github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-08 03:26:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,482,135 Commits 1 Branch 949 Tags 16 GiB
2d5061ff37
Commit Graph

1482135 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Arnd Bergmann
2d5061ff37 Renesas fixes for v7.3 (take two) 
- Fix UFS regression on R-Car S4.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCaqztfAAKCRCKwlD9ZEnx
 cLmlAP4hG63oxIP1QUeZpEMjRkTBGhFXnlSkvluVyrd8otWniQEAvCCC31KtKqqK
 B9W1mWzwBX9UITXB4cL69Zw/26W9+QI=
 =5xv9
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqtL8EACgkQmmx57+YA
 GNkQ9A/9FuSvFGANim6ksz5JN4ObTC4hjJu8rxrxF3uGekQNJZPO06EDU9DkM/bJ
 XOLDFkt3k+M3e60wdH9NKzEl54xQxyLre2XyRN2diit3ihDF9Jrv3YPFzuZcA+gR
 vmRh9LLIStdDNxGbRrEubfx1+WqbiNpkXqE8syXVsn93hYduMsWnrSReXA5jGENt
 Wjq9ghujL9Othgh8B1FOi6W4oupsBN1mCLAL0DJ0k8z0whBfb2Qkq5tnrDCPcjXc
 CVKzVWqe5nIMw5akMu14MToId3JpTxTrws5FOP4OUoxEVL/sCBUbS4PNujgHEMVh
 Ovd5DmpfNjWOB+rr4/B/u2H97e6AmNvCp5Sbd8gADBCO7RHD9zxYbGYPy9Pemhqd
 YBNAufAR3Bkkq0IheXVS5Dtzg2TSUchomaIz7o/hhMBu4lLdaVJyyalAy5bVOR1W
 l7DtetG1DqABWAsF5pm0Q8iy7lFEJlzWdhzONJn4TBCXOLi6k3lO07gmd+eIYhyM
 EvssZFTciDoyhurdDgqeLfjKQvvgiOi0l4SpdT606+YMipz5C5zo0oPOk4j26qvp
 22Mw3JupFQCDCwsN37locBhQccdKfHuzfsy52vDMxHRuOcpnfIIcCsPkaMq5VMQu
 Bm8c3No5AJQGcODe4Rg7nmZrxzSNnilWGxKSkWH7C0J5vbzuXRY=
 =9HfJ
 -----END PGP SIGNATURE-----

Merge tag 'renesas-fixes-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes

Renesas fixes for v7.3 (take two)

  - Fix UFS regression on R-Car S4.

* tag 'renesas-fixes-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: r8a779f0: Set UFS lane count

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-09-18 14:34:03 +02:00
Arnd Bergmann
ce55a6545a Amlogic DT Fixes for v7.3: 
- Set of fixes for Amlogic T7:
  - use the real UART pclk
  - allow the SD card to be power cycled by dropping regulator-always-on
  - fix the pin groups of two PWM outputs
  - add the CPU cores PWM-driven supplies to fix runtime crashes
  - fix the pin groups of the vsync PWM using non-existing pin group
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAmqqangACgkQd9zb2sjI
 SdH/SRAAhEKoBMpJG8Ps7SKIx/l2tJQcCMhbyNXl6aCUrDFx+m7lQiM7obNNFMf8
 nFerqNRlXlWrsyQE4HVBudv7umt5tl3xazo1jkma6jxjyWSaStba0R3/dNkEIynb
 ZsiQWtbbbFiGcKdKOnEqfdVbKtrTa+KfrmmSJ/L5jofhMdw19J0R0/nALfS6rDpl
 Rpdm2IuEH2gotD4TBEtg06gwXDX8JmlrVW+0RPc9rDKROFAMfrdnX3NHwXlRW2UG
 vmXaAPu0HHcjmUtxdPS9ULadUeEYmCMnnmLEXaA5P/O4Y4gCY7xsQjnrq74k3R42
 woAZVmYUTxsm2hZ/b5Oh073MpisQfM257+FTOIWK74EBYKJz8xfpjxra84KmtvH7
 Ya+Glr2PePa+rLlIjF1pDuxRVMaSyJVXXMnfuY3lQGRymqSZn+LU1d8QkvzF8gEf
 DMqy2ypdDt5rY4//iO2vCjD8qUAPT2DaHwprIZSspHijVcZh3nOZb/K2iOXq4dVP
 B0oq7uPqQKqlY27yBr4mvcbiCjSqHPugJoGnl1jrJkeOqprpqHZsdz+nFZEGpMfb
 gNc3BNGcOS7KtePXe2NRnGXxLT0I2mjd55X4zIpCWHnkEWdq/7A91d5NeebKJfjs
 6Ekjyk7DhKM79Xb8CKpzxZjQFx100MSpuqGp2oMK9VFFZP60woM=
 =7sol
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqqeAcACgkQmmx57+YA
 GNk9Lg//TiOyBr9jmffWvzW6HxWMnLrO8K1VfEFJw3meLneV6sxR4ltDiSTEA21u
 L5E9HTX4L2rEMPL9c7o7mxIJvCch06BjPUIzH8aNl8tFTa7pxp+TQxZP6Ly4mmtC
 fTWVZwcdbGo2OhExix/mnPKKV+RDz/ymUXqjKWqvup/DC26QRTZ3qI94dtKC/eQ0
 zbEt+2wrNZY2ol3OJ6l1O6Y3B/3EJ0VcCVwwFsy+6L8DCQf8BcJLM8HKBPKmUciI
 VdEV9/EvqD5AovspiAgIQYuomqZRqQVIS/dRQ2Uq6JTPteQQ28yUKAoysr5WjnYq
 /5VpvrM2zrsXjnXQBYbiLpO7Bc4we8HrakMNo2FVKr8Ptp+bg8EnHcEJRjg0Ced9
 cfwJPc4AXF3UF/LiwtugbJpm4FvuGoZaF2oNRqfilwPAhXHld3GZssopAflxYB2M
 C1WCDynmjiJHQ07DaIg5kVxhAeyIWbS9gJrJ3j/eiFWjxWxYhkQPMumnUrk3zaaa
 0gFYcu2SP5Qr0SDFE3EqyK8tvcB21Mnah7nrIQarCCBlw5HCMN3v8kUCmGvjmh5E
 A6YSPfXJHAjyba0nsuoFToGpREUG5iGE12aBE5YfcRl/FpHEBbYma0Kn3JFojTU0
 7J5W4+zsQrKHUWzbvViHU73TWQIQcrUK9963Hs591l57umViEVU=
 =p+Zk
 -----END PGP SIGNATURE-----

Merge tag 'amlogic-fixes-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into arm/fixes

Amlogic DT Fixes for v7.3:
- Set of fixes for Amlogic T7:
 - use the real UART pclk
 - allow the SD card to be power cycled by dropping regulator-always-on
 - fix the pin groups of two PWM outputs
 - add the CPU cores PWM-driven supplies to fix runtime crashes
 - fix the pin groups of the vsync PWM using non-existing pin group

* tag 'amlogic-fixes-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux:
  arm64: dts: amlogic: t7: fix the pin groups of the vsync PWM
  arm64: dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies
  arm64: dts: amlogic: t7: fix the pin groups of two PWM outputs
  arm64: dts: amlogic: t7: khadas-vim4: allow the SD card to be power cycled
  arm64: dts: amlogic: t7: use the real UART pclk

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-09-16 13:05:33 +02:00
Arnd Bergmann
869e97e66d Arm firmware fixes for v7.3 
SCPI fixes address resource leaks and invalid firmware responses, while
 FF-A gains shutdown cleanup needed for normal kexec.
 
 - Release the device node reference acquired during SCPI domain lookup.
 - Validate SCPI DVFS OPP counts and indices returned by firmware to
   prevent out-of-bounds accesses and invalid clock rates.
 - Register the SCPI cpufreq device only once across DVFS providers,
   preserving the registered device pointer for cleanup and allowing
   retries after registration failure.
 - Run FF-A teardown during orderly shutdown so notifications, partition
   devices and RX/TX mappings are released before a replacement kernel
   boots through normal kexec.
 
 Also includes replacing a literal platform device ID with
 PLATFORM_DEVID_NONE and correcting an SCMI comment typo.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmqga1IACgkQAEG6vDF+
 4piNYg//fMyEAKgjG0VkVH5/s+saxVFoh9GKhyqunZr39uc9R/ES5hDIY35tTiui
 d4GIoKJlRbas6d/6oK8J669aAMpEP/YIRHQizH59cpkIRIzaFo4rJ+2Cl3CYeHG5
 i6gFIlCdNk0Jv9evv6wQ2PSnkXo4Sgzx1wWBr3KbMUWXafa16bA7gTY7z2xYII1s
 Ocv/VvDnQNlEGVIiMUZI3JAS3Z4CAcxL8iLyDpmwh1ZXNs/OYkDnuY1fWtTbqBir
 anDQnNCM7U4uhvtBFmdXH0A/ySUD39igMmebIUS1z1wSN8Cu67VxmR3yY8sQZdbF
 SEPnQKkY/nBRcMGAf8NBYEo5O1VoCmfxUOnArYfNQlDnWGobPRtNyombPYIu+JcZ
 AsQdKOLbv28R3q+G3yMTOul5bhKSni7txdh7jgTe0kW+qvuzkC42Z5sNP+msCOUv
 oeFAtPVT39qDTMtsF0oKRGiQ9CiXOw7fGdaJk/KZbSMZsQcHWWBgaFngLHX6apW8
 Em8fi+Vazq4lz8gmtnaQPNvskex4OnkmtSYMy93PQBYtUbSO0i7Nzx913VOCHocF
 7GmqXoQG6Jgc4sZJR4ujTFB+xyv1i7xTVgcEp8CeTtzPUgy5l6A2MAec7Wl52Zz9
 Evf6wA2+L6HVoy7L6msDBCzpsTTmaQ+zewsdOMcw33MEC7JrYXA=
 =XE7J
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDIQACgkQmmx57+YA
 GNmLpg//T50aSO0dK31LotTisraS9AGdUWuFLOYmBCeic1eN3SCVq31Q0MFK5+US
 iI1iGjAW/+QJvpr+gSZsmIwaRdxyZwUBda8fanSj/5EEkWE4egQOHnZlkGKTuamO
 Dq5pncqpxiU5m5AAVwYBZf/CrXU8lY+4yjeJESItAFsd2TWUa1tua7GyDRTA0E4n
 8h97fYujgwr/ULMAyaZO11OxqE2Gl7yRGI19iW+V+B8/0Sc+LOstFCORQBWTnsNH
 rQUF/qFH4Czx/mtqvlWWN2roX4/2HyLpAdz1m6idh20ryFJkhvVBlvUFsdmIEQOK
 cPLP1+Auo4MwnSQ+tmRGMXZ7W+f3aXBUUkuZVnqDtGeLuvv+CfYiJBxgteWRlqNR
 FjkRyoi7dTEk06jYJqYy3OEBUKRm/9jgJxnRKgTOeeNLNzRqcb0DU8TqjpsDE6Ie
 K2QlYssVIZk3jgMGFoUvrRxJK4HbH7dWcnJeZHdtljf61Qnf9GcR9EjjGXeyaPz/
 RdduIYHOi/XzTXuaLQcRfJZO6BxMiV5s4tCU/8djy9ZyVa6Sb5kE5q1bzSgW4fyj
 FTttAXx9yyjWHhYdEs3g9Tfg1VewYzoDh0W7gpCe5pYb/CyA7BHH+f64lV7CW+ZF
 lFBI4S55qzAnspl7l/R2WGNT6bPJsesd5Lwmah7Adj/UfwRAl8s=
 =I4bY
 -----END PGP SIGNATURE-----

Merge tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes

Arm firmware fixes for v7.3

SCPI fixes address resource leaks and invalid firmware responses, while
FF-A gains shutdown cleanup needed for normal kexec.

- Release the device node reference acquired during SCPI domain lookup.
- Validate SCPI DVFS OPP counts and indices returned by firmware to
  prevent out-of-bounds accesses and invalid clock rates.
- Register the SCPI cpufreq device only once across DVFS providers,
  preserving the registered device pointer for cleanup and allowing
  retries after registration failure.
- Run FF-A teardown during orderly shutdown so notifications, partition
  devices and RX/TX mappings are released before a replacement kernel
  boots through normal kexec.

Also includes replacing a literal platform device ID with
PLATFORM_DEVID_NONE and correcting an SCMI comment typo.

* tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Fix typo "upto" in comment
  firmware: arm_ffa: Tear down driver during shutdown
  clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq
  clk: scpi: register scpi-cpufreq once and clear on failure
  clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
  firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
  firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-09-14 17:02:19 +02:00
Arnd Bergmann
2d5adffc11 Renesas fixes for v7.3 
- Fix Ethernet stalls on RZ/V2H, RZ/V2N, RZ/G3E, RZ/T2H, and RZ/N2H.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCaprEkQAKCRCKwlD9ZEnx
 cMpLAP9H6eVF6pfnOLjgqE41gQUaMdn5SDmlIteD8Xyx8PQRngEA+CAMdw1oJeIy
 mtENt2HlmGqIYnNZhZ4Ip/VPQ5BIBwY=
 =usMX
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDGkACgkQmmx57+YA
 GNmJqg//Vh6VARqCnKv9ZY0jvalvXg7ff3PLJ26bNbZEYY1u/u6II5XgJoeUP0im
 3kPZihu1ZxT0vCDPOFsH1l4XUyVDhD7G36kQl9uq2stD1/N7t8uXMlObymL4jUCE
 LNUBaHxyOZSzdGHtPmDAZpyUrz+VZTOJmz5HFDQVHvV+JSLcy4qsQsxTOjJCTe0h
 TDEko4XmOBPfbjIfo9y+gAR1caD5F1EsOtS3OjjZWTLHPmHGpqQ3fBoWch0kyW7H
 8RSEpxnVwxJCiBoazYdPpWuHiYk95lNlwdyhAPZAPLJmQm9CrpZsOFFEvIkuafVf
 K+zGvXEkrvJBDTCA3i3GbX+tuIdNjrTKneL1QqmK1bHlyrAUP1Kd5d1zmZh3AY0X
 mwiHSaNId0NZDkGgEWxdOHDZL8Ln+aaYMFqz+ebc7kuaL+IN18goKSxLwwgcSELN
 S6i1nr07r0HyLoFyz/KHoA4ormWJgLe/3Z7trxZ/Ic4An/5HAOFH/N3WyWOhpSYb
 jno71gz/XRjVCHBFLruc9bR3VrKhSDEL+WixIQsUNajOAkgQia8NwpwJGC4Nji1z
 GPmCaa8Rs3CL4FdjEvcY8zAnMdZlrXe7QCA+fWmjGT51jfdJLh+nES98wGs2HmWw
 uuIjvBPwv+BtT7k09j3H3rnEJ8i9IxBCHWlLih0KVGpUpGYtfno=
 =2JAV
 -----END PGP SIGNATURE-----

Merge tag 'renesas-fixes-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes

Renesas fixes for v7.3

  - Fix Ethernet stalls on RZ/V2H, RZ/V2N, RZ/G3E, RZ/T2H, and RZ/N2H.

* tag 'renesas-fixes-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-09-14 17:01:58 +02:00
Arnd Bergmann
ebdad7d867 SoCFPGA DTS fix for v7.3 
- Fix DTS file access permissions
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmqe40AACgkQGZQEC4Gj
 KPR2yBAAlKHiNj+Jm4+cKypqiaE0RNd1YEsaLVfzLUFxnjUiFLwsZ+hdgH8y1H+Z
 2oVaXykvNdWMCURmDnc+md5Dve1rWV2hA2w29ESUg/IW6J5rfjbBawl1L/nEXwwa
 OcsQFWCZg5FnQd8OW+ZT/BtNSV5MFIyYB/S0TKkCd1y3WsUSb2ZZxbN2IDeUvqjb
 FDv85FXhPS5uO11SkIvgAik0nTHW86FdCwmaICggYNeMorlYHOCi/ZT4WP+AkW4D
 z6tCFyYCypLB5vwRcy6pVJMycPg/7chO//PKiMA34Hn4cYRz5P7+qt63rOmKhhny
 D2n7QKB61n0uOnTFVaTUDXuVCDEX8/uGIYSkGPd2vq2a7IRI2xIVsIlEcxYm4tJW
 VvpKFmP/5rq3dBdIdjyxVJ4q5tNAz+uOAaWKnbQs5HylgOYECYr8Qc3hO3fO0Gza
 vOQe+/TKnUuMbVM8dTWYymzof5nIN6coxQJh8VcWihlmKB1M2p6kwx+VaTvYzluL
 Embxge1w4P0J5JTa4rAhRjMY77YjgxxLA1wiEU/1CU0HwSCPOXjEu2kgB26gAOaA
 X2x9iyGqY2xmdXzkFOtQTbQyvGOpKo1F7zTmKujJAPWcDl5f+I+jBqD2/QgZa0Po
 UGyGBR9kkt4/uAk4jCOTgAd9q6YW8tHJK4PrvN6tx3JURTbzQ3I=
 =oz9W
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDEIACgkQmmx57+YA
 GNn3pw//YlboS3mV4S+uizgUVZF1/kUdrRuen19LgDXi/0CrnsWEkEKh/tKNztz7
 Z4LldyNQVjmnd7poN+PB2uS1Su4U4mAkaGqTp3gCQhNmNqWDGyFIda1d1I4yGvxY
 awrJBHp4bKtD9KEwUcp70ey5PQ8ngIIVjWqKxWfMzgl6HzgYs9kDD/26CA534hDK
 MZ6vU4I/S+7vYhi1Uw4R6lT/9dU2wu4wLSP+wy9XOYVtF97ZGLQzkMY8+H13b0Tv
 bShneO/fgchoirmDJ1RCZ2aT5cgazX+KbBb2XGbDFHDGPXMlq9BC4N0sQb3Y3HI3
 67qkBSmiS2TT5/Ia0SnWfUApROZ6Jn+/LubsU70YwRKqpo5VR64XC4SzVIkqSJVK
 nCa5izvfhJvEh7aeRiyVqaOYUwz5cr4DeZEirv4IC53/ZwEY0edlCtZ4yr18D+6h
 EarJNigEl5V3pz9ii7YHcNo6z6YhaE+raoZVTZWr92DeLYvm+H2aVBJL2zKgfr8Z
 AXHGATzC5Nsr28H4IGvPE1XhJ6QkSTRJdMcBAVmeP1Hcf5Zh3fxxCaToD8l2ZgbK
 Og9A9RapNfZ2eGK72u5waGT5VrLrLEF+UIL/ZxIxbDKT8v4CCZxt5M8z1gm0c3k4
 BtvvbW17bH4YE1O2XWrQsvnJDsQ4FiijlcfK81QCKxo9kVjwxQA=
 =kOVb
 -----END PGP SIGNATURE-----

Merge tag 'socfpga_dts_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes

SoCFPGA DTS fix for v7.3
- Fix DTS file access permissions

* tag 'socfpga_dts_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  arm64: dts: socfpga: change access permission from 755 to 644

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-09-14 17:01:19 +02:00
Arnd Bergmann
8c8a0cac6f SoCFPGA fix for v7.3 
- Fix PL310_ERRATA_753970 Kconfig option
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmqe4XYACgkQGZQEC4Gj
 KPTAQg//U7gbQs//XbjkgGZwN2RB42Sz8AqH1DeAH9LE/N4Mc1eLnQY+t3qv2S2W
 6hR4kRvRqRXI3Kk/vZA7t3dx8l2BM8lFJr6kgnWbGHdFqsO07I8rYBk1O7IyMj4+
 zxJJYp644x8eAXRowqATR//1CpGGEzFKbgNCiL0aHu18aHX2xaGbuNcxLZJO8wou
 BZeLzwlzpMr6rNdKeLPqlELfU7HwL3wgmSDXhlahLiNg9gIGtxGk4JOOlgGmJpN4
 0DQ3UMLYAXHuBZ9YKkSMliDK2HOmL1B6D2+zgkhBN4YzCjM+HW3t9xwErNoE8wPU
 3lx5Pjtm4DrDmkWh3FsIsKVoQ6SnQX1kL72PzU5gfG2IIqi3pleaGJGOqZQxmmUi
 5WMwVhmU1dxvs5ahy0whjQd7ExMmh0oK29jOLOMDV257KWQ0jSq49S7fkXPcbns7
 tLf1f/gLTrgMn+fGKhx5aJHxbOLj4fK8H+yIkh2donr4tYHl1lKmc8WHkWKJy660
 01bFh2zhu7Ngy0YUPuA2bEZ5fMVb3Yr6GoETm8ZdHcrNCGss3cYBcIItGWYdNniE
 YRdkO2uGe+k4UH5SdiuwFp/CUXKrwIO/aUVVY7W++WEshkVem21fQ2XFeq6ol9FX
 BQKxB6GAFEJi5P0w8paJytiMDuFP7MgHwJZVaGMsQDf1ToXc6AI=
 =SIMB
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDC4ACgkQmmx57+YA
 GNnndg//SpH4rVpU1I67e0Z31qMgxkvUGV4EjMjsRiExo3cMIHtw189USGQgpIDh
 ThkSdh7ewq+IZkQlD775++5NN8tUQiEwLYr/cwWgk7BIdjRk99oVYtFTM9KSZT3o
 wWXbt7NPoe5tFMeGtqkEmzJtS37f5QLDO9jCTKyHtD0OzG5OnBCIWchrJYi+DbGE
 9/KwneKPUwR7ViFrkOnTXUipC28EMyg3ROFKVWzbiYD88mFAxQMypEliCKIYos1a
 JvvVHqsPacT7hVM4cbCGC+65qlpe1gVexOfcHqpQ4yTHi46wEXyb6uZCJx+Pg8Ny
 lI4fNxEi3OcmqsJf7VEmarm3MOViTzae+HdVD3A31pL1JibgkwlokFwv+xuXHWn6
 m8S5EIv82VK+sFR5NjA94LMGzl13FoZR523MtawLx9uFi+0FTUKIcNpx7ov/Dt2Q
 G0FtvY9APyIchGJyPZhz8nLWiCdEjWffR9xma8u89osLs91Po0HSJDG5Hrjj3RBD
 GRDZ7r72UJ87WEGNxCzo3LInSL9+IeUc8xcIVKM8oNWFyJJkKwXVNhXx2nJJ8F0n
 KcST4dlmheZFN1jDijgO2Ip+aarfZ98gZxzYkQKtLeo3euro4frxUhRhOt2uHHwp
 7ZFQUFy/VWyljYhhB49b3Z8jPowzil/bieuoFzTDOhsXEOpzToo=
 =ocHH
 -----END PGP SIGNATURE-----

Merge tag 'socfpga_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes

SoCFPGA fix for v7.3
- Fix PL310_ERRATA_753970 Kconfig option

* tag 'socfpga_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  ARM: socfpga: select the PL310 erratum 753970 workaround

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-09-14 17:00:58 +02:00
Koichiro Den
8dc2615d57 arm64: dts: renesas: r8a779f0: Set UFS lane count 
Since commit e72323f3b0 ("scsi: ufs: core: Configure only active lanes
during link"), the following error is observed on R-Car S4:

    ufshcd-renesas e6860000.ufs: Tx lane mismatch [config,reported] [2,1]
    ufshcd-renesas e6860000.ufs: link startup failed -67
    ufshcd-renesas e6860000.ufs: error -ENOLINK: Initialization failed with error -67
    ufshcd-renesas e6860000.ufs: probe with driver ufshcd-renesas failed with error -67

R-Car S4 has one UFS lane per direction, as described in section 152.1
of its hardware manual.  Without lanes-per-direction, the UFS platform
driver defaults to two lanes.

Previously, the core used PA_CONNECTEDRXDATALANES and
PA_CONNECTEDTXDATALANES to configure the link without checking them
against lanes-per-direction, so the missing property did not prevent
initialization.

Explicitly set lanes-per-direction to 1, now that the validation is in
place.

Fixes: 5235d55177 ("arm64: dts: renesas: r8a779f0: Add UFS node")
Cc: stable@vger.kernel.org # 7.2+
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260911073058.253000-1-den@valinux.co.jp
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
 2026-09-14 10:07:09 +02:00
Sudeep Holla
8544e0da1a Merge branches 'for-next/ffa/fixes' and 'for-next/scmi/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux 
* 'for-next/ffa/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_ffa: Tear down driver during shutdown

* 'for-next/scmi/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Fix typo "upto" in comment
  clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq
  clk: scpi: register scpi-cpufreq once and clear on failure
  clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
  firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
  firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id
 2026-09-08 21:04:42 +01:00
Linus Torvalds
df2908090c Linux 7.3-rc2 2026-09-06 15:07:20 -07:00
Linus Torvalds
b1e00ffaf9 tracing fixes for v7.3: 
- Fix several tracefs files that did not take the trace_array reference
 
   A trace instance can be created and destroyed in the tracefs "instances"
   directory via mkdir and rmdir respectively. The instance is represented by
   a trace_array descriptor. Most tracefs files pass the trace_array as the
   private data of the inode to the open/read/write functions. Since there is
   no locking between the time a task opens a file and the deletion of the
   instance (and the freeing of the trace_array), each open needs to get a
   reference to the trace_array and each close must remove it. A instance
   can't be removed if there's any reference taken on its trace_array. The
   open function uses trace_array_get() that takes a lock (preventing removal
   of instances) and iterates the list of all existing trace_arrays and if it
   finds a match, it takes the reference and releases the lock. If it doesn't
   find a match, it causes the open to return -ENODEV.
 
   There were some added files that did not take the trace_array reference
   on open that needed to be fixed. Sashiko also correctly pointed out that
   there were some files that took an address of an field or element of the
   trace_array which had a pointer back to the trace_array to take its
   reference on open. But this leaves a slight race between referencing this
   element to get the trace_array as the element itself could be freed. To
   solve this, some helper functions were created to look for trace_arrays
   with this field or element in the search so that the element did not have
   to be dereferenced before the trace_array's reference was taken.
 
 - Add a lock around ftrace_ops initialization
 
   When a ftrace_ops is first used by ftrace, some internal initialization is
   performed on the ops. But if multiple tasks were calling functions that
   did this initialization, it could race and perform doing the
   initialization more than once, corrupting the internal data. Add a lock in
   the initialization code to prevent this from happening.
 
 - Fix splice reads on mmapped buffers
 
   The logic in the ring buffer splice code for mmapped buffers is supposed
   to do a copy of the memory as the mapped buffers can't be given to splice.
   But there was an if statement within the copy code that would return a -1
   if a request for a full page was done and it wasn't a partial read. This
   is because this logic was written before mmapped buffers existed and this
   case didn't make sense at the time. For mmapped buffers it makes perfect
   sense and by returning early can drop a lot of pages unnecessarily.
 
 - Have the persistent ring buffer validation check nr_subbufs
 
   Sashiko reported that the validation code was relying on the saved
   nr_subbufs to match the calculated nr_pages + 1 and if they were off, that
   the code could cause corruption. Sashiko is correct, and the saved
   nr_subbufs should be validated before assuming it is correct.
 
 - Do not allow more than one instance with the same name on cmdline
 
   If an admin were to add more than one trace instances with the same name
   they all would be created, but only the first one would be accessible via
   tracefs. This used to not be allowed but some restructuring of code has
   since made it possible.
 
 - Fix the race between subbuf resize and trace_pipe_raw readers
 
   If a task was reading trace_pipe_raw while another task was changing the
   ring buffer subbuf size, it could crash the reader. The trace_pipe_raw
   readers do get their own copy of the page from the buffer, but the code
   needs some restructuring to not have the resize of the subbuffers cause
   issues.
 
 - Cap the size of the mapped (static) ring buffer nr_pages
 
   The meta data used for ring buffer mapped buffers is 32 bit in size. A
   normal ring buffer could (in theory) have more than 4 billion pages.
   But this is not allowed by mapped buffers, so enforce it.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCap3GJRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qtAfAP9hDPtzctAoz+IHZq+GYejhKTu99ICG
 vAxTOZivuG6KYAD/UPA4P7z5ayxGM5UlT+2U81+mpCd55F2oFiIxRuFYcwk=
 =/d+T
 -----END PGP SIGNATURE-----

Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fixes from Steven Rostedt:

 - Fix several tracefs files that did not take the trace_array reference

   A trace instance can be created and destroyed in the tracefs
   "instances" directory via mkdir and rmdir respectively. The instance
   is represented by a trace_array descriptor.

   Most tracefs files pass the trace_array as the private data of the
   inode to the open/read/write functions. Since there is no locking
   between the time a task opens a file and the deletion of the instance
   (and the freeing of the trace_array), each open needs to get a
   reference to the trace_array and each close must remove it.

   An instance can't be removed if there's any reference taken on its
   trace_array. The open function uses trace_array_get() that takes a
   lock (preventing removal of instances) and iterates the list of all
   existing trace_arrays and if it finds a match, it takes the reference
   and releases the lock. If it doesn't find a match, it causes the open
   to return -ENODEV.

   There were some added files that did not take the trace_array
   reference on open that needed to be fixed. Sashiko also correctly
   pointed out that there were some files that took an address of an
   field or element of the trace_array which had a pointer back to the
   trace_array to take its reference on open. But this leaves a slight
   race between referencing this element to get the trace_array as the
   element itself could be freed. To solve this, some helper functions
   were created to look for trace_arrays with this field or element in
   the search so that the element did not have to be dereferenced before
   the trace_array's reference was taken.

 - Add a lock around ftrace_ops initialization

   When a ftrace_ops is first used by ftrace, some internal
   initialization is performed on the ops. But if multiple tasks were
   calling functions that did this initialization, it could race and
   perform doing the initialization more than once, corrupting the
   internal data. Add a lock in the initialization code to prevent this
   from happening.

 - Fix splice reads on mmapped buffers

   The logic in the ring buffer splice code for mmapped buffers is
   supposed to do a copy of the memory as the mapped buffers can't be
   given to splice. But there was an if statement within the copy code
   that would return a -1 if a request for a full page was done and it
   wasn't a partial read. This is because this logic was written before
   mmapped buffers existed and this case didn't make sense at the time.
   For mmapped buffers it makes perfect sense and by returning early can
   drop a lot of pages unnecessarily.

 - Have the persistent ring buffer validation check nr_subbufs

   Sashiko reported that the validation code was relying on the saved
   nr_subbufs to match the calculated nr_pages + 1 and if they were off,
   that the code could cause corruption. Sashiko is correct, and the
   saved nr_subbufs should be validated before assuming it is correct.

 - Do not allow more than one instance with the same name on cmdline

   If an admin were to add more than one trace instances with the same
   name they all would be created, but only the first one would be
   accessible via tracefs. This used to not be allowed but some
   restructuring of code has since made it possible.

 - Fix the race between subbuf resize and trace_pipe_raw readers

   If a task was reading trace_pipe_raw while another task was changing
   the ring buffer subbuf size, it could crash the reader. The
   trace_pipe_raw readers do get their own copy of the page from the
   buffer, but the code needs some restructuring to not have the resize
   of the subbuffers cause issues.

 - Cap the size of the mapped (static) ring buffer nr_pages

   The meta data used for ring buffer mapped buffers is 32 bit in size.
   A normal ring buffer could (in theory) have more than 4 billion
   pages. But this is not allowed by mapped buffers, so enforce it.

* tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Use a macro for static buffer bits
  tracing: Fix comment in tracing_buffers_splice_read()
  ring-buffer: Prevent truncation of nr_pages / nr_subbufs
  ring-buffer: Cap static ring buffer nr_pages
  tracing: Fix subbuf resize races with trace_pipe_raw readers
  tracing: Fix to avoid creating trace instances with duplicate names
  ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
  ring-buffer: Allow splice reads on static buffers
  tracing: Take trace_array reference when opening options file
  ftrace: Synchronize the initialization of ftrace_ops
  ftrace: Take trace_array reference before accessing its ftrace_ops
  tracing: Have show_event_filters/triggers files take trace array ref
 2026-09-06 14:21:24 -07:00
Linus Torvalds
2beb1b31a1 bpf-fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmqdhRMACgkQ6rmadz2v
 bTo8vRAAnP+x1z6FBOgHawGmmBpXtazoipRFeok/+/YGQ4SbS+evvFNvmkeCyihZ
 7EeNHGuWEbA6xQBAcMf0StMjmr3jkJvUA6lsHSxBiFLpHGqNt0Fz9IXvAL/8QWPg
 F7+CBs5A+J61i66LEmINbWzW1ujDf7baU/1VWui9zfPxnmPu40V/74eXzm6DmH/V
 oHTsCscCYNe+N+Wix6B6nLrObY537fcJU12N56uqpkaSc0+6H1fBQJmyFGpYroTX
 +4g+DNzEHyIYmt6B3+oDpbT0Zh/pP6ROq5TPDNJSSa+5B/uPo5C5pH520HwXF9hJ
 04uaD7y2fpE809Nwl3OEK4ozpJ+mEGU1NKZPvFAxckY6GCiBtfbGd1etFno7r+4F
 mZhNBKbQVEQX4XJUlcoqn9n7T2OCDnjiuneZAjIi4vUdevnSnakr0rCTFriiHP54
 jg4fEkXxvYjPiqs5SQbxoGxmYSfg9fYaSfK4HgFdlfbwp+3Vmv4BW/tcsIJ9dcPs
 L3YWkUU3znjbu2BLy0CP9fGt/1ik8p4/tA8vvZwz0yqpDMJkLy1TziGMef51UQ7k
 1Pe/Ln5J3C6xnWs+3TRF11y8PuuCF0y47DGPACfwPoQxca1ufJ5fgmLXRRQToZe4
 RjDmoeQvvI9w9kxh6gVhTHoiiEeD0wcQqx2CMHKTrU/PbM7d4Co=
 =oz4Z
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:
 "This mainly contains verifier fixes that address bugs reported by
  Nicholas Carlini.

   - Fix incorrect non-NULL inference in pointer comparisons: pointer
     types that may be NULL at runtime, pointers with unbounded offsets,
     JMP32 comparisons with zero, and imprecise zero registers (Eduard
     Zingerman)

   - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
     implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
     NULL call arguments (Eduard Zingerman)

   - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
     extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
     patterns entered by a jump (Eduard Zingerman)

   - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
     (Hui Su)

   - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
     and reject key-less BTF for hash maps (Jiayuan Chen)

   - Various fixes (Kumar Kartikeya Dwivedi):
       - Fix out-of-bounds access in disassembler on invalid LDSX
         instruction
       - mark siginfo of signal tracepoints as scalar and
         sched_process_wait argument as nullable
       - mark faultable stack helpers as sleepable
       - reject tail calls and legacy packet loads from callbacks
       - enforce rbtree callback lock restrictions for resilient locks
       - require MEM_PERCPU for percpu kptr stores
       - clear NON_OWN_REF after RCU protection ends
       - mark NULL kptr stores precise
       - preserve inner map identity in callback frames
       - reject non-scalar bpf_loop() iteration counts

   - Fix trampoline allocation slowdown on x86 by using
     EXECMEM_MODULE_DATA (Mike Rapoport)

   - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
     reject untrusted allocated-object pointers (Ning Ding)

   - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
     Yuan Chen)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
  bpf, riscv: Make arena support depend on ZACAS
  selftests/bpf: Test pointer bpf_loop iteration count rejection
  bpf: Reject non-scalar bpf_loop iteration counts
  bpf: use mark_arg_precision() in check_mem_size_reg()
  bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
  selftests/bpf: precision of a NULL global subprogram BTF_ID argument
  bpf: mark a NULL BTF_ID argument of a global subprogram precise
  selftests/bpf: precision of a NULL kfunc argument
  bpf: mark a NULL kfunc argument precise
  selftests/bpf: precision of a NULL global subprogram memory argument
  bpf: mark a NULL memory argument of a call precise
  selftests/bpf: precision of a NULL helper argument
  bpf: mark a NULL call argument precise
  selftests/bpf: Test inner map identities in callbacks
  bpf: Preserve inner map identity in callback frames
  selftests/bpf: Test imprecise scalar kptr stores
  bpf: Mark NULL kptr stores precise
  selftests/bpf: Test rhtab kptr cancellation semantics
  bpf: Cancel special fields when recycling rhtab elements
  selftests/bpf: Test timer field on recycled rhtab element
  ...
 2026-09-06 13:49:44 -07:00
Linus Torvalds
88405f0ad1 Miscellaneous scheduler fixes: 
- Fix a timestamping bug in pick_task_fair() and
    yield_task_fair() (Zhan Xusheng)
 
  - Skip migrate-disabled tasks when picking a push
    candidate in the RT and DL schedulers (Seiji Nishikawa)
 
  - Skip rq->avg_idle update without a valid idle_stamp
    (Shubhang Kaushik)
 
  - Fix throttling bug in throttle_cfs_rq(), caused
    by the recent single-runqueue conversion (Wanwu Li)
 
  - Fix bandwidth calculation bug in distribute_cfs_runtime(),
    caused by the single-runqueue conversion (Wanwu Li)
 
  - Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)
 
  - Avoid creating misfits during cache-aware load-balancing
    on hybrid systems (Tim Chen)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdTLIRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gdURAAnjK4q2xg115VyKOvg4u4epPre1XNK4a/
 RmimS/2+1fm7/5zqOXOQG3qU8z2Aj+nBIZa1d1yadV7ARHSymDINobCX+2HQ1DjU
 Iysk2BqbbLnQQNKh81OBWhPMyJy4yOnig/670KR5JdFAdTKFYW/Ys+pQmO9M6rEx
 hc8B4SUhOGeRnonfPMTbFW7H9eopWzst8kIpF0USl58az0mla5tkooWYJsvSuUHn
 g4s9IALlRe3DxgmMT3kLKoAx2+ySnrzZNRs+M8Z/sMSDKXCMFpvX36wOqBJMHwXe
 ZoAow/fJh4ysoYTR7luhDIBDQAkszf4GE9a644I/Bd0sIIYKs4+1RW1T3DAoWmKv
 Sx0C29MM4Ng4R3lPx2avb+c0T0VO080/3fqRFrGrck8BIpMa9HcinOxf6etI8+vt
 STnz5uQZZj3V+A5vzlKCAFGUUqK/s3EJnrT5z4VPxXmY2ZSyLLub4C5SQ8RNnqRL
 u+Q9ra9DYBJh/HJTgjjcAP/HxmKK5LyQXd2DzuA1wy/wwC+s7TtPrxN5ep5EdZmv
 K65zGGo28BgcCKD8jc1DfVXf8cf80fMiAr4fruGdo5TVwPyBahwZBi4sbqhahtqL
 D4QwCsbOfhS+evVpx29n+V7eQzZzvSdN1tFCtZ3Tg6VvT9aJ2jLSx79aCsL/cYbr
 hViB9N0yhGk=
 =8l0J
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:

 - Fix a timestamping bug in pick_task_fair() and yield_task_fair()
   (Zhan Xusheng)

 - Skip migrate-disabled tasks when picking a push candidate in the
   RT and DL schedulers (Seiji Nishikawa)

 - Skip rq->avg_idle update without a valid idle_stamp (Shubhang
   Kaushik)

 - Fix throttling bug in throttle_cfs_rq(), caused by the recent
   single-runqueue conversion (Wanwu Li)

 - Fix bandwidth calculation bug in distribute_cfs_runtime(),
   caused by the single-runqueue conversion (Wanwu Li)

 - Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)

 - Avoid creating misfits during cache-aware load-balancing on hybrid
   systems (Tim Chen)

* tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Avoid creating misfits during cache-aware balancing
  x86/itmt: Don't make ITMT enablement depend on debugfs
  sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
  sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
  sched/core: Skip rq->avg_idle update without a valid idle_stamp
  sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
  sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers
 2026-09-06 11:08:44 -07:00
Linus Torvalds
c4a3928e7d Misc perf events fixes: 
- Skip empty AUX records with only format flags
    (Leo Yan)
 
  - Fix use-after-free when perf mmap() revival races with the
    last munmap() (Yilin Zhang, Weiming Shi)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdSokRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gRKRAAkDxFT3BNAtAypk5CvTPeO9K530u38mqc
 fIvYQYbYkqIMZaFSmIthSgsPOJD/mqkccl1sd6djlS/73mI/X8eXCwZOgjLnaCsu
 jRx8atD8Q7hHeyJ78qY/hFsyHPTQel5+cniEk4BjUrYIYhHklFfpQw1AZhoJieUs
 vnqkDGMY/qHQ5pGs+dnz3oI8FE6ruNU0Ps6qiBqsbsvMJI+wviCidpC6BqluyxvQ
 Pp6ACwqQIiH2mPwI9WYtHKmVL5ajQJPt8fbIwIvRbX5wCY566zb79oUys2pNUh/U
 zzpTNOGgqtVCTgiuMiEI2SlIIMzC36P071vBTyD8YZWUNpdYXLM20RdvAUZkqefT
 Vx3cMs8rgcPnjGO4XhPJJOzfyyCi25VL/p3af9S3wSJhfQNdMF9BuqRABFMBmtDi
 5adP+4p5Dw9sfc2+F2/OCT7PrXsFiNsOp+iduWJYb6i8hdSjV1mfjGLyptdBCdj2
 dUYr4VrFoiYUVLPWJD5F4/dDAIljN3CEoGwHiOITNCYu0fgO7GCALf8FG5U9Ec7D
 guuRGnEXDFQDCOZHm5MuVYWAR7qPhe+iVoX6Dw9ZmgecGWb4eTl4A5e8LGgbcbJ1
 JMfVr3OENSyGi1dPnCX4DEsIpeXN1UTMHhrwNosWcu1OrEEUkzdQ8GQ17qU6PURG
 yYSXCvhdEtY=
 =Ffvz
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Skip empty AUX records with only format flags (Leo Yan)

 - Fix use-after-free when perf mmap() revival races with the
   last munmap() (Yilin Zhang, Weiming Shi)

* tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix use-after-free when perf mmap() revival races with the last munmap()
  perf/core: Skip empty AUX records with only format flags
 2026-09-06 11:06:09 -07:00
Linus Torvalds
c8990f3179 Misc locking fixes: 
- Fix a softirq processing delay bug in local_interrupt_disable(),
    which should mostly only affect the Rust runtime (Boqun Feng)
 
  - Remove the hardirq_disable_count() function which caused the
    previous bug and is now unused & unnecessary (Boqun Feng)
 
  - lockdep: Invalidate stale class_cache entries for zapped classes
    (Eric Dumazet)
 
  - Fix rt_mutex specific futex scheduling helpers
    (Sebastian Andrzej Siewior)
 
  - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdSKMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gh6hAAtIhAm10pkx7JG4Kl+SQArmoAxNMfW9X1
 grx50dn1/LFuIF0upooJwJmLMBpPMmxcpYPWbg5nTUsx+wDqcJTT0T7Aw2iZN2f+
 OdODMOGNuQU4IUxDC+qX+fkgHvRFzng0zhSXYL2kGpQJHktrFMAHn90+5aO9SEgA
 XcSjmDacTxfJADNk43snrlHy6t+yOXBEmIrhicnbh11GFNIXLbvdGW/0SObU0Q5o
 WdwGHTZRFAM3mpX7xMSFOKypM+Gt4pXdQ/uC1PQg0B/AT35p4zsYIdcht/cBMHp0
 93eTeJd9ede410t3hL1Hnsuo1zf5qHtCgBukS+UHJWoWpnSOMgT2iaBx2X3jIsev
 ptPIqV5Alq8O+tnNOSDOwD2HH2drAdUBVH+gZ/yKMDbk9jfw9eZKqRw628U2P7rG
 mD5CLzpmfj0mMAuqcOhhdqSQmPhjp2Y8Ju/8UAMSmcocvqjQBxvouNS3Tby9U5v+
 R4CsuUwtnYpMyy5xyRrnwVsaE3le5fvneXCmCokk8FtQ8as/4ATd+cG+RROSa3vW
 /AAjrB1HBQqyseE8lki4LFFmlr01Otc8u6pASy4/pxeuKMA9hSuLC3RuEfVetW6W
 BcK4BCIJBy6chcsCBxv0F7FgI/y7/bpVyBmoTkW3Sb0I23xswXzTzbucn/dPJNdl
 oqFj3KQygxw=
 =vEuZ
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fixes from Ingo Molnar:

 - Fix a softirq processing delay bug in local_interrupt_disable(),
   which should mostly only affect the Rust runtime (Boqun Feng)

 - Remove the hardirq_disable_count() function which caused the
   previous bug and is now unused & unnecessary (Boqun Feng)

 - lockdep: Invalidate stale class_cache entries for zapped classes
   (Eric Dumazet)

 - Fix rt_mutex specific futex scheduling helpers
   (Sebastian Andrzej Siewior)

 - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)

* tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent rcuwait use-after-free during requeue PI
  futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
  locking/lockdep: Invalidate stale class_cache entries for zapped classes
  preempt: Remove hardirq_disable_count()
  interrupt: Disable interrupt before modifying hardirq_disable counter
 2026-09-06 10:45:46 -07:00
Linus Torvalds
b485131995 Miscellaneous IRQ subsystem fixes: 
- Revert a commit to the mbigen irqchip driver that caused
    a regression on two-port Hi1616 chips (Caina)
 
  - Fix a too-long-preemption-off bug in the stm32mp-exti
    irqchip driver, caused by a time unit ambiguity & mismatch (Ju Nan)
 
  - Remove the now completely unused irq_domain_add_linear()
    inline function (Jiri Slaby)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdRScRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hPZhAAtKTux+xrKNQ2AsJsVoQFpf/B3EHodf9C
 7SPLROhmYYTpOTAdjB0ZP6jxssCmu+Q5NtZzXxX9QU5D3l9aIG6RYQsKd0hQ2tPm
 2Gb5dwFw4Ozfh1OrJKbFTC/nFsmAZETzF8bm9gfsfWoYIcblNNJ6Fp8yya0q04/g
 qupnXpY9XLZtgFVG4tgJSH5ICxCa/1vTYukU5vdDMkHRyN9ENVWTbTTUqFHiBbeO
 1V2oT3q2sM3tLGHifg1RWQ9uC3Vo3M+kS/bAZFlWcu0ZuIcW0WjU4pxjQjfviB8w
 zFLY+erKIUIDt6JQ8E9Iapa+EMMIR4CKqfjMoYWoYTrzXX1X6XRtnGpTDZ8t3wl9
 HrvR4eO/IqiUgR54lpE/J9eysBqo3+UbN6qVAo0jCo+D+z13AOTp5Rdz5CPD2zKr
 7KUURB5SvkaTMz4zoOGNI3NTARKoEac6eAZgUXfWR/+94W1f2fM+lLyC7cUiDTyA
 A/eoy1Kcj5sTiTgVtR+pDKi9enSD6etJkvEeJvThZ3yjcUVPjUGDh5IFahq8dR57
 J018f1q8yBZ6rAr4q0oOMkWscYIK2WBeXbdUc7+IPreFPoooRzHeNSa7abLaKiX5
 MBidcgHBL7XE1HEpTz/1rL6F226IqEfAtWuMuMWyuHQ5uYTCzoJ2sELjH/++XOdV
 k1qP+93K1dI=
 =54qE
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull IRQ subsystem fixes from Ingo Molnar:

 - Revert a commit to the mbigen irqchip driver that caused
   a regression on two-port Hi1616 chips (Caina)

 - Fix a too-long-preemption-off bug in the stm32mp-exti
   irqchip driver, caused by a time unit ambiguity & mismatch
   (Ju Nan)

 - Remove the now completely unused irq_domain_add_linear()
   inline function (Jiri Slaby)

* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
  Revert "irqchip/mbigen: Fix mbigen node address layout"
  irqdomain: Delete irq_domain_add_linear()
 2026-09-06 10:35:24 -07:00
Linus Torvalds
d3cbb9af72 virtio console fix for 7.3-rc2 
Here is a single virtio console fix for 7.3-rc2 to fix a much reported
 regression in 7.3-rc1, sorry about that.  It's not been in linux-next,
 but it has been sent by many different developers to resolve the issue
 and is "obviously" correct.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCap0yag8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykbSwCcDmF2b0gZnZY3LaaJjdryq8yXP8cAnjEGPEl9
 OcipLpPGvj6dq+5Xv2qE
 =5+1N
 -----END PGP SIGNATURE-----

Merge tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull virtio console fix from Greg KH:
 "Here is a single virtio console fix for 7.3-rc2 to fix a much reported
  regression in 7.3-rc1, sorry about that. It's not been in linux-next,
  but it has been sent by many different developers to resolve the issue
  and is 'obviously' correct"

* tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  virtio_console: allocate the port_buffer with the caller's gfp
 2026-09-06 09:55:20 -07:00
Linus Torvalds
bf979ab8f2 Staging driver fixes for 7.3-rc2 
Here are some small staging driver fixes to resolve some reported bugs
 that have been found, and tested, in a few staging drivers in 7.3-rc1.
 Included in here are:
   - OOB read problem fixes in the rtl8723bs driver
   - fbtft driver fix
   - sm750fb driver fix
 
 All of these have been in linux-next this week with no reported
 problems.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCap0zHA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylsuwCfc6ycZ0QbcKpiDZpzijDTduvUh1IAnAky4xi7
 rNKgULapaYP63Mt0exzR
 =Cajg
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are some small staging driver fixes to resolve some reported bugs
  that have been found, and tested, in a few staging drivers in 7.3-rc1.
  Included in here are:

   - OOB read problem fixes in the rtl8723bs driver

   - fbtft driver fix

   - sm750fb driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
  staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
  staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
  staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
  staging: fbtft: make dirty_lock IRQ-safe
 2026-09-06 09:49:06 -07:00
Linus Torvalds
65538a8f02 USB fixes for 7.3-rc2 
Here are some small USB driver fixes for reported problems and
 regressions.  Include in here are:
   - xhci driver fixes
   - cdns3 driver fixes
   - usb gadget driver fixes for syzbot found problems
   - typec driver fixes for broken hardware and other bugs found
   - kernel data leaks in mdc800 driver
   - usb storage driver fixes
   - other small USB driver fixes
 
 All of these have been in linux-next this week with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCap0z6Q8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynS5QCfbHGkxWTxkZ5dhvMn0Xs4/+ekE1QAn35xFYmZ
 SzXW+Kqkf7nMhxHo9yj0
 =L8pK
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for reported problems and
  regressions. Include in here are:

   - xhci driver fixes

   - cdns3 driver fixes

   - usb gadget driver fixes for syzbot found problems

   - typec driver fixes for broken hardware and other bugs found

   - kernel data leaks in mdc800 driver

   - usb storage driver fixes

   - other small USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
  usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
  usb: gadget: fix null pointer dereference in usb_put_function_instance()
  usb: typec: qcom-pmic: cancel reset_work on stop
  usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
  usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
  usb: storage: realtek_cr: fix use-after-free on disconnect
  usb: cdnsp: fix wakeup from S3 after controller context loss
  usb-storage: ene_ub6250: fix race between scan work and probe
  USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
  usb: gadget: f_midi: initialize work in f_midi_alloc()
  usb: gadget: f_midi2: fix use-after-free in string attribute show path
  usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
  usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
  usb: typec: hd3ss3220: track VBUS enable state per consumer
  usb: dwc3: clear forceRM when issuing EndTransfer
  usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
  usb: typec: mux: avoid duplicated mux switches
  usb: typec: mux: Fix typec_switch_match()
  usb: image: mdc800: change kmalloc() to kzalloc()
  ...
 2026-09-06 08:50:20 -07:00
Chen Pei
536b523b40
bpf, riscv: Make arena support depend on ZACAS 
The arena range tree allocates its nodes with kmalloc_nolock() since
commit f8c67d8550 ("bpf: Use kmalloc_nolock() in range tree").
kmalloc_nolock() requires slab caches with cmpxchg128 support
(__CMPXCHG_DOUBLE); on riscv cmpxchg128 is provided by the ZACAS
extension. On systems without ZACAS every arena map creation fails
with a misleading -ENOMEM.

Report the missing support instead: make bpf_jit_supports_arena()
return system_has_cmpxchg128() where it is defined, so arena map
creation fails with -EOPNOTSUPP on systems without ZACAS. The macro
is only defined when both CONFIG_RISCV_ISA_ZACAS and
CONFIG_TOOLCHAIN_HAS_ZACAS are enabled, so guard it with #ifdef the
same way mm/slab.h consumes it, and reject arena otherwise. This
matches how arena BPF_CMPXCHG instructions are already gated on ZACAS
in bpf_jit_supports_insn().

Fixes: f8c67d8550 ("bpf: Use kmalloc_nolock() in range tree")
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Acked-by: Pu Lehui <pulehui@huawei.com>
Acked-by: Björn Töpel <bjorn@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260902061451.1416-1-cp0613@linux.alibaba.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
 2026-09-06 16:23:12 +02:00
Eduard Zingerman
fd5348b434 Merge branch 'fix-bpf_loop-syzbot-report' 
Kumar Kartikeya Dwivedi says:

====================
Fix bpf_loop syzbot report

Needs Eduard's ack. Fix for the report in
https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com.
====================

Link: https://patch.msgid.link/20260905014735.1452988-1-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
 2026-09-05 20:50:13 -07:00
Kumar Kartikeya Dwivedi
bde8901ea1 selftests/bpf: Test pointer bpf_loop iteration count rejection 
Add a verifier test that leaves the raw tracepoint context pointer in R1
when calling bpf_loop(). This is the smallest trigger for the incorrect
precision backtracking: it reuses an existing callback and needs no maps or
userspace setup.

Expect an ordinary scalar-type rejection. Without the verifier fix, the
test instead reaches precision backtracking and reports an internal
"backtracking misuse" error.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260905014735.1452988-3-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
 2026-09-05 20:50:13 -07:00
Kumar Kartikeya Dwivedi
c3fd8e5fd1 bpf: Reject non-scalar bpf_loop iteration counts 
bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged
programs may pass pointer values to such arguments, so check_func_arg()
lets a pointer-valued R1 reach the helper-specific checks.

Since commit bb124da69c ("bpf: keep track of max number of bpf_loop
callback iterations"), the verifier marks R1 precise and reads its upper
bound to limit callback simulation. Precision backtracking only accepts
scalar registers, so passing a pointer instead triggers the "backtracking
misuse" verifier warning. Kernels with panic_on_warn enabled subsequently
panic.

Introduce ARG_SCALAR for helper arguments that only accept scalar values
and use it for bpf_loop() nr_loops. Generic helper argument validation then
rejects pointers before loop inlining and precision processing.

Fixes: bb124da69c ("bpf: keep track of max number of bpf_loop callback iterations")
Reported-by: syzbot+7b47f87674e9a1569110@syzkaller.appspotmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://patch.msgid.link/20260905014735.1452988-2-memxor@gmail.com
Closes: https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
 2026-09-05 20:50:13 -07:00
Linus Torvalds
1fc5a74b10 kmalloc_obj conversions for v7.3-rc2 
- Run scripts/coccinelle/api/kmalloc_objs.cocci for v7.3
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCapuwVwAKCRA2KwveOeQk
 u5EeAP9TS7K4iVlw3KlZHuLIK2q+CQfALPepcu+ME2lO5dta4gEAxCTi0ZXmU7OT
 XbmWUd+DTkKNYCBW8E6Lvn72Er13uQs=
 =ZtN4
 -----END PGP SIGNATURE-----

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull kmalloc_obj conversions from Kees Cook:
 "Another run of the Coccinelle script for converting kmalloc()
  family of allocations to kmalloc_obj() via the existing rules
  in scripts/coccinelle/api/kmalloc_objs.cocci"

* tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: refresh kmalloc_obj() conversions
  drm/amd/display: Fix harmless type mismatch in allocation
 2026-09-05 20:45:18 -07:00
Linus Torvalds
9f0346dcbe Driver core fixes for 7.3-rc2 
- Fix kernfs listxattr() not returning security xattr names (e.g.
   SELinux labels) when the kernfs node has no allocated kernfs_iattrs
 
 - Fix silent truncation of IRQ vector indices in the Rust PCI
   abstractions
 
 - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is
   disabled instead of silently enabling extra kernel functionality
 
 - Russ Weight is retiring from kernel development; update the Firmware
   Loader sysfs contact to the driver-core mailing list, add a CREDITS
   entry for Firmware Upload, and update MAINTAINERS accordingly
 -----BEGIN PGP SIGNATURE-----
 
 iHQEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCapxQTQAKCRBFlHeO1qrK
 Lr1NAQD09hhWzsAkRvdDgf/rd3iUW4Fxro/KOIf+OThNRgWpRQD4+hMNQqxzk3OB
 QT3xFMqLPFtLf+voWTcWniC6UsLfCA==
 =k/Gx
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Fix kernfs listxattr() not returning security xattr names (e.g.
   SELinux labels) when the kernfs node has no allocated kernfs_iattrs

 - Fix silent truncation of IRQ vector indices in the Rust PCI
   abstractions

 - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is
   disabled instead of silently enabling extra kernel functionality

 - Russ Weight is retiring from kernel development; update the Firmware
   Loader sysfs contact to the driver-core mailing list, add a CREDITS
   entry for Firmware Upload, and update MAINTAINERS accordingly

* tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  MAINTAINERS: Remove Russ Weight from Firmware Loader
  CREDITS: Add CREDITS entry for Firmware Upload
  firmware_loader: Change contact for sysfs nodes
  rust: pci: reject IRQ vector indices that do not fit in u32
  kernfs: preserve security xattrs without allocating iattrs
  drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF
 2026-09-05 11:59:05 -07:00
Linus Torvalds
214f4aeb22 LoongArch fixes for v7.3-rc2 
-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmqb6gQWHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImeuBkD/9SNpBtFcumYkl1S3FUSTC8Up5k
 8exUSd6bJr/lc5+cPJcY4VZLOus8ueKjJuKXQE0C3Id6Cd8g1MGZUQVGXIWYz2Sx
 69z2rhYkE4b386ivNutwCzA7Bjlb/rMZEeDGfEuRe2eVOH2o8ADiLG+ANNUHbpWt
 zTbLUiBOFD2sfWL2fSShcBJthYF7QTBh54jlL56HBleWMdq6y4ii7rh1X+6RFgNg
 xRi7s/4+FLxh+F+1GOVrPvIuNrqQaTgWVASsmmRE56n66WOFeVgsG4NVi0/i0f9Z
 MLHp/QeSx5/OtIhjjt9BkV+0E2tXAUMEOalj0HpaDBxsfAjAFLDt7TRra9BhV+aI
 FrEnbIwG809BYAjRO2scf4khtrLofZpIv+STt+vbKjFYEv2Z03x/2JS6Tg9gGmtN
 wP1GfzfPgk8FgdbQ4pgT354COYr1Ey+OU1tjNTmmYMYN7WmXmGG9Yx7LfrtvsNU9
 ohFeHyTygAcw/bE1/IdWqFK7DP6V5LuOoeOtfuEnRC/SFHdGbr2fvu3dfZSK06kE
 CWY9QSF7J8MfLNhgRi4/Q0QxRtdekDyANZezS2uwNv1Hn6Pwt9rXMScMiyWkNSg7
 6oltWiIrXx5lMBCHDciNWyAR+mQe3/G8YUPnrpPWsfMcOelvfMN/RWtYWMalevZ5
 YY9ufXSCGMQQDBPFDQ==
 =SgJ4
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch fixes from Huacai Chen:

 - Fix build errors when RUST and KASAN enabled

 - fix a typo in comment of vmlinux.lds.S

 - fix several bugs in Kprobes, BPF JIT and KVM support

* tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  perf build: Add clang and rust target flags for LoongArch
  LoongArch: KVM: Fix TOCTOU race on pv_features
  LoongArch: KVM: Validate MSI data before routing it to EIOINTC
  LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
  LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot()
  LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path
  LoongArch: KVM: Add unregister helpers for the KVM interrupt devices
  LoongArch: KVM: Free init resources if kvm_init() fails
  LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
  LoongArch: Avoid preempt count underflow without probe
  LoongArch: Do not save/restore percpu base register in rethook trampoline
  LoongArch: Remove unused setup_profiling_timer() function
  LoongArch: Fix typo "avaliable" in comment of vmlinux.lds.S
  LoongArch: Do not select HAVE_RUST when KASAN is enabled
 2026-09-05 10:45:51 -07:00
Breno Leitao
b144dc5a24 virtio_console: allocate the port_buffer with the caller's gfp 
put_chars() runs from the hvc console write path with preemption
disabled, so it asks alloc_buf() for GFP_ATOMIC. Only the data buffer
gets it: the struct port_buffer itself keeps the GFP_KERNEL default, so
the allocation can enter direct reclaim and sleep. A write to /dev/kmsg
on a CONFIG_DEBUG_ATOMIC_SLEEP kernel splats:

  BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:320
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: virtme-ng-init
  preempt_count: 1, expected: 0
  Preemption disabled at:
  [<ffffffff813fd90d>] vprintk_emit+0x17d/0x510
  Call Trace:
   <TASK>
   dump_stack_lvl+0x69/0xa0
   __might_resched+0x37a/0x4d0
   __kmalloc_cache_noprof+0x94/0x5f0
   put_chars+0x209/0x3e0
   hvc_console_print+0x234/0x640
   console_flush_all+0x4fc/0x950
   console_unlock+0xbf/0x1b0
   vprintk_emit+0x312/0x510
   devkmsg_emit+0xba/0x110
   devkmsg_write+0x21b/0x2e0
   vfs_write+0x4dc/0x9d0
   ksys_write+0x108/0x1e0
   do_syscall_64+0xfa/0x460
   </TASK>

Pass gfp on to that allocation too.

Fixes: fc220d6be3 ("virtio_console: refactor __send_to_port() buffer ownership")
Signed-off-by: Breno Leitao <leitao@debian.org>
Acked-by: Sungho Bae <baver.bae@lge.com>
Tested-by: Florian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20260810-serial-v1-1-abbe51602c13@debian.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2026-09-05 19:28:39 +02:00
Linus Torvalds
d9d80a859b for-7.3-rc1-tag 
-----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmqcOFUbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg7DwAP/i5lmUS85n22uWD7wkmU
 5ocMbdl9cKprtcpi8axR9kbtBIC5bq0j3sUwmiFgR6KI774v7FnxJ3AIrey3GwtF
 okiaWLffKOYROCDvmLg36ciSbFGEqjS8lwOPl1geBX7tZhhnGgcV+XRXcMv4ehj8
 HiOtjN8a+8kXrYTMB73JhBkzku7Hojb/vA9ZHXeCLjP4nfzlXneqltSQw/+3uVvf
 jrLfOX3a1lgLkz0Q7AlfAO7ppXv5msrZYu7E1aILYtLA5K6J6Gh1jyK+Y8OZlvdg
 hukhU3mAw2pCV5dg6rAurYWzVhE/tNmKmlg2s1LiW3K1Q2NNSPGvR0ArmAnd9bPY
 6ZwoK47m98xuZgIAO7v+ej9LYI3XANGwdupTmrKhQ7shLYtzvSsob7kWRYfjCMWu
 UaTGshMsrfMXZNznXm2Ydy1Gmr3TBI2J1HpUFiibRL4XgsQ7u9hLUFwiFUiMEi9V
 g9oqTN/1VUMsImADlnrdAf30pLtOe8PHV1naFLdmdl+iCPc9o0cX9X5m2fHWtkpt
 Cjz/au8Z0zMVJMIDUZuBgCX4mWNSx7pWYKQYvlGOLQEehXNLRVcY5SnIqRman8WF
 gnUPaaTb6KDS+SJjRDPkRH9ihGlNEd2c/tzrxek4/42CF842PGeMvGK06PtPyzxW
 LWtmCtBWRArSHUq09NZbboim
 =z6qW
 -----END PGP SIGNATURE-----

Merge tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:

 - preserve inode compression level when changing attributes

 - fix lost wakeup when waiting for a zstd workspace

 - fix bio context leaks after ordered extent processing errors

 - in send, handle unexpected extents for non-regular inodes

 - handle edge case in creation of reloc tree with enabled quotas

 - in scrub report the exact failing offset, not the stripe base

 - error handling fixes
     - error code propagation in send, zoned mode and raid-stripe-tree
     - restore active device pointer after seeding device addition error
     - transaction abort fixups

 - update Chris' email address

* tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  MAINTAINERS: update Chris Mason's email address
  btrfs: tests: do not touch page cache if root/inode allocation failed
  btrfs: zstd: fix lost wakeup when waiting for a workspace
  btrfs: do not force reloc root creation during qgroup_account_snapshot()
  btrfs: send: fix lost error return value in will_overwrite_ref()
  btrfs: abort transaction before releasing tree_log_mutex on commit failure
  btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio()
  btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
  btrfs: send: reject extents for non-regular inodes
  btrfs: return proper negative error code for update_raid_extent_item()
  btrfs: fix the possible bioc_list memory leak during error
  btrfs: fix transaction use-after-free in raid stripe insertion
  btrfs: scrub: report the failing sector's address, not the stripe base
  btrfs: preserve the compression property when other inode flags change
  btrfs: restore active device pointers after failed sprout
  btrfs: detach failed sprout device from transaction update list
  btrfs: clean up target device if block group marking fails
 2026-09-05 10:18:21 -07:00
Linus Torvalds
0d9ff90a54 SCSI fixes on 20260905 
2 enhancements to add support and MCQ for additional Intel 4.0
 controller types. The rest are all driver fixes, the largest of which is
 the mpi3mr target use after free fix, follwed by a similar TOCTOU fix
 for io_uring passthrough in bsg.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCapw/mRsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIXurAD7BFNaHlTRLIlurYSeMYOV0ZVQQXR9GsW8
 1KQhJW1W6GABAIr7L81Gm1jTUa+CuXixW2N9tv8PBsXx627eWyRZ7tyb
 =9pG9
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two enhancements to add support and MCQ for additional Intel 4.0
  controller types.

  The rest are all driver fixes, the largest of which is the mpi3mr
  target use after free fix, follwed by a similar TOCTOU fix for
  io_uring passthrough in bsg"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
  scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
  scsi: bsg: Cap io_uring sense copy to max_response_len
  scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
  scsi: mpi3mr: Fix use-after-free on tgt_dev->starget during target device refresh/update
  scsi: target: iscsi: Reserve a terminator byte for the login payload
  scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
  scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
  scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
  scsi: sg: Report request-table problems when any status is set
  scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
  scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
  scsi: ufs: ufs-qcom: Fix sequential read variance
  scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+
  scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target()
  scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin()
  scsi: pm8001: Use rollback index when freeing MSI-X vectors
  scsi: fnic: Initialize the NVMe local port info before registering
 2026-09-05 09:25:50 -07:00
Linus Torvalds
d0fc310b4d block-7.3-20260905 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqb+cYQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpjBkEACTFzHAVopJbtKT6+Rg9esQNPUDfeJkJy/L
 3v8Vi4R7tozAB0IKc58RxV2YFMvga5teWJkAnd33983/MbwCzj9B0oRjSmnHf8K5
 pq4gu1f5pdyfRXGGAnI6ZMom1MNsfuWWiZmD8vQuQ+q4qNVSnQBg0UjrDggDlcW6
 o6EtyjgqAwaaGs+sWgxgy0sYWV7TMiCx4+AZR0TDm8cN3LXyOkOp2abgR35/tnDB
 fs3kUPTkBC4rCZK2uVUhgF6Wctcd2qIF6AEP+bBbWifSCI/jmqAYHk/0IM1xpn8e
 XXPO43X5Iad5iiMWMHlku9G7ZjTo/K2bLc1n9F4IlNZgVPAcF9qtYok5Uc3ghldg
 /qOsclI8D2feQ5j6u060FdnN99+TSHcS3h4roa8jIPNojmh5orw2xRiDCvSVG3au
 +UfEUWnf0JjsmJfX9HCQyV6oTB/7IeiSI+4akHXobCnsG4n9BL8kZ1HR8qwPWsYj
 HPeLHraPljX2slDj+X9EFA8AyxgU33HC9JbjvLlN4L2amX+7Jtwb3A7MlKrGEuUP
 gzybtHk5g17/mcYVj9N2k4tHECR1aZChTQcfNdCctMVB3vXk3KKkFsZstJapCVmT
 fSKx7pdrrNwo3WoKzn8xp/+2gcrRRo4AhSCg9oVfloc5nSFkyfPpq0vPspsUj3ib
 4ze4Sy2TiQ==
 =4ZE+
 -----END PGP SIGNATURE-----

Merge tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - NVMe fixes via Keith:
     - nvme-tcp fixes for an out-of-bounds write on an over-long PDU
     - nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering
       fixes
     - FDP placement id array racy access fix
     - nvme-fc double free of fabrics options on nvme_add_ctrl()
       failure, and a secret leak failure
     - Fault injection opcode filtering
     - stale namespace removal during scan
     - Various other smaller fixes and cleanups

 - Flag zoned disks with GENHD_FL_NO_PART

 - Save the page offset gaps in a cloned bio

 - Fix dma_alignment for large or unreported limits in loop and zloop

 - Clear VM_MAYWRITE on a read-only ublk char device mmap

* tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits)
  nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
  nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
  nvmet: reject namespace enable without device path
  nvmet-auth: Synchronize timeout work during SQ teardown
  MAINTAINERS: update nvme entry
  nvmet-tcp: reject unsolicited H2CData PDUs
  nvme-tcp: defer TLS inline send to io_work
  nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
  nvme-tcp: return -EPROTO for a C2HData on a write
  nvmet: print namespace IDs as unsigned 32bit value
  nvme: print namespace IDs as unsigned 32bit value
  nvme: remove stale namespaces by NSID range during scan
  nvme: add missing SRCU grace period in error path
  nvme-fabrics: fix DHCHAP secret leak on parse failure
  ublk: clear VM_MAYWRITE on read-only ublk char device mmap
  loop, zloop: fix dma_alignment for large or unreported limits
  block: save page offset gaps in cloned bio
  block: flag zoned disks with GENHD_FL_NO_PART
  nvmet-rdma: fix queue leak when connect backlog is exceeded
  nvme: add opcode filtering for fault injection
  ...
 2026-09-05 08:58:55 -07:00
Kees Cook
3a2c4d55e3 treewide: refresh kmalloc_obj() conversions 
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
 2026-09-04 21:37:00 -07:00
Linus Torvalds
4d7d9486c0 integrity-v7.3-rc2 
-----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQQdXVVFGN5XqKr1Hj7LwZzRsCrn5QUCapsP/BQcem9oYXJAbGlu
 dXguaWJtLmNvbQAKCRDLwZzRsCrn5b2gAQC3ms2HRoZolscMWqnUNoi5SmPpwcV2
 v/ojwDc1TnS9HAEA/604QYihEvRQzKQwEyF6W6b83w22tyWKhDW1a0d7KQ4=
 =/Hd6
 -----END PGP SIGNATURE-----

Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull IMA fixes from Mimi Zohar:

 - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks
   resulted in configfs locking issues.

   configfs files should not be measured, appraised, or audited in the
   first place, so the builtin policies are updated to exclude them.

 - IMA audit messages include the filename, which could result in a page
   fault when the filename doesn't exist

 - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt

* tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX
  ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
  ima: don't measure/appraise files on configfs
  configfs: move CONFIGFS_MAGIC definition to magic.h
 2026-09-04 19:36:11 -07:00
Alexei Starovoitov
b75a000f2a Merge branch 'bpf-add-missing-precision-propagation-after-bpf_register_is_null-calls' 
Eduard Zingerman says:

====================
bpf: add missing precision propagation after bpf_register_is_null calls

Fix [1] uncovered a host of locations where the call to
bpf_register_is_null() is not followed by a call to
bpf_mark_chain_precision().

check_map_kptr_access() is omitted as it is handled [2]
by another series.

[1] https://lore.kernel.org/bpf/20260904083325.2083493-7-eddyz87@gmail.com/
[2] https://lore.kernel.org/bpf/20260904104203.345917-6-memxor@gmail.com/
---
====================

Link: https://patch.msgid.link/20260904-register-is-null-precise-fixes-v1-0-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:31 -07:00
Eduard Zingerman
cf2475616b bpf: use mark_arg_precision() in check_mem_size_reg() 
Use newly added mark_arg_precision() helper in check_mem_size_reg().

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-10-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
1d7f8f191c bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() 
Stop verification if mark_chain_precision() fails when called from
loop_flag_is_zero(). No functional change intended for the paths where
backtracking succeeds.

Fixes: 1ade237119 ("bpf: Inline calls to bpf_loop when callback is known")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-9-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
9195779166 selftests/bpf: precision of a NULL global subprogram BTF_ID argument 
Check that mark_chain_precision() is called for a NULL pointer passed
as an __arg_trusted __arg_nullable argument of a global subprogram.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-8-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
e726fc6b9a bpf: mark a NULL BTF_ID argument of a global subprogram precise 
btf_check_func_arg_match() accepts a NULL register for an
ARG_PTR_TO_BTF_ID argument tagged __arg_nullable and skips
check_reg_type() and check_func_arg_reg_off() without marking the
register precise. Hence a checkpoint created on such a path would
prune against arbitrary scalar value.

Fixes: e2b3c4ff5d ("bpf: add __arg_trusted global func arg tag")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-7-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
562d266d3f selftests/bpf: precision of a NULL kfunc argument 
Check that mark_chain_precision() is called for a NULL pointer passed
as a __nullable kfunc memory argument.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-6-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
506ada8962 bpf: mark a NULL kfunc argument precise 
check_kfunc_arg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.

Fixes: 3bda08b636 ("bpf: Allow NULL buffers in bpf_dynptr_slice(_rw)")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-5-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
100f4cc0d5 selftests/bpf: precision of a NULL global subprogram memory argument 
Check that mark_chain_precision() is called for a NULL pointer passed
as a nullable pointer argument of a global subprogram.
(Pointer arguments of the global subprograms are nullable by default).

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-4-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
f1e418129f bpf: mark a NULL memory argument of a call precise 
check_mem_reg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.

The argument may live on the stack rather than in a register when a
call has more than MAX_BPF_FUNC_REG_ARGS arguments, hence the new
mark_arg_precision() helper.

Fixes: e5069b9c23 ("bpf: Support pointers in global func args")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-3-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:30 -07:00
Eduard Zingerman
593c8eb0fb selftests/bpf: precision of a NULL helper argument 
Check that mark_chain_precision() is called for a NULL nullable memory
argument and for the zero flags argument of bpf_get_local_storage().

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-2-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:29 -07:00
Eduard Zingerman
1a3a10b030 bpf: mark a NULL call argument precise 
check_func_arg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.

check_helper_call() enforces second parameter of the
bpf_get_local_storage() to be zero, w/o marking the underlying scalar
register precise. Hence a checkpoint created on such a path would
prune against arbitrary scalar value.

Grouping these two into one patch, as they share the same fixes tag.

Fixes: b5dc0163d8 ("bpf: precise scalar_value tracking")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-04 18:17:29 -07:00
Linus Torvalds
654ae5d73c drm fixes for 7.3-rc2 
core:
 - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used,
 
 dma-buf:
 - Publish the dma-buf only after copy_to_user succeeds
 - fix some kernel-doc warnings
 
 atomic-state-helpers:
 - set pixel_blend_mode to prop default on reset
 
 sysfb:
 - Fix integer overflow
 - fix constant comparison bug
 
 pagemap:
 - Prevent double migration of device pages
 - Reset migration page count on eviction retry
 - dma-unmap pages before handling migration errors
 - use after free fixes
 
 prime:
 - fix prime exports tracing
 
 amdgpu:
  - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit userspace
 - plane blend mode fixes
 - SR-IOV fix
 - GFX8 fix
 - MES queue reset fix
 - GPUVM fixes
 - DCN 6 warning fix
 - DCN 3.5/3.6 fix
 - DML fix
 - Backlight fix
 - Colorop fix
 - DC get_estimated_bw() fix
 - devcoredump fix
 - Userq fixes
 - APU PSP fix
 - Cursor fix
 
 amdkfd:
 - MES queue eviction fix
 - MQD debugfs fix
 
 xe:
 - oa uapi error handling fix
 - drm info message to report FLAT_CSS base misalignment.
 
 i915:
 - Drop an accidentally duplicated panel fitter call in DP MST
 - Fix DDI clock programming for Cx0 and LT PHY
 - Fix PTL CDCLK handling at probe, causing a glitch
 - Fix dg2_power_well_count() return type
 - Fix a NULL pointer deref at forced probe
 - Fix selective fetch disable
 
 amdxdna:
 - out-of-bounds access fix
 - reject commands chains with no commands
 - handle chained mapping BO failures
 - refuse to flush an imported BO
 
 ethosu:
 - handle mmio mapping failures
 - handle storage modes only on hardware that supports it
 - fix job completion fence cleanup
 
 fastrpc:
 - Publish the dma-buf only after copy_to_user succeeds
 
 gud:
 - Improve TV modes and rotation handling
 
 nouveau:
 - use-after-free fixes
 - add missing scanline position support
 - HDMI and DP fixes
 - null pointer dereference fix
 - dmem accounting fixes for large folios
 - use write-combined maps for coherent
 
 qaic:
 - out-of-bounds access fix
 
 tegra:
 - Add blend mode properties
 
 virtio:
 - exit path and error handling fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqbH88ACgkQDHTzWXnE
 hr7stA//SAJOADL8CuoBzSyAX7zoqhVErYk798+4r5tPFJ5CzjkZVxGRGur7XWbm
 atezEEKaMTEz2BDVb1JDNRI1X1Yq9GtfWM860hUXmYHCegeO49B9lDnS1v0HZweD
 PQvPhCqvJpOOF6D8sjYFjVNvi0OrY0JVRlzsnMNmTIlw0xbg01lqn/oWgRA7qdvq
 Zo1k1yEPlK3jV2YuX674n7NoioFqeiSWBo9PzIX+yghagg2LrrS1Plx4RFA/B6bm
 Czt/x7WPE7lvoZqyDGBwlAY/dta3bagCFkGoDwb2Q1B3MjYXKcKBS0aGL9PyOgu/
 /9dNqvR4aDu9CXvNwb3kNbqjJL7DdFBCzwm78PNc43TizkR4WXCBXCNxJOf93e6h
 Bwx0GamXQJeGI6xNvQpEssUxezuS3wdoNZ0Rbk3nxMXlvf7OB/sgwkNYVCNKkk/V
 dSMOr1XB9pBGmtuWFPOf1kq/is4P4Ns/m8Rutfp5SBJNU9Air5ECblRNNkqFuOtS
 582QAM+7xp6zIbepWALu8TTNQMsNKlDwiNc3JOH3Ks3wZ0wExXMTIaSJ7NHOxYj/
 B9gWEN+g1LreFHDaCzR1xRetO1bIHNGMNhuqChXj8K8vuDoVPP8FAvKzKEy/iyIl
 CRQXLPSV8LjqKL5d5YW3QFvwUSwJwGr3fXCWd1Voo26dL4DOEx0=
 =vHdE
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Lots of scattered fixes: nouveau has a bunch of display fixes for
  blackwell GPUs that should mean we light up monitors properly and fix
  some desktop rendering problems, amdgpu and intel display changes as
  usual.

  There also changes to the core pagemap, then the usual amouny of AI
  inspired validation fixes.

  core:
   - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used

  dma-buf:
   - Publish the dma-buf only after copy_to_user succeeds
   - fix some kernel-doc warnings

  atomic-state-helpers:
   - set pixel_blend_mode to prop default on reset

  sysfb:
   - Fix integer overflow
   - fix constant comparison bug

  pagemap:
   - Prevent double migration of device pages
   - Reset migration page count on eviction retry
   - dma-unmap pages before handling migration errors
   - use after free fixes

  prime:
   - fix prime exports tracing

  amdgpu:
   - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit
     userspace
   - plane blend mode fixes
   - SR-IOV fix
   - GFX8 fix
   - MES queue reset fix
   - GPUVM fixes
   - DCN 6 warning fix
   - DCN 3.5/3.6 fix
   - DML fix
   - Backlight fix
   - Colorop fix
   - DC get_estimated_bw() fix
   - devcoredump fix
   - Userq fixes
   - APU PSP fix
   - Cursor fix

  amdkfd:
   - MES queue eviction fix
   - MQD debugfs fix

  xe:
   - oa uapi error handling fix
   - drm info message to report FLAT_CSS base misalignment

  i915:
   - Drop an accidentally duplicated panel fitter call in DP MST
   - Fix DDI clock programming for Cx0 and LT PHY
   - Fix PTL CDCLK handling at probe, causing a glitch
   - Fix dg2_power_well_count() return type
   - Fix a NULL pointer deref at forced probe
   - Fix selective fetch disable

  amdxdna:
   - out-of-bounds access fix
   - reject commands chains with no commands
   - handle chained mapping BO failures
   - refuse to flush an imported BO

  ethosu:
   - handle mmio mapping failures
   - handle storage modes only on hardware that supports it
   - fix job completion fence cleanup

  fastrpc:
   - Publish the dma-buf only after copy_to_user succeeds

  gud:
   - Improve TV modes and rotation handling

  nouveau:
   - use-after-free fixes
   - add missing scanline position support
   - HDMI and DP fixes
   - null pointer dereference fix
   - dmem accounting fixes for large folios
   - use write-combined maps for coherent

  qaic:
   - out-of-bounds access fix

  tegra:
   - Add blend mode properties

  virtio:
   - exit path and error handling fixes

* tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel: (83 commits)
  drm/xe/vram: report FLAT_CCS base misalignment
  MAINTAINERS, mailmap: use Aditya Garg's linux.dev account
  drm/amd/display: use plane color_mgmt_changed to track colorop changes
  drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile
  drm/amd/display: Fix cursor disable with horizontally split planes
  drm/amdgpu/userq: dont overwrite the error of subsequent map call
  drm/amdgpu: Skip accessing psp rum time db for APUs
  drm/amdgpu: update the fw version for gfx12 userqueues
  drm/amdgpu: update the fw version for gfx11 userqueues
  drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump
  drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
  drm/amd/display: fix division by zero in get_estimated_bw()
  drm/amd/display: use halving distribution for all encode-to-linear curves
  drm/amd/display: Fix backlight control for luminance-capable OLED
  drm/amd/display: Remove const Qualifier From Non-Pointer Fields
  drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
  drm/amd/display: Fix DCN5/6 DML2 compilation warnings
  drm/amdgpu: fix Idle BOs list in VM debugfs status info
  drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
  drm/amdgpu: Update queue reset support version
  ...
 2026-09-04 13:42:16 -07:00
Linus Torvalds
3f17a52d47 arm64 fixes for -rc2 
- Disable interrupts during page-table walk in show_pte()
 
 - Fix kexec_file_load() with 52-bit capable kernels on machines without
   52-bit addressing
 
 - Fix MIDR matching in CPU errata handling for KVM guests
 
 - Avoid reading MTE-specific ID registers when MTE support is disabled
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmqayVUQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNIG6B/47THEr7Wqq00c1s7loGtwGJiN8dMcfSMpp
 r86zeLL37erJQ9K/OeaUFR0bQEgfh7gXSqXXJ8N1wqAObrAfzek7X0lxxXMkVz4p
 tpNPFgEgP9jwvtYbKH2W9apmP8xxT7MJHF/FnLQVkdVdJBBU+nmrpYcEz37e7O6a
 PmSdl4grWL6AG/CifSCnGvyVFsWVzLeaDgJSAXQWgalefZJzar8dki6W7HfZULo0
 I9uizj52+lG2tVpIz6MUcy9k1cwOyTDl061qrD4/oD6aC67U6aS3tRPmwX3qKF7a
 rvuwEBwRckmKoK1bxzd3wjzkEH/Urhom1Op8SwJ72s1ex6m5EUJ4
 =QWAE
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
 "Nothing Earth-shattering, but worthwhile fixes nonetheless:

   - Disable interrupts during page-table walk in show_pte()

   - Fix kexec_file_load() with 52-bit capable kernels on machines
     without 52-bit addressing

   - Fix MIDR matching in CPU errata handling for KVM guests

   - Avoid reading MTE-specific ID registers when MTE support is
     disabled"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Don't read GMID_EL1 when MTE is disabled
  arm64: errata: pass REVIDR when matching target implementation CPUs
  arm64: trans_pgd: clone only the linear map that exists at runtime
  arm64: mm: Fix the lockless page-table walk in show_pte()
 2026-09-04 13:32:46 -07:00
Linus Torvalds
408802f1e6 A small fixup for the new nearfull_sync mount option, a potential 
use-after-free fix (marked for stable) and a patch that eliminates
 the last use of PageWriteback macro in the tree.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmqa/nETHGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi7qLB/4gfbxdP5lystLHoDbwSo+ceM15Apl+
 THXVTBGspHNe5w07/fk1NfSk8KccqN66cCh9W23JMZt2PQr+n5/0Azp+ZkcL+koO
 CNNhvachvs+E3J5cRNHvvP3PCQurOO0tCO4vGGHRt6j3VTrWdwKkgVHGHu2hZ49q
 GLkm82eUKYkZdV80FV31q1ZdXHQBCAuxkBgRQNbqlc9yj3OA6UoxLsAaB3uxvmKq
 sifdvIyWFt/+SdntzoM6Dt4vo6P0/RiQJdIXKLj+fxHFiJEeX0IJaTpZvA7FOHOt
 DyRMhb3lTzQBDjZydNQO15XcjfifskuqeQxxSQmISv7lASiUkq5Tn+uj
 =p61q
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A small fixup for the new nearfull_sync mount option, a potential
  use-after-free fix (marked for stable) and a patch that eliminates
  the last use of PageWriteback macro in the tree"

* tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client:
  ceph: apply nearfull_sync option on remount
  libceph: remove pinning assertion in ceph_msg_data_iter_next()
  ceph: lock mutex in ceph_mds_check_access()
 2026-09-04 13:27:58 -07:00
Steven Rostedt
d80e12156f ring-buffer: Use a macro for static buffer bits 
Instead of hard coding 30 for the number of bits used for the static
buffer ids in two places, create a macro. This way if it changes in the
future, it will change in all the locations that use it.

Link: https://patch.msgid.link/20260904151641.17eae0aa@gandalf.local.home
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
 2026-09-04 16:20:23 -04:00
Steven Rostedt
5cbea50077 tracing: Fix comment in tracing_buffers_splice_read() 
The comment about returning an error if the read fails on the first
iteration is slightly incorrect. It makes it sound like the only reason it
could fail on a later iteration is if the subbuf order changed. That is
incorrect, it could also fail if the length passed in was not a multiple
of the subbuf size. Fix the comment.

Link: https://lore.kernel.org/all/20260904143527.40e73d36@gandalf.local.home/
Link: https://patch.msgid.link/20260904144902.506862a1@gandalf.local.home
Fixes: dae8dda341 ("tracing: Fix subbuf resize races with trace_pipe_raw readers")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
 2026-09-04 16:19:29 -04:00
Vincent Donnefort
c843fd3c73 ring-buffer: Prevent truncation of nr_pages / nr_subbufs 
Although ring_buffer_per_cpu::nr_pages is defined as unsigned long, it
is capped to 32-bits in a few places, limiting the operations possible
on a very large buffer. Use `unsigned long` where appropriate and
prevent truncation of values using nr_pages (or nr_subbufs).

While at it, subbuf_size must be at least `unsigned int`.

Note that persistent, remote and user-mapped ring buffers are capping
the number of pages to 30 bits already, making "int" safe in many
places.

Link: https://patch.msgid.link/20260904164450.1345852-5-vdonnefort@google.com
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
 2026-09-04 16:19:15 -04:00
Vincent Donnefort
f2b2b64559 ring-buffer: Cap static ring buffer nr_pages 
Static ring buffers (i.e. persistent, user-mapped and remote) rely on
the bpage::id field. The number of pages for those ring buffers must fit
into that variable. Enforce this limit on ring buffer creation or
user-mapping.

While at it, prevent nr_pages underflow when allocating a persistent
buffer.

Link: https://patch.msgid.link/20260904164450.1345852-4-vdonnefort@google.com
Fixes: be68d63a13 ("ring-buffer: Add ring_buffer_alloc_range()")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
 2026-09-04 16:19:14 -04:00
Vincent Donnefort
dae8dda341 tracing: Fix subbuf resize races with trace_pipe_raw readers 
Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
uninitialized memory to userspace due to stale size values.

Modify ring_buffer_alloc_read_page() to handle the resizing of an
existing buffer_data_read_page if necessary and add a new
ring_buffer_read_page_size(). This new function enables ring-buffer
buffer_data_read_page users to not call the racy
ring_buffer_subbuf_size_get(). This makes the spare_size member of
ftrace_buffer_info redundant.

Finally, handle buffer_data_read_page/reader_page order discrepancy in
ring_buffer_read_page(). On a mismatch simply copy manually the data to
the buffer_data_read_page.

Link: https://lore.kernel.org/all/20260817140812.2C7D41F00A3A@smtp.kernel.org/
Link: https://patch.msgid.link/20260904164450.1345852-3-vdonnefort@google.com
Fixes: bce761d757 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
 2026-09-04 16:19:07 -04:00