mirror of
https://github.com/torvalds/linux.git
synced 2026-07-29 02:31:27 +02:00
12091470c6
1458686 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Bradley Morgan
|
12091470c6 |
bpf: Disable xfrm_decode_session hook attachment
BPF LSM programs can currently attach to xfrm_decode_session(). That
hook may return an error, but security_skb_classify_flow() calls it
from a void path and triggers BUG_ON() if an error is returned.
Disable BPF attachment to the hook to prevent a BPF LSM program from
turning packet classification into a full panic.
Fixes:
|
||
|
Alexei Starovoitov
|
274b4027d8 |
Merge branch 'fix-stale-register-bounds-on-lsm-retval-context-load'
Tristan Madani says: ==================== Fix stale register bounds on LSM retval context load From: Tristan Madani <tristan@talencesecurity.com> check_mem_access() calls __mark_reg_s32_range() to narrow a register to the LSM hook retval range, but the intersection preserves stale bounds from prior instructions. Add mark_reg_unknown() before narrowing (same pattern as the else branch) and a selftest that catches the mismatch. Changes in v3: - Add selftest demonstrating the issue (Eduard Zingerman) - No code change in patch 1 from v2 ==================== Link: https://patch.msgid.link/20260622230123.3695446-1-tristmd@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Tristan Madani
|
644332f48f |
selftests/bpf: Add test for stale bounds on LSM retval context load
Add a verifier test that catches the stale-bounds issue fixed in the previous patch. The test sets r6 = 0 to create known bounds, then loads the LSM hook return value into r6 from the context. Without the fix, the verifier intersects the retval range with the stale bounds and incorrectly narrows r6 to a single value, pruning the fall-through branch as dead code and missing the div-by-zero. Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260622230123.3695446-3-tristmd@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Tristan Madani
|
5e0b273e0a |
bpf: Reset register bounds before narrowing retval range in check_mem_access()
When the BPF verifier processes a context load of an LSM hook return
value, it calls __mark_reg_s32_range() to narrow the register to the
hook's valid range. However, __mark_reg_s32_range() intersects the new
range with the register's existing bounds using max_t()/min_t() rather
than replacing them.
If the destination register carries stale bounds from a prior instruction
(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than
reality. The verifier then believes it knows the register's exact value,
while at runtime the actual hook return value is loaded, creating a
verifier/runtime mismatch that can be used to bypass BPF memory safety
checks.
The else branch already calls mark_reg_unknown() to reset register state
before any narrowing. Apply the same reset in the is_retval path so
stale bounds are cleared before __mark_reg_s32_range() intersects.
Fixes:
|
||
|
Alexei Starovoitov
|
6a8e9b4f1f |
Merge branch 'bpf-guard-conntrack-opts-error-writes'
Yiyang Chen says:
====================
bpf: Guard conntrack opts error writes
The conntrack lookup/allocation kfuncs expose an opts/opts__sz pair.
The verifier checks the caller-provided opts__sz range, but the wrappers
currently write opts->error after internal errors even when opts__sz is too
small to include that field.
Patch 1 writes opts->error only when opts__sz includes it, and uses a
single helper to fold ERR_PTR returns into the kfunc ABI result while keeping
the local nfct result variable in each wrapper.
Patch 2 adds a bpf_nf regression check that keeps a guard in opts->error
while passing opts__sz covering only netns_id.
The regression check follows the existing bpf_nf test shape. Before the
fix, the guard is overwritten with -EINVAL even though opts__sz covers only
the first four bytes of the options object. After the fix, the kfunc still
returns NULL for the invalid size, but the guard remains intact.
Validation, rebased and tested on bpf-next master
|
||
|
Yiyang Chen
|
38ba6d43af |
selftests/bpf: Cover small conntrack opts error writes
Add a conntrack kfunc regression check for opts__sz values that do not cover opts->error. The BPF program initializes opts->error with a guard value, calls the lookup and allocation kfuncs with opts__sz set to sizeof(opts->netns_id), and verifies that the guard is still intact after the kfunc returns NULL. Without the conntrack wrapper guard, the kfunc error path overwrites that guard with -EINVAL even though the verifier checked only the first four bytes of the options object. Fixes: |
||
|
Yiyang Chen
|
6f6183a395 |
bpf: Guard conntrack opts error writes
The conntrack lookup and allocation kfuncs take an opts pointer together with an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal lookup or allocation helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. Keep returning NULL for invalid arguments, but only report the error through opts->error when the supplied size includes the field. This preserves error reporting for the supported 12-byte and 16-byte layouts, and for other invalid sizes that still include opts->error. Fixes: |
||
|
Nuoqi Gui
|
8816d94303 |
selftests/bpf: Cover half-slot cleanup of pointer spills
Add a verifier regression test for a pointer spill whose high half is cleaned dead while the low half remains live. Force checkpoint creation with BPF_F_TEST_STATE_FREQ and assert the verifier log reaches the checkpoint and the subsequent 32-bit fill before rejecting the partial fill from a non-scalar spill. Acked-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn> Link: https://lore.kernel.org/r/20260617-f01-06-half-slot-pointer-spill-v2-2-42b9cdc3cf64@mails.tsinghua.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Nuoqi Gui
|
3a354149bc |
bpf: Preserve pointer spill metadata during half-slot cleanup
__clean_func_state() cleans dead stack slots in 4-byte halves. When the
high half of a STACK_SPILL slot is dead and the low half remains live,
cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears
the saved spilled_ptr metadata.
That conversion is safe only for scalar spills. For a pointer spill, this
metadata clear lets a later 32-bit fill from the still-live half avoid the
normal non-scalar register-fill check and be treated as an ordinary scalar
stack read.
Leave non-scalar spill slots intact in this half-live shape. This is
conservative for pruning and preserves the existing
check_stack_read_fixed_off() rejection path for partial fills from pointer
spills.
Fixes:
|
||
|
Alexei Starovoitov
|
3d8e6fef15 |
Merge branch 'fix-effective-prog-array-indexing-with-bpf_f_preorder'
Amery Hung says: ==================== Fix effective prog array indexing with BPF_F_PREORDER This patchset fixes a cgroup effective-array indexing bug where replace_effective_prog() and purge_effective_progs() used a linear hlist position that doesn't match the array layout when BPF_F_PREORDER programs are present, corrupting the array on link update and risking a use-after-free in the detach fallback. It computes the slot via a shared effective_prog_pos() helper and adds a cgroup_preorder selftest. Changelog v1 -> v2: - Also fix purge_effective_progs(), in addition to replace_effective_prog() (Sashiko). - selftest: Set err on bpf_link_create() failure so the failure is reported to the caller (Sashiko). ==================== Link: https://patch.msgid.link/20260619063520.2690547-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Amery Hung
|
a6ff26f360 |
selftests/bpf: Test cgroup link replace with BPF_F_PREORDER
Add a cgroup_preorder case that attaches a normal and a BPF_F_PREORDER program to a cgroup (effective order [2, 1]), then replaces the normal link's program via bpf_link_update() and checks the effective order becomes [2, 3] — i.e. only the non-preorder slot changes. Without the replace_effective_prog() fix the array is corrupted and the order is wrong. Signed-off-by: Amery Hung <ameryhung@gmail.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260619063520.2690547-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Amery Hung
|
f08aaee315 |
bpf: Fix effective prog array index with BPF_F_PREORDER
replace_effective_prog() and purge_effective_progs() located the slot in
the effective array by walking the program hlist and counting entries
linearly. That count does not match the array layout: compute_effective_
progs() places BPF_F_PREORDER programs at the front (ancestor cgroup
first, attach order within a cgroup) and the rest after them (descendant
cgroup first). So when a preorder program is present, the linear hlist
position no longer equals the program's index in the effective array.
For replace_effective_prog() (bpf_link_update()) this overwrote the
wrong slot, corrupting the effective order. For purge_effective_progs(),
it could dummy out a slot belonging to a different program and leave the
detached program in the array while bpf_prog_put() drops its reference,
i.e. a use-after-free.
Fix both by replaying compute_effective_progs()'s placement (including
the per-cgroup preorder reversal) in a shared effective_prog_pos()
helper. Identify the entry by its struct bpf_prog_list pointer rather
than by (prog, link) value, so the lookup resolves to exactly the
attachment the syscall selected even when the same bpf_prog is attached
to several cgroups in the hierarchy.
Fixes:
|
||
|
Thiébaud Weksteen
|
8405c46264 |
bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check
When struct prog_assoc_struct_ops was added,
BPF_PROG_ASSOC_STRUCT_OPS_LAST_FIELD referenced prog_fd instead of the
actual last field, flags.
Fixes:
|
||
|
Avinash Duduskar
|
0dfcb68a6a |
bpf: zero-initialize the fib lookup flow struct
bpf_ipv4_fib_lookup() and bpf_ipv6_fib_lookup() build the flow key on
the stack with a bare "struct flowi4 fl4;" / "struct flowi6 fl6;" and
fill it field by field, but never set flowi4_l3mdev / flowi6_l3mdev.
On the non-DIRECT path the lookup goes through the fib rules whenever the
netns has custom rules, which a VRF installs:
bpf_ipv4_fib_lookup() -> fib_lookup() -> __fib_lookup()
-> l3mdev_update_flow() reads !fl->flowi_l3mdev
-> fib_rules_lookup() -> fib_rule_match()
-> l3mdev_fib_rule_match() uses fl->flowi_l3mdev
l3mdev_update_flow() resolves the l3mdev master from the ingress device
only while the field is still zero. Left at a nonzero stack value the
resolution is skipped, and l3mdev_fib_rule_match() then tests that value
as an ifindex, so the VRF master is not resolved and the rule fails to
match: an ingress enslaved to a VRF can fail to select its table. FIB
rules matching on an L3 master device (l3mdev_fib_rule_iif_match()/
_oif_match()) read the same value, so an "ip rule iif/oif <vrf>"
mismatches the same way.
Zero-initialize the whole flow struct rather than adding one more
field assignment, so any flowi field added later is covered too.
ip_route_input_slow() likewise zeroes the field before its input lookup.
CONFIG_INIT_STACK_ALL_ZERO masks this by default, but it depends on
compiler support (CC_HAS_AUTO_VAR_INIT_ZERO), so INIT_STACK_NONE builds,
including older toolchains that fall back to it, are exposed. Built with
INIT_STACK_ALL_PATTERN, a plain bpf_fib_lookup (no VLAN, no DIRECT) over a
VRF slave whose destination is routed only in the VRF table returns
BPF_FIB_LKUP_RET_NOT_FWDED, and resolves with this patch. On the default
config the lookup succeeds either way, so ordinary testing does not catch
the bug.
Fixes:
|
||
|
Yichong Chen
|
bda6a7308e |
bpftool: Fix vmlinux BTF leak in cgroup commands
bpftool cgroup show and tree call libbpf_find_kernel_btf() to
resolve attach_btf names, but never release the returned BTF object.
For cgroup tree, do_show_tree_fn() is called once for each cgroup
visited by nftw(). When more than one cgroup has attached programs,
each callback overwrites btf_vmlinux with a new object and loses the
previous allocation.
Load vmlinux BTF only once during a tree walk and release it when
cgroup show or tree completes. Reset btf_vmlinux_id at the same time
so batch mode starts with clean state.
Fixes:
|
||
|
Jiri Olsa
|
d5dc200c3a |
bpf: Add missing access_ok call to copy_user_syms
As reported by sashiko we use __get_user without prior access_ok call on the
user space pointer. Adding the missing call for the whole pointer array.
Plus removing the err check in the error path, because it's not needed and
also we can return -ENOMEM directly from the first kvmalloc_array fail path.
Cc: stable@vger.kernel.org
[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
Fixes:
|
||
|
Emil Tsalapatis
|
39799c6357 |
bpf: Allow type tag BTF records to succeed other modifier records
llvm commit [1] allowed attaching type tag records to modifier BTF records. This is useful for using typedefs that encompass a base type and a type tag, e.g.: typedef struct rbtree __arena rbtree_t; Modify btf_check_type_tags() so that it allows this sequence of records. The function now only checks for record loops in BTF modifier record chains. Rename to btf_check_modifier_chain_length to reflect this. Also expand the BTF modifier traversal code to take into account that type record can be interleaved with other modifier records. In effect this means traversing all modifiers to collect the type tags. Also modify existing selftests to now accept modifier records (const, typedef) that point to type tag records. [1] https://github.com/llvm/llvm-project/pull/203089 Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260616061454.7869-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Alexei Starovoitov
|
a933bade82 |
bpf: Emit verbose message when prog-specific btf_struct_access rejects a write
When BPF_WRITE goes through a PTR_TO_BTF_ID register, check_ptr_to_btf_access() delegates to env->ops->btf_struct_access(). Most implementations (bpf_scx_btf_struct_access, tc_cls_act_btf_struct_access, etc.) return -EACCES for disallowed fields without logging anything, so the verifier rejects the program with an empty message. For example a scx program doing 1: R1=trusted_ptr_task_struct() ... 4: (7b) *(u64 *)(r1 +0) = r2 verification time 83 usec the program is rejected leaves the user guessing which field is off-limits. Emit verbose message. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260615232146.5491-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Ihor Solodrai
|
5e72b5b157 |
bpf: Fix build_id caching in stack_map_get_build_id_offset()
This patch is a follow up to recent implementation of
stack_map_get_build_id_offset_sleepable() [1].
stack_map_get_build_id_offset() and its sleepable variant each cached
only the last successfully resolved VMA, with separate bookkeeping in
each function. A run of IPs in a VMA with no usable build ID will
repeat the lookup for every frame: find_vma() in the non-sleepable
path, a VMA lock and a blocking build_id_parse_file() in the sleepable.
Factor the per-call cache into a shared struct stack_map_build_id_cache
with two independent slots [2][3], used by both functions:
* resolved - last VMA that produced a build ID (file, build_id and
range), reused to skip the lookup and the parse;
* unresolved - last VMA with no usable build ID (range only), reused to
emit a raw IP without another lookup or parse.
Keeping the slots independent means a build-ID-less VMA no longer evicts
the last resolved build ID, so a trace alternating between a binary and a
region without one stops re-resolving the binary on every return.
The shared lookup tests [vm_start, vm_end), matching the sleepable path;
the non-sleepable path previously reused a build ID for ip == vm_end
(range_in_vma() is inclusive) and now re-resolves it correctly.
[1] https://lore.kernel.org/bpf/20260525223948.1920986-1-ihor.solodrai@linux.dev/
[2] https://lore.kernel.org/bpf/CAEf4Bza2fRDGhLQoPE-EzM7F34xaEJfi5Exmxb-iWVUN3F06=g@mail.gmail.com/
[3] https://lore.kernel.org/bpf/CAEf4BzZXJFr=1iiVx937ht=4PYQkQHg=eFk810zhMDzXQG3ihw@mail.gmail.com/
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/r/20260615195536.1065107-1-ihor.solodrai@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
||
|
Sun Jian
|
b5f3534268 |
bpf: Fix partial copy of non-linear test_run output
For non-linear test_run output, bpf_test_finish() derives the linear
data copy length from copy_size - frag_size. This only matches the
linear data length when copy_size is the full packet size.
When userspace provides a short data_out buffer, copy_size is clamped to
that buffer size. If copy_size is smaller than frag_size, the computed
length becomes negative and bpf_test_finish() returns -ENOSPC before
copying the packet prefix or updating data_size_out.
Compute the linear data length from the packet layout instead, and clamp
the linear copy length to copy_size. This preserves the expected
partial-copy semantics: return -ENOSPC, copy the packet prefix that fits
in data_out, and report the full packet length through data_size_out.
Fixes:
|
||
|
Alexei Starovoitov
|
3eb21c8691 |
Merge branch 'bpf-fix-stack-slot-index-for-spectre-v4-nospec-checks'
Nuoqi Gui says: ==================== bpf: Fix stack slot index for Spectre v4 nospec checks check_stack_write_fixed_off() uses one byte-indexing scheme when checking whether a fixed-offset stack write needs Spectre v4 sanitization, and another scheme when recording the write into slot_type[]. For sub-8-byte writes this can make the sanitization check look at bytes that are not overwritten by the write. A zeroed lower half-slot followed by a write to the upper half-slot can therefore miss the nospec barrier for the second write. Use the same stack-byte index for the sanitization check and the slot update, and add a focused verifier selftest that expects both half-slot writes to emit nospec through the unprivileged loader lane. Bounded impact: this fixes verifier/JIT Spectre v4 mitigation emission for a fixed-offset stack-write corner case. No architectural verifier memory-safety bypass, exploit chain, CVE, embargo, or security escalation is claimed. Fixes: |
||
|
Nuoqi Gui
|
a93ae7ed59 |
selftests/bpf: Cover stack nospec slot indexing
Add a verifier test for the fixed-offset stack write case where two 4-byte stores initialize opposite halves of the same stack slot. The test runs through the unprivileged loader lane and expects both half-slot writes to emit nospec in the translated program. Acked-by: Luis Gerhorst <luis.gerhorst@fau.de> Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn> Link: https://lore.kernel.org/r/20260618-f01-11-stack-nospec-slot-index-v3-2-780297041721@mails.tsinghua.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
||
|
Nuoqi Gui
|
d1d53aa30a |
bpf: Fix stack slot index in nospec checks
check_stack_write_fixed_off() computes the byte slot for a fixed-offset
stack write as -off - 1, and records each written byte in slot_type[] with
(slot - i) % BPF_REG_SIZE.
The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a
4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the
pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates
bytes 7..4. That can leave the second half-slot write without nospec_result
even though the bytes being overwritten still require sanitization.
Use the same slot index in the sanitization pre-check that the write path uses
when updating slot_type[].
Fixes:
|
||
|
Linus Torvalds
|
ef0c9f75a1 |
lib: Add stale 'raid6' directory to .gitignore file
I keep having to do this, because people think they can just move
directories around and move the gitignore files around with them.
You really can't do that - the old generated files stay around for
others, and still need to be ignored in the old location.
So when moving gitignore entries around because you moved the files (or
when moving a whole gitignore file around because the directory it was
in moved), the old gitignore situation needs to be dealt with.
Yes, those files may have moved in *your* tree when you moved the
directory. And yes, new repositories will never even have seen them.
But all those other developers that see the result of your move still
likely have a working tree with the old state, and the files that were
hidden from git by an old gitignore file do not suddenly become
relevant.
Fixes:
|
||
|
Linus Torvalds
|
2e05544060 |
mm.git review status for mm-hotfixes-stable..mm-nonmm-stable
Everything:
Total patches: 108
Reviews/patch: 0.84
Reviewed rate: 75%
Patch series in this merge:
- The 2 patch series "taskstats: fix TGID dead-thread stat retention"
from Yiyang Chen fixes a taskstats TGID aggregation bug where fields
added in the TGID query path were not preserved after thread exit, and
adds a kselftest covering the regression.
- The 2 patch series "lib/tests: string_helpers: Slight improvements"
from Andy Shevchenko improves lib/tests/string_helpers_kunit.c a little.
- The 2 patch series "lib/base64: decode fixes" from Josh Law addreesses
minor issues in lib/base64.c.
- The 3 patch series "selftests/filelock: Make output more kselftestish"
from Mark Brown makes the output from the ofdlocks test a bit easier for
tooling to work with, and also ignores the generated file.
- The 3 patch series "uaccess: unify inline vs outline
copy_{from,to}_user() selection" from Yury Norov simplifies the usercopy
code by removing the selectability of inlining copy_{from,to}_user().
- The 5 patch series "ocfs2: validate inline xattr header consumers"
from ZhengYuan Huang fixes a number of possible issues in the ocfs2
xattr code.
- The 8 patch series "lib and lib/cmdline enhancements" from Dmitry
Antipov provides additional robustness checking in the cmdline handling
code and its in-kernel testing and selftests.
- The 18 patch series "cleanup the RAID6 P/Q library" from Christoph
Hellwig cleans up the RAID6 P/Q library to match the recent updates to
the RAID 5 XOR library and other CRC/crypto libraries.
- The 3 patch series "ocfs2: harden inode validators against forged
metadata" from Michael Bommarito adds three structural checks to OCFS2
dinode validation so malformed on-disk fields are rejected before
ocfs2_populate_inode() copies them into the in-core inode.
- The 2 patch series "lib/raid: replace __get_free_pages() call with
kmalloc()" from Mike Rapoport cleans up the lib/raid code by using
kmalloc() in more places.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCajgeIQAKCRDdBJ7gKXxA
jmlWAQCLJVDZNJMFaXy4a+YHdu3tfemLpSy83A0Le61tOZUdBQD/Sf/7rhgeaM74
32yp53TZLA8xHImCGEin/1ddPJ8DbgY=
=GW2I
-----END PGP SIGNATURE-----
Merge tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM updates from Andrew Morton:
- "taskstats: fix TGID dead-thread stat retention" (Yiyang Chen)
Fix a taskstats TGID aggregation bug where fields added in the TGID
query path were not preserved after thread exit, and adds a kselftest
covering the regression.
- "lib/tests: string_helpers: Slight improvements" (Andy Shevchenko)
Improve lib/tests/string_helpers_kunit.c a little
- "lib/base64: decode fixes" (Josh Law)
Address minor issues in lib/base64.c
- "selftests/filelock: Make output more kselftestish" (Mark Brown)
Make the output from the ofdlocks test a bit easier for tooling to
work with. Also ignore the generated file
- "uaccess: unify inline vs outline copy_{from,to}_user() selection"
(Yury Norov)
Simplify the usercopy code by removing the selectability of inlining
copy_{from,to}_user().
- "ocfs2: validate inline xattr header consumers" (ZhengYuan Huang)
Fix a number of possible issues in the ocfs2 xattr code
- "lib and lib/cmdline enhancements" (Dmitry Antipov)
Provide additional robustness checking in the cmdline handling code
and its in-kernel testing and selftests
- "cleanup the RAID6 P/Q library" (Christoph Hellwig)
Clean up the RAID6 P/Q library to match the recent updates to the
RAID 5 XOR library and other CRC/crypto libraries
- "ocfs2: harden inode validators against forged metadata" (Michael
Bommarito)
Add three structural checks to OCFS2 dinode validation so malformed
on-disk fields are rejected before ocfs2_populate_inode() copies them
into the in-core inode
- "lib/raid: replace __get_free_pages() call with kmalloc()" (Mike
Rapoport)
Clean up the lib/raid code by using kmalloc() in more places
* tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (108 commits)
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
lib: interval_tree_test: validate benchmark parameters
ocfs2: avoid moving extents to occupied clusters
treewide: fix transposed "sign" typos and update spelling.txt
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
fat: reject BPB volumes whose data area starts beyond total sectors
selftests/uevent: increase __UEVENT_BUFFER_SIZE to avoid ENOBUFS on busy systems
lib/test_firmware: allocate the configured into_buf size
fs: efs: remove unneeded debug prints
checkpatch: cuppress warnings when Reported-by: is followed by Link:
MAINTAINERS: add Alexander as a kcov reviewer
mailmap: update Alexander Sverdlin's Email addresses
fs: fat: inode: replace sprintf() with scnprintf()
ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
ocfs2/dlm: require a ref for locking_state debugfs open
ocfs2: reject FITRIM ranges shorter than a cluster
ocfs2: validate fast symlink target during inode read
ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
...
|
||
|
Linus Torvalds
|
09e3b4a76b |
NAND changes:
- Extend SPI NAND continuous read to Winbond devices, which requires
numerous changes in the spi-{mem,nand} layers such as the need for a
secondary read operation template.
- Continuous reads in general have also been enhanced/fixed for avoiding
potential issues at probe time and at block boundaries.
SPI NOR changes:
- Big set of cleanups and improvements to the locking support. This
series contains some cleanups and bug fixes for code and documentation
around write protection. Then support is added for complement locking,
which allows finer grained configuration of what is considered locked
and unlocked. Then complement locking is enabled on a bunch of Winbond
W25 flashes.
- Fix die erase support on Spansion flashes. Die erase is only supported
on multi-die flashes, but the die erase opcode was set for all. When
the opcode is set, it overrides the default chip erase opcode which
should be used for single-die flashes. Only set the opcode on
multi-die flashes. Also, the opcode was not set on multi-die s28hx-t
flashes. Set it so they can use die-erase correctly.
General changes:
- A few drivers and mappings have been removed following SoCs support
removal.
- And again, there is the usual load of misc improvements and fixes.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmo3/r8ACgkQJWrqGEe9
VoQcbgf/c6g4W+83hH9E+/6p2CvAFt1SdVSkR5wLG7duZjD1uhSqlHNEOW2auNMn
fdzgaXr/XmOP0Saob2LV8nNMWDJ2oWmqvJ065obK/Aj+BTDZwPaeMDDxdjMKTxkk
kOzqE7HuBrIotAMtsEpiMm1sGjRQYSQpVFfWmCMANWGnU44aaqGfGWKQVV/ZNlZK
YToLnjHdB8B0jU8FtJEbJoG7UeM2WFGp1/Ok8E7Tci47JklDybYauJnICDkwHSv/
UcdR0QdiOw1K2pRx9Ja/YIOmr7JmZ1ERX1bEI5Um9dsGUeAhB5Vd0YrKLiX1o98W
ygLyTPRTuKNihN7tr5ZLWoNrD5pzUg==
=6rG2
-----END PGP SIGNATURE-----
Merge tag 'mtd/for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull mtd updates from Miquel Raynal:
"NAND changes:
- Extend SPI NAND continuous read to Winbond devices, which requires
numerous changes in the spi-{mem,nand} layers such as the need for
a secondary read operation template
- Continuous reads in general have also been enhanced/fixed for
avoiding potential issues at probe time and at block boundaries
SPI NOR changes:
- Big set of cleanups and improvements to the locking support.
This series contains some cleanups and bug fixes for code and
documentation around write protection. Then support is added for
complement locking, which allows finer grained configuration of
what is considered locked and unlocked. Then complement locking is
enabled on a bunch of Winbond W25 flashes
- Fix die erase support on Spansion flashes.
Die erase is only supported on multi-die flashes, but the die erase
opcode was set for all. When the opcode is set, it overrides the
default chip erase opcode which should be used for single-die
flashes. Only set the opcode on multi-die flashes. Also, the opcode
was not set on multi-die s28hx-t flashes. Set it so they can use
die-erase correctly
General changes:
- A few drivers and mappings have been removed following SoCs support
removal
- And again, there is the usual load of misc improvements and fixes"
* tag 'mtd/for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (63 commits)
mtd: cfi: Use common error handling code in two functions
mtd: slram: simplify register_device() cleanup
mtd: slram: remove failed entries from the device list
mtd: rawnand: ndfc: use ioread32be/iowrite32be and allow COMPILE_TEST
mtd: spi-nor: spansion: add die erase support in s28hx-t
mtd: spi-nor: spansion: use die erase for multi-die devices only
mtd: spi-nor: winbond: Add W25Q02NWxxIM CMP locking support
mtd: spi-nor: winbond: Add W25Q01NWxxIM CMP locking support
mtd: spi-nor: winbond: Add W25Q01NWxxIQ CMP locking support
mtd: spi-nor: winbond: Add W25H02NWxxAM CMP locking support
mtd: spi-nor: winbond: Add W25H01NWxxAM CMP locking support
mtd: spi-nor: winbond: Add W25H512NWxxAM CMP locking support
mtd: spi-nor: Add steps for testing locking with CMP
mtd: spi-nor: swp: Add support for the complement feature
mtd: spi-nor: Add steps for testing locking support
mtd: maps: remove obsolete impa7 map driver
mtd: maps: remove uclinux map driver
mtd: maps: remove AMD Élan specific drivers
mtd: inftlmount: convert printk(KERN_WARNING) to pr_warn
mtd: Consistently define pci_device_ids
...
|
||
|
Linus Torvalds
|
8cd8cf7a07 |
SCSI misc on 20260621
Only ufs driver updates this time, apart from which this is just an assortment of bug fixes and AI assisted changes. The biggest other change is the reversion of the sas_user_scan patch which supported a mpi3mr NVME behaviour but caused major issues for other sas controllers. The next biggest is the removal of target reset in tcm_loop.c. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCajfkNxsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIUNpAD+LZEfeMQpNZrEd4Ug/1IGHjnDvEnGp3Wx lDfSEVqLqfABAIKqL0npb+kjgdkGT3IuugIboX27/XDBcCb6mPQdXIst =6T7N -----END PGP SIGNATURE----- Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Only ufs driver updates this time, apart from which this is just an assortment of bug fixes and AI assisted changes. The biggest other change is the reversion of the sas_user_scan patch which supported a mpi3mr NVME behaviour but caused major issues for other sas controllers. The next biggest is the removal of target reset in tcm_loop.c" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (56 commits) scsi: target: Remove tcm_loop target reset handling scsi: lpfc: Fix spelling mistakes in comments scsi: ufs: ufs-pci: Add AMD device ID support scsi: ufs: core: Handle PM commands timeout before SCSI EH scsi: devinfo: Broaden Promise VTrak E310/E610 identification scsi: target: Use constant-time crypto_memneq() for CHAP digests scsi: target: Fix hexadecimal CHAP_I handling scsi: scsi_debug: Fix one-partition tape setup bounds scsi: ufs: qcom: dt-bindings: Document the Hawi UFS controller scsi: mailmap: Update Avri Altman's email address scsi: ufs: Remove redundant vops NULL check and trivial wrapper scsi: ufs: Remove unnecessary return in void vops wrappers scsi: ufs: Fix wrong value printed in unexpected UPIU response case scsi: ufs: core: Fix NULL pointer dereference in scsi_cmd_priv() calls scsi: megaraid_mbox: Avoid double kfree() scsi: pm8001: Fix error code in non_fatal_log_show() scsi: lpfc: Turn lpfc_queue q_pgs into a flexible array scsi: ufs: core: Skip link param validation when lanes_per_direction is unset scsi: sas: Skip opt_sectors when DMA reports no real optimization hint scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" ... |
||
|
Linus Torvalds
|
1bc1885835 |
Asides of the avalanche of LLM-driven fixes, there are a couple of
big changes this cycle: - negative dentry and symlink cache - a way out of the unkillable "io_wait_event_killable" (because it looped around waiting for the request flush to come back from server; this has been bugging syzcaller folks since forever): I'm still not 100% sure about this patch, but I think it's as good as we'll ever get, and will keep testing a bit further in the coming weeks The rest is more noisy than usual, but shouldn't cause any trouble. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE/IPbcYBuWt0zoYhOq06b7GqY5nAFAmo34aAACgkQq06b7GqY 5nDn4g/9GuPXA8CLoHaRGToNvQhgTVjqKlqHA94kicLX3EFd9xgapu22kPUHa1Li 94bceMtyvCcCNkdzPVcQUEIUo4O7PC20u6ljxulSqU1UxwwhWsIiLMwoZi8gJFcq LLAoa4v/cY3pGYru1SHoVo31rh0AWN+y4V6Xc7uQvHIFANlMEcMLkGvlM8RJXVk2 3pMWj4jIIksQ1JlRc/NM2Eysvj5Wr6QksULvRNPCRj0jTvHBxuFPWz6WEIz26W21 h8y9n1bZttwoECL/I8vPzKu4atEXgDUTj/fRhfR0EfxwU/fRFUrbbfGYWOEBoLrs BHtDNy2X7vfg6TCqyxWByxDODgz2NPcV81JyPoexDCyAVfObwf+xzHOUgHeZaewa VYFV59fNWKRw0knzHZWdgNs9NUdCiaCO8qagVI2gWqjP2guCfCASfTwYMAqOL5LI ESEyzIoRYYcCw0BbIYiUw+cf4mHzA4tyxy/ST7ZpvHhE3yuEk3gzGiX0Yr/0pJqF VyRa2qzJsImCWaiS2Ex3VVimzaN1x7bAganFqzcxklK5qvdfT9nDI1hjjFPKsqeD zmDBfOCySN1KmTFopL2+tkLwLRXby/TRGPXZU8tDcqWWzT71I2sm01u8J3YS5LC0 z8CaPKToZl6DfQ+rWkdQe8NDFdsPvmc8SICnyQsv6jFl8nkCPUo= =sgkZ -----END PGP SIGNATURE----- Merge tag '9p-for-7.2-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "Asides of the avalanche of LLM-driven fixes, there are a couple of big changes this cycle: - negative dentry and symlink cache - a way out of the unkillable "io_wait_event_killable" (because it looped around waiting for the request flush to come back from server; this has been bugging syzcaller folks since forever): I'm still not 100% sure about this patch, but I think it's as good as we'll ever get, and will keep testing a bit further in the coming weeks The rest is more noisy than usual, but shouldn't cause any trouble" * tag '9p-for-7.2-rc1' of https://github.com/martinetd/linux: 9p: Add missing read barrier in virtio zero-copy path net/9p: Replace strlen() strcpy() pair with strscpy() 9p: skip nlink update in cacheless mode to fix WARN_ON net/9p: fix race condition on rdma->state in trans_rdma.c 9p: v9fs_file_do_lock: replace WARN_ONCE with p9_debug 9p: Enable symlink caching in page cache 9p: Set default negative dentry retention time for cache=loose 9p: Add mount option for negative dentry cache retention 9p: Cache negative dentries for lookup performance 9p: avoid returning ERR_PTR(0) from mkdir operations 9p: avoid putting oldfid in p9_client_walk() error path net/9p: fix infinite loop in p9_client_rpc on fatal signal docs/filesystems/9p: fix broken external links 9p: invalidate readdir buffer on seek 9p: use kvzalloc for readdir buffer net/9p/usbg: Constify struct configfs_item_operations |
||
|
Linus Torvalds
|
aff3ca32f3 |
firewire updates for v7.2
This update includes the following changes. Unit drivers have been able to assign an arbitrary value in the mod_device entry, which is typed as kernel_ulong_t. While storing the pointer value is legitimate, conversion back to a pointer has been performed without preserving const qualifier. Uwe Kleine-König introduced an union to provide safer and more robust conversions, as part of the ongoing CHERI enhancement work for ARM and RISC-V architectures. This update includes changes in the sound subsystem, since the conversion pattern is widely used in ALSA firewire stack. The userspace applications can request the core function to perform isochronous resource management procedures. Dingsoul reported reference-count leak when these procedures are processed in workqueue contexts. This update refactors the relevant code paths following a divide and conquer approach. Consequently, it became clear that the issue still remain only in the path when userspace applications delegate automatic resource reallocation after bus resets to the core. In practice, the leak is rarely triggered, and a complete fix is still in progress. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCajZH8gAKCRCsLtaWM8Lw E5zDAP4gyY1cTSdvIeKay8yYRLqZXtBQTzMeqfSsptLBQgemCAEAwAFP+KKghjU7 sDhDPgBD4bTDvYtjyh/RFb0lkTGV7wA= =3J0T -----END PGP SIGNATURE----- Merge tag 'firewire-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: - firewire drivers have been able to assign an arbitrary value in the mod_device entry, which is typed as kernel_ulong_t. While storing the pointer value is legitimate, conversion back to a pointer has been performed without preserving the const qualifier. Uwe Kleine-König introduced an union to provide safer and more robust conversions, as part of the ongoing CHERI enhancement work for ARM and RISC-V architectures. This includes changes to the sound subsystem, since the conversion pattern is widely used in ALSA firewire stack. - Userspace applications can request the core function to perform isochronous resource management procedures. Dingsoul reported a reference-count leak when these procedures are processed in workqueue contexts. This refactors the relevant code paths following a divide and conquer approach. Consequently, it became clear that the issue still remain in the path when userspace applications delegate automatic resource reallocation after bus resets to the core. In practice, the leak is rarely triggered, and a complete fix is still in progress. * tag 'firewire-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: Open-code topology list walk firewire: core: cancel using delayed work for iso_resource_once management firewire: core: rename member name for channel mask of isoc resource firewire: core: minor code refactoring for case-dependent parameters of iso resources management ALSA: firewire: Make use of ieee1394's .driver_data_ptr firewire: Simplify storing pointers in device id struct firewire: core: move allocation/reallocation paths into specific branch after isoc resource management in cdev firewire: core: refactor notification type determination after isoc resource management in cdev firewire: core: use switch statement for post-processing of isoc resource management in cdev firewire: core: reduce critical section duration in pre-processing of isoc resource management in cdev firewire: core: code cleanup for iso resource auto creation firewire: core: append _auto suffix for non-once iso resource operations firewire: core: code cleanup to remove old implementations for once operation firewire: core: split functions for iso_resource once operation firewire: core: code refactoring for helper function to fill iso_resource parameters firewire: core: code refactoring to queue work item for iso_resource firewire: core: code refactoring for early return at client resource allocation |
||
|
Linus Torvalds
|
d639d9fa16 |
liveupdate: updates for 7.2-rc1
- kho: make memory preservation compatible with deferred initialization of
the memory map
- luo: add LIVEUPDATE_SESSION_GET_NAME ioctl and parameter verification for
LIVEUPDATE_IOCTL_CREATE_SESSION ioctl
- luo: documentation updates for liveupdate=on command line option, systemd
support and the current compatibility status
- luo: remove the fixed limits on the number of files that can be preserved
within a single session, and the total number of sessions managed by the
Live Update Orchestrator
- fixes that didn't cut as urgent and were delayed until the merge window:
* reference count incoming File-Lifecycle-Bound (FLB) data so it cannot
be freed while a subsystem is still using it
* fixes for a TOCTOU race in luo_session_retrieve(), a use-after-free in
the file finish and unpreserve paths, concurrent session mutations
during reboot and serialization on preserve_context kexec
* make sure ioctls for incoming LUO sessions are blocked for outgoing
sessions and vice versa
* make sure KHO scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
* fix memblock tests build issue introduced by KHO changes
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmo315YACgkQOQOGJssO
/ZE1SQf/e+ETXoC/oAhg7aIR8HM8NRWxgp1Ira6fpLJ0IvUlPQSE3yumLaVUymg3
T3mK+b0BbIEjb6QT4/+UQEFnh01C+opxceghjCc2z6HIsp2Y/VCXnZNj31FWrspZ
yWAVkhppHwEpA6z45jDM6ua8KI5V3TwyZ15xxCUewVYSKqw7GrvijHlAowAa5H3n
elwqfjjiooGnDKTrcjpVJj7Qix9LRf0OJhGqlip5np8TW9S/pU3gT7g304iQEgSj
GiDs/3vmOkV82HV5ifAgv21Tjs4bCQi1hk9f8SpgF10onnhokSp2/uzVmfqYqcxx
hvANOdCBUoO4FzIg/9uBriSynGzYbw==
=urD+
-----END PGP SIGNATURE-----
Merge tag 'liveupdate-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux
Pull liveupdate updates from Mike Rapoport:
"Kexec Handover (KHO):
- make memory preservation compatible with deferred initialization
of the memory map
Live Update Orchestrator (LUO):
- add LIVEUPDATE_SESSION_GET_NAME ioctl and parameter verification
for LIVEUPDATE_IOCTL_CREATE_SESSION ioctl
- documentation updates for liveupdate=on command line option,
systemd support and the current compatibility status
- remove the fixed limits on the number of files that can be
preserved within a single session, and the total number of
sessions managed by the LUO
Misc fixes:
- reference count incoming File-Lifecycle-Bound (FLB) data so
it cannot be freed while a subsystem is still using it
- fixes for a TOCTOU race in luo_session_retrieve(), a use-
after-free in the file finish and unpreserve paths, concurrent
session mutations during reboot and serialization on
preserve_context kexec
- make sure ioctls for incoming LUO sessions are blocked for
outgoing sessions and vice versa
- make sure KHO scratch size is always aligned by
CMA_MIN_ALIGNMENT_BYTES
- fix memblock tests build issue introduced by KHO changes"
* tag 'liveupdate-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: (36 commits)
liveupdate: Document that retrieve failure is permanent
docs: memfd_preservation: fix rendering of ABI documentation
selftests/liveupdate: Add stress-files kexec test
selftests/liveupdate: Add stress-sessions kexec test
selftests/liveupdate: Test session and file limit removal
liveupdate: Remove limit on the number of files per session
liveupdate: Remove limit on the number of sessions
liveupdate: defer session block allocation and physical address setting
kho: add support for linked-block serialization
liveupdate: Extract luo_session_deserialize_one helper
liveupdate: Extract luo_file_deserialize_one helper
liveupdate: register luo_ser as KHO subtree
liveupdate: centralize state management into struct luo_ser
liveupdate: avoid mixing cleanup guards with goto in luo_session_retrieve_fd
liveupdate: change file_set->count type to u64 for type safety
liveupdate: Remove unused ser field from struct luo_session
liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()
liveupdate: block session mutations during reboot
liveupdate: fix TOCTOU race in luo_session_retrieve()
liveupdate: skip serialization for context-preserving kexec
...
|
||
|
Linus Torvalds
|
1e762b53a8 |
OpenRISC updates for 7.2
A few fixes for text patching related code:
* Update the section of map_page used in text patching. It was
left with __init when text patching was introduced to OpenRISC.
* Add fix to invalidate remote SMP core i-caches after text is patched.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmo2KLoACgkQw7McLV5m
J+Rc6g/+IGKEW1snpoq8Gwfi3nYHhrwpR7oFvq+hwCIMd1srnsKy9r5O2bZmahha
dSST4ZnSdxu1j0sS8tmNPK+ese7AKP5W0Qp79TnagqF0USTgp/ea5POA0mCxiswB
YjmV6FbueYJV85sX6caiJyV4WHYoFr3RyydmJvq64eiTV5u4oekRpvFtXEJfTY+J
ACvJ7hVDg6ZogdUfhWJDdMGTS+fdeOeBLyspFVDaWUCaWVyADgC8zMJT2+Z3mgDt
2tUgN/QGW3vfWsjttstvvCRB5KwmSo1NhUumcUsWr30qioxR04DZwV1UgT3MNqE1
pj9dNakhYU5PMosKK6GQ4JTh8tLJ4sbo1CLUrmtMMhZc65K30gF9v0xX+oYsh+J7
Rmb/hLqp/nOptp0PHcwPgPXJIujBEHCul5vDbgYFd3CpQLl1CtCy/+FHldNm11NW
CmfUgXLLLd5ftZqcXVRyo1f5r03bvidgNi4xdVvS4g/H0wHt0A6L8j7VZO6DjmAF
AwbBJBQRXf7xSBbzYNzoZz+WClJ8CKsL1GKr07CRLS7vTQVtLWQXE/2wLqYTKTcq
R7JoaaBvQIMQDhTM++26rQwSp5Y3dl7GAWjUNiMHMCUiwIZ1k30W5qbE+v2upf72
bD8vgc3A8bYSAz70rCwjC4vBexVGYB6imq6HoQNDTfZZo5od49E=
=aHUx
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC updates from Stafford Horne:
"A few fixes for text patching related code:
- Update the section of map_page used in text patching. It was
left with __init when text patching was introduced to OpenRISC
- Add fix to invalidate remote SMP core i-caches after text is
patched"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: Fix jump_label smp syncing
openrisc: Add full instruction cache invalidate functions
openrisc: Cache invalidation cleanup
openrisc: mm: Fix section mismatch between map_page and __set_fixmap
|
||
|
Miquel Raynal
|
49420dfded |
* Extend SPI NAND continuous read to Winbond devices, which requires
numerous changes in the spi-{mem,nand} layers such as the need for a
secondary read operation template.
* Continuous reads in general have also been enhanced/fixed for avoiding
potential issues at probe time and at block boundaries.
Plus, there is the usual load of misc fixes and improvements.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmo3/ScACgkQJWrqGEe9
VoSQpAf+Lmra6J3A1kiQAfNdod2Yt7WtOvmc3qRrhuN5yt7h/pgnmIVdii6j+zFQ
mxmrN5sDSujA5nZnsPb3pcFyLBvfFsh+6LYDzE5zYODDO17TwPOJWR8qYaQVzFyC
Ml6drEQBssGPVIWoI1jdihNuyY3bMlWXvYgbLkr2qfdzlmRDbdCPXFWLBItT4ZEp
N+sEHVPB34MbVZRXha0A+H85uvatQ0+8i19V7i4WT1NRT/l85IKDwxUYgV5Ehc4Y
LDiHW6eN49blRnrQmSZDujTlfz3PILdFRhwJtwBQRru6JC+iSAPcCz1TY0fX/Ys/
JS8OR5UYkWlBCKxqdvnb2XteLIPqaw==
=WYxG
-----END PGP SIGNATURE-----
Merge tag 'nand/for-7.2' into mtd/next
* Extend SPI NAND continuous read to Winbond devices, which requires
numerous changes in the spi-{mem,nand} layers such as the need for a
secondary read operation template.
* Continuous reads in general have also been enhanced/fixed for avoiding
potential issues at probe time and at block boundaries.
Plus, there is the usual load of misc fixes and improvements.
|
||
|
Miquel Raynal
|
c10f641fcb |
SPI NOR changes for 7.2
Notable changes: - Big set of cleanups and improvements to the locking support. This series contains some cleanups and bug fixes for code and documentation around write protection. Then support is added for complement locking, which allows finer grained configuration of what is considered locked and unlocked. Then complement locking is enabled on a bunch of Winbond W25 flashes. - Fix die erase support on Spansion flashes. Die erase is only supported on multi-die flashes, but the die erase opcode was set for all. When the opcode is set, it overrides the default chip erase opcode which should be used for single-die flashes. Only set the opcode on multi-die flashes. Also, the opcode was not set on multi-die s28hx-t flashes. Set it so they can use die-erase correctly. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQQTlUWNzXGEo3bFmyIR4drqP028CQUCajKB6hQccHJhdHl1c2hA a2VybmVsLm9yZwAKCRAR4drqP028Ca/wAQCL6gEVL6OXpBrHRxmwt5l8/m7h9ZML fYf15pwRE2fg5gD+NSavIqhuSp9yAF1PhNTAirE0iKDTo7t12Z9HM8LYGQ4= =w7Eg -----END PGP SIGNATURE----- Merge tag 'spi-nor/for-7.2' into mtd/next SPI NOR changes for 7.2 Notable changes: - Big set of cleanups and improvements to the locking support. This series contains some cleanups and bug fixes for code and documentation around write protection. Then support is added for complement locking, which allows finer grained configuration of what is considered locked and unlocked. Then complement locking is enabled on a bunch of Winbond W25 flashes. - Fix die erase support on Spansion flashes. Die erase is only supported on multi-die flashes, but the die erase opcode was set for all. When the opcode is set, it overrides the default chip erase opcode which should be used for single-die flashes. Only set the opcode on multi-die flashes. Also, the opcode was not set on multi-die s28hx-t flashes. Set it so they can use die-erase correctly. |
||
|
Linus Torvalds
|
322008f87f |
hwspinlock updates for v7.2
Avoid uninitialized struct members in the Qualcomm hwspinlock driver. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmo2pkEOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcVY1Q//ULNhvQ+9BOs0QvWsZI6pHUkXohaF5dRdSXOK EWmJVHMZo/lGHN6bwB+wz88jHMbIWZYUSbPLbvigVlCm4xgbKFHbyUp3eym4+GOo nvaRz98sqAb/xK3bLgMoAb1wK4oPa+5Ahb6732R2wTcSar3x+LgM2yOOVboYLKrV zfsIlTxC+4vK2cj420rrTO+6okz1kW46korNecnFdjoK4odrWjic4B9SE+L3hgEN GzlvZelRmyXOUuroyzhhcOTo4CkkFuRQYhALw0QocDkEdlU1Nm1+gWAcl5KtgxEa QoCkRPen3xPBlpeH8VBm1k3rZcprt2QxzEzKgDJiCCS2XT64GdktrMj2J6expLfr CZNLTbcLUwOzmBaPt7Bbe0ROcG14WXJBJ4UzHxUa6tQvCErLnHPzZ3M2MbSEnZ1u Qw2edOTeZXuAChxIudd26+uNjDyofj/+8Tfux0hyEYt9MqSPapZx6pbtpLz/UN/o BLFHaV6VVTwtxeqRMi/iTvHN9vSadNbYekzVBpNIRWyDt1lPZ6RNJAEIrfTCxJFd GkEicrTSEESSsgxp3VlOK1KPkKJ4tgGux+JILuI/7u/iefRQ3ZEsAd9ud5RiX72r lc3Ho7aHRCyqDyO4t7Lt+5+4jUMBMXZdKTm0ujXh9VmGJ3zhGOM0VwFfikd6zKoN MmyGLmc= =bLgG -----END PGP SIGNATURE----- Merge tag 'hwlock-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock update from Bjorn Andersson: - Avoid uninitialized struct members in the Qualcomm hwspinlock driver * tag 'hwlock-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: qcom: avoid uninitialized struct members |
||
|
Linus Torvalds
|
c7f112e12d |
rpmsg update for v7.2
Fix use-after-free in rpmsg-char driver. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmo2pc0OHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcVsQBAArnG1O+UQjt8CViyIknMdrTEplFcYQvSMwyDu jQVcz9Y0exom1+CgZPe9zTuR/wEl7t8O9wxjJm+5w1XeiCXl/CElwaZ5FEZxE5NF xi7jGbvJDVMgxHBTZ4x4hJE+MgxkwKpLn7dKZuXGUi0AkvPsWVusQPrmbPryT8VB 9Qx5FaZMz2wTy92Kx3X9S5/4eixG4zX7cVGAJVlGHxFhxWI3M0S5XxoVClI0aSc7 luhe8bYiA9AtXzEVRI3k2eEeOC/MtSAoZXcU3eef8BhH9YENNv1s4dLHEasN7nuP 9WozrEn2zDrzi38G6RNra+UIxl1lzuNyQaTJGxpKypo71zmJbUgbySmrtwt9akAC ZyXVSKOCp8eZqu1PXFBacsiIDJJEHt2dcgEHXkw0XMl/JSQwEfO5v/ohvnyl9UX4 VpCPjevKae00LUEFA8IhTgfP0zKLqAlFR/aiZrF2s8eJuxv7Y50SWi5ArVj/6ioe B7yDxQNuH/6VM4K29E7vh/81oQETF4x87QNBr1WC26pAMNlPOYrLJ0rvu6fkER+H OXDlA5GpwqrnJJy4fBMISrU3hdqADkttgdW1knRmY9jMP78pwH9eGfpra+p54IzF 28n/ujn+RbksV0cXK/JX7p84Lk9Ik/ZzTkwq2vfSUjZJKI66ASLplZCfqWm+fvyp 6KPym/c= =2sdb -----END PGP SIGNATURE----- Merge tag 'rpmsg-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg update from Bjorn Andersson: - Fix use-after-free in rpmsg-char driver * tag 'rpmsg-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: char: Fix use-after-free on probe error path |
||
|
Linus Torvalds
|
9d0d4d12e4 |
remoteproc updates for v7.2
Add i.MX94 support to the i.MX remoteproc driver, covering the Cortex-M7 and Cortex-M33 Sync cores. This also fixes programming of non-zero System Manager CPU/LMM reset vectors. Move the remoteproc resource table definitions to a separate header, so they can be used by clients that do not otherwise depend on remoteproc. Switch the firmware resource handling over to the common iterator. Update the Xilinx R5F remoteproc driver to check the remote core state before attaching, drop a binding header dependency, and add firmware-name based auto boot support. Add Qualcomm Hawi ADSP/CDSP bindings, together with Shikra RPM bindings and CDSP, LPAICP, and MPSS PAS support. Fix a Qualcomm minidump leak, clean up PAS and WCSS reset handling, and make the user-visible Qualcomm naming consistent. Remove a duplicate STM32_RPROC Kconfig dependency and make i.MX remoteproc instances use the device node name so multiple processors can be distinguished in sysfs. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmo2pWgOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcUxqA//XXAZHUD0Hz7Qag+z38N5qSCk/U/Qg38lvRWB lNDZ2g7KqmwdJbzJr5wzG8hoTO84hs3/nRAzV+KnwOIJ5M4EyH0AF9aqXjaqvyC7 V10OYSt5eQQZPBCZ87D7lABVxeuXtc07ETcecx3/zLZSdPqHUa25E1V86EwqYNl1 50wXTjbzhqdCOxKHxxhBhLq1GdPZE4shfzkTATfhAOTInRHwsfUS2u08Wh31kcuX eGG3vAIWQKbLGtM+ZLy/GCNhT58pBtHixnMjCJOmv2c8HzPoQmkSZbf+/8L6fOYY 48XbRJG1PdlraWVpEXzjJBLO+jULJmAtqlptMXX30V/qAnxoLWyU22Vw86hcj5XU Cxb/O1YconxtAbzQvCcB94oSpGM5DXXyHiUk+Cwizv3q+SHaMIdTA51Atpf/ly5k /di1FqOKzVHYbFDYYxttXmXrpUVIRfFDMkONoZgLZiE1cRZXrbwHrqZFaBz7lvw/ m/tu1+VX3jGaVJpyA5uAflxVW29r+VCNZ2RLKDC0vLnnRAut5oMbWUtLJlXhD9Ad wvgMkNMXPCsSyuUQ3gBLqHP8TdBMQav5dNGy0LcLuRDLN82I+h/GfxFOqowArKdh iVNnogPUJhscsSdnyspqBMDZ+fexYw6jIknt3ALet+6MWJ2gxt7k4j8y3CoRL6GB 5okVSqM= =6cLo -----END PGP SIGNATURE----- Merge tag 'rproc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Add i.MX94 support to the i.MX remoteproc driver, covering the Cortex-M7 and Cortex-M33 Sync cores. This also fixes programming of non-zero System Manager CPU/LMM reset vectors. - Move the remoteproc resource table definitions to a separate header, so they can be used by clients that do not otherwise depend on remoteproc. Switch the firmware resource handling over to the common iterator. - Update the Xilinx R5F remoteproc driver to check the remote core state before attaching, drop a binding header dependency, and add firmware-name based auto boot support. - Add Qualcomm Hawi ADSP/CDSP bindings, together with Shikra RPM bindings and CDSP, LPAICP, and MPSS PAS support. Fix a Qualcomm minidump leak, clean up PAS and WCSS reset handling, and make the user-visible Qualcomm naming consistent. - Remove a duplicate STM32_RPROC Kconfig dependency and make i.MX remoteproc instances use the device node name so multiple processors can be distinguished in sysfs. * tag 'rproc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: remoteproc: qcom: pas: Drop start/stop completion from struct qcom_pas remoteproc: qcom: pas: Add Shikra remoteproc support dt-bindings: remoteproc: qcom,shikra-pas: Document Shikra PAS remoteprocs dt-bindings: remoteproc: Add Shikra RPM processor compatible remoteproc: qcom: Unify user-visible "Qualcomm" name remoteproc: qcom: Fix leak when custom dump_segments addition fails remoteproc: qcom_q6v5_wcss: drop redundant wcss_q6_bcr_reset dt-bindings: remoteproc: qcom,sm8550-pas: Add Hawi CDSP compatible dt-bindings: remoteproc: qcom,sm8550-pas: Add Hawi ADSP compatible remoteproc: xlnx: Enable auto boot feature dt-bindings: remoteproc: xlnx: Add firmware-name property remoteproc: xlnx: Remove binding header dependency remoteproc: imx_rproc: Use device node name as processor name remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() remoteproc: Move resource table data structure to its own header remoteproc: xlnx: Check remote core state remoteproc: imx_rproc: Add support for i.MX94 remoteproc: imx_rproc: Program non-zero SM CPU/LMM reset vector dt-bindings: remoteproc: imx-rproc: Support i.MX94 remoteproc: Dead code cleanup in Kconfig for STM32_RPROC |
||
|
Gui-Dong Han
|
aa88278693 |
9p: Add missing read barrier in virtio zero-copy path
Commit |
||
|
David Laight
|
cc8b15a2c4 |
net/9p: Replace strlen() strcpy() pair with strscpy()
Use the result of strscpy() for the overflow check. Signed-off-by: David Laight <david.laight.linux@gmail.com> Message-ID: <20260606202744.5113-3-david.laight.linux@gmail.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> |
||
|
Breno Leitao
|
574aa0b479 |
9p: skip nlink update in cacheless mode to fix WARN_ON
v9fs_dec_count() unconditionally calls drop_nlink() on regular files,
even when the inode's nlink is already zero. In cacheless mode the
client refetches inode metadata from the server (the source of truth)
on every operation, so by the time v9fs_remove() returns, the locally
cached nlink may already reflect the post-unlink value:
1. Client initiates unlink, server processes it and sets nlink to 0
2. Client refetches inode metadata (nlink=0) before unlink returns
3. Client's v9fs_remove() completes successfully
4. Client calls v9fs_dec_count() which calls drop_nlink() on nlink=0
This race is easily triggered under heavy unlink workloads, such as
stress-ng's unlink stressor, producing the following warning:
WARNING: fs/inode.c:417 at drop_nlink+0x4c/0xc8
Call trace:
drop_nlink+0x4c/0xc8
v9fs_remove+0x1e0/0x250 [9p]
v9fs_vfs_unlink+0x20/0x38 [9p]
vfs_unlink+0x13c/0x258
...
In cacheless mode the server is authoritative and the inode is on its
way out, so locally adjusting nlink buys nothing. Skip v9fs_dec_count()
entirely when neither CACHE_META nor CACHE_LOOSE is set, which both
avoids the warning and removes a class of nlink races (two concurrent
unlinkers observing nlink > 0 and both calling drop_nlink()) that an
nlink == 0 guard alone would only narrow rather than close.
Fixes:
|
||
|
Yizhou Zhao
|
7d54894a1e |
net/9p: fix race condition on rdma->state in trans_rdma.c
The rdma->state field is modified without holding req_lock in both
recv_done() and p9_cm_event_handler(), while rdma_request() accesses
the same field under the req_lock spinlock. This inconsistent locking
creates a race condition:
- recv_done() running in softirq completion context sets
rdma->state = P9_RDMA_FLUSHING without acquiring req_lock
- p9_cm_event_handler() modifies rdma->state at multiple points
(ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without
req_lock
- rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to
protect the read-modify-write of rdma->state
The race can cause lost state transitions: recv_done() or the CM
event handler could set state to FLUSHING/CLOSED while rdma_request()
is concurrently checking or modifying state under the lock, leading to
the FLUSHING transition being silently overwritten by CLOSING. This
corrupts the connection state machine and can cause use-after-free on
RDMA request objects during teardown.
Fix by adding req_lock protection to all rdma->state modifications in
recv_done() and p9_cm_event_handler(), matching the pattern already
used in rdma_request(). Use spin_lock_irqsave/spin_unlock_irqrestore
in the CM event handler since it can race with recv_done() which runs
in softirq context.
Tested with a kernel module that races two threads (simulating
rdma_request and recv_done/CM handler) on rdma->state with proper
locking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost
transitions.
Fixes:
|
||
|
Dominique Martinet
|
96a6db3fd7 |
9p: v9fs_file_do_lock: replace WARN_ONCE with p9_debug
This warning depends on server-provided data, we should not use WARN here Reported-by: Yifei Chu <yifeichu24@gmail.com> Closes: https://lore.kernel.org/r/CAPJnbgJ7ZK7DCjCfG56hd_iKGePmAzudb4hOWd4=9r32nM+KcA@mail.gmail.com Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> Message-ID: <20260529-lock-warn-v1-1-20c29580d61d@codewreck.org> |
||
|
Remi Pommarel
|
712da38d13 |
9p: Enable symlink caching in page cache
Currently, when cache=loose is enabled, file reads are cached in the page cache, but symlink reads are not. This patch allows the results of p9_client_readlink() to be stored in the page cache, eliminating the need for repeated 9P transactions on subsequent symlink accesses. This change improves performance for workloads that involve frequent symlink resolution. Signed-off-by: Remi Pommarel <repk@triplefau.lt> Message-ID: <982462d17c0c0d2856763266a25eb04d080c1dbb.1779355927.git.repk@triplefau.lt> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> |
||
|
Remi Pommarel
|
15bbf82857 |
9p: Set default negative dentry retention time for cache=loose
For cache=loose mounts, set the default negative dentry cache retention time to 24 hours. Signed-off-by: Remi Pommarel <repk@triplefau.lt> Message-ID: <b5beca3e70890ab8a4f0b9e99bd69cb97f5cb9eb.1779355927.git.repk@triplefau.lt> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> |
||
|
Remi Pommarel
|
5670a84b5c |
9p: Add mount option for negative dentry cache retention
Introduce a new mount option, negtimeout, for v9fs that allows users to specify how long negative dentries are retained in the cache. The retention time can be set in milliseconds (e.g. negtimeout=10000 for a 10secs retention time) or a negative value (e.g. negtimeout=-1) to keep negative entries until the buffer cache management removes them. For consistency reasons, this option should only be used in exclusive or read-only mount scenarios, aligning with the cache=loose usage. Signed-off-by: Remi Pommarel <repk@triplefau.lt> Message-ID: <b2d66500aa5a2f6540347c4aa46a4be10dd01bc6.1779355927.git.repk@triplefau.lt> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> |
||
|
Remi Pommarel
|
f00e6c1d28 |
9p: Cache negative dentries for lookup performance
Not caching negative dentries can result in poor performance for workloads that repeatedly look up non-existent paths. Each such lookup triggers a full 9P transaction with the server, adding unnecessary overhead. A typical example is source compilation, where multiple cc1 processes are spawned and repeatedly search for the same missing header files over and over again. This change enables caching of negative dentries, so that lookups for known non-existent paths do not require a full 9P transaction. The cached negative dentries are retained for a configurable duration (expressed in milliseconds), as specified by the ndentry_timeout field in struct v9fs_session_info. If set to -1, negative dentries are cached indefinitely. This optimization reduces lookup overhead and improves performance for workloads involving frequent access to non-existent paths. Signed-off-by: Remi Pommarel <repk@triplefau.lt> Message-ID: <e542317dd03bbadb5249abd3ea6aecfdca692c19.1779355927.git.repk@triplefau.lt> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> |
||
|
Hongling Zeng
|
314b58c01a |
9p: avoid returning ERR_PTR(0) from mkdir operations
When mkdir succeeds, v9fs_vfs_mkdir_dotl() and v9fs_vfs_mkdir() return
ERR_PTR(0) which is incorrect. They should return NULL instead for
success and ERR_PTR() only with negative error codes for failure.
Return NULL instead of passing to ERR_PTR while err is zero
Fixes smatch warnings:
fs/9p/vfs_inode_dotl.c:420 v9fs_vfs_mkdir_dotl() warn: passing zero to 'ERR_PTR'
fs/9p/vfs_inode.c:695 v9fs_vfs_mkdir() warn: passing zero to 'ERR_PTR'
The v9fs_vfs_mkdir() code was further simplified because v9fs_create()
can never return NULL, so we do not need to check for fid being set
separately, and the error path can be a simple return immediately after
v9fs_create() failure.
There is no intended functional change.
Fixes:
|
||
|
Yizhou Zhao
|
1a3860d46e |
9p: avoid putting oldfid in p9_client_walk() error path
When p9_client_walk() is called with clone set to false, fid aliases
oldfid. If the walk subsequently fails after the request has been sent,
the error path jumps to clunk_fid, which currently calls p9_fid_put(fid)
unconditionally.
This drops a reference to oldfid even though ownership of oldfid remains
with the caller. If this is the last reference, oldfid can be clunked and
destroyed while the caller still expects it to be valid. A later use or
put of oldfid can then trigger a use-after-free or refcount underflow.
Fix this by only putting fid in the clunk_fid error path when it does not
alias oldfid, matching the existing guard in the error path below.
This can be triggered when a multi-component walk is split into multiple
p9_client_walk() calls and a later non-cloning walk fails. A reproducer
and refcount warning logs are available on request.
Fixes:
|
||
|
Linus Torvalds
|
390d73adf8 |
power supply and reset changes for the 7.2 series
* power-supply drivers
- surface-rt-ec: new EC driver providing battery info for Microsoft Surface RT
- s2m-charger: new driver for battery charger in Samsung S2M PMICs
- max17042: rework driver
- bd71828: sysfs for auto input current limitation
- use named fields for struct platform_device_id and of_device_id entries
- misc. small cleanups and fixes
* reset drivers
- use named fields for struct platform_device_id and of_device_id entries
- misc. small cleanups and fixes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmo0caUACgkQ2O7X88g7
+prx1A//VWm8y2rZMfkbwmfgu45LFT1cNpKyNVAQoMK3GH+r8kIi3cOsHuk5sxZF
z6uSQ1y/4apmjaaEGeg4hpwKWiNCT+X6G2lnZuqKF7H9wk7RRuMUpXdBL5Vj4zDK
4xgvylD4vkWM8f11NYQSEtvB5/XqGIrU3HZW1pj044tTUYbaDGdaoDJngtPOvM0X
igUAb8c7lYt+gaN4n22c1FsPWeY4hXcR6w6sgb+ou0SVT/Yd5IQd9hFnPODlwfmZ
czMYJJePpjhllIN7eaBootPFaxLQ7lkgRwCaV58XDP7CPqSd/6Ui5VygtoQceDbK
Hc76/suIdwEF4DAPVsl1Af/JJVLwpwSLul0tCte8kPLlwoCQixkDhYT6B/QjjZXc
qH8qG8SnNJyBT8xrDWR1yaONT7iPhknNqlFj0Y+E1uUkCjWxWs9VW06+FZiSh2tg
MMLU1zxffbsBCUFKqFV7pstepR1wIl5sNhVswkjf02uVRTdVtIFNvakQDnYhansE
Pk0uhTRHXpA8wrI/tSIe0Fsr50y0TdCOfczgxiNpElVgRBUWdkbz3wt9IEmTKlA9
Ra/oRu9KVJBsO6ZnjdcyyW0Swqd+M+6V0YthbuzdNtvlByNJam6IlgDar9oGXMoO
sPvHiTlWotxxxzcNYwqR0CUHla9CeymvhS/yEnwOcyFpqhrfqXM=
=dzFy
-----END PGP SIGNATURE-----
Merge tag 'for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
Pull power supply and reset updates from Sebastian Reichel:
"Power-supply drivers:
- New EC driver providing battery info for Microsoft Surface RT
- New driver for battery charger in Samsung S2M PMICs
- Rework max17042 driver
- sysfs control for bd71828 auto input current limitation
All over:
- Use named fields for struct platform_device_id and of_device_id
entries
- Misc small cleanups and fixes"
* tag 'for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (33 commits)
Documentation: ABI: sysfs-class-reboot-mode-reboot_modes: fix doc warnings
power: supply: charger-manager: fix refcount leak in is_full_charged()
power: supply: core: fix supplied_from allocations
power: supply: max17042_battery: Use modern PM ops to clear up warning
power: supply: add support for Samsung S2M series PMIC charger device
power: supply: Add support for Surface RT battery and charger
dt-bindings: embedded-controller: Document Surface RT EC
power: supply: bd71828: sysfs for auto input current limitation
power: supply: cpcap-charger: include missing <linux/property.h>
power: supply: cros_charge-control: Move MODULE_DEVICE_TABLE next to the table itself
power: supply: ab8500_fg: Fix typos in comments
power: supply: Use named initializers for arrays of i2c_device_data
power: supply: Remove unused jz4740-battery.h
power: reset: st-poweroff: Use of_device_get_match_data()
power: supply: bq257xx: Add fields for 'charging' and 'overvoltage' states
power: supply: bq257xx: Consistently use indirect get/set helpers
power: supply: bq257xx: Make the default current limit a per-chip attribute
power: supply: bq257xx: Fix VSYSMIN clamping logic
power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
power: supply: max17042: fix OF node reference imbalance
...
|
||
|
Linus Torvalds
|
1a3746ccbb |
strncpy removal for v7.2-rc1
- Remove the per-arch strncpy implementations in alpha, m68k, powerpc,
x86, and xtensa
- Remove strncpy API
Over the last 6 years working on strncpy removal there were 362 commits
by 70 contributors. Folks with more than 1 commit were:
211 Justin Stitt <justinstitt@google.com>
22 Xu Panda <xu.panda@zte.com.cn>
21 Kees Cook <kees@kernel.org>
17 Thorsten Blum <thorsten.blum@linux.dev>
12 Arnd Bergmann <arnd@arndb.de>
4 Pranav Tyagi <pranav.tyagi03@gmail.com>
4 Lee Jones <lee@kernel.org>
2 Steven Rostedt <rostedt@goodmis.org>
2 Sam Ravnborg <sam@ravnborg.org>
2 Marcelo Moreira <marcelomoreira1905@gmail.com>
2 Krzysztof Kozlowski <krzk@kernel.org>
2 Kalle Valo <kvalo@kernel.org>
2 Jaroslav Kysela <perex@perex.cz>
2 Daniel Thompson <danielt@kernel.org>
2 Andrew Lunn <andrew@lunn.ch>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCajSC5QAKCRA2KwveOeQk
u+L0AQCqbRKDuNHKWwbdwv5Sy6nbsHLLd4//m+dJDesqbdMYfgD/UQyygfeicqep
tXcP2krB9Mcl6qsMqNgkKAPpNTCPAwE=
=FZ+4
-----END PGP SIGNATURE-----
Merge tag 'strncpy-removal-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull strncpy removal from Kees Cook:
- Remove the per-arch strncpy implementations in alpha, m68k, powerpc,
x86, and xtensa
- Remove strncpy API
Over the last 6 years working on strncpy removal there were 362
commits by 70 contributors. Folks with more than 1 commit were:
211 Justin Stitt <justinstitt@google.com>
22 Xu Panda <xu.panda@zte.com.cn>
21 Kees Cook <kees@kernel.org>
17 Thorsten Blum <thorsten.blum@linux.dev>
12 Arnd Bergmann <arnd@arndb.de>
4 Pranav Tyagi <pranav.tyagi03@gmail.com>
4 Lee Jones <lee@kernel.org>
2 Steven Rostedt <rostedt@goodmis.org>
2 Sam Ravnborg <sam@ravnborg.org>
2 Marcelo Moreira <marcelomoreira1905@gmail.com>
2 Krzysztof Kozlowski <krzk@kernel.org>
2 Kalle Valo <kvalo@kernel.org>
2 Jaroslav Kysela <perex@perex.cz>
2 Daniel Thompson <danielt@kernel.org>
2 Andrew Lunn <andrew@lunn.ch>
* tag 'strncpy-removal-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
string: Remove strncpy() from the kernel
xtensa: Remove arch-specific strncpy() implementation
x86: Remove arch-specific strncpy() implementation
powerpc: Remove arch-specific strncpy() implementation
m68k: Remove arch-specific strncpy() implementation
alpha: Remove arch-specific strncpy() implementation
|
||
|
Linus Torvalds
|
a975094bf9 |
Description for this pull request:
- Converts exfat buffered and direct I/O to the iomap infrastructure.
- Adds the supporting block mapping changes needed for that conversion,
including multi-cluster allocation, byte-based cluster mapping helpers.
- Supports SEEK_HOLE/SEEK_DATA and swapfile activation through iomap.
- Fix damaged upcase-table handling so a zero-sized table does not lead
to an infinite loop.
- Fix a potential use-after-free in exfat_find_dir_entry()
- Bound filename-entry advancement in exfat_find_dir_entry()
- Preserve benign secondary entries during rename and move
- Serialize truncate against in-flight direct I/O
- Simplify exfat_lookup().
- Replace unsafe arithmetic macros with static inline helpers.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmoz9dYWHGxpbmtpbmpl
b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCOcfEACXzHTGyd58G6oS7o0NsL+W1Z4j
vUV7CB6liGYPi2jO4FzLoQTImLClTAae0skSiDnR9gmxqrzrv0GGntB0lLbjuD5M
91qaBpzjSpnaoZLOA3/y5EapH3842I23pHS1MprOdyTr0sG6l2TYP/Uop01oyBv8
o4NCWwzXykkOBwoGGTZS2ANg59X5hcjIM+v43rmLbeMur1zO9wZOBIjJ7yyz+LxB
IVD1C5Vul6Oeg9FvWL21kmVhM0qWWUQUWL6d1YiUb41BV6lJ3GIbJOhUl/Veju1/
AHOYIVMn8fo10F22H/FaIe6k0I9Qc9KB71ewX1wnCrre1cNtyiNIklDuoni+YwBn
mTdJ+Glh3QlsWC3Bw9MySOnSDuaKta6j59S2Q5K3VarKLE92dONpIMFnMmcITUTH
WveF0/XdkTzO1z7+C2N1wnEkQUxDH9kbYxRuCPUQxrFchbx/zZv8+d/PloKRlVg3
h/GMd3N3oRwgAb3d8vo8AUjBErp04BvcfHXbOISHybLyFdsLay3DNPRsd0IPZoLW
VV0CLRUtWJztCzSA2VJUNC8CUFTXP1hfQtaYpEPNDKtSZ4XnRXUgKFcH7og1GuWx
cTtDf+MdyqANUOEbdfYspR/q+gMMDZF6UumD2ttII/iozJHMVYjid45oN3Vy6cM/
QHiKAniPqxOl+70Olw==
=FP3d
-----END PGP SIGNATURE-----
Merge tag 'exfat-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat
Pull exfat updates from Namjae Jeon:
- Convert exfat buffered and direct I/O to the iomap infrastructure
- Add the supporting block mapping changes needed for that conversion,
including multi-cluster allocation, byte-based cluster mapping
helpers
- Support SEEK_HOLE/SEEK_DATA and swapfile activation through iomap
- Fix damaged upcase-table handling so a zero-sized table does not lead
to an infinite loop
- Fix a potential use-after-free in exfat_find_dir_entry()
- Bound filename-entry advancement in exfat_find_dir_entry()
- Preserve benign secondary entries during rename and move
- Serialize truncate against in-flight direct I/O
- Simplify exfat_lookup()
- Replace unsafe arithmetic macros with static inline helpers
* tag 'exfat-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
exfat: bound uniname advance in exfat_find_dir_entry()
exfat: add swap_activate support
exfat: preserve benign secondary entries during rename and move
exfat: serialize truncate against in-flight DIO
exfat: add support for SEEK_HOLE and SEEK_DATA in llseek
exfat: add iomap direct I/O support
exfat: add iomap buffered I/O support
exfat: fix implicit declaration of brelse()
exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
exfat: add support for multi-cluster allocation
exfat: add exfat_file_open()
exfat: add balloc parameter to exfat_map_cluster() for iomap support
exfat: replace unsafe macros with static inline functions
exfat: simplify exfat_lookup()
exfat: fix potential use-after-free in exfat_find_dir_entry()
exfat: fix handling of damaged volume in exfat_create_upcase_table()
|