y
# CONFIG_KEYBOARD_LKKBD is not set
# CONFIG_KEYBOARD_NEWTON is not set
# CONFIG_KEYBOARD_STOWAWAY is not set
# CONFIG_KEYBOARD_SUNKBD is not set
# CONFIG_KEYBOARD_XTKBD is not set
CONFIG_INPUT_MOUSE=y
CONFIG_MOUSE_PS2=y
CONFIG_MOUSE_PS2_ALPS=y
CONFIG_MOUSE_PS2_BYD=y
CONFIG_MOUSE_PS2_LOGIPS2PP=y
CONFIG_MOUSE_PS2_SYNAPTICS=y
CONFIG_MOUSE_PS2_CYPRESS=y
CONFIG_MOUSE_PS2_TRACKPOINT=y
# CONFIG_MOUSE_PS2_ELANTECH is not set
# CONFIG_MOUSE_PS2_SENTELIC is not set
# CONFIG_MOUSE_PS2_TOUCHKIT is not set
CONFIG_MOUSE_PS2_FOCALTECH=y
# CONFIG_MOUSE_SERIAL is not set
# CONFIG_MOUSE_VSXXXAA is not set
# CONFIG_INPUT_TABLET is not set
# CONFIG_INPUT_TOUCHSCREEN is not set
# CONFIG_INPUT_MISC is not set
# CONFIG_RMI4_CORE is not set
#
# Hardware I/O ports
#
CONFIG_SERIO=y
CONFIG_SERIO_SERPORT=y
CONFIG_SERIO_LIBPS2=y
# CONFIG_SERIO_RAW is not set
# CONFIG_SERIO_PS2MULT is not set
# CONFIG_USERIO is not set
# end of Hardware I/O ports
# end of Input device support
#
# Character devices
#
CONFIG_TTY=y
CONFIG_UNIX98_PTYS=y
CONFIG_LEGACY_PTYS=y
CONFIG_LEGACY_PTY_COUNT=32
CONFIG_LEGACY_TIOCSTI=y
CONFIG_LDISC_AUTOLOAD=y
# CONFIG_N_GSM is not set
# CONFIG_NULL_TTY is not set
# CONFIG_SERIAL_DEV_BUS is not set
# CONFIG_VIRTIO_CONSOLE is not set
CONFIG_HW_RANDOM=y
CONFIG_UML_RANDOM=y
CONFIG_DEVMEM=y
# end of Character devices
#
# I2C support
#
# CONFIG_I2C is not set
# end of I2C support
# CONFIG_I3C is not set
# CONFIG_SPMI is not set
# CONFIG_HSI is not set
CONFIG_PPS=y
# CONFIG_PPS_DEBUG is not set
#
# PPS clients support
#
# CONFIG_PPS_CLIENT_KTIMER is not set
# CONFIG_PPS_CLIENT_LDISC is not set
# CONFIG_PPS_CLIENT_GPIO is not set
# CONFIG_PPS_GENERATOR is not set
#
# PTP clock support
#
CONFIG_PTP_1588_CLOCK=y
CONFIG_PTP_1588_CLOCK_OPTIONAL=y
#
# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks.
#
# CONFIG_PTP_1588_CLOCK_MOCK is not set
# end of PTP clock support
#
# DPLL device support
#
# end of DPLL device support
# CONFIG_PINCTRL is not set
CONFIG_GPIOLIB_LEGACY=y
# CONFIG_GPIOLIB is not set
# CONFIG_POWER_RESET is not set
# CONFIG_POWER_SEQUENCING is not set
# CONFIG_POWER_SUPPLY is not set
# CONFIG_THERMAL is not set
# CONFIG_WATCHDOG is not set
# CONFIG_REGULATOR is not set
# CONFIG_RC_CORE is not set
#
# CEC support
#
# CONFIG_MEDIA_CEC_SUPPORT is not set
# end of CEC support
#
# Graphics support
#
# CONFIG_AUXDISPLAY is not set
# CONFIG_TRACE_GPU_MEM is not set
# end of Graphics support
CONFIG_HID_SUPPORT=y
CONFIG_HID=y
# CONFIG_HID_BATTERY_STRENGTH is not set
# CONFIG_HIDRAW is not set
# CONFIG_UHID is not set
CONFIG_HID_GENERIC=y
# CONFIG_HID_HAPTIC is not set
#
# Special HID drivers
#
# CONFIG_HID_A4TECH is not set
# CONFIG_HID_ACRUX is not set
# CONFIG_HID_AUREAL is not set
# CONFIG_HID_BELKIN is not set
# CONFIG_HID_CHERRY is not set
# CONFIG_HID_COUGAR is not set
# CONFIG_HID_MACALLY is not set
# CONFIG_HID_CMEDIA is not set
# CONFIG_HID_CYPRESS is not set
# CONFIG_HID_DRAGONRISE is not set
# CONFIG_HID_EMS_FF is not set
# CONFIG_HID_ELECOM is not set
# CONFIG_HID_EVISION is not set
# CONFIG_HID_EZKEY is not set
# CONFIG_HID_GEMBIRD is not set
# CONFIG_HID_GFRM is not set
# CONFIG_HID_GLORIOUS is not set
# CONFIG_HID_GOOGLE_STADIA_FF is not set
# CONFIG_HID_VIVALDI is not set
# CONFIG_HID_KEYTOUCH is not set
# CONFIG_HID_KYE is not set
# CONFIG_HID_WALTOP is not set
# CONFIG_HID_VIEWSONIC is not set
# CONFIG_HID_VRC2 is not set
# CONFIG_HID_XIAOMI is not set
# CONFIG_HID_GYRATION is not set
# CONFIG_HID_ICADE is not set
# CONFIG_HID_ITE is not set
# CONFIG_HID_JABRA is not set
# CONFIG_HID_TWINHAN is not set
# CONFIG_HID_KENSINGTON is not set
# CONFIG_HID_LCPOWER is not set
# CONFIG_HID_MAGICMOUSE is not set
# CONFIG_HID_MALTRON is not set
# CONFIG_HID_MAYFLASH is not set
# CONFIG_HID_RAKK is not set
# CONFIG_HID_REDRAGON is not set
# CONFIG_HID_MICROSOFT is not set
# CONFIG_HID_MONTEREY is not set
# CONFIG_HID_MULTITOUCH is not set
# CONFIG_HID_NTI is not set
# CONFIG_HID_ORTEK is not set
# CONFIG_HID_PANTHERLORD is not set
# CONFIG_HID_PETALYNX is not set
# CONFIG_HID_PICOLCD is not set
# CONFIG_HID_PLANTRONICS is not set
# CONFIG_HID_PXRC is not set
# CONFIG_HID_RAZER is not set
# CONFIG_HID_PRIMAX is not set
# CONFIG_HID_SAITEK is not set
# CONFIG_HID_SEMITEK is not set
# CONFIG_HID_SPEEDLINK is not set
# CONFIG_HID_STEAM is not set
# CONFIG_HID_SUNPLUS is not set
# CONFIG_HID_RMI is not set
# CONFIG_HID_GREENASIA is not set
# CONFIG_HID_SMARTJOYPLUS is not set
# CONFIG_HID_TIVO is not set
# CONFIG_HID_TOPSEED is not set
# CONFIG_HID_TOPRE is not set
# CONFIG_HID_UDRAW_PS3 is not set
# CONFIG_HID_XINMO is not set
# CONFIG_HID_ZEROPLUS is not set
# CONFIG_HID_ZYDACRON is not set
# CONFIG_HID_ALPS is not set
# end of Special HID drivers
#
# HID-BPF support
#
# end of HID-BPF support
CONFIG_USB_OHCI_LITTLE_ENDIAN=y
# CONFIG_MEMSTICK is not set
# CONFIG_NEW_LEDS is not set
# CONFIG_ACCESSIBILITY is not set
# CONFIG_RTC_CLASS is not set
#
# DMABUF options
#
# CONFIG_SYNC_FILE is not set
# CONFIG_DMABUF_HEAPS is not set
# end of DMABUF options
# CONFIG_UIO is not set
# CONFIG_VFIO is not set
# CONFIG_VIRT_DRIVERS is not set
CONFIG_VIRTIO_MENU=y
# CONFIG_VDPA is not set
CONFIG_VHOST_MENU=y
# CONFIG_VHOST_NET is not set
# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y
#
# Microsoft Hyper-V guest support
#
# end of Microsoft Hyper-V guest support
# CONFIG_GREYBUS is not set
# CONFIG_COMEDI is not set
# CONFIG_GPIB is not set
# CONFIG_STAGING is not set
# CONFIG_COMMON_CLK is not set
# CONFIG_HWSPINLOCK is not set
#
# Clock Source drivers
#
# end of Clock Source drivers
# CONFIG_MAILBOX is not set
CONFIG_IOMMU_SUPPORT=y
#
# Generic IOMMU Pagetable Support
#
# end of Generic IOMMU Pagetable Support
# CONFIG_IOMMU_DEBUGFS is not set
# CONFIG_IOMMUFD is not set
#
# Remoteproc drivers
#
# end of Remoteproc drivers
#
# Rpmsg drivers
#
# end of Rpmsg drivers
#
# SOC (System On Chip) specific Drivers
#
#
# Amlogic SoC drivers
#
# end of Amlogic SoC drivers
#
# Broadcom SoC drivers
#
# end of Broadcom SoC drivers
#
# NXP/Freescale QorIQ SoC drivers
#
# end of NXP/Freescale QorIQ SoC drivers
#
# fujitsu SoC drivers
#
# end of fujitsu SoC drivers
#
# i.MX SoC drivers
#
# end of i.MX SoC drivers
#
# Enable LiteX SoC Builder specific drivers
#
# end of Enable LiteX SoC Builder specific drivers
# CONFIG_WPCM450_SOC is not set
#
# Qualcomm SoC drivers
#
# end of Qualcomm SoC drivers
# CONFIG_SOC_TI is not set
#
# Xilinx SoC drivers
#
# end of Xilinx SoC drivers
# end of SOC (System On Chip) specific Drivers
#
# PM Domains
#
#
# Amlogic PM Domains
#
# end of Amlogic PM Domains
#
# Broadcom PM Domains
#
# end of Broadcom PM Domains
#
# i.MX PM Domains
#
# end of i.MX PM Domains
#
# Qualcomm PM Domains
#
# end of Qualcomm PM Domains
# end of PM Domains
# CONFIG_PM_DEVFREQ is not set
# CONFIG_EXTCON is not set
# CONFIG_MEMORY is not set
# CONFIG_IIO is not set
# CONFIG_PWM is not set
#
# IRQ chip support
#
# end of IRQ chip support
# CONFIG_RESET_CONTROLLER is not set
#
# PHY Subsystem
#
# CONFIG_GENERIC_PHY is not set
# CONFIG_PHY_CAN_TRANSCEIVER is not set
#
# PHY drivers for Broadcom platforms
#
# end of PHY drivers for Broadcom platforms
# end of PHY Subsystem
# CONFIG_POWERCAP is not set
# CONFIG_RAS is not set
#
# Android
#
# CONFIG_ANDROID_BINDER_IPC is not set
# end of Android
# CONFIG_DAX is not set
# CONFIG_NVMEM is not set
#
# HW tracing support
#
# CONFIG_STM is not set
# end of HW tracing support
# CONFIG_FPGA is not set
# CONFIG_TEE is not set
# CONFIG_MUX_CORE is not set
# CONFIG_SIOX is not set
# CONFIG_SLIMBUS is not set
# CONFIG_INTERCONNECT is not set
# CONFIG_COUNTER is not set
# CONFIG_PECI is not set
# CONFIG_HTE is not set
# end of Device Drivers
#
# File systems
#
CONFIG_DCACHE_WORD_ACCESS=y
# CONFIG_VALIDATE_FS_PARSER is not set
CONFIG_FS_IOMAP=y
CONFIG_FS_STACK=y
CONFIG_BUFFER_HEAD=y
# CONFIG_EXT2_FS is not set
CONFIG_EXT4_FS=y
CONFIG_EXT4_USE_FOR_EXT2=y
# CONFIG_EXT4_FS_POSIX_ACL is not set
# CONFIG_EXT4_FS_SECURITY is not set
# CONFIG_EXT4_DEBUG is not set
CONFIG_JBD2=y
# CONFIG_JBD2_DEBUG is not set
CONFIG_FS_MBCACHE=y
# CONFIG_JFS_FS is not set
# CONFIG_XFS_FS is not set
# CONFIG_GFS2_FS is not set
# CONFIG_BTRFS_FS is not set
# CONFIG_NILFS2_FS is not set
# CONFIG_F2FS_FS is not set
CONFIG_FS_POSIX_ACL=y
CONFIG_EXPORTFS=y
# CONFIG_EXPORTFS_BLOCK_OPS is not set
CONFIG_FILE_LOCKING=y
# CONFIG_FS_ENCRYPTION is not set
# CONFIG_FS_VERITY is not set
CONFIG_FSNOTIFY=y
CONFIG_DNOTIFY=y
CONFIG_INOTIFY_USER=y
# CONFIG_FANOTIFY is not set
CONFIG_QUOTA=y
# CONFIG_QUOTA_NETLINK_INTERFACE is not set
# CONFIG_QUOTA_DEBUG is not set
# CONFIG_QFMT_V1 is not set
# CONFIG_QFMT_V2 is not set
CONFIG_QUOTACTL=y
CONFIG_AUTOFS_FS=m
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
# CONFIG_VIRTIO_FS is not set
CONFIG_FUSE_PASSTHROUGH=y
CONFIG_FUSE_IO_URING=y
# CONFIG_OVERLAY_FS is not set
#
# Caches
#
# end of Caches
#
# CD-ROM/DVD Filesystems
#
CONFIG_ISO9660_FS=m
CONFIG_JOLIET=y
# CONFIG_ZISOFS is not set
# CONFIG_UDF_FS is not set
# end of CD-ROM/DVD Filesystems
#
# DOS/FAT/EXFAT/NT Filesystems
#
# CONFIG_MSDOS_FS is not set
# CONFIG_VFAT_FS is not set
# CONFIG_EXFAT_FS is not set
# CONFIG_NTFS_FS is not set
# CONFIG_NTFS3_FS is not set
# end of DOS/FAT/EXFAT/NT Filesystems
#
# Pseudo filesystems
#
CONFIG_PROC_FS=y
CONFIG_PROC_KCORE=y
CONFIG_PROC_SYSCTL=y
CONFIG_PROC_PAGE_MONITOR=y
# CONFIG_PROC_CHILDREN is not set
CONFIG_KERNFS=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
# CONFIG_TMPFS_POSIX_ACL is not set
# CONFIG_TMPFS_XATTR is not set
# CONFIG_TMPFS_INODE64 is not set
# CONFIG_TMPFS_QUOTA is not set
# CONFIG_CONFIGFS_FS is not set
# end of Pseudo filesystems
CONFIG_MISC_FILESYSTEMS=y
# CONFIG_ORANGEFS_FS is not set
# CONFIG_ADFS_FS is not set
# CONFIG_AFFS_FS is not set
# CONFIG_HFS_FS is not set
# CONFIG_HFSPLUS_FS is not set
# CONFIG_BEFS_FS is not set
# CONFIG_BFS_FS is not set
# CONFIG_EFS_FS is not set
# CONFIG_CRAMFS is not set
# CONFIG_SQUASHFS is not set
# CONFIG_VXFS_FS is not set
# CONFIG_MINIX_FS is not set
# CONFIG_OMFS_FS is not set
# CONFIG_HPFS_FS is not set
# CONFIG_QNX4FS_FS is not set
# CONFIG_QNX6FS_FS is not set
# CONFIG_ROMFS_FS is not set
# CONFIG_PSTORE is not set
# CONFIG_UFS_FS is not set
# CONFIG_EROFS_FS is not set
CONFIG_NETWORK_FILESYSTEMS=y
# CONFIG_NFS_FS is not set
# CONFIG_NFSD is not set
# CONFIG_CEPH_FS is not set
# CONFIG_CIFS is not set
CONFIG_SMB_SERVER=y
CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=y
CONFIG_SMB_SERVER_KERBEROS5=y
CONFIG_SMBFS=y
# CONFIG_CODA_FS is not set
# CONFIG_AFS_FS is not set
CONFIG_NLS=y
CONFIG_NLS_DEFAULT="iso8859-1"
# CONFIG_NLS_CODEPAGE_437 is not set
# CONFIG_NLS_CODEPAGE_737 is not set
# CONFIG_NLS_CODEPAGE_775 is not set
# CONFIG_NLS_CODEPAGE_850 is not set
# CONFIG_NLS_CODEPAGE_852 is not set
# CONFIG_NLS_CODEPAGE_855 is not set
# CONFIG_NLS_CODEPAGE_857 is not set
# CONFIG_NLS_CODEPAGE_860 is not set
# CONFIG_NLS_CODEPAGE_861 is not set
# CONFIG_NLS_CODEPAGE_862 is not set
# CONFIG_NLS_CODEPAGE_863 is not set
# CONFIG_NLS_CODEPAGE_864 is not set
# CONFIG_NLS_CODEPAGE_865 is not set
# CONFIG_NLS_CODEPAGE_866 is not set
# CONFIG_NLS_CODEPAGE_869 is not set
# CONFIG_NLS_CODEPAGE_936 is not set
# CONFIG_NLS_CODEPAGE_950 is not set
# CONFIG_NLS_CODEPAGE_932 is not set
# CONFIG_NLS_CODEPAGE_949 is not set
# CONFIG_NLS_CODEPAGE_874 is not set
# CONFIG_NLS_ISO8859_8 is not set
# CONFIG_NLS_CODEPAGE_1250 is not set
# CONFIG_NLS_CODEPAGE_1251 is not set
# CONFIG_NLS_ASCII is not set
# CONFIG_NLS_ISO8859_1 is not set
# CONFIG_NLS_ISO8859_2 is not set
# CONFIG_NLS_ISO8859_3 is not set
# CONFIG_NLS_ISO8859_4 is not set
# CONFIG_NLS_ISO8859_5 is not set
# CONFIG_NLS_ISO8859_6 is not set
# CONFIG_NLS_ISO8859_7 is not set
# CONFIG_NLS_ISO8859_9 is not set
# CONFIG_NLS_ISO8859_13 is not set
# CONFIG_NLS_ISO8859_14 is not set
# CONFIG_NLS_ISO8859_15 is not set
# CONFIG_NLS_KOI8_R is not set
# CONFIG_NLS_KOI8_U is not set
# CONFIG_NLS_MAC_ROMAN is not set
# CONFIG_NLS_MAC_CELTIC is not set
# CONFIG_NLS_MAC_CENTEURO is not set
# CONFIG_NLS_MAC_CROATIAN is not set
# CONFIG_NLS_MAC_CYRILLIC is not set
# CONFIG_NLS_MAC_GAELIC is not set
# CONFIG_NLS_MAC_GREEK is not set
# CONFIG_NLS_MAC_ICELAND is not set
# CONFIG_NLS_MAC_INUIT is not set
# CONFIG_NLS_MAC_ROMANIAN is not set
# CONFIG_NLS_MAC_TURKISH is not set
CONFIG_NLS_UTF8=y
CONFIG_NLS_UCS2_UTILS=y
CONFIG_UNICODE=y
CONFIG_IO_WQ=y
# end of File systems
#
# Security options
#
# CONFIG_KEYS is not set
# CONFIG_SECURITY_DMESG_RESTRICT is not set
# CONFIG_PROC_MEM_ALWAYS_FORCE is not set
CONFIG_PROC_MEM_FORCE_PTRACE=y
# CONFIG_PROC_MEM_NO_FORCE is not set
# CONFIG_SECURITY is not set
# CONFIG_SECURITYFS is not set
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_DEFAULT_SECURITY_DAC=y
#
# Kernel hardening options
#
#
# Memory initialization
#
CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
# CONFIG_INIT_STACK_NONE is not set
# CONFIG_INIT_STACK_ALL_PATTERN is not set
CONFIG_INIT_STACK_ALL_ZERO=y
# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
# CONFIG_ZERO_CALL_USED_REGS is not set
# end of Memory initialization
#
# Bounds checking
#
# CONFIG_FORTIFY_SOURCE is not set
# CONFIG_HARDENED_USERCOPY is not set
# end of Bounds checking
#
# Hardening of kernel data structures
#
# CONFIG_LIST_HARDENED is not set
# CONFIG_BUG_ON_DATA_CORRUPTION is not set
# end of Hardening of kernel data structures
CONFIG_RANDSTRUCT_NONE=y
# end of Kernel hardening options
# end of Security options
CONFIG_CRYPTO=y
#
# Crypto core or helper
#
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
CONFIG_CRYPTO_AEAD2=y
CONFIG_CRYPTO_SKCIPHER=y
CONFIG_CRYPTO_SKCIPHER2=y
CONFIG_CRYPTO_HASH=y
CONFIG_CRYPTO_HASH2=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
# CONFIG_CRYPTO_USER is not set
# CONFIG_CRYPTO_NULL is not set
# CONFIG_CRYPTO_CRYPTD is not set
# CONFIG_CRYPTO_AUTHENC is not set
# CONFIG_CRYPTO_KRB5ENC is not set
# CONFIG_CRYPTO_BENCHMARK is not set
# end of Crypto core or helper
#
# Public-key cryptography
#
# CONFIG_CRYPTO_RSA is not set
# CONFIG_CRYPTO_DH is not set
# CONFIG_CRYPTO_ECDH is not set
# CONFIG_CRYPTO_ECDSA is not set
# CONFIG_CRYPTO_ECRDSA is not set
# CONFIG_CRYPTO_MLDSA is not set
# end of Public-key cryptography
#
# Block ciphers
#
# CONFIG_CRYPTO_AES is not set
# CONFIG_CRYPTO_ARIA is not set
# CONFIG_CRYPTO_BLOWFISH is not set
# CONFIG_CRYPTO_CAMELLIA is not set
# CONFIG_CRYPTO_CAST5 is not set
# CONFIG_CRYPTO_CAST6 is not set
# CONFIG_CRYPTO_DES is not set
# CONFIG_CRYPTO_SERPENT is not set
# CONFIG_CRYPTO_SM4_GENERIC is not set
# CONFIG_CRYPTO_TWOFISH is not set
# end of Block ciphers
#
# Length-preserving ciphers and modes
#
# CONFIG_CRYPTO_ADIANTUM is not set
# CONFIG_CRYPTO_CHACHA20 is not set
# CONFIG_CRYPTO_CBC is not set
CONFIG_CRYPTO_CTR=y
# CONFIG_CRYPTO_CTS is not set
CONFIG_CRYPTO_ECB=y
# CONFIG_CRYPTO_HCTR2 is not set
# CONFIG_CRYPTO_LRW is not set
# CONFIG_CRYPTO_XTS is not set
# end of Length-preserving ciphers and modes
#
# AEAD (authenticated encryption with associated data) ciphers
#
# CONFIG_CRYPTO_AEGIS128 is not set
# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
CONFIG_CRYPTO_CCM=y
CONFIG_CRYPTO_GCM=y
# CONFIG_CRYPTO_SEQIV is not set
# CONFIG_CRYPTO_ECHAINIV is not set
# CONFIG_CRYPTO_ESSIV is not set
# end of AEAD (authenticated encryption with associated data) ciphers
#
# Hashes, digests, and MACs
#
# CONFIG_CRYPTO_BLAKE2B is not set
# CONFIG_CRYPTO_CMAC is not set
# CONFIG_CRYPTO_HMAC is not set
# CONFIG_CRYPTO_MD4 is not set
# CONFIG_CRYPTO_MD5 is not set
# CONFIG_CRYPTO_RMD160 is not set
# CONFIG_CRYPTO_SHA1 is not set
# CONFIG_CRYPTO_SHA256 is not set
# CONFIG_CRYPTO_SHA512 is not set
# CONFIG_CRYPTO_SHA3 is not set
# CONFIG_CRYPTO_SM3 is not set
# CONFIG_CRYPTO_STREEBOG is not set
# CONFIG_CRYPTO_WP512 is not set
# CONFIG_CRYPTO_XCBC is not set
# CONFIG_CRYPTO_XXHASH is not set
# end of Hashes, digests, and MACs
#
# CRCs (cyclic redundancy checks)
#
# CONFIG_CRYPTO_CRC32C is not set
# CONFIG_CRYPTO_CRC32 is not set
# end of CRCs (cyclic redundancy checks)
#
# Compression
#
# CONFIG_CRYPTO_DEFLATE is not set
# CONFIG_CRYPTO_LZO is not set
# CONFIG_CRYPTO_842 is not set
# CONFIG_CRYPTO_LZ4 is not set
# CONFIG_CRYPTO_LZ4HC is not set
# CONFIG_CRYPTO_ZSTD is not set
# end of Compression
#
# Random number generation
#
# CONFIG_CRYPTO_DRBG is not set
# CONFIG_CRYPTO_JITTERENTROPY is not set
# end of Random number generation
#
# Userspace interface (deprecated)
#
# CONFIG_CRYPTO_USER_API_HASH is not set
# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
# CONFIG_CRYPTO_USER_API_RNG is not set
# CONFIG_CRYPTO_USER_API_AEAD is not set
# end of Userspace interface (deprecated)
CONFIG_CRYPTO_HW=y
#
# Certificates for signature checking
#
CONFIG_OPENSSL_SUPPORTS_ML_DSA=y
# end of Certificates for signature checking
# CONFIG_CRYPTO_KRB5 is not set
#
# Library routines
#
# CONFIG_PACKING is not set
CONFIG_BITREVERSE=y
CONFIG_GENERIC_BITREVERSE=y
CONFIG_ARCH_HAS_STRNCPY_FROM_USER=y
CONFIG_ARCH_HAS_STRNLEN_USER=y
CONFIG_GENERIC_NET_UTILS=y
# CONFIG_CORDIC is not set
# CONFIG_PRIME_NUMBERS is not set
CONFIG_CRC16=y
CONFIG_CRC32=y
CONFIG_CRYPTO_LIB_UTILS=y
CONFIG_CRYPTO_LIB_AES=y
CONFIG_CRYPTO_LIB_AES_CBC_MACS=y
CONFIG_CRYPTO_LIB_ARC4=y
CONFIG_CRYPTO_LIB_DES=y
CONFIG_CRYPTO_LIB_GF128HASH=y
CONFIG_CRYPTO_LIB_MD5=y
CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
CONFIG_CRYPTO_LIB_SHA1=y
CONFIG_CRYPTO_LIB_SHA256=y
CONFIG_CRYPTO_LIB_SHA512=y
# CONFIG_RANDOM32_SELFTEST is not set
# CONFIG_XZ_DEC is not set
CONFIG_NO_DMA=y
CONFIG_ARCH_DMA_ADDR_T_64BIT=y
# CONFIG_DMA_API_DEBUG is not set
# CONFIG_DMA_MAP_BENCHMARK is not set
CONFIG_FORCE_NR_CPUS=y
CONFIG_DQL=y
CONFIG_NLATTR=y
# CONFIG_IRQ_POLL is not set
CONFIG_DIMLIB=y
CONFIG_OID_REGISTRY=y
CONFIG_STACKDEPOT=y
CONFIG_STACKDEPOT_ALWAYS_INIT=y
CONFIG_STACKDEPOT_MAX_FRAMES=64
CONFIG_SBITMAP=y
# CONFIG_LWQ_TEST is not set
# end of Library routines
#
# Kernel hacking
#
#
# printk and dmesg options
#
# CONFIG_PRINTK_TIME is not set
# CONFIG_PRINTK_CALLER is not set
# CONFIG_STACKTRACE_BUILD_ID is not set
CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
CONFIG_CONSOLE_LOGLEVEL_QUIET=4
CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
# CONFIG_BOOT_PRINTK_DELAY is not set
# CONFIG_DYNAMIC_DEBUG is not set
# CONFIG_DYNAMIC_DEBUG_CORE is not set
CONFIG_SYMBOLIC_ERRNAME=y
CONFIG_DEBUG_BUGVERBOSE=y
# CONFIG_DEBUG_BUGVERBOSE_DETAILED is not set
# end of printk and dmesg options
CONFIG_DEBUG_KERNEL=y
CONFIG_DEBUG_MISC=y
#
# Compile-time checks and compiler options
#
CONFIG_DEBUG_INFO=y
CONFIG_AS_HAS_NON_CONST_ULEB128=y
# CONFIG_DEBUG_INFO_NONE is not set
CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
# CONFIG_DEBUG_INFO_DWARF4 is not set
# CONFIG_DEBUG_INFO_DWARF5 is not set
# CONFIG_DEBUG_INFO_REDUCED is not set
CONFIG_DEBUG_INFO_COMPRESSED_NONE=y
# CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set
# CONFIG_DEBUG_INFO_COMPRESSED_ZSTD is not set
# CONFIG_DEBUG_INFO_SPLIT is not set
# CONFIG_GDB_SCRIPTS is not set
CONFIG_FRAME_WARN=2048
# CONFIG_STRIP_ASM_SYMS is not set
# CONFIG_READABLE_ASM is not set
# CONFIG_HEADERS_INSTALL is not set
# CONFIG_DEBUG_SECTION_MISMATCH is not set
CONFIG_SECTION_MISMATCH_WARN_ONLY=y
CONFIG_FRAME_POINTER=y
# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
# end of Compile-time checks and compiler options
#
# Generic Kernel Debugging Instruments
#
CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1
CONFIG_MAGIC_SYSRQ_SERIAL=y
CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_FS_ALLOW_ALL=y
# CONFIG_DEBUG_FS_ALLOW_NONE is not set
CONFIG_ARCH_HAS_UBSAN=y
# CONFIG_UBSAN is not set
CONFIG_HAVE_KCSAN_COMPILER=y
# end of Generic Kernel Debugging Instruments
#
# Networking Debugging
#
# CONFIG_NET_DEV_REFCNT_TRACKER is not set
# CONFIG_NET_NS_REFCNT_TRACKER is not set
# CONFIG_DEBUG_NET is not set
# CONFIG_DEBUG_NET_SMALL_RTNL is not set
# end of Networking Debugging
#
# Memory Debugging
#
# CONFIG_PAGE_EXTENSION is not set
# CONFIG_DEBUG_PAGEALLOC is not set
CONFIG_SLUB_DEBUG=y
# CONFIG_SLUB_DEBUG_ON is not set
CONFIG_SLUB_RCU_DEBUG=y
# CONFIG_PAGE_OWNER is not set
# CONFIG_PAGE_POISONING is not set
# CONFIG_DEBUG_RODATA_TEST is not set
CONFIG_HAVE_DEBUG_KMEMLEAK=y
CONFIG_DEBUG_KMEMLEAK=y
CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE=16000
# CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF is not set
CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y
# CONFIG_DEBUG_KMEMLEAK_VERBOSE is not set
# CONFIG_DEBUG_OBJECTS is not set
# CONFIG_SHRINKER_DEBUG is not set
# CONFIG_DEBUG_STACK_USAGE is not set
# CONFIG_SCHED_STACK_END_CHECK is not set
# CONFIG_DEBUG_VFS is not set
# CONFIG_DEBUG_VM is not set
CONFIG_DEBUG_MEMORY_INIT=y
# CONFIG_MEM_ALLOC_PROFILING is not set
CONFIG_HAVE_ARCH_KASAN=y
CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
CONFIG_CC_HAS_KASAN_GENERIC=y
CONFIG_CC_HAS_KASAN_SW_TAGS=y
CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
CONFIG_KASAN=y
CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX=y
CONFIG_KASAN_GENERIC=y
CONFIG_KASAN_OUTLINE=y
# CONFIG_KASAN_INLINE is not set
CONFIG_KASAN_STACK=y
# CONFIG_KASAN_VMALLOC is not set
# CONFIG_KASAN_EXTRA_INFO is not set
# end of Memory Debugging
# CONFIG_DEBUG_SHIRQ is not set
#
# Debug Oops, Lockups and Hangs
#
CONFIG_PANIC_ON_OOPS=y
CONFIG_PANIC_TIMEOUT=0
# CONFIG_SOFTLOCKUP_DETECTOR is not set
# CONFIG_DETECT_HUNG_TASK is not set
# CONFIG_WQ_WATCHDOG is not set
# CONFIG_WQ_CPU_INTENSIVE_REPORT is not set
# CONFIG_TEST_LOCKUP is not set
# end of Debug Oops, Lockups and Hangs
#
# Scheduler Debugging
#
# CONFIG_SCHEDSTATS is not set
# end of Scheduler Debugging
# CONFIG_DEBUG_ATOMIC is not set
#
# Lock Debugging (spinlocks, mutexes, etc...)
#
CONFIG_LOCK_DEBUGGING_SUPPORT=y
# CONFIG_PROVE_LOCKING is not set
# CONFIG_LOCK_STAT is not set
# CONFIG_DEBUG_RT_MUTEXES is not set
# CONFIG_DEBUG_SPINLOCK is not set
# CONFIG_DEBUG_MUTEXES is not set
# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
# CONFIG_DEBUG_RWSEMS is not set
# CONFIG_DEBUG_LOCK_ALLOC is not set
# CONFIG_DEBUG_ATOMIC_SLEEP is not set
# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
# CONFIG_LOCK_TORTURE_TEST is not set
# CONFIG_WW_MUTEX_SELFTEST is not set
# CONFIG_SCF_TORTURE_TEST is not set
# end of Lock Debugging (spinlocks, mutexes, etc...)
# CONFIG_DEBUG_IRQFLAGS is not set
CONFIG_STACKTRACE=y
# CONFIG_DEBUG_KOBJECT is not set
CONFIG_HAVE_DEBUG_BUGVERBOSE=y
#
# Debug kernel data structures
#
# CONFIG_DEBUG_LIST is not set
# CONFIG_DEBUG_PLIST is not set
# CONFIG_DEBUG_SG is not set
# CONFIG_DEBUG_NOTIFIERS is not set
# CONFIG_DEBUG_MAPLE_TREE is not set
# end of Debug kernel data structures
#
# RCU Debugging
#
# CONFIG_RCU_SCALE_TEST is not set
# CONFIG_RCU_TORTURE_TEST is not set
# CONFIG_RCU_REF_SCALE_TEST is not set
# CONFIG_RCU_TRACE is not set
# CONFIG_RCU_EQS_DEBUG is not set
# end of RCU Debugging
# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
# CONFIG_LATENCYTOP is not set
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
CONFIG_TRACING_SUPPORT=y
CONFIG_FTRACE=y
# CONFIG_IRQSOFF_TRACER is not set
# CONFIG_SCHED_TRACER is not set
# CONFIG_HWLAT_TRACER is not set
# CONFIG_OSNOISE_TRACER is not set
# CONFIG_TIMERLAT_TRACER is not set
# CONFIG_ENABLE_DEFAULT_TRACERS is not set
# CONFIG_FTRACE_SYSCALLS is not set
# CONFIG_TRACER_SNAPSHOT is not set
CONFIG_BRANCH_PROFILE_NONE=y
# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
# CONFIG_PROFILE_ALL_BRANCHES is not set
# CONFIG_BLK_DEV_IO_TRACE is not set
# CONFIG_SYNTH_EVENTS is not set
# CONFIG_USER_EVENTS is not set
# CONFIG_TRACEPOINT_BENCHMARK is not set
# CONFIG_PREEMPTIRQ_DELAY_TEST is not set
# CONFIG_RV is not set
# CONFIG_TRACE_REMOTE_TEST is not set
# CONFIG_SAMPLES is not set
#
# um Debugging
#
# CONFIG_GPROF is not set
CONFIG_EARLY_PRINTK=y
# end of um Debugging
#
# Kernel Testing and Coverage
#
# CONFIG_KUNIT is not set
# CONFIG_NOTIFIER_ERROR_INJECTION is not set
# CONFIG_FAULT_INJECTION is not set
CONFIG_ARCH_HAS_KCOV=y
# CONFIG_KCOV is not set
CONFIG_RUNTIME_TESTING_MENU=y
# CONFIG_TEST_DHRY is not set
# CONFIG_LKDTM is not set
# CONFIG_TEST_DIV64 is not set
# CONFIG_TEST_MULDIV64 is not set
# CONFIG_BACKTRACE_SELF_TEST is not set
# CONFIG_TEST_REF_TRACKER is not set
# CONFIG_RBTREE_TEST is not set
# CONFIG_REED_SOLOMON_TEST is not set
# CONFIG_INTERVAL_TREE_TEST is not set
# CONFIG_PERCPU_TEST is not set
# CONFIG_ATOMIC64_SELFTEST is not set
# CONFIG_TEST_HEXDUMP is not set
# CONFIG_TEST_KSTRTOX is not set
# CONFIG_TEST_BITMAP is not set
# CONFIG_TEST_XARRAY is not set
# CONFIG_TEST_MAPLE_TREE is not set
# CONFIG_TEST_RHASHTABLE is not set
# CONFIG_TEST_IDA is not set
# CONFIG_TEST_LKM is not set
# CONFIG_TEST_BITOPS is not set
# CONFIG_TEST_VMALLOC is not set
# CONFIG_TEST_WORKQUEUE is not set
# CONFIG_TEST_BPF is not set
# CONFIG_FIND_BIT_BENCHMARK is not set
# CONFIG_TEST_FIRMWARE is not set
# CONFIG_TEST_SYSCTL is not set
# CONFIG_TEST_UDELAY is not set
# CONFIG_TEST_STATIC_KEYS is not set
# CONFIG_TEST_KMOD is not set
# CONFIG_TEST_KALLSYMS is not set
# CONFIG_TEST_MEMCAT_P is not set
# CONFIG_TEST_MEMINIT is not set
# CONFIG_TEST_FREE_PAGES is not set
# CONFIG_TEST_OBJPOOL is not set
# end of Kernel Testing and Coverage
#
# Rust hacking
#
# end of Rust hacking
# end of Kernel hacking
CONFIG_IO_URING_BPF=y
On Sat, Aug 29, 2026 at 9:32 PM Kanishka De Silva
<kpskanna1915@gmail.com> wrote:
>
> Hi Miklos and Joanne,
Hi Kanishka,
>
> I am reporting two latent data-integrity defects in the FUSE iomap
> read integration introduced in Linux 7.2. Both defects are unreachable
> in stock 7.2.2 today, but activate the moment partially-uptodate
> folios exist in FUSE — which is precisely what the announced "fuse:
> support large folios" series (Joanne) and any sub-page-blocksize
> invalidation semantics will create. I'm reporting now, before that
> series merges, so the fixes can land alongside or before the
> enablement.
>
> Full report, suggested fixes patch, PoC source, and runtime evidence
> logs are attached as plain text files.
>
> Summary:
>
> The 7.2 series "fuse: use iomap for buffered reads + readahead"
> introduced, for the first time, FUSE read paths where a folio read can
> be a sub-range of that folio (desc.offset > 0 and/or desc.length <
> folio_size). Two legacy helpers were not adapted:
>
> Defect A — fuse_copy_folio() whole-folio zeroing (fs/fuse/dev.c):
> When zeroing is set and count < folio_size, the function calls
> folio_zero_range(folio, 0, size) — zeroing the ENTIRE folio before
> copying the reply at [offset, offset+count). With sub-folio read
> ranges this destroys valid, cached, uptodate data located before the
> requested range in the same folio. Demonstrated end-to-end: 1024 bytes
> of valid cached data silently replaced by zeros.
>
> Suggested fix (one line):
> - folio_zero_range(folio, 0, size);
> + folio_zero_range(folio, offset, size - offset);
I think the fix needs to be folio_zero_range(folio, offset,
ap->descs[i].length); else there's the case where writing to the last
block of a folio and then reading in the entire folio will overwrite
the last block. This is what I had in my local tree, after sashiko
mentioned this a few months ago in [1]:
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1240,17 +1240,11 @@
* done atomically
*/
int fuse_copy_folio(struct fuse_copy_state *cs, struct folio **foliop,
- unsigned offset, unsigned count, int zeroing)
+ unsigned offset, unsigned count)
{
int err;
struct folio *folio = *foliop;
- size_t size;
-
- if (folio) {
- size = folio_size(folio);
- if (zeroing && count < size)
- folio_zero_range(folio, 0, size);
- }
+ size_t size = folio ? folio_size(folio) : 0;
while (count) {
if (cs->write && cs->pipebufs && folio) {
@@ -1308,10 +1302,25 @@
for (i = 0; i < ap->num_folios && (nbytes || zeroing); i++) {
int err;
+ struct folio *folio = ap->folios[i];
unsigned int offset = ap->descs[i].offset;
- unsigned int count = min(nbytes, ap->descs[i].length);
+ unsigned int length = ap->descs[i].length;
+ unsigned int count = min(nbytes, length);
+
+ /*
+ * The reply may be shorter than what was asked for, in which
+ * case the tail of the requested range needs to be zeroed.
+ * Only [offset, offset + length) may be touched here: the
+ * rest of the folio can hold blocks that are already uptodate
+ * or dirty, and clearing those would lose data.
+ *
+ * Clear the range up front, so that a failed copy leaves
+ * zeroes rather than stale folio contents.
+ */
+ if (folio && zeroing && count < length)
+ folio_zero_range(folio, offset, length);
- err = fuse_copy_folio(cs, &ap->folios[i], offset,
count, zeroing);
+ err = fuse_copy_folio(cs, &ap->folios[i], offset, count);
if (err)
return err;
diff --git a/fs/fuse/dev.h b/fs/fuse/dev.h
--- a/fs/fuse/dev.h
+++ b/fs/fuse/dev.h
@@ -90,7 +90,7 @@
int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size);
int fuse_copy_folio(struct fuse_copy_state *cs, struct folio **foliop,
- unsigned offset, unsigned count, int zeroing);
+ unsigned offset, unsigned count);
void fuse_copy_finish(struct fuse_copy_state *cs);
#ifdef CONFIG_FUSE_IO_URING
diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
--- a/fs/fuse/notify.c
+++ b/fs/fuse/notify.c
@@ -190,7 +190,7 @@
folio_offset = offset_in_folio(folio, pos);
nr_bytes = min(num, folio_size(folio) - folio_offset);
- err = fuse_copy_folio(cs, &folio, folio_offset, nr_bytes, 0);
+ err = fuse_copy_folio(cs, &folio, folio_offset, nr_bytes);
if (!folio_test_uptodate(folio) && !err && folio_offset == 0 &&
(nr_bytes == folio_size(folio) || file_size == end)) {
folio_zero_segment(folio, nr_bytes, folio_size(folio));
I'll prioritize sending this upstream this week.
>
> Defect B — fuse_send_readpages() ignores descs[0].offset (fs/fuse/file.c):
> The readahead sender computes the FUSE_READ request start as
> folio_pos(ap->folios[0]), ignoring ap->descs[0].offset. If the first
> folio of a batch is prefix-partial, the kernel asks the server for
> data beginning at the folio start instead of the first invalid block.
> The reply is copied at the wrong position — every byte of the batch is
> silently shifted. Both sibling paths handle this correctly:
> - writeback: folio_pos(folio) + offset (fuse_writepage_args_setup)
> - sync read: folio_pos(folio) + off (fuse_do_readfolio)
> The readahead path is the odd one out.
>
> Suggested fix (one line):
> - loff_t pos = folio_pos(ap->folios[0]);
> + loff_t pos = folio_pos(ap->folios[0]) + ap->descs[0].offset;
>
> Reachability today (why latent):
> Stock 7.2.2 cannot construct a partially-uptodate folio in FUSE —
> order-0 folios only, no code path clears per-block uptodate bits, and
> the VFS readahead core only hands freshly-allocated fully-non-uptodate
> folios to ->readahead(). Both defects activate exactly when the
> large-folio series lands or any sub-page invalidation semantics are
> introduced.
>
Even with large folios enabled, this isn't reachable since
page_cache_ra_unbounded() never adds an already-present folio to the
rac. Every folio that ->readahead() sees is freshly allocated / wholly
non-uptodate.
Large folios aren't enabled yet but a patch for that will be sent out
for inclusion in the next (7.4) merge, which would only land after the
above patch for the zeroing lands.
Thanks,
Joanne
[1] https://sashiko.dev/#/patchset/20260717032835.922433-1-lihaofeng%40kylinos.cn
© 2016 - 2026 Red Hat, Inc.