mirror of
https://github.com/torvalds/linux.git
synced 2026-10-08 19:46:02 +02:00
53472eb262
1463854 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Ye Liu
|
53472eb262 |
mm/page_owner: extract skip_buddy_pages() helper to unify buddy page skipping
Patch series "mm/page_owner: misc cleanups", v6. This series collects a few cleanups for mm/page_owner.c that have been accumulated while reading through the file. There is no functional change -- the goal is to make the code easier to read and maintain. Patch 1 consolidates three identical PageBuddy skip blocks into a single skip_buddy_pages() helper, eliminating the duplication and keeping the lockless-read comment in one place. Patch 2 replaces the -1 magic number used for "never migrated" with a proper MR_NEVER member in enum migrate_reason, adds the corresponding "never_migrated" string in the MIGRATE_REASON trace macro, and updates the GDB page_owner script to use MR_NEVER so that lx-dump-page-owner correctly detects unmigrated pages. Patch 3 follows up by converting the remaining 'int reason' parameters throughout the migration and hugetlb callchains to 'enum migrate_reason', making the type explicit and gaining compiler checking. The 'short last_migrate_reason' struct field in page_owner is intentionally left as 'short' since it is per-page metadata where size matters. Patch 4 hoists the CONFIG_MEMCG guard out of print_page_owner_memcg()'s body so that the real implementation and the empty stub are two clearly separate definitions, the common kernel idiom. Patch 5 adds a missing \n to the count_threshold debugfs attribute format string so that cat(1) output is properly terminated. Patch 6 moves free_ts_nsec from the allocation summary line to the free section in __dump_page_owner(), grouping it with free_pid and free_tgid where it logically belongs. This also makes the dump output consistent with print_page_owner(). Patch 7 drops the redundant page_owner_ prefix from file-scoped static symbols (stack_fops, threshold_fops, etc.). Since they cannot collide across translation units, the prefix carries no information. Patch 8 clamps the PFN advance in skip_buddy_pages() at the next MAX_ORDER_NR_PAGES boundary. The lockless buddy_order_unsafe() read can return a garbage order value if the page is concurrently allocated between the PageBuddy check and the private read, potentially causing the PFN to advance past the next bounadry whose pfn_valid() check would have caught an offline memory section. In read_page_owner(), which relies solely on boundary-aligned pfn_valid() to guard pfn_to_page(), this could lead to an unmapped mem_section access. Patch 9 avoids two TOCTOU issues in print_page_owner_memcg() by reusing the page->memcg_data snapshot already taken via READ_ONCE at the top of the function throughout, instead of calling page_memcg_check() and PageMemcgKmem() which re-read page->memcg_data locklessly with VM_BUG_ON assertions. If the page is concurrently freed and reallocated as a THP tail or slab page between the initial guards and these later calls, those assertions can fire on CONFIG_DEBUG_VM=y builds. The OBJEXTS (slab) case is also simplified with an early return since objcg != memcg for slabs. This patch (of 6): Three places in page_owner.c duplicate the same pattern: check if a page is PageBuddy, read its order via buddy_order_unsafe(), advance the pfn past the buddy block if the order is valid, and continue. Consolidate them into a single inline helper skip_buddy_pages(). The function returns true (skip) for any buddy page and advances @pfn past the block when the order is valid; returns false if the page is not a buddy page and should be processed normally. The old init_pages_in_zone() variant used "order > 0" as an extra guard before advancing pfn, but the continue was unconditional and (1UL << 0) - 1 == 0, so the behaviour is identical. The comment about zone->lock is preserved in the helper's kernel-doc. No functional change. Link: https://lore.kernel.org/20260714015117.78351-1-ye.liu@linux.dev Link: https://lore.kernel.org/20260714015117.78351-2-ye.liu@linux.dev Signed-off-by: Ye Liu <ye.liu@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Brendan Jackman <jackmanb@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Breno Leitao
|
cdf95d6b33 |
mm/kmemleak: stop the per-cpu and struct page scans early too
The per-cpu and struct page scan loops have no reschedule-stop check of their own: once a scan is interrupted they keep calling scan_block() for every remaining block, which scans nothing useful. Propagate scan_block()'s interrupted status through scan_large_block() and break both loops as soon as it is set. Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-3-acecd7d7fd92@debian.org Signed-off-by: Breno Leitao <leitao@debian.org> Suggested-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Lance Yang <lance.yang@linux.dev> Cc: Qian Cai <cai@lca.pw> Cc: SeongJae Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Breno Leitao
|
eb11f56eec |
mm/kmemleak: stop the task stack scan early when interrupted
scan_block() already checks scan_should_stop() for every pointer and bails out of the current block, but the task stack walk cannot tell and keeps issuing a separate scan_should_stop() between every task. Return that status from scan_block() and use it as the task stack loop condition, so the walk stops as soon as a scan is interrupted. Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-2-acecd7d7fd92@debian.org Signed-off-by: Breno Leitao <leitao@debian.org> Suggested-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Lance Yang <lance.yang@linux.dev> Cc: Qian Cai <cai@lca.pw> Cc: SeongJae Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Breno Leitao
|
5d10d4e19e |
mm/kmemleak: avoid soft lockup when scanning task stacks
Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3.
kmemleak_scan() scans every task stack under one rcu_read_lock() with no
reschedule point, which can trip the soft lockup watchdog on hosts with
very many threads.
That prints the following message, depending on the workload+host
configuration:
watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]
scan_block
kmemleak_scan
kmemleak_scan_thread
kthread
Patch 1 walks the tasks with find_ge_pid() so the scan reschedules between
tasks
Patches 2-3 let the scan loops stop early once a scan is interrupted.
This patch (of 3):
kmemleak_scan() walks every thread and scans its kernel stack under a
single rcu_read_lock() with no reschedule point. On a host with very many
threads -- amplified by KASAN/lockdep in debug builds -- this loop can hog
a CPU long enough to trip the soft lockup watchdog:
watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]
scan_block
kmemleak_scan
kmemleak_scan_thread
kthread
A cond_resched() cannot be added directly: the loop runs inside an RCU
read-side critical section.
Walk the tasks one PID at a time with find_ge_pid(), taking the RCU read
lock only to look up and pin each task. The stack is then scanned with no
lock held, so cond_resched() runs between tasks and the scan stops early
on scan_should_stop(). This follows the next_tgid()/task_seq_get_next()
iteration pattern and keeps each RCU critical section short.
Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-0-acecd7d7fd92@debian.org
Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-1-acecd7d7fd92@debian.org
Fixes:
|
||
|
Ethan Nelson-Moore
|
aa38f2454b |
mm: hugetlb: correct CONFIG_CGROUP_HUGETLB macro name in comment
A comment in <linux/hugetlb_cgroup.h> incorrectly refers to CONFIG_MEM_RES_CTLR_HUGETLB, which has never existed in the kernel, instead of CONFIG_CGROUP_HUGETLB. Correct it. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Link: https://lore.kernel.org/20260616000135.62815-1-enelsonmoore@gmail.com Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Cc: Anthony Yznaga <anthony.yznaga@oracle.com> Cc: Muchun Song <muchun.song@linux.dev> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Markus Elfring
|
24e9b62985 |
mm/vmalloc: use more common error handling code in pcpu_get_vm_areas()
Use an existing label once more so that a bit of exception handling can be better reused at the end of this function implementation. This issue was detected by using the Coccinelle software. Link: https://lore.kernel.org/453375c4-c3ca-4e6f-8880-0e6ff3c74ee3@web.de Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Daniel Axtens <dja@axtens.net> Cc: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Sang-Heon Jeon
|
73e28dccd0 |
arch_numa: remove redundant nodemask clears in numa_init()
numa_init() clears numa_nodes_parsed, node_possible_map and
node_online_map, then calls numa_memblks_init(), which clears the same
nodemasks. Nothing uses them in between.
These clears have been redundant since commit
|
||
|
Andrew Morton
|
d623ed9ba0 |
csky: implement flush_cache_vmap() in C
To avoid getting an unused-var warning from unsigned long start = something; ... flush_cache_vmap(start, ...); Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606291606.9h8aGniQ-lkp@intel.com/ Reviewed-by: Guo Ren <guoren@kernel.org> Reviewed-by: Barry Song <baohua@kernel.org> Cc: Andrew Donnellan <ajd@linux.ibm.com> Cc: Anshuman Khandual <anshuman.khandual@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Leo Yan <leo.yan@arm.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Uladzislau Rezki <urezki@gmail.com> Cc: Wen Jiang <jiangwen6@xiaomi.com> Cc: Wen Jiang <jiangwenxiaomi@gmail.com> Cc: Will Deacon <will@kernel.org> Cc: Xueyuan Chen <xueyuan.chen21@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Ben Dooks
|
cdea9364e4 |
mm/page_alloc: don't build vm_numa_stat_key if CONFIG_NUMA=n
vm_numa_stat_key is only exported if CONFIG_NUMA is set, so avoid the following warning by guarding it in an #ifdef on CONFIG_NUMA: mm/page_alloc.c:165:1: warning: symbol 'vm_numa_stat_key' was not declared. Should it be static? Link: https://lore.kernel.org/20260618100614.1321950-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: SeongJae Park <sj@kernel.org> Cc: Brendan Jackman <jackmanb@google.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Kefeng Wang
|
a35d8872da |
mm: remove PageTransCompound()
Remove the last user of PageTransCompound() in ksm and get rid of PageTransCompound(). Link: https://lore.kernel.org/20260618113523.3913307-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Xu Xin <xu.xin16@zte.com.cn> Tested-by: Xu Xin <xu.xin16@zte.com.cn> Acked-by: Zi Yan <ziy@nvidia.com> Reviewed-by: SeongJae Park <sj@kernel.org> Cc: Chengming Zhou <chengming.zhou@linux.dev> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Kaitao Cheng
|
8725ae13f0 |
mm/percpu: avoid IO/FS reclaim in backing allocations
Commit |
||
|
Kaitao Cheng
|
17fcdd8699 |
mm/percpu: make cached pages lookup explicit
pcpu_depopulate_chunk() only needs the temporary pages array that was already allocated by an earlier successful population attempt. Passing GFP_KERNEL to pcpu_get_pages() in this path is misleading because the depopulation path is not expected to allocate the array. Teach pcpu_get_pages() to treat a zero gfp mask as a cached-only lookup and add pcpu_get_pages_cached() for that use case. This keeps allocation on the populate path tied to the caller supplied GFP mask while making the depopulate path's dependency on the cached array explicit. Link: https://lore.kernel.org/20260618130414.96383-4-kaitao.cheng@linux.dev Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Suggested-by: Dennis Zhou <dennis@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Christoph Lameter <cl@gentwo.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Shivam Kalra <shivamkalra98@zohomail.in> Cc: Tejun Heo <tj@kernel.org> Cc: Uladzislau Rezki (Sony) <urezki@gmail.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Kaitao Cheng
|
881adc51b2 |
mm/percpu: honor GFP constraints when populating chunks
pcpu_alloc_noprof() derives pcpu_gfp from the caller supplied GFP mask and passes it down to pcpu_populate_chunk(). pcpu_alloc_pages() already uses that mask for backing page allocation. However, the populate slow path still has internal allocations and page table allocations which can lose the caller's allocation context. The temporary pages array is allocated by pcpu_get_pages() with GFP_KERNEL, and pcpu_map_pages() maps the backing pages through vmap_pages_range_noflush() using GFP_KERNEL. The latter can allocate vmalloc page tables implicitly, so a caller which deliberately uses GFP_NOFS or GFP_NOIO can still enter FS or IO reclaim while populating a percpu chunk. This has the same concern as chunk creation: callers such as blk-cgroup may use GFP_NOIO because they hold locks which can be involved in queue freeze or IO reclaim dependencies. If an allocation reaches the percpu slow path and needs to populate previously unbacked pages, the internal GFP_KERNEL allocations can defeat that context. One possible case is blk-cgroup after commit |
||
|
Kaitao Cheng
|
dec068de6d |
mm/vmalloc: honor GFP constraints in pcpu_get_vm_areas()
Patch series "mm/percpu: Fix possible NOFS/NOIO reclaim recursion", v4. Commit |
||
|
Thomas Huth
|
5339ec29f9 |
mm: replace __ASSEMBLY__ with __ASSEMBLER__ in memory management header files
While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is a completely mechanical patch (done with a simple "sed -i" statement). Link: https://lore.kernel.org/20260619131830.229804-1-thuth@redhat.com Signed-off-by: Thomas Huth <thuth@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Barry Song <baohua@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Kairui Song <kasong@tencent.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Chi Zhiling
|
32cd1afeca |
mm/filemap: reduce unnecessary xarray lookups in filemap_get_folios_contig()
Apply the same optimization used in filemap_get_read_batch() by moving the boundary check from the loop condition to before xas_next(), avoiding an unnecessary xarray lookup and reducing branches in the fast path. Link: https://lore.kernel.org/20260620062446.351475-3-chizhiling@163.com Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Chi Zhiling
|
e1c345582c |
mm/filemap: reduce unnecessary xarray lookups when read cached pages
Patch series "mm/filemap: reduce unnecessary xarray lookups". This series optimizes xarray lookups in filemap by avoiding redundant iterations after obtaining the last needed folio. The boundary check is moved to before advancing the xarray iterator, eliminating unnecessary lookups and branches in the fast path. This reduces the overhead of filemap_get_read_batch() from 2.91% to 2.53% in 4k read tests. This patch (of 2): When reading small amounts of data from the page cache, only a single folio is typically returned from filemap_read_get_batch(). In this case, calling xas_advance() or xas_next() after adding the folio to the batch is unnecessary and only introduces extra branches. The same issue exists for large reads, where one additional xarray walk is always performed before termination. Quit the loop once we get the last folio in the range, so the final redundant xarray advancement can be avoided. The xas_next() does not update xa_index when xas->xa_node is set to XAS_RESTART, so the put and retry path would not update xa_index, hence the warning should therefore never trigger. During the 4k reads test, the overhead of this function dropped from 2.91% to 2.53%. Link: https://lore.kernel.org/20260620062446.351475-2-chizhiling@163.com Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn> Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Chi Zhiling <chizhiling@kylinos.cn> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
JP Kobryn
|
094470f3f4 |
mm/lruvec: trace LRU add drains and drain-all requests
LRU add batches can be drained before they reach capacity. This can be a source of LRU lock contention, but it is not currently possible to attribute these drains to callers with existing tracepoints. Add mm_lru_add_drain to report the CPU and lru_add batch count when an lru_add batch is drained. This allows tracing to distinguish full drains from partial drains and attribute them to the calling stack. Add mm_lru_add_drain_all to capture callers of __lru_add_drain_all and whether they set the force flag for all CPUs. The tracepoint resembles the signature of the enclosing function, but is needed because of potential inlining. Note that DECLARE_TRACE() is used for these new trace hooks to avoid creating a new trace event ABI. Link: https://lore.kernel.org/20260622185127.24579-1-jp.kobryn@linux.dev Signed-off-by: JP Kobryn <jp.kobryn@linux.dev> Reviewed-by: Barry Song <baohua@kernel.org> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Baoquan He <baoquan.he@linux.dev> Cc: Chris Li <chrisl@kernel.org> Cc: Kairui Song <kasong@tencent.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Nhat Pham <nphamcs@gmail.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Guopeng Zhang
|
4ac732c370 |
mm: memcg: remove stray text from obj_stock_pcp comment
A patch filename was accidentally inserted into the comment describing the nr_bytes field of struct obj_stock_pcp. Remove it. No functional change. Link: https://lore.kernel.org/20260623082614.81621-1-guopeng.zhang@linux.dev Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn> Acked-by: Harry Yoo (Oracle) <harry@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Igor Putko
|
253ed912fe |
mm/memory-failure: remove redundant initialization for hw_memory_failure
The static variable 'hw_memory_failure' is implicitly initialized to false. Remove the explicit initialization to follow the Linux kernel coding style. Link: https://lore.kernel.org/20260623114743.4565-3-igorpetindev@gmail.com Signed-off-by: Igor Putko <igorpetindev@gmail.com> Reviewed-by: SeongJae Park <sj@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Acked-by: Miaohe Lin <linmiaohe@huawei.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Igor Putko
|
731a624641 |
mm/kasan: remove redundant initialization for kasan_flag_write_only
Patch series "mm: remove redundant static variable initializations". This series removes explicit initializations of static bool variables to false within the mm/ subsystem. In C, static variables without explicit initialization are implicitly placed in the .bss section and initialized to zero/false by default. Removing these explicit initializations follows the Linux kernel coding style and avoids cluttering the data section. This patch (of 2): The static variable 'kasan_flag_write_only' is implicitly initialized to false. Remove the explicit initialization to follow the Linux kernel coding style. Link: https://lore.kernel.org/20260623114743.4565-1-igorpetindev@gmail.com Link: https://lore.kernel.org/20260623114743.4565-2-igorpetindev@gmail.com Signed-off-by: Igor Putko <igorpetindev@gmail.com> Reviewed-by: SeongJae Park <sj@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Miaohe Lin <linmiaohe@huawei.com> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Dev Jain
|
8a28b50d6f |
mm/mprotect: drop 'sub' from batching context
Shorten the name of page_anon_exclusive_sub_batch by dropping the "sub-batch" context - the function itself doesn't need this context. Similarly, drop "sub" from sub_batch_idx, it is unnecessary and the usage is clear enough. Link: https://lore.kernel.org/20260623125723.2503832-3-dev.jain@arm.com Signed-off-by: Dev Jain <dev.jain@arm.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Barry Song <baohua@kernel.org> Cc: Anshuman Khandual <anshuman.khandual@arm.com> Cc: Baoquan He <baoquan.he@linux.dev> Cc: Chris Li <chrisl@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Kairui Song <kasong@tencent.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Nhat Pham <nphamcs@gmail.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Dev Jain
|
3ade884239 |
mm/swap: rename subpage->page in folio_dup_swap/folio_put_swap
Patch series "mm: drop "sub" prefix from various places". Patch 1 converts subpage->page : folios have pages, not subpages. Patch 2 drops "sub" from a function and a variable because the context is clear enough. This patch (of 2): Folios have pages, not subpages. Rename 'subpage' parameters to 'page'. Link: https://lore.kernel.org/20260623125723.2503832-1-dev.jain@arm.com Link: https://lore.kernel.org/20260623125723.2503832-2-dev.jain@arm.com Signed-off-by: Dev Jain <dev.jain@arm.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Acked-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Nhat Pham <nphamcs@gmail.com> Reviewed-by: Kairui Song <kasong@tencent.com> Reviewed-by: Barry Song <baohua@kernel.org> Cc: Anshuman Khandual <anshuman.khandual@arm.com> Cc: Baoquan He <baoquan.he@linux.dev> Cc: Chris Li <chrisl@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Zenghui Yu
|
7698d52e33 |
tools/mm: add thp_swap_allocator_test binary to .gitignore
Tell git to ignore the generated binary for thp_swap_allocator_test.c. Link: https://lore.kernel.org/20260624150642.19749-1-zenghui.yu@linux.dev Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Reviewed-by: SeongJae Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Joshua Hahn
|
ac0f3be693 |
mm/memcontrol: remove unused for_each_mem_cgroup macro and cleanup
Commit |
||
|
Linus Torvalds
|
62cc902415 |
13 hotfixes. All are cc:stable. 11 are for MM. All are singletons -
please see the changelogs for details. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCamfLHAAKCRDdBJ7gKXxA jrrMAQDQHf+VGi/lZaxtgfLv0OThODhzzckRI2dcTGG66YX/DQD/V4aTndWFUUpM j1aSODTTWeKi3Ija4E3dA7SIaZkqSAI= =s/6H -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "13 hotfixes. All are cc:stable. 11 are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes mm/hugetlb: fix list corruption in allocate_file_region_entries() mm: mglru: fix stale batch updates after memcg reparenting selftest: fix headers in fclog.c ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() mm/util: don't read __page_2 for order-1 folios in snapshot_page() mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes userfaultfd: wait on source PMD during UFFDIO_MOVE lib: test_hmm: use device devt for coherent device range selection mm/vmstat: fold stranded per-cpu node stats when a node comes online |
||
|
Linus Torvalds
|
aa6fc3defb |
Hi
This pull request contains bug fixes discussed in [1] and two fixes (in one commit) from Fabrice for DCP trusted keys backend.. BR, Jarkko [1] https://lore.kernel.org/keyrings/amINZJVhEBwxEixP@kernel.org/ -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCamem9QAKCRAaerohdGur 0nA1AQD4TMj2MpvOW4XREPB05JXeiYFkeDHKZ07o6tvPsTnuTgEA6pjY/Q5MqjLh gAUHzv5mjA4TvrERvDXC+6oh+wiWrwc= =bpHR -----END PGP SIGNATURE----- Merge tag 'for-next-keys-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull keys fixes from Jarkko Sakkinen: - An unprivileged keyring whose keys collide through the description-chunk path can drive assoc_array node splitting into an out-of-bounds slot write. Fix it. - Fix the DCP trusted keys backend * tag 'for-next-keys-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: assoc_array: trim the final shortcut word using the current chunk end keys: make keyring key-chunk byte order agree with keyring_diff_objects() keys: fix out-of-bounds read in keyring_get_key_chunk() KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type |
||
|
Linus Torvalds
|
e895a6fc20 |
Changes since the last update:
- Keep a valid f_path for page cache sharing to fix a recent mincore()
NULL pointer dereference
- Limit LZMA stream pool size when too many processors are available
- Sync up with Hongbo Li's latest email address
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmpndxERHHhpYW5nQGtl
cm5lbC5vcmcACgkQUXZn5Zlu5qpMkw/+JjAgjf9G5boFLgBiZGpBXSaZiBoCQcl2
0AAR0S7c2J1Egqf6WMEF+9pe/+vsV/jlGrJ5wU4fLtXozUa/bEVZStrEAj5Qzk3n
0EHBuXA/pqzthHLlfHdAbhNuD6+JAxKfz1tEr7Fgdcn6agIsAyCvLwDse3BRzzAN
50mYVm/txLyoRlw5cTI5WwIPouufRId1PXT3eMacsJ8rZHqUn3pFwUuHeUClgzUi
e1zlaVDppHjeDFVMqTav2/3Tv0ASClzhDKpLD7e1oHBOJ08S9c/9ofKZbvW1xlcU
aEhQXawXT0zAlqYYn/NWEXn7sAJFHqmyl94c/1w5BfAVErPHmGwlXgmegQqipnpJ
B6gFSyaggbZx9iEeFH27wwW/UHefCwx0anfNMpjZheHbrDd+7SnLEINnDQVyD+n7
oC7UQ41k6rYRqfHb1zBHzf8l5OCc4f8d9YYLjn5hSveMWtmFhK075gY1AdYvfNMi
ojb2WRVIMkyIxEJvqNsV149q+dEAXJFtTAGZCm7Jps9cYJ1qnOCsfL8MK81cOn8K
h1SRvLTEGLZyE/KBpEVpn115DqbTcA5eaLlTMGcfqjfBN7S+LeSv3fVMIYN8IR4j
kZcoQZJdSGPdYvUmS0RDYXtV1wQTfgoTBRTsIYhvwYVTInKImP8lVyeqvPUYea+l
ohs2lJ0CQkw=
=XDWu
-----END PGP SIGNATURE-----
Merge tag 'erofs-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs fixes from Gao Xiang:
"Fix a regression in page cache sharing which can cause a NULL pointer
dereference, and limit LZMA stream memory usage on systems with many
CPUs.
- Keep a valid f_path for page cache sharing to fix a recent
mincore() NULL pointer dereference
- Limit LZMA stream pool size when too many processors are available
- Sync up with Hongbo Li's latest email address"
* tag 'erofs-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: cap LZMA stream pool size
erofs: ensure valid f_path for page cache sharing
MAINTAINERS: update Hongbo Li's email address
|
||
|
Linus Torvalds
|
e63c75f72f |
Pin control fixes for the v7.2 series:
- Wakeup nits on the Qualcomm SC8280XP.
- Double-free issues on the device tree parsing error path.
- Fixup of the S4 sleep state handling on AMD pin control.
- Missing Kconfig select REGMAP_MMIO for the Microchip
driver leading to compile stalls.
- Missing Kconfig select GENERIC_PINCONF for the Bitmain
BM1880 leading to compile stalls.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmpnIncACgkQQRCzN7AZ
XXPYww/6A9lTia3eOzmtjGCJZpKtIjQQ1S6E9/Fm8zSkWJGEDykcPRu2TE4cj12L
6ciGxdfUOhcRS+Trjezz9QntwF1QXQCFx+BuDHMUOVqHOSwmzsX2qCEr1w056nk5
6DcMDvF11/k9axkZfSI9SQtUacI0eCRXVGJ3y1TVkgm6KS3fhrzDl0dUmlhSbj5H
bzNWyzJT9CdNAZEXily3phfKbPB8C+j7cy7MHX/T7QVt/GMGYR9VxZUkrqBknQXc
Bnv+TkNrmrOcOlFgEVJ1iwjXi19yvf+E/9xSTgSO/K7piTLNjPJebV0g4OOc3iNF
Lu6DxMVkj3To+LoknmatSK0Dnns97qngZalxmKwo0ptzccXNuae6rgsAAeHQLGvZ
iZ33xYOkWj2deMPH5H2su1YPxIN6YwOdT9dmvO52nZ4mG5khqp23idgyzLK/VCo/
yglJ158QTFa1oH9Vk8qvNTG5c4gQsoLIj1e8vGHUdZtswTDoJrYu3qTo9OkX98yc
97hxits+kw31ZH65w9bXfneHV1hc53BqTr8FKqkjHTQV8NPBe5rVehitRWYoTGn0
wfhkgOcvtYzGRII6QbBqMm4BW+0GnIddXFp8EUEm+tDF9Uh9sviJigjvLYjPt2VA
QalF6hDrSwZE/IQLccG1YaxdQxq+ddUaIEMn++vP1uFOly56pys=
=GI5s
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
"The most interesting commit is the S4 fix for AMD, which probably is
helpful to a whole bunch of important machines.
- Wakeup nits on the Qualcomm SC8280XP
- Double-free issues on the device tree parsing error path
- Fixup of the S4 sleep state handling on AMD pin control
- Missing Kconfig select REGMAP_MMIO for the Microchip driver leading
to compile stalls
- Missing Kconfig select GENERIC_PINCONF for the Bitmain BM1880
leading to compile stalls"
* tag 'pinctrl-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: bm1880: add missing select GENERIC_PINCONF
pinctrl-amd: Don't clear S4 wake bits at probe
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
pinctrl: devicetree: don't free uninitialized dev_name on error path
pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
pinctrl: qcom: Unconditionally mark gpio as wakeup enable
|
||
|
Michael Bommarito
|
c9b47e6b23 |
erofs: cap LZMA stream pool size
fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() when the lzma_streams module parameter is
unset, then z_erofs_load_lzma_config() preallocates one image-supplied
dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU
systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed
decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of
vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the
worst-case default preallocation is 128 MiB if the number of CPUs is no
less than 16 while preserving the existing per-image dictionary limit.
An explicit lzma_streams module parameter is still honoured as-is, so
administrators who deliberately size the pool are not affected.
Fixes:
|
||
|
Gao Xiang
|
96b2dbbe58 |
erofs: ensure valid f_path for page cache sharing
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid). It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__do_sys_mincore+0xc0/0x2c0
...
Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.
Fixes:
|
||
|
Linus Torvalds
|
f5098b6bae | Linux 7.2-rc5 | ||
|
Linus Torvalds
|
4235cb24ec |
vfs-7.2-rc5.fixes
Please consider pulling these changes from the signed vfs-7.2-rc5.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCamYljAAKCRCRxhvAZXjc
ogWyAPwORZDIIsRiAQbnPs+OkYszuWCY29OeUrTf+m3z+tBTLwD+NUFtpH5XIcYJ
3jHtGXPoHjEaOVsNyIdxwnOxWfo+6ws=
=VNq0
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().
ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
cache, and as fuse doesn't invalidate the cache for such servers a
properly timed get_acl() returned stale ACLs. Comes with a fuse
selftest reproducing this.
- pidfs:
- Preserve PIDFD_THREAD when a thread pidfd is reopened via
open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
do_dentry_open() strips after the flags have been validated, so
the reopened pidfd silently became a process pidfd. Comes with a
selftest.
- Add a pidfs_dentry_open() helper so the regular pidfd allocation
path and the file handle path share the code that forces O_RDWR
and reapplies the pidfd flags that do_dentry_open() strips.
- Handle FS_IOC32_GETVERSION in the compat ioctl path.
- Make pidfs_ino_lock static.
- iomap:
- Fix the block range calculation in ifs_clear_range_dirty() so a
partial clear doesn't drop the dirty state of blocks the range
only partially covers.
- Support invalidating partial folios so a partial truncate or hole
punch with blocksize < foliosize doesn't leave stale dirty bits
behind.
- Only set did_zero when iomap_zero_iter() actually zeroed
something.
- Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
zero-length ranges where the unsigned last-block calculation
underflows and bitmap_set() writes far beyond the ifs->state
allocation.
- Don't merge ioends with different io_private values as the merge
could leak or corrupt the private data of the individual ioends.
- exec:
- Raise bprm->have_execfd only once the binfmt_misc interpreter has
actually been opened. The flag was set as soon as a matching 'O'
or 'C' entry was found. If the interpreter open failed with
ENOEXEC the exec fell through to the next binary format with
have_execfd raised but no executable staged and begin_new_exec()
NULL derefed past the point of no return.
- Fix an unsigned loop counter wrap in transfer_args_to_stack() on
nommu. An overlong argument or environment string pushes bprm->p
below PAGE_SIZE, the stop index becomes zero, and the loop never
terminates, wrapping its counter and copying garbage from in
front of the page array into the new process stack.
- Make binfmt_elf_fdpic only honour the first PT_INTERP like
binfmt_elf does. Each additional PT_INTERP overwrote the previous
interpreter, leaking the name allocation and the interpreter file
reference together with the write denial open_exec() took,
leaving the file unwritable for as long as the system runs.
- overlayfs:
- Compare the full escaped xattr prefix including the trailing dot.
An xattr like "trusted.overlay.overlayfoo" was misclassified as
an escaped overlay xattr.
- Check read access to the copy_file_range() source with the
source's mounter credentials.
- super: Thawing a filesystem whose block device was frozen with
bdev_freeze() deadlocked. Dropping the last block layer freeze
reference from under s_umount ends up in fs_bdev_thaw() which
reacquires s_umount on the same task. Pin the superblock with an
active reference instead and call bdev_thaw() without holding
s_umount.
- procfs: Return EACCES instead of success when the ptrace access check
for namespace links fails.
- afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().
- Push the memcg gating of ->nr_cached_objects() down into the btrfs
and shmem callbacks instead of skipping every callback during
non-root memcg reclaim. The blanket check short-circuited XFS whose
inode reclaim hook is intentionally driven from per-memcg contexts to
free memcg-charged slab.
- eventpoll: Pin files while checking reverse paths.
Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
could free and recycle the file under the check which then took and
dropped the f_lock of whatever live file now occupies that slot.
* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
super: fix emergency thaw deadlock on frozen block devices
pidfs: make pidfs_ino_lock static
eventpoll: pin files while checking reverse paths
fs: push nr_cached_objects memcg gating into individual filesystems
afs: Fix afs_edit_dir_remove() to get, not find, block 0
iomap: prevent ioend merge when io_private differs
iomap: add comments for ifs_clear/set_range_dirty()
iomap: fix out-of-bounds bitmap_set() with zero-length range
iomap: fix incorrect did_zero setting in iomap_zero_iter()
iomap: support invalidating partial folios
iomap: correct the range of a partial dirty clear
fs/super: fix emergency thaw double-unlock of s_umount
pidfs: handle FS_IOC32_GETVERSION in compat ioctl
ovl: check access to copy_file_range source with src mounter creds
proc: Fix broken error paths for namespace links
pidfs: add pidfs_dentry_open() helper
selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
pidfs: preserve thread pidfds reopened by file handle
ovl: fix trusted xattr escape prefix matching
selftests/fuse: add ACL_DONT_CACHE regression test
...
|
||
|
Linus Torvalds
|
72841e8e83 |
spi: Fixes for v7.2
Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmL3sACgkQJNaLcl1U h9CDnwgAggPOeUHMrQWYES7f74oTVl/kt0B1TBV6g91r8a4p0yyy7Kn6C1njBQ7n N5bgSL2EkpQRjj2d5akh42Apwb5EQZMdqICo68XElWnk0AxH6Y1PdRkfcruU9PnS t7KJEeBxdsZAJhx5ZEWZrIwjY/rbEvI+rfePgdm8kVeUUVs4ur6Zg1DNk/LgolOP xr60E5DWHIczjJ3Ae+svL5mmJ8FICFOThAYjMzGyRACB4c3znMBhzKVoNrUR6sl5 7qSf1x3WBXIYwd0RRs9YhTF6vQhlnfKfu8rPfb2S6v8rE7JmmokLr3kVFzgpph1K o893VMecWe5al0ZuE2qdf44w2Ohv0Q== =2PTr -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding" * tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spacemit: add K3 SPI compatible spi: spacemit: Correct TX FIFO slot calculation |
||
|
Linus Torvalds
|
e6bfeebfe1 |
regulator: Fixes for v7.2
One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmMC4ACgkQJNaLcl1U h9DoiAf/V64CUAFspev+AtzWpx1Su9zZoSzoMM5Gj0WBuMoo4G5hZj804DQ/n8al sai+f0loMEVcblfpZNOlYagSkDgvvIc/1SQrAQ1oIxMbpotE1vn4htzGsJJuwwgL lh5GC4CsrXOSRX3VG6pJeBR6RTb9VEbkAhLoxKAJyPlcynk2KdBPwR9B1ZlCgpe6 MP2WrurEVexvuDlZdE8THYth4FXCms0uH5VLo+Q3G4r1Ayt9YpvbvG91fzJSJGti NAzAWma2GFGwQkka5sgMYHyP6rwM1vJ71mz+Bq9G5fUe6DyEp85jv993D5lq2vbH 69GO6ZTZmruCqOkDEELIKA4EpKYzZA== =3XbV -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints" * tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: clamp voltage constraints before applying apply_uV regulator: mt6358: use regmap helper to read fixed LDO calibration |
||
|
Linus Torvalds
|
09b2124a47 |
Char/Misc driver fixes for 7.2-rc5
Here are a number of small char/misc/etc. driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYCHg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ymTpwCgyyS6niRHf2Y0qx/o+i8s87h+ipoAoJeaOzb7 RWX/ZYiUEoQCtfbxmXZF =cRG6 -----END PGP SIGNATURE----- Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs |
||
|
Linus Torvalds
|
516e2cb010 |
Staging driver fixes for 7.2-rc5
Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYAxA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylfoQCghy7Exq7vpWMlhR8LwQucWqABsxsAnjzK86WN 8VZ68CMngObWMPH31Dx7 =sWD7 -----END PGP SIGNATURE----- Merge tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues" * tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset |
||
|
Linus Torvalds
|
3d0a01cad2 |
Serial driver fixes for 7.2-rc5
Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid serial
driver
Both have been in linux-next for over a week with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYBZA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykMjACgpSS04QGbBIWmMHnxBWHnDT+Z8qoAn210DRbo
l5E84oG0BSJg1i9c3mnj
=WB87
-----END PGP SIGNATURE-----
Merge tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull serial driver fixes from Greg KH:
"Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid
serial driver
Both have been in linux-next for over a week with no reported issues"
* tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: sc16is7xx: implement gpio get_direction() callback
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
|
||
|
Linus Torvalds
|
79ba9db003 |
USB fixes for 7.2-rc5
Here are some small USB fixes and new device quirks and ids for 7.2-rc5. Included in here are: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems. All of these have been in linux-next this past week, many of them much longer. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYE0A8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+yk0twCdFi0ivPtWtEzmP7lUNRCzmyT3MvoAoI7o6lJm E5+ID/c4mWfX/DjoPFhU =uUBv -----END PGP SIGNATURE----- Merge tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device quirks and ids: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems All of these have been in linux-next this past week, many of them much longer" * tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits) usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path USB: serial: io_edgeport: cap received transmit credits USB: serial: option: add TDTECH MT5710-CN USB: serial: io_ti: reject oversized boot-mode firmware USB: serial: mxuport: validate firmware header size usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling usb: typec: ucsi: Add duplicate detection to nvidia registration path usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: core: sysfs: add lock to bos_descriptors_read() usb: musb: omap2430: Do not put borrowed of_node in probe usb: core: port: Deattach Type-C connector on component unbind USB: storage: add NO_ATA_1X quirk for Longmai USB Key USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: keyspan_pda: fix data loss on receive throttling usb: gadget: printer: fix infinite loop in printer_read() usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown ... |
||
|
Linus Torvalds
|
864be1277d |
tracing fix for 7.2:
- Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCamYDGhQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qkhYAP9G5wDTVQQzitl900iWp9rvQ2Qm5UWN JDnK2HO1elmj0AD8CRiHBI5W3O2yUmoO4bOFZ9YFXz+DqJ1jwkDs5FfqjAU= =EMD9 -----END PGP SIGNATURE----- Merge tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. * tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data tracing: Fix context switch counter truncation selftests/ftrace: Reset triggers at top level before instance loop tracing: Fix union collision of module and refcnt for dynamic events tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing: Propagate errors from remote event bulk updates tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() |
||
|
Linus Torvalds
|
86d1022b2c |
m68knommu: fix on top off v7.2-rc4
. fix broken local SoC IO accesses for ColdFire -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmpmCkEQHGdlcmdAa2Vy bmVsLm9yZwAKCRBOJBWpob0vgAfGEACdeDStzWowLpRvqHymL+KlOiPxkHFjaevD nlCybnL77KAu/bsY6gxKEadAplS/PCutNn4U4gtikdKPGklS8wIEMK9JttUzJhCl /Tv2sawYoTzyFj8leXi7slQowQjsj3GEhUpm0WMilRRVNENpQvpxRYos4qiScMdZ xsp9gmL8gK9UIbOYnNpPP95jOlnO9DblSllVBuPwXcsb8AX1uUj1c83720vVqfYO pH8nnhvOr1PHIbfEeDPuOGj/z0uTIgVJxa7wtvhEraLxgedTJHcKpI7HMmF3R1Yr 0yM3n3hI9XoC6FU3ySP+KQOLyrGhbd6p5uajxc8SgHoIF4QZj92IK04+z4psFfQC MNg1c3yoXY4BZX9lIsZ52JzC2dVacBIntuclYFwu0xeFHDdtp7wH38Y8pbOGwmVY ObR6fooPbv54wT53b4oiW0RvtTp1QMRbQywr1O1RRM6QUr/a9wgXcIZ+d75GBlCV NftNvvjlEvVcfHl/nuBtDj9zQpYkwL41u/L5eg9riqHllEY1JV2GPsLQWmWP3CVw OVygfxEe66dppbW+QuVK3Pl72P2yVLBqdERZFYnibMNFiy5jnGxhOZ9G0/W+ewna LsL0BbDQEBduxUrbVSkNbM34e48v5IRHVFO3PD47u3gaFvL3Z8WksacENBimT5hy btidRA+Tyg== =r9I3 -----END PGP SIGNATURE----- Merge tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu fix from Greg Ungerer: - fix broken local SoC IO accesses for ColdFire * tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: coldfire: fix breakage of missed IO access update |
||
|
Linus Torvalds
|
3f97818796 |
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code. (Nathan Chancellor)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0uARHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hmpxAAltRv2TwPA4MeZt10iYTG4BdwMp4OleR4
hDxqYL9T1OJev4wLujlri3/Vb1MVKG1S3YQjeG6hWAB0L+//hbx2e/nEU24uW5xb
j+0kAWSSZPUIP3KRc5Cy4mb1EXiumjk3GHnwXZpRV5XA4RRoTmpexd09J5v5KNvt
/q/c8ZzVMB8p8S1K98BdL/wMAyEHLg+iSywTdNsa8Zyw8qB8qAlRgLHTlhYjkcnO
E1+g3MY7QDEjMYDgHAMP1GHvtXTktXfp2Neo4s0WLmY/C6LEyWE/+HIDrMVuzjat
AU5IWbE0tDxGYdeyVvVoxRafFWmVg7mfnazkORp6iojbfJeVBB+IkNAVX0fbKEBT
Yx6Gcm/x0Xb2pf8zaUWE2q02Sz4WYpWrkcLZrLIVnCphyAK7K7V+I7ZkFP1reQR9
fr9RIsKC+6K5mWivFpOjkEzYp+D9Yp2OJyAgK0oE7F7Zd6u0+qpCWaM+VPHsYp41
wsVGTPgD5JP871o6ln38YskBct70E3BnzO5p10a5PbyRaaBCSBZC1XGCglIs7PS9
TmsZOI4Wc8dHzobUTXNdgOymfqXV/bQEITL8qRt9Ge2GUiUROFLp8IVzmJIADWKv
oqtoNo/vjthpFTXVZ3c4beACEaNu71bDbLjwjOdIb2W8NPY+Z+WeSkHDcg5Gt7qN
2cYWBUyhc3o=
=3e+9
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code (Nathan Chancellor)
* tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot/compressed: Disable jump tables
|
||
|
Linus Torvalds
|
a6671109d6 |
- SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou)
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0OURHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1jnng/9HrimCemEFDFpbyfbqf5ucrV8FyrbIWIX HgxpXYKpOAobz2d0DYA0dn7y+HGVJr9rU7tLxeLpH+NSsT+nm/wva+2D0X4h8Lod VKNFXI1EeQ6GJ0bmRY/DBv2GKPrYfnb1gzn/HO6KE/GITWO79Uq48K/4GTE+mbR6 l++YilPqJfujYA6IlnxdexSJNZUkNbL8lDHsxBm0xM+TyG5JP+xpdHZLpU6Tf5fd l+DcTg6KriS1T+PqAWa+2BXhMhJg2BTEZmH3mU3uvqv8EDMyTUpP4X/f0JLVU/qi 24aFDCrd5zwDey58CXnOhybzpgH7Em8/1GMN5t+6eJBtPt4Hd48h7XVgJeGZje8t yxxtruQ/c5NiKYCoHPro0uMPYu6SWaz8k/h8U2dHqtg6nswVTv89V7jSno8UGsW0 W+vJcDpO3KlfHDRXLQg2E+/WRpQzD5bUeaV9/d0x/4BzokmSDNlafMNZ/bL0RUT+ I0ij4TI16RQNSMxUMTLRC9SP4n1YyH0VMGRn9goTEns2DBdl8Y+xHH+Cnk4RedwX 9MmTLvHyuKHh5VeytWlvNbQD7+L13neec/Hlhw7/sLH7+LMUJfeMM6y4roWQvDuG /5lIT/7P/ketFzgQSGVMtaUi3ZCgfT4ZCS6X6KyaSe3F654Jt0ZpdyUQ9t1Xc42U Z+QM5jJ/4gY= =6nVN -----END PGP SIGNATURE----- Merge tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP debug fixes from Ingo Molnar: - SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou) * tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Make CSD lock acquisition atomic for debug mode smp: Avoid invalid per-CPU CSD lookup with CSD lock debug |
||
|
Christian Brauner
|
749d7aa037
|
super: fix emergency thaw deadlock on frozen block devices
do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount
exclusively. If the block device was frozen via bdev_freeze() dropping
the last block layer freeze reference calls fs_bdev_thaw() which
reacquires s_umount:
do_thaw_all_callback(sb)
super_lock_excl(sb) # holds sb->s_umount
bdev_thaw(sb->s_bdev)
mutex_lock(&bdev->bd_fsfreeze_mutex)
# bd_fsfreeze_count drops 1 -> 0
bd_holder_ops->thaw == fs_bdev_thaw
get_bdev_super(bdev)
bdev_super_lock(bdev, true)
super_lock(sb, true)
down_write(&sb->s_umount) # same task: deadlock
The emergency thaw worker deadlocks against itself holding both
s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,
freeze, or thaw of that filesystem and block device.
[ 81.878470] sysrq: Show Blocked State
[ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000
[ 81.884876] Workqueue: events do_thaw_all
[ 81.886656] Call Trace:
[ 81.887759] <TASK>
[ 81.888763] __schedule+0x579/0x1420
[ 81.890372] schedule+0x3a/0x100
[ 81.891794] schedule_preempt_disabled+0x15/0x30
[ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900
[ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10
[ 81.896528] down_write+0xbd/0xc0
[ 81.897505] super_lock+0x91/0x180
[ 81.898457] ? __mutex_lock+0xa99/0x1140
[ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400
[ 81.902069] bdev_super_lock+0x5b/0x150
[ 81.903132] get_bdev_super+0x10/0x60
[ 81.904042] fs_bdev_thaw+0x23/0xf0
[ 81.904755] bdev_thaw+0x82/0x100
[ 81.905484] do_thaw_all_callback+0x2c/0x50
[ 81.906298] __iterate_supers+0x5d/0x130
[ 81.907067] do_thaw_all+0x20/0x40
[ 81.907739] process_one_work+0x206/0x5e0
[ 81.908545] worker_thread+0x1e2/0x3c0
[ 81.909339] ? __pfx_worker_thread+0x10/0x10
[ 81.910171] kthread+0xf4/0x130
[ 81.910799] ? __pfx_kthread+0x10/0x10
[ 81.911528] ret_from_fork+0x2e2/0x3b0
[ 81.912259] ? __pfx_kthread+0x10/0x10
[ 81.913010] ret_from_fork_asm+0x1a/0x30
[ 81.913806] </TASK>
bdev_super_lock() even documents the violated requirement with
lockdep_assert_not_held(&sb->s_umount).
Acquiring bd_fsfreeze_mutex under s_umount also inverts the
bd_fsfreeze_mutex vs. s_umount ordering established by
bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer
freeze even when the recursive path isn't hit.
Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin
the superblock with an active reference instead as
filesystems_freeze_callback() does. The active reference keeps the
superblock from being shut down and so ->s_bdev stays valid without
holding s_umount. The block-layer-held freeze is dropped by
fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as
a regular unfreeze would and thaw_super_locked() handles
filesystem-level freezes as before.
The emergency thaw path has deadlocked like this in one form or
another for a long long time but the current exclusively-held
shape dates back to commit [1] where thaw_bdev() already ended in
thaw_super() with s_umount held by do_thaw_all_callback().
Fixes:
|
||
|
Linus Torvalds
|
3dab139d47 |
Rust fixes for v7.2 (2nd)
Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmpk6V4ACgkQGXyLc2ht
IW24OQ/7B2pQtg8IE/6fvkPO7I+EPGknkiutPczrh0HFJ2x0rSaC69NVjkV3d5nq
KWk1zOPPzxMoOeIEOR/e8iAMfo9B093mlohappwMKLZGju2x+K6JA+rn6HsvTLiv
fGgjM7hq3B7ExBCon7qDQLYh6cib9T90e9IJrE8rnitbJ8QkUSqXTwCqUbkN7pOt
U5GUX9yHxo9slc9XYy3AC8aifqaBNeUWzfn6a7DN7nLUNhm5AYiYyduvU6QZQ1kR
ezinZn3Jqv+VrpXcuM2x2iMMJCdFILzXdnrhPWoT8whc9GzNWVArkSIYFefvjgvK
Yb+gppVjEuKwsT81eoMwD9edD+wL/4MSU6lnW4eN0EhgECSy7HZs2Jjv1UIrPPSH
ZvVp6Bzn0nuXed4fh+mrqvwmltqnDpVK06c/q6M8u5mQ/HURwCsh43M7X7S4Sm0p
X8AutCjsWj+uP44ZnC/Y5p/r3tFl+HM55YT/favb54Xzq+SDrMtSQ7HFM7CZaDHd
g1B/SBlCTs1O1htqNDWqzew8HdoLfRueZf9tRnTCYSlvOgjSgBB9561m2wfgVE86
yrwPnaYZeipny2hVh+iCiZGDvrqKh+r4nMB8R8X61qjWC7/szjsxs3IiCUpPpMJB
3omYUm3nOxzZjYp9uK0E+YW+BITjC8VrP6XWUnzedfas1bds63k=
=4BpZ
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly"
* tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: time: fix as_micros_ceil() to round correctly for negative Delta
rust: device: avoid trailing ; in printing macros
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
rust: zerocopy: update to v0.8.54
rust: zerocopy: update to v0.8.52
rust: allow `clippy::unwrap_or_default` globally
rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
|
||
|
Linus Torvalds
|
ef9ce800df |
perf tools fixes for v7.2.
- Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h. - Add some build files related to BPF skels to .gitignore. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCamSrfQAKCRCyPKLppCJ+ J41WAQCqkEX7tpYp9F1f/lhzLjeeBc1dcvddAgrlzr/79E0Y8AD8ChH8SMc95ERH rOrpIKhflMUQw5EazDW/AczabIZfcQs= =2+4S -----END PGP SIGNATURE----- Merge tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h - Add some build files related to BPF skels to .gitignore * tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools headers: Sync KVM headers with the kernel sources tools headers: Sync UAPI linux/fs.h with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources tools headers: Sync UAPI drm/drm.h with kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers x86 cpufeatures: Sync with the kernel sources tools headers: Sync linux/gfp_types.h with the kernel sources tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources tools headers UAPI: Sync linux/const.h with the kernel sources perf bench bpf: Add missing .gitignore file |
||
|
Linus Torvalds
|
d99d2a953a |
firewire fixes for 7.2-rc5
Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCamSU6gAKCRCsLtaWM8Lw E/B8AQDAi36W7MJ/y+pcbYA0BQHE/hsr/BbVsx3LmuR2WrHKFwD/WXat4OwVtdVc ZkrO1gwRE263p3UGpqFEftZdS976xgw= =z/i1 -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it" * tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: net: Fix fragmented datagram reassembly |
||
|
Linus Torvalds
|
3fb11702e4 |
LoongArch fixes for v7.2-rc5
-----BEGIN PGP SIGNATURE----- iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmpjKJIWHGNoZW5odWFj YWlAa2VybmVsLm9yZwAKCRAChivD8uImeulhD/9Oe/6FLvyuK4KYi+0DyacU4FZ4 NQjgFa3g2CBY+qiS6qSjzygbClFLZjkhbXsOaQekQjiYWNCKwTCJGg0m/y+qNS+S F1UWxuZxVor1ty4y6KSldCHtdI5ROSXf2Iq3UNw2JX2W8LK0r/asLvFpkIHGcDdJ kqMnD4aktxgs+RYZVs9rQrS0cR8mQom6KVu39/4KB/6QulEMEaH857txobexlaTo 7Jo/I3fcsxbcWxo+I6yZSdSkIBRI5H6eywbHgF0ug7cOmpQL70IGIx0S42XK7RUy A/A7BrPN1JMFTloDSHTX6b05lCh4UEhLBbFgX3ztVCNXt0j5v7/y5dqISwn4qlDP LkPEx/LQ1GsHQu9pqDN3gpD/G/RK+DvpA4p6+GpDrrQ7PQFMIKuzcil7LeZZ0C7H VNbt7QP+HgPHezNroOMp16/PeEBLp2tkO1bqjCf/gRc47OPqLQtOiPJOK0B9yFzw x4J8SRwxjqrg/TYYfP5lOhqafF0cp7ZE7LSlCMwylnZ6EYHaeEJh14ii5u36XJuj ohu83vsobIRa9fJ7StQ8Hf6nJSGSoWpkn6WIAxiL/+Ksz4gzfe+5TNEoBg1cGqjX XBS/qVj0ju06QVrg4H8X9gKEt7LQN+nIXBCg/OXSD75pdM/wlO08PANygU4FXUbE /Q3RTJykzBT4P1TETg== =BlSV -----END PGP SIGNATURE----- Merge tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - fix build warnings and errors - move jump_label_init() before parse_early_param() - retrieve CPU package ID from PPTT when available - fix some bugs kgdb, BPF JIT and laptop platform driver bugs * tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: platform/loongarch: laptop: Explicitly reset bl_powered state when suspend platform/loongarch: laptop: Stop setting acpi_device_class() LoongArch: BPF: Fix memory leak in bpf_jit_free() LoongArch: BPF: Zero-extend signed ALU32 div/mod results LoongArch: Fix oops during single-step debugging LoongArch: Fix address space mismatch in kexec command line lookup LoongArch: Retrieve CPU package ID from PPTT when available LoongArch: Move jump_label_init() before parse_early_param() LoongArch: Fix build errors due to wrong instructions for 32BIT LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT |
||
|
Benjamin Boortz
|
dad6e107b3 |
pinctrl: bm1880: add missing select GENERIC_PINCONF
drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with
.is_generic = true, but that field is only present when
CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h).
The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF,
so any config that enables CONFIG_PINCTRL_BM1880=y without
CONFIG_GENERIC_PINCONF=y fails to compile:
drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic'
Found by randconfig testing on arm64; tinyconfig reproducer below.
Add the missing select to fix the build.
Fixes:
|
||
|
Mario Limonciello
|
ffe8a0c6b5 |
pinctrl-amd: Don't clear S4 wake bits at probe
commit |