Commit Graph

11141 Commits

Author SHA1 Message Date
Linus Torvalds
776bb6df3f Locking updates:
- In the refcount checking code, BUG() on UAF related errors if
    CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
 
  - Add {over,under}flow detection for local_interrupt_{enable,disable}()
    (Boqun Feng)
 
  - Add kunit test case for max local_interrupt_disable() nesting level
    (Boqun Feng)
 
  - Clarify comment (Boqun Feng)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUlMkRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jSug//cjg5WItJ31KfJuzjlRhLJmMdjaPflV+7
 y99hHMLZFu8+L20U8lqBLCCdjmgS3RnPUHsncSwxZHOIrp3zAduc85oa4FMultwq
 XT39jTLEiIfa/2S5/k48PCFZbB6kgFGZGLiAd/h8HuUi4w8t0deGNggdtQCANOdF
 OnpZedXttevu+tbqZFVn2CBZ9Y83S8au1GNuQTu/CAILAPFOalJWP/L+yxns6uZo
 W/5oJvW+RmjswKBFKEgPJSOg56VPURZBPqPZntB9TVyiUSAx7wQeXhMdVFL6e6hx
 MEE5uxbKAqau0LmbTJy7GHpZym4p2hNHIyACxiQX7eXd4l20C/INHVgwYvSRgF9F
 V2VgBMPxH6wXxxNeFujBnNfeUaZfb/9c/E0AQfIQNhexqXahA8bBfmwDy3T+2smq
 usRFLW676zAam2WybsJmANSHZ+KhKaVolOBJTLEUnGA2CG5ONt/xa3HqHNTKCI22
 CY6D6iSgKBzhmso2A7EGdajx3kBkNycfdrVlqXz6YIw7MiNZlONPWf7698bzszPL
 HcE9KWr+0Pt23R5t6g1BBg7T0mnARX8/k3UR5fUC+1zovoKQAm4k8VacDMhF1GSP
 xt7EKiQgNjSRPKdlF+vAlk97qEWqIqkHjvyw5dX+Gz3d4uJ+UHwJDqMM50dEm8g6
 JgqckejzN1A=
 =nN01
 -----END PGP SIGNATURE-----

Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking updates from Ingo Molnar:

 - In the refcount checking code, BUG() on UAF related errors if
   CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)

 - Add {over,under}flow detection for local_interrupt_{enable,disable}()
   (Boqun Feng)

 - Add kunit test case for max local_interrupt_disable() nesting level
   (Boqun Feng)

 - Clarify comment (Boqun Feng)

* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irq: Add max local_interrupt_disable() nesting level kunit test case
  irq: Explain better on NMI_MASK overflow condition
  irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
  refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
2026-10-20 12:43:05 -10:00
Linus Torvalds
cb95904b47 Scheduler updates:
Kconfig updates:
 
  - Simplify PREEMPT_DYNAMIC (Mark Rutland)
 
 Fair scheduler updates:
 
  - Remove redundant RUN_TO_PARITY check (Elif Topuz)
 
  - Declare augmented callbacks per field, fix rb_add_augmented_cached()
    descent (Yiwei Lin, Peter Zijlstra)
 
  - Restart fair hrtick after same-task repicks (Shubhang Kaushik)
 
  - Improve the scheduling latency of short slice tasks (Vincent Guittot)
 
 Deadline/RT scheduler updates:
 
  - Check start_dl_timer expiry with ktime_before()
    (Liang Hao)
 
  - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
    Siewior)
 
 Energy-aware scheduling updates:
 
  - Implement the steal_governor, introduce preferred CPUs and
    steal-driven vCPU backoff (Shrikanth Hegde)
 
 Multi-processor load-balancing updates:
 
  - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
 
  - Randomize equally shallow idle CPU picks (Christian Loehle)
 
  - Remove redundant core_sched_seq (Hui Su)
 
 Cache-aware scheduling updates:
 
  - Avoid publishing partial LLC utilization (Jemmy Wong)
 
 NUMA-balancing updates:
 
  - Reset NUMA fault locality after scan period update (Eric Kim)
 
 Proxy execution updates:
 
  - Ongoing work to implement sleeping owner handling for proxy
    execution (John Stultz, Vasily Gorbik)
 
  - Preparatory steps to make sched_ext compatible with proxy
    execution (Andrea Righi)
 
 Scheduler infrastructure updates & fixes:
 
  - Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
 
  - Avoid modifying wait-entry on failed priority registration
    (Hui Su)
 
  - Use the new static key API for sched_feat (Hongyan Xia)
 
  - Convert paravirt_steal to new static key APIs (Hongyan Xia)
 
  - cputime: Don't account idle time twice after dyntick-idle
    (Stian Halseth)
 
 Scheduler debugging updates:
 
  - Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
    (Sechang Lim)
 
  - Fix context analysis errors in non-preferred CPU push (Shrikanth
    Hegde)
 
 Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
 Thomas Huth and Vladimir Zapolskiy.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUomIRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1ik+Q/+Jx0tXmwOm/wk1ba50zz/tkUL17APJzD1
 0TdHSf0sqssyVnQVmGBNWoKfp30zzrnd8Yf46PH5kUmyIxX0LqazAXsPA/0lxAY6
 jB2b5ZGosyQQPqyjM1q48K/BMB+GGO9xDKlFxxkBsICi+vS+6diBzXM70xla9M4O
 CcAO5DHb50otN/TljfnkmbxG7vgssCVZyS7XG6bSyhd6tUrcr4DVD7gYOMbSVcaL
 8Cgu+b54rOAcrcWU1454YKHI5etUOTjblCbFgISrdw7lwf4dKVtTAKSanFX9n522
 q9sQ1vzuRz6JfSak9nxFkCy5SMjuHJ53DkVNR4eUXNmM0tHdAcVd8jOexmQVBrug
 Yjloo/WydUqGT2TYYEVQPi4J+jMqMRyDIp3TL9UuQjwcjHRnUpd8EVmoNme0TOi+
 e3SoS+xOSVBLgbMFwrjJR/tQuqDPjgBrgIyg8wL+ed5cY6Equ+J3467wp8lO7RBN
 uGwChvxQAOaMlkh5tIR38Zjq9kzs79y85vz3uD2SNk17TcvijVw9UsmQKfAkpdZo
 5FUDM2AdyOhOtZkzMNLHfjjBLSMVCBRo726c6WbELibhuWN7xTAJSJx8o8JNOCrC
 vOBcNNAHpU7BwqA0gFIA3lL1uMXvKn9npKKjnB2C4WxhFGf23NF6uPapyA4sMZ00
 YwRGvOeDvu4=
 =cPCx
 -----END PGP SIGNATURE-----

Merge tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler updates from Ingo Molnar:
 "Kconfig updates:

   - Simplify PREEMPT_DYNAMIC (Mark Rutland)

  Fair scheduler updates:

   - Remove redundant RUN_TO_PARITY check (Elif Topuz)

   - Declare augmented callbacks per field, fix
     rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)

   - Restart fair hrtick after same-task repicks (Shubhang Kaushik)

   - Improve the scheduling latency of short slice tasks (Vincent
     Guittot)

  Deadline/RT scheduler updates:

   - Check start_dl_timer expiry with ktime_before() (Liang Hao)

   - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
     Siewior)

  Energy-aware scheduling updates:

   - Implement the steal_governor, introduce preferred CPUs and
     steal-driven vCPU backoff (Shrikanth Hegde)

  Multi-processor load-balancing updates:

   - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)

   - Randomize equally shallow idle CPU picks (Christian Loehle)

   - Remove redundant core_sched_seq (Hui Su)

  Cache-aware scheduling updates:

   - Avoid publishing partial LLC utilization (Jemmy Wong)

  NUMA-balancing updates:

   - Reset NUMA fault locality after scan period update (Eric Kim)

  Proxy execution updates:

   - Ongoing work to implement sleeping owner handling for proxy
     execution (John Stultz, Vasily Gorbik)

   - Preparatory steps to make sched_ext compatible with proxy execution
     (Andrea Righi)

  Scheduler infrastructure updates & fixes:

   - Remove the RCU wait from PSI trigger destruction (Shakeel Butt)

   - Avoid modifying wait-entry on failed priority registration
     (Hui Su)

   - Use the new static key API for sched_feat (Hongyan Xia)

   - Convert paravirt_steal to new static key APIs (Hongyan Xia)

   - cputime: Don't account idle time twice after dyntick-idle
     (Stian Halseth)

  Scheduler debugging updates:

   - Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
     (Sechang Lim)

   - Fix context analysis errors in non-preferred CPU push (Shrikanth
     Hegde)

  Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
  Thomas Huth and Vladimir Zapolskiy"

* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
  sched: Replace nr_iowait_cpu() with a bool accessor
  Revert "sched/fair: Remove dead code on enqueue_task_fair()"
  sched/cache: Avoid publishing partial LLC utilization
  sched/cputime: Don't account idle time twice after dyntick-idle
  sched/psi: Remove the RCU wait from trigger destruction
  sched/eevdf: Remove redundant RUN_TO_PARITY check
  sched/wait: Avoid modifying entry on failed priority registration
  rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
  rbtree: Update augmented data on the way down in rb_add_augmented_cached()
  rbtree: Declare augmented callbacks per field with RB_AUG()
  rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
  smpboot: Don't park the thread if work is pending
  irq_work: Flush lazy work CPU down on PREEMPT_RT
  irq_work: Update a comment regarding CPU hotplug invocation
  sched/topology: Add asymmetric SMT packing override
  sched/fair: Honor asymmetric SMT priority in idle selection
  sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
  sched/core: Fix context analysis errors in non-preferred CPU push
  virt/steal_governor: Enable the driver
  virt/steal_governor: Implement steal_governor policy loop
  ...
2026-10-20 12:35:35 -10:00
Linus Torvalds
dd8845db6d - Document and cleanup the signal frame handling with the goal to allow
process migration between CPUs with different FPU capabilities but which use
   only a common set of FPU features, i.e., think checkpoint/restore. By
   Andrei Vagin
 
 - Consolidate how XSTATE features are checked by doing them once during boot
   with the intent of removing cpu_has_xfeatures(). Latter will happen in the
   next cycle. Work by Eric Biggers
 
 - Other cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrW6K8ACgkQEsHwGGHe
 VUqFJg//WXn5Lu71l3TnoucbDjvdKoTvYH1zwrvxJirPsWK5+12Hvr2psTwh2GPF
 6xEYJJEJHMt5VzSo+vjA5aHwqZOFhgQefBEpZqzgWYUBZ7q0ALsGbVzF1iVYNRTW
 MHYg8V7OMdlq6mgB06sdTJbIG+EfiQch2EiefMK7PdBa+fU2oxBMbSDvCPl537ug
 yF6+Qv/sKDKPZdZNvA6d5Vy/k0UpV4Cd1YyWhFjJtiYU1bSBjL1AazM5b9qMbl4E
 t2hlZ+Agi7yucsoZ+tD1IMJsjYyRByZPPQAGNvqZv1YOYWp6LnbHi8cKSpY+N8zS
 RnVao7PkfyZzjcV0q4fYpzzGIiZZWwpa9k1y98F7MBVEi7hWG5VaguNDI6+2xvs8
 FQDNGG1TWtjPltgxsO4ouy2QzbrwzRiWfpP2YHAx5BsYUue5IFeIF3LlwPz0pKz6
 2tfsIuMQe5kr43Q3g/LwJuaISLS0rhAXXPceWI8Oiz+sJSsjadnQgOG/tLyySfpF
 Kea3OIexbpzQ+DtaxQXzPeGp80sOdG9QontV1Ce4HpieWizKSN3ggqcbhae3aUlh
 P0fGALhhlLZFpwkyRkcCbRcyu0yrCaNmfwG9KWa4gajGVCfr9Y/WvyBhsT7nTfaQ
 +ngSKg968mDmgdD0SwJ/ejpJg4cGeAAMj7q/VN15qUlEgomkTEg=
 =OJI1
 -----END PGP SIGNATURE-----

Merge tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 FPU state updates from Borislav Petkov:

 - Document and cleanup the signal frame handling with the goal to allow
   process migration between CPUs with different FPU capabilities but
   which use only a common set of FPU features, i.e., think
   checkpoint/restore (Andrei Vagin)

 - Consolidate how XSTATE features are checked by doing them once during
   boot with the intent of removing cpu_has_xfeatures(). Latter will
   happen in the next cycle (Eric Biggers)

 - Other cleanups

* tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/fpu: Remove additional remnants of math emulation
  x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU
  selftests/x86: Add tests for signal frame FPU portability
  x86/fpu: Pre-fault only required size of xstate buffer
  x86/fpu: Fix potential underflow in xstate_calculate_size()
  x86/fpu: Document reasoning of FX-only fallback
  x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()
  x86/fpu: Clean up and rename variables in signal frame handling
  x86/fpu: Document signal frame layout and portability
  xor: Add AVX-512 optimized xor_gen()
  xor: Remove redundant X86_FEATURE_OSXSAVE check
  lib/crc: x86: Stop using cpu_has_xfeatures()
  lib/crypto: x86: Stop using cpu_has_xfeatures()
  crypto: x86 - Stop using cpu_has_xfeatures()
  um: Check for missing AVX and AVX-512 xstate bits
  x86/fpu: Check for missing AVX and AVX-512 xstate bits
2026-10-20 11:03:51 -10:00
Linus Torvalds
0fcb05b723 Crypto library fixes for 7.3-final
Fix two Poly1305 bugs including a lost carry bit, and add a regression
 test.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCas92XxQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOKzlqAP9wGX5K4F95NgzPhJ/AG0Ze5aEiRzbR
 Bay8csFZoftMoQEA2LipJ8lmHFrvOHwIiiUP/d3LWWXiEYaq4+y0R7CYXwo=
 =CmWW
 -----END PGP SIGNATURE-----

Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull crypto library fixes from Eric Biggers:
 "Fix two Poly1305 bugs including a lost carry bit, and add a regression
  test"

* tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  lib/crypto: tests: Add Poly1305 split-update carry regression test
  lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state
  lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()
2026-10-14 08:23:37 -07:00
Yiwei Lin
cc459ecd93 rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
insert_augmented_cached() open-codes the descent that the generic
rb_add_augmented_cached() helper provides.  Use the helper instead,
so that rbtree_test covers it: it is what sched/eevdf relies on and
nothing in lib/ exercises it today.

Signed-off-by: Yiwei Lin <s921975628@gmail.com>
Assisted-by: LLM
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20261005093236.62702-5-s921975628@gmail.com
2026-10-13 13:51:28 +02:00
Yiwei Lin
9fc91ae685 rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
insert() and insert_cached() open-code exactly what the generic
rb_add() and rb_add_cached() helpers do.  Use the helpers instead.

Besides removing duplicated code, this makes rbtree_test cover the
helpers themselves, which is what most in-tree rbtree users call
nowadays.

Signed-off-by: Yiwei Lin <s921975628@gmail.com>
Assisted-by: LLM
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20261005093236.62702-2-s921975628@gmail.com
2026-10-13 13:51:27 +02:00
Peter Zijlstra
840e23085b Merge branch 'tip/sched/urgent'
Pickup dependencies; notably the RB-tree fix.

Signed-off-by: Peter Zijlstra <peterz@infradead.org>
2026-10-13 13:51:24 +02:00
Eric Biggers
7b817748bf lib/crypto: tests: Add Poly1305 split-update carry regression test
Add a test case which reproduces the bug fixed by commit 24f07e8c07
("lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state").
It is written in a fairly general way, such that it should also be able
to reproduce similar bugs in other implementations.

Update the comment on test_poly1305_allones_keys_and_message() to more
accurately describe what it does and differentiate it from the new test.

Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://patch.msgid.link/20261009125354.315476-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-09 19:21:07 +02:00
Jérémy Jean
24f07e8c07 lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state
When poly1305_blocks_neon() resumes from a base 2^26 accumulator and the
next update contains an odd number of full 16-byte blocks, it processes
one leading block through poly1305_mult() so that the remaining NEON
work has an even block count.  That requires converting the accumulator
to the base 2^64 form used by poly1305_mult().  The final ADC of that
conversion stores the carry into d2, but the following accumulation and
poly1305_mult() use h2.  If the conversion carries across bit 128, the
carry is dropped and the emitted tag is wrong.

This was introduced by Cryptogams commit 03dc4adf91c8
("arm/poly1305-armv*.pl: optimize branches."), which removed the
reduction that consumed d2 shortly before Linux imported the code.
OpenSSL's copy did not take that change.

The carry is possible because the NEON code stores the accumulator [h0,
h1, h2, h3, h4] in a lazily reduced, redundant base 2^26 form: its final
carry chain leaves h0, h2, h3 < 2^26, but h1 and h4 may slightly exceed
2^26 - 1.  For example, the reachable state

  h0 = 4
  h1 = 2^26
  h2 = 2^26 - 1
  h3 = 2^26 - 1
  h4 = 2^24 - 1

represents 4 + 2^26*2^26 + (2^26-1)*2^52 + (2^26-1)*2^78 +
(2^24-1)*2^104 = 2^128 + 4, despite the bit representing the 2^128 term
(bit 24 of h4) not being set; the extra comes from the h1 limb being
above the normal base 2^26 range.  When this value is converted into the
non-redundant base 2^64 form, a carry into the new 2^128 bit (in bit 0
of h2) is necessary to preserve the value.

Given the above bounds, a carry into bit 128 happens exactly when
h1 >= 2^26, h2 = h3 = 2^26 - 1, and h4 mod 2^24 = 2^24 - 1.

Store the carry into h2, matching the other base 2^26 to base 2^64
conversions in poly1305_blocks() and poly1305_emit().

This bug causes an incorrect tag to be emitted.  However, this is
unlikely to happen in practice where Poly1305 is used with a random key,
since the random key tends to distribute the accumulator values
throughout their valid range.  There isn't an obvious way for an
attacker without knowledge of the r_key to cause [h0, h1, h2, h3, h4] to
land on the precise values where this bug occurs.

[EB: Rewrote the commit message to more clearly describe the bug and
 its impact, and simplified explanation about why there's a carry bit.]

Fixes: f569ca1647 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS NEON implementation")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20261009125354.315476-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-09 19:20:29 +02:00
Eric Biggers
da619121a5 lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()
Use memzero_explicit() instead of a plain struct assignment to guarantee
zeroization of the 'struct poly1305_desc_ctx'.

Note that dead store elimination was only theoretically possible with
link-time optimization here.  But it's still worth fixing.

Fixes: a1d9306409 ("crypto: poly1305 - expose init/update/final library interface")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-c3a6bd76-f6ab-4203-892a-cd06f7aa0c34
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20261006083432.16328-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-09 19:20:29 +02:00
Shashank Mohan Jain
636035157a lib/dim: add KUnit test for dim_calc_stats()
Add a KUnit suite for the DIM library that checks the packet, byte,
event and completion rates computed by dim_calc_stats(), including
counter wraparound and windows whose byte or packet count times
USEC_PER_MSEC does not fit in 32 bits. The latter cases fail on 32-bit
architectures without the previous commit.

Assisted-by: LLM
Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-10-02 07:52:31 +01:00
Shashank Mohan Jain
0843b23890 lib/dim: fix 32-bit overflow in dim_calc_stats() rates
dim_calc_stats() computes the per-millisecond rates as

	DIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us)

where nbytes is a u32 and USEC_PER_MSEC is 1000L. On 64-bit the product
is done in 64-bit long arithmetic, but on 32-bit architectures long is
32 bits wide and the product wraps as soon as a measurement window
carries more than 4294967 bytes (about 4.3 MB). The same applies to the
packet and completion counts, although those need more than 4.29
million packets or completions per window.

A DIM window spans DIM_NEVENTS (64) events. Drivers count events per
interrupt or per NAPI poll, so under sustained load a window can easily
carry more than 4.3 MB: 64 full NAPI polls of 64 MTU-sized frames are
already 6.2 MB, and drivers such as mtk_eth_soc count one event per
interrupt while NAPI keeps polling with the interrupt masked. On 32-bit
users of the library (for example mtk_eth_soc on MT7621, bcmgenet and
bcmsysport on 32-bit ARM, or virtio_net in a 32-bit guest) bpms then
becomes the product modulo 2^32 divided by the window length, and
net_dim_stats_compare() makes its BETTER/WORSE decisions on a value
that has little to do with the real throughput.

For example, a 1 Gbit/s link at line rate that moves 5 MB in a 40 ms
window gives bpms = 125000 on 64-bit but 17626 on 32-bit, and 5 million
packets in 2 s gives ppms = 353 instead of 2500.

Widen the products to 64 bits and divide with DIV_ROUND_UP_ULL(). The
results are unchanged on 64-bit.

Fixes: cb3c7fd4f8 ("net/mlx5e: Support adaptive RX coalescing")
Fixes: 4c4dbb4a73 ("net/mlx5e: Move dynamic interrupt coalescing code to include/linux")
Assisted-by: LLM
Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-10-02 07:52:31 +01:00
Jann Horn
5b52242207 refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
Some refcount issues are not necessarily associated with memory corruption,
but REFCOUNT_ADD_UAF suggests that a UAF either just happened or is about
to happen.

REFCOUNT_SUB_UAF is also an indicator that reference counting is wrong, and
suggests (less strongly) that a UAF access might have happened recently.

In these cases, BUG() is appropriate if CONFIG_BUG_ON_DATA_CORRUPTION is
set.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20260812-refcount-bug-on-data-corruption-v1-1-c6da63566101@google.com
2026-10-01 14:00:40 +02:00
Shrikanth Hegde
cfb463b717 cpumask: Introduce cpumask_intersects_and
Introduce bitmap_intersects_and() to determine whether the intersection
of three bitmaps is non-empty. Unlike cpumask_first_and_and(), this
returns immediately when an intersecting word is found and does not
calculate the first matching bit.

Add cpumask_intersects_and() as the corresponding cpumask wrapper.

A subsequent patch uses the helper to determine whether a task
has a CPU that is present in its affinity mask, the preferred CPU mask,
and task possible CPU mask.

Suggested-by: Yury Norov <yury.norov@gmail.com>
Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Reviwed-by: Yury Norov <yury.norov@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Yury Norov <yury.norov@gmail.com>
Link: https://patch.msgid.link/20260928053728.797539-3-sshegde@linux.ibm.com
2026-09-28 08:44:40 +02:00
Linus Torvalds
164f652b6e 14 hotfixes. 10 are cc:stable. 11 are for MM.
All are singletons - please see the changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaqd9PAAKCRDdBJ7gKXxA
 jh2vAP4xdo8yWk9qZB55kCHfgsXC25o+ycn0odOoVw391KN7qAEA9PEXTx6taV+N
 slCGe5cW1Cxnsx23PipcYGdq6LKfMQE=
 =4b4Y
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "14 hotfixes.  10 are cc:stable.  11 are for MM.

  All are singletons - please see the changelogs for details"

* tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/folio: EXPORT_SYMBOL_FOR_KVM(lru_cache_drain_for_folio)
  mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
  mm/vma: correctly unaccount on mmap_prepare() failure
  mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
  remove old lib/alloc_tag.c
  fs/dax: check zero or empty entry before converting xarray entry
  fs: fix missed removal of super_fs_objects_eligible()
  mm: filemap: retain mapped dropbehind folios
  mailmap: update entry for Christopher Obbard
  memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
  mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
  mailmap: map Coiby Xu's address
  mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP
  mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
2026-09-14 08:59:09 -07:00
Linus Torvalds
35ef102063 block-7.3-20260911
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqj5hAQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphqIEADE/9nkItU8nufHLICBr8FI+IncrvHJQpag
 1iLerBftMLxNJDS+CAQEF5oOcorL/6bUga6nHmMAds7pILdDzafWkvnuCbrGIC1q
 j0V7a0Rkalv87ObbYZcoKWTTjv0IdCmNEC93fitwTujqYclI7Hwvr/t+0nkprcxU
 jjbHq9tzkVHVX771usCIKOVRdI+xc5TSDbOfm13tE5ESH2GzZaPqu4Aqq3nvVSOO
 xmLYzDlz8NRApmCl6a3KzCxHi8fROMnjlaeQrAmh6+Zov/iB5Bzqo98NBeWXgbh6
 WvFxLm/zR5+WFppp+GblAZ5FtkOv5ICAYeM9fQkuiCo6o8/t+cxnTUgyex9qtMBr
 Uhoct1jM+eNCEWEgA1ZBRVWLsyr0FbNDrowsP4YvvqW3WdQeq8ABRz44lcRqhQJy
 BQYydnk7PpANdDhaAOO2JpoYbkokvPfT/8TwDFMmJlp+gwydXfE64IjE5ljaf6xr
 DRMxeZzFkwYrF++1KiN3Kozqe0jFINDuB9ysPrGlDHlPFK/tbx8nZn8aKOIHccBj
 mGNJ+fNWkFJczeuGiIbWEtNci0ZL+8eaDqF+uOp5odQ7vo8rYPv2TRff436dcI0c
 0EnQrC9orScabgRAIklnnEWjw9XoHmpoCTQE/LhlA1rf+zDNQ2cvNopBePDuxaku
 IChLh+u+0g==
 =JeEt
 -----END PGP SIGNATURE-----

Merge tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - Fix the start and length check added to iov_iter_extract_bvecs(),
   which used iter_iov_addr()/iter_iov_len() helpers that aren't safe
   for the ITER_BVEC/FOLIOQ/etc iterator types passed

 - sunvdc fixes for an -EIO issue from lack of retries, and unmapping
   LDC cookies when the descriptor send fails

 - Clear force_abort in ublk_queue_reset_io_flags()

 - ublk selftest install fix

* tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  selftests: ublk: add batch IO cases to recover_03
  ublk: clear force_abort in ublk_queue_reset_io_flags()
  sunvdc: fix -EIO issue due to lack of retries
  sunvdc: unmap LDC cookies when the descriptor send fails
  block: Fix start and length check added to iov_iter_extract_bvecs()
  selftests: ublk: install test_common.sh and trace/ scripts
2026-09-11 12:38:44 -07:00
David Howells
b0d8d56b7c block: Fix start and length check added to iov_iter_extract_bvecs()
Commit 14b007e178 added an address check using iter_iov_addr() and a
length check using iter_iov_len() to iov_iter_extract_bvecs(), but these
cannot be used so and are unsafe in this circumstance as the functions have
hardwired assumptions about the iterator type.  They should only be used
with ITER_UBUF or ITER_IOVEC-type iterators; they shouldn't be used with
ITER_BVEC, ITER_KVEC, ITER_FOLIOQ, ITER_XARRAY or ITER_DISCARD iterators.

This proves to be a problem for cachefiles as an iterator of type
ITER_FOLIOQ is passed and iter_iov_addr() and iter_iov_len() both
malfunction because iter->__iov in iter_iov() is not pointing to an iovec
array.

Fix this by using iov_iter_alignment() instead.

Fixes: 14b007e178 ("block: validate user space vectors during extraction")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
cc: Hannes Reinecke <hare@kernel.org>
cc: Christoph Hellwig <hch@infradead.org>
cc: Jens Axboe <axboe@kernel.dk>
cc: Alexander Viro <viro@zeniv.linux.org.uk>
cc: Paulo Alcantara <pc@manguebit.org>
cc: netfs@lists.linux.dev
cc: linux-block@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/1667275.1788941191@warthog.procyon.org.uk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-10 14:44:39 -06:00
Eric Biggers
c0a44d1745 xor: Add AVX-512 optimized xor_gen()
Add an implementation of xor_gen() using AVX-512.

It uses 512-bit vectors, i.e. ZMM registers.  It also uses the
vpternlogq instruction to do three-input XORs when applicable.

It's enabled on x86_64 CPUs that have AVX512F && !PREFER_YMM.  In
practice that means:

    - AMD Zen 4 and later (client and server)
    - Intel Sapphire Rapids and later (server)
    - Intel Rocket Lake (client)
    - Intel Nova Lake and later (client)

The !PREFER_YMM condition excludes the older AVX-512 implementations in
Intel Skylake Server and Intel Ice Lake.  They could run this code, but
they're known to have overly-eager downclocking when ZMM registers are
used.  This is the same policy that the crypto and CRC code uses.

Results from xor_benchmark on AMD Ryzen 9 9950X (Zen 5):

Before:

    # xor_benchmark:           	 4096 bytes	16384 bytes
    # xor_benchmark:   4 disks:	  256  GB/s	  185  GB/s
    # xor_benchmark:   5 disks:	  233  GB/s	  165  GB/s
    # xor_benchmark:   6 disks:	  243  GB/s	  174  GB/s
    # xor_benchmark:   7 disks:	  244  GB/s	  176  GB/s
    # xor_benchmark:   8 disks:	  265  GB/s	  179  GB/s
    # xor_benchmark:  10 disks:	  249  GB/s	  175  GB/s
    # xor_benchmark:  12 disks:	  219  GB/s	  173  GB/s
    # xor_benchmark:  15 disks:	  206  GB/s	  177  GB/s
    # xor_benchmark:  16 disks:	  212  GB/s	  180  GB/s
    # xor_benchmark:  32 disks:	  193  GB/s	  177  GB/s

After:

    # xor_benchmark:           	 4096 bytes	16384 bytes
    # xor_benchmark:   4 disks:	  492  GB/s	  202  GB/s
    # xor_benchmark:   5 disks:	  436  GB/s	  191  GB/s
    # xor_benchmark:   6 disks:	  466  GB/s	  193  GB/s
    # xor_benchmark:   7 disks:	  491  GB/s	  194  GB/s
    # xor_benchmark:   8 disks:	  513  GB/s	  205  GB/s
    # xor_benchmark:  10 disks:	  454  GB/s	  199  GB/s
    # xor_benchmark:  12 disks:	  330  GB/s	  204  GB/s
    # xor_benchmark:  15 disks:	  266  GB/s	  198  GB/s
    # xor_benchmark:  16 disks:	  243  GB/s	  177  GB/s
    # xor_benchmark:  32 disks:	  187  GB/s	  165  GB/s

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: David Laight <david.laight.linux@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260901145740.42337-9-ebiggers@kernel.org
2026-09-10 07:26:19 -07:00
Eric Biggers
2405d15e5a xor: Remove redundant X86_FEATURE_OSXSAVE check
X86_FEATURE_AVX implies X86_FEATURE_OSXSAVE already.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260901145740.42337-8-ebiggers@kernel.org
2026-09-10 07:26:19 -07:00
Eric Biggers
b93f05df9c lib/crc: x86: Stop using cpu_has_xfeatures()
Checking both boot_cpu_has() and cpu_has_xfeatures() has never really been
needed in practice, and it's never been universally done (e.g., lib/raid/
omits cpu_has_xfeatures()).  Nevertheless, both x86 and UML now explicitly
clear the AVX and AVX-512 flags if their xfeatures are missing, which should
remove any remaining doubts.

Thus, remove all the calls to cpu_has_xfeatures().

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260901145740.42337-6-ebiggers@kernel.org
2026-09-09 14:04:40 -07:00
Eric Biggers
ffe52429f8 lib/crypto: x86: Stop using cpu_has_xfeatures()
Checking both boot_cpu_has() and cpu_has_xfeatures() has never really been
needed in practice, and it's never been universally done (e.g., lib/raid/
omits cpu_has_xfeatures()).  Nevertheless, both x86 and UML now explicitly
clear the AVX and AVX-512 flags if their xfeatures are missing, which should
remove any remaining doubts.

Thus, remove all the calls to cpu_has_xfeatures().

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260901145740.42337-5-ebiggers@kernel.org
2026-09-08 21:53:17 -07:00
Andrew Morton
0791a234b3 remove old lib/alloc_tag.c
This was moved into mm/, but the original lib/ file somehow remained. 
Remove it.

Reported-by: Suren Baghdasaryan <surenb@google.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-09-05 11:47:49 -07:00
Kees Cook
3a2c4d55e3 treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-04 21:37:00 -07:00
Eric Dumazet
0ba6912f7e Revert "once: don't use a work queue to reset sleepable static key"
This reverts commit e8eef69a99.

While DO_ONCE_SLEEPABLE() is used from sleepable/process context, callers
may still be holding arbitrary subsystem locks.

For instance, __inet_hash_connect() uses get_random_sleepable_once() which
invokes DO_ONCE_SLEEPABLE() while holding the socket lock (sk_lock):

  lock_sock(sk)
    __inet_hash_connect()
      get_random_sleepable_once()
        DO_ONCE_SLEEPABLE()
          __do_once_sleepable_done()
            static_branch_disable()
              static_key_disable()
                cpus_read_lock()

Calling static_branch_disable() directly from __do_once_sleepable_done()
causes static_key_disable() to synchronously acquire cpus_read_lock()
(cpu_hotplug_lock) and jump_label_mutex inside the caller's lock context.

This introduces an unwanted lockdep dependency:
  sk_lock -> cpu_hotplug_lock

Because cpu_hotplug_lock depends on fs_reclaim (via workqueue CPU bringup
allocating memory with GFP_KERNEL), and storage/block layers (such as
NVMe-TCP) acquire sk_lock during I/O dispatch, lockdep reports circular
locking dependencies:

  set->srcu -> sk_lock -> cpu_hotplug_lock -> fs_reclaim -> q_usage_counter -> elevator_lock -> set->srcu

This false positive previously prompted commit 19bdb70c77 ("nvme-tcp:
lockdep: use dynamic lockdep keys per socket instance") to work around the
warning using per-socket dynamic keys in NVMe-TCP.  That in turn broke
asynchronous socket teardown and caused syzbot warnings in
tcp_tsq_handler().

Restoring once_disable_jump() in __do_once_sleepable_done() ensures that
static_branch_disable() is executed asynchronously from a system workqueue
without holding the caller's locks.

Link: https://lore.kernel.org/20260825142515.1965654-1-edumazet@google.com
Fixes: e8eef69a99 ("once: don't use a work queue to reset sleepable static key")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Closes: https://lore.kernel.org/lkml/ao0mwtt8ePAINFni@shinhome/
Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Reinette Chatre <reinette.chatre@intel.com>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Nilay Shroff <nilay@linux.ibm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-09-01 20:26:22 -07:00
Linus Torvalds
18fbf5151d mm.git review status for linus..mm-stable
Everything:
 
 Total patches:       171
 Reviews/patch:       1.83
 Reviewed rate:       82%
 
 Excluding selftests:
 
 Total patches:       149
 Reviews/patch:       1.77
 Reviewed rate:       80%
 
 Excluding selftests and maple_tree:
 
 Total patches:       129
 Reviews/patch:       1.99
 Reviewed rate:       89%
 
 Summary of patch series in this merge:
 
 - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
   (Lorenzo Stoakes):
 
   Index MAP_PRIVATE file-backed folios by their anonymous page offset to
   resolve confusion around reverse mapping for zeroed and CoW'd
   file-backed memory.
 
   Use this new VMA anonymous page offset tracking to eliminate index
   conflicts and lay the foundation for scalable CoW performance
   improvements.
 
 - "promote mapped executable folios after first usage for MGLRU" (Baolin
   Wang):
 
   Make MGLRU's protection of mapped executable file folios more
   reliable.  Follow the classical LRU's logic, promoting mapped executable
   file folios after their first usage to give executable code a better
   chance to stay in memory and improve workload performance.
 
 - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong Chen):
 
   Fix per-node proactive reclaim interface's ignoring the swappiness
   parameter when CONFIG_MEMCG is disabled by consolidating sc_swappiness()
   into a single function that checks proactive_swappiness regardless of
   kernel configuration.
 
 - "mm/vmscan: reduce lru_lock contention via vmstat-derived scan-balance
   cost" (Usama Arif):
 
   Reduce lru_lock contention in the reclaim path by deriving
   scan-balance costs from vmstat counters rather than lock-acquired
   producer updates.
 
   Read and decay these cost signals on the reclaim side under a
   dedicated per-lruvec lock, reducing total LRU lock wait time by over 60%
   without impacting scan throughput.
 
 - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky):
 
   Fix two low-risk zram bugs which Sashiko spotted in drive-by review.
 
 - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
   memcg" (Zi Yan):
 
   Fix xas_split_alloc() by enabling target folio memcg charging during
   splits and adding the missing __GFP_ACCOUNT flag for proper XArray node
   memory accounting.
 
 - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick):
 
   Replace hardcoded binary names in selftests/mm/.gitignore with a
   generic pattern-matching rule to automatically ignore generated test
   files and avoid manual updates when adding new tests.
 
 - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon):
 
   Make the incompatibility between FLATMEM and NUMA explicit in
   mm/Kconfig and remove the unused pgdat_page_ext_init() function.
 
 - "zram: fix zstd error paths and add parameter validation" (Haoqin Huang):
 
   Clean up zram compression backends by removing redundant error
   cleanup, adding parameter and dictionary validation, auto-prefixing
   algorithm error logs, and resetting parameters prior to
   reinitialization.
 
 - "zram: fix stale scan bounds after reinitialization" (Longlong Xia):
 
   Prevent out-of-bounds slot accesses during concurrent zram resets by
   moving table scan bound calculations under dev_lock in writeback_store()
   and read_block_state().
 
 - "add anon mTHP collapse test cases" (Baolin Wang):
 
   Extend selftests helper functions to support arbitrary page orders and
   add new test cases and options for mTHP collapse in khugepaged.
 
 - "selftests/mm: Handle unsupported and transient test conditions"
   (Muhammad Usama Anjum):
 
   Update MM selftests to report a SKIP status instead of a failure when
   required kernel or filesystem features are unsupported, while adding
   retry logic for transient page migration errors.
 
 - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia):
 
   Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
   and extend shrink_memcg() to support batch writeback for improved
   writeback efficiency.
 
 - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren Baghdasaryan):
 
   Introduce an IOCTL-based binary interface for memory allocation
   profiling that enables kernel-side filtering before per-CPU counter
   aggregation.
 
   This eliminates the text-parsing overhead of /proc/allocinfo and
   provides up to a 20x speedup by transferring only filtered allocation
   data to userspace.
 
 - "better block swap batching and a different take on swap_ops v5"
   (Christoph Hellwig):
 
   Refactor block swap I/O to use swap_iocb for batching instead of
   single-bio requests and rebase the swap_ops interface, achieving faster
   swap throughput during kernel builds.
 
 - "mm: kmemleak: reduce transient false positives by confirming leaks"
   (Catalin Marinas):
 
   Reduce false-positive kmemleak reports by combining two kmemleak
   enhancements that add a second confirmation scan and a configurable
   minimum unreferenced scan count module parameter.
 
 - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
   (Breno Leitao):
 
   Auto-scanning kernels can generate false-positive memory leak reports
   on single scans, so this patch defaults min_unref_scans to 2 when
   CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second confirming
   scan.
 
 - "swap_ops updates" (Christoph Hellwig):
 
   Batching I/O for synchronous swap devices causes performance
   regressions and filesystem-based swap suffers from double-indirection
   overhead.  This series resolves both issues by reintroducing per-folio
   writes for synchronous swap and allowing filesystems to directly export
   their own swap_ops.
 
 - "mm/khugepaged: several cleanups" (Nico Pache):
 
   khugepaged accumulated redundant state-checking patterns and outdated
   comments following mTHP integration.  Introduce dedicated helpers for
   PTE validation and event counting while refreshing the internal
   documentation.
 
 - "maple_tree: lock checking and clean ups" (Liam Howlett):
 
   Syzbot reports incorrectly blame memory management exit paths for
   locking bugs, maple tree erase operations risk allocation failures
   without gfp flags and internal documentation lacks clarity.
 
   Improve lock error detection, update docs, fix race and allocation
   edge cases and optimize erase allocations using a fallback to GFP_KERNEL
   | GFP_NOFAIL.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCao9nJQAKCRDdBJ7gKXxA
 jk/9AQDlfevYJuSJmzAI8bt8ISG+/TfXMtIZC/MdbHqtQVYWPQD8Cvm3DUZsdGB/
 Gloq/HBFuMPgE8p2pwUIthdgnTPNvAc=
 =c+Nb
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

 - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
   (Lorenzo Stoakes)

   Index MAP_PRIVATE file-backed folios by their anonymous page offset
   to resolve confusion around reverse mapping for zeroed and CoW'd
   file-backed memory.

   Use this new VMA anonymous page offset tracking to eliminate index
   conflicts and lay the foundation for scalable CoW performance
   improvements.

 - "promote mapped executable folios after first usage for MGLRU"
   (Baolin Wang)

   Make MGLRU's protection of mapped executable file folios more
   reliable. Follow the classical LRU's logic, promoting mapped
   executable file folios after their first usage to give executable
   code a better chance to stay in memory and improve workload
   performance.

 - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong
   Chen)

   Fix per-node proactive reclaim interface's ignoring the swappiness
   parameter when CONFIG_MEMCG is disabled by consolidating
   sc_swappiness() into a single function that checks
   proactive_swappiness regardless of kernel configuration.

 - "mm/vmscan: reduce lru_lock contention via vmstat-derived
   scan-balance cost" (Usama Arif)

   Reduce lru_lock contention in the reclaim path by deriving
   scan-balance costs from vmstat counters rather than lock-acquired
   producer updates.

   Read and decay these cost signals on the reclaim side under a
   dedicated per-lruvec lock, reducing total LRU lock wait time by over
   60% without impacting scan throughput.

 - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky)

   Fix two low-risk zram bugs which Sashiko spotted in drive-by review.

 - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
   memcg" (Zi Yan)

   Fix xas_split_alloc() by enabling target folio memcg charging during
   splits and adding the missing __GFP_ACCOUNT flag for proper XArray
   node memory accounting.

 - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick)

   Replace hardcoded binary names in selftests/mm/.gitignore with a
   generic pattern-matching rule to automatically ignore generated test
   files and avoid manual updates when adding new tests.

 - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon)

   Make the incompatibility between FLATMEM and NUMA explicit in
   mm/Kconfig and remove the unused pgdat_page_ext_init() function.

 - "zram: fix zstd error paths and add parameter validation" (Haoqin
   Huang)

   Clean up zram compression backends by removing redundant error
   cleanup, adding parameter and dictionary validation, auto-prefixing
   algorithm error logs, and resetting parameters prior to
   reinitialization.

 - "zram: fix stale scan bounds after reinitialization" (Longlong Xia)

   Prevent out-of-bounds slot accesses during concurrent zram resets by
   moving table scan bound calculations under dev_lock in
   writeback_store() and read_block_state().

 - "add anon mTHP collapse test cases" (Baolin Wang)

   Extend selftests helper functions to support arbitrary page orders
   and add new test cases and options for mTHP collapse in khugepaged.

 - "selftests/mm: Handle unsupported and transient test conditions"
   (Muhammad Usama Anjum)

   Update MM selftests to report a SKIP status instead of a failure when
   required kernel or filesystem features are unsupported, while adding
   retry logic for transient page migration errors.

 - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia)

   Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
   and extend shrink_memcg() to support batch writeback for improved
   writeback efficiency.

 - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren
   Baghdasaryan)

   Introduce an IOCTL-based binary interface for memory allocation
   profiling that enables kernel-side filtering before per-CPU counter
   aggregation.

   This eliminates the text-parsing overhead of /proc/allocinfo and
   provides up to a 20x speedup by transferring only filtered allocation
   data to userspace.

 - "better block swap batching and a different take on swap_ops v5"
   (Christoph Hellwig)

   Refactor block swap I/O to use swap_iocb for batching instead of
   single-bio requests and rebase the swap_ops interface, achieving
   faster swap throughput during kernel builds.

 - "mm: kmemleak: reduce transient false positives by confirming leaks"
   (Catalin Marinas)

   Reduce false-positive kmemleak reports by combining two kmemleak
   enhancements that add a second confirmation scan and a configurable
   minimum unreferenced scan count module parameter.

 - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
   (Breno Leitao)

   Auto-scanning kernels can generate false-positive memory leak reports
   on single scans, so this patch defaults min_unref_scans to 2 when
   CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second
   confirming scan.

 - "swap_ops updates" (Christoph Hellwig)

   Batching I/O for synchronous swap devices causes performance
   regressions and filesystem-based swap suffers from double-indirection
   overhead. This series resolves both issues by reintroducing per-folio
   writes for synchronous swap and allowing filesystems to directly
   export their own swap_ops.

 - "mm/khugepaged: several cleanups" (Nico Pache)

   khugepaged accumulated redundant state-checking patterns and outdated
   comments following mTHP integration. Introduce dedicated helpers for
   PTE validation and event counting while refreshing the internal
   documentation.

 - "maple_tree: lock checking and clean ups" (Liam Howlett)

   Syzbot reports incorrectly blame memory management exit paths for
   locking bugs, maple tree erase operations risk allocation failures
   without gfp flags and internal documentation lacks clarity.

   Improve lock error detection, update docs, fix race and allocation
   edge cases and optimize erase allocations using a fallback to
   GFP_KERNEL | GFP_NOFAIL.

* tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits)
  selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
  memcg: move LRU size accounting on reparenting instead of copying it
  mm/vmscan: fix comment logic in balance_pgdat
  maple_tree: add helper mas_make_walkable()
  maple_tree: avoid extra gap calculation
  maple_tree: fix argument name in header
  maple_tree: change two GFP flags in tests
  maple_tree: document erase and allocations better
  maple_tree: avoid mas_erase() and mtree_erase() failures
  maple_tree: document that erase may use GFP_KERNEL for allocations
  maple_tree: catch race in mas_alloc_cyclic()
  maple_tree: add bulk parent set helper
  maple_tree: micro optimisation of mas_wr_store_type()
  maple_tree: optimise mas_wr_node_store() when not in rcu mode
  maple_tree: use prefetched value in mas_wr_store_type()
  maple_tree: clarify comments on mas_nomem()
  maple_tree: drop MAPLE_ALLOC_SLOTS
  maple_tree: drop dead code from mas_extend_spanning_null()
  maple_tree: documentation fix
  maple_tree: add write lock checking with lockdep sequence numbers
  ...
2026-08-27 09:17:06 -07:00
Linus Torvalds
93e4b3076b Char/Misc/IIO/etc driver update for 7.3-rc1
Here is the big set of char, misc, iio, counter, fpga, and other small
 driver subsystems for 7.3-rc1.
 
 Overall, due to some driver removals we only added a bit more code than
 removed, which was a nice change.  Highlights in this merge request are:
   - Loads of IIO driver updates and additions
   - binder driver updates (more on that below...)
   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall
   - Removal of the obsolete ibmasm driver as it's not being used anymore
   - Coresight driver updates and additions
   - Mei driver udpates
   - Counter driver updates
   - FPGA driver updates
   - ICC driver updates
   - lots and lots of other tiny driver updates to resolve reported
     issues
 
 All of these have been in linux-next for a while, with the only reported
 issues being some major merge conflicts.  Miguel pointed out some of
 these with the Rust tree merge, which is the majority of them.  I'll
 follow up with a diffstat of the merge resolution I made against your
 most recent tree, which works for me.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao143A8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymtUgCeKB62gT1JfA86cg3NDB1opp+10N0An3oBBegQ
 IJLqJgK45dTNtMGBwGFV
 =68af
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
2026-08-25 09:38:50 -07:00
Linus Torvalds
5f5ef9c407 Bootconfig updates for v7.3:
- bootconfig: Support build-time command line rendering for embedded bootconfig
   . bootconfig: render descendant keys when xbc_snprint_cmdline() root has a
     value. Fix xbc_snprint_cmdline() to render descendant keys when the root
     has both a value and subkeys, and treats empty subtrees correctly.
   . bootconfig: render embedded bootconfig as a kernel cmdline at build time.
     Add build-time pipeline using tools/bootconfig -C to render the embedded
     bootconfig "kernel" subtree into .init.rodata as a cmdline string.
   . bootconfig: clean build-time tools/bootconfig from make clean.
   . bootconfig: add xbc_prepend_embedded_cmdline() helper.
     Add helper to prepend embedded bootconfig cmdline into boot_command_line
     early before parse_early_param().
   . x86/setup: prepend embedded bootconfig cmdline before parse_early_param.
     Wire early prepend helper in x86 setup_arch() so early_param handlers see
     values from the embedded bootconfig. (So this feature is currently x86 only)
   . bootconfig: skip runtime kernel.* render once prepended early.
     Avoid duplicating "kernel" keys in setup_boot_config().
   . init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in.
     Refactor setup_boot_config() to share bootconfig_cmdline_requested().
   . Documentation: bootconfig: document build-time cmdline rendering.
     Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and precedence.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqNQwAbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bcLcH/1GHYfxZHrl1aA112j60
 YqBgn98hnCiH+Q1wMhqgDIF7ks1qePT9pq0zC2vJawVa1BM6OM5RpnC4BW+YSpCa
 7tRf209Hrr5sd2i0vmsnYpmd9SV9JWKsuyz6VJjFjPsfEFtI9Nj7d3jm7WfGypUc
 aNEAjf3sntEaFB44MoKekHlLzTXDFrgBaUaAcdw3aGjUU1CE9ltdT+QooQGv6CHe
 7Z+UlmGhg+jkQa1tNNpRnKZErD5OBLnTkoMU5ca3M7PQLlPjIcOTf62SInm47Ma/
 viOyzkSYIXC/yq2U4Je4qKcZaKhNIL61jtQGFI8EbbZ0x1BzVbPjbr0DB3iq2YW4
 4Xk=
 =8++3
 -----END PGP SIGNATURE-----

Merge tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull bootconfig updates from Masami Hiramatsu:

 - Support build-time command line building for embedded bootconfig

 - Fix xbc_snprint_cmdline() to render descendant keys when the root has
   both a value and subkeys, and treats empty subtrees correctly.

 - Add build-time pipeline using tools/bootconfig -C to render the
   embedded bootconfig "kernel" subtree into .init.rodata as a cmdline
   string.

 - Clean build-time tools/bootconfig from make clean

 - Add helper to prepend embedded bootconfig cmdline into
   boot_command_line early before parse_early_param()

 - Wire early prepend helper in x86 setup_arch() so early_param handlers
   see values from the embedded bootconfig (currently x86 only)

 - Avoid duplicating "kernel" keys in setup_boot_config()

 - Refactor setup_boot_config() to share bootconfig_cmdline_requested()

 - Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and
   precedence

* tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in
  bootconfig: skip runtime kernel.* render once prepended early
  x86/setup: prepend embedded bootconfig cmdline before parse_early_param
  Documentation: bootconfig: document build-time cmdline rendering
  bootconfig: add xbc_prepend_embedded_cmdline() helper
  bootconfig: clean build-time tools/bootconfig from make clean
  bootconfig: render embedded bootconfig as a kernel cmdline at build time
  bootconfig: render descendant keys when xbc_snprint_cmdline() root has a value
2026-08-25 08:59:09 -07:00
Liam R. Howlett (Oracle)
d17c749d32 maple_tree: add helper mas_make_walkable()
A check in mas_walk() was incorrect and caused inefficient use of the
maple state.  The same issue existed in mas_erase(), but was left unfixed.
Making a helper function is the obvious answer.

Link: https://lore.kernel.org/20260821192627.4085470-20-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:32 -07:00
Liam R. Howlett (Oracle)
4e4fe9d727 maple_tree: avoid extra gap calculation
Prior to ending the ascension loop of larger operations like split,
rebalance, and spanning store the gap in the node had been calculated. 
Once the node is inserted into the tree, the gap is recalculated in
mas_update_gap().  This can be avoided by creating a helper for
mas_update_gap() that accepts the known gap value, which reduces the
operations required for gap updating path.

Link: https://lore.kernel.org/20260821192627.4085470-19-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:32 -07:00
Liam R. Howlett (Oracle)
f1681380b5 maple_tree: avoid mas_erase() and mtree_erase() failures
Failures to remove entries using the two APIs to erase the entries may
result in allocation failures.  The failures may go unnoticed and an
unexpected entry may remain.  Instead, fall back to retrying with
GFP_KERNEL | __GFP_NOFAIL so that the entry will be removed.

Link: https://lore.kernel.org/20260821192627.4085470-15-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:31 -07:00
Liam R. Howlett (Oracle)
3f06ef1f34 maple_tree: document that erase may use GFP_KERNEL for allocations
State that the mas_erase() and mtree_erase() functions may use GFP_KERNEL
on allocation retry.  Don't just depend on people reading the
documentation by adding a check that will warn of the use.

Link: https://lore.kernel.org/20260821192627.4085470-14-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:31 -07:00
Liam R. Howlett (Oracle)
35f1342e5b maple_tree: catch race in mas_alloc_cyclic()
If mas_alloc_cyclic() is called during a low memory situation, it is
possible the lock may be dropped so reclaim can occur.  There is a window
where some other task may allocate the same id and cause the mas_insert()
to fail with -EEXIST.  In this scenario the function will return -EEXIST,
which is not expected.

Modifying the retry on mas_nomem() to re-search for a slot means that any
race with other writes will not matter as the lock will be held between
finding the index and writing the index.

Moving the flag logic avoids cases where the flag is modified on drop
lock/reacquire or when the write fails after clearing the flag.

No existing users are exposed to this issue.

Link: https://lore.kernel.org/20260821192627.4085470-13-liam@infradead.org
Fixes: 9b6713cc75 ("maple_tree: Add mtree_alloc_cyclic()")
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Reported-by: Chris Mason <clm@meta.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:30 -07:00
Liam R. Howlett (Oracle)
cf1f9bae5d maple_tree: add bulk parent set helper
Instead of calculating the parent pointer each time for a child, cache the
majority of the parent pointer and only change the slot per child.

Drop the mas_set_parent() function since the last user has been removed.

Testing on a tree containing 2048 entries of height 4 had an increased
gain of 3.51% on nodes tracking gaps.

Link: https://lore.kernel.org/20260821192627.4085470-12-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:30 -07:00
Liam R. Howlett (Oracle)
f0a3892cd7 maple_tree: micro optimisation of mas_wr_store_type()
Use three new local booleans instead of reading other structures.  This
has shown an increase of 0.62% on a 2048 entry tree of height 4.

Link: https://lore.kernel.org/20260821192627.4085470-11-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:30 -07:00
Liam R. Howlett (Oracle)
88f87f8812 maple_tree: optimise mas_wr_node_store() when not in rcu mode
Clearing the entire node on the stack is unnecessary since most of the
node will be overwritten anyways.  Just clear what isn't used after the
data is in place.

Benchmarking shows a speedup of 0.67% on a height 4 tree with 2048
entries.

Link: https://lore.kernel.org/20260821192627.4085470-10-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:30 -07:00
Liam R. Howlett (Oracle)
4bd59d5bc2 maple_tree: use prefetched value in mas_wr_store_type()
The slot contents exist in wr_mas->content, which has less overhead than
reading the slot again.

Link: https://lore.kernel.org/20260821192627.4085470-9-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:29 -07:00
Liam R. Howlett (Oracle)
7d1e343527 maple_tree: clarify comments on mas_nomem()
When an allocation completely fails, the return is false.  If the
allocation succeeds or partially succeeds, return true to indicate a retry
of the operation.  Note that since the lock may have been dropped, the
operation is retried from the start - including potentially allocating
more memory.

Link: https://lore.kernel.org/20260821192627.4085470-8-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:29 -07:00
Liam R. Howlett (Oracle)
acac9108a6 maple_tree: drop dead code from mas_extend_spanning_null()
mas_extend_spanning_null() had a clause if the end of the range being
written (mas->last) is the same as the end of the existing range it is
overwriting (wr_mas->r_max), action will be taken.

This code path is not possible because the only calling function
increments mas->last (unless it's ULONG_MAX) to walk to one beyond the
write and then resets the value back to the initial value.

In the case of mas->last == ULONG_MAX, then the second part of the
statement will always be false - mas->last cannot be less than the node
max.

This code never executed and is flawed anyways (the arguments are
incorrectly ordered), so removing it is the safest action.  Since the code
never executes, it is not fixing any issue so Fixes tag is not given.

Link: https://lore.kernel.org/20260821192627.4085470-6-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:28 -07:00
Liam R. Howlett (Oracle)
19e269917d maple_tree: add write lock checking with lockdep sequence numbers
Use the lockdep sequence numbers to ensure the write lock is not dropped
between write operations.  The lockdep sequence is recorded on any walk
that starts from the top of the tree and re-checked prior to any operation
using an active node.

When lockdep detects an issue, it sets debug_locks to 0 disabling further
reports.  __lock_sequnece() will return u32 ~0 when debug_locks is zero,
and the real sequnece count cannot return such a high value as it is less
than 32bits.

By always updating the sequence number, regardless of lock state and by
ignoring ~0 value in the sequence number will avoid ever printing a
WARN_ON when lockdep sets debug_locks to 0.

Link: https://lore.kernel.org/20260821192627.4085470-4-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Breno Leitao <leitao@debian.org>
Tested-by: Breno Leitao <leitao@debian.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:28 -07:00
Liam R. Howlett (Oracle)
9e32ec53b1 maple_tree: add rcu locking check when LOCKDEP is enabled
Patch series "maple_tree: lock checking and clean ups", v3.

In this series:
1. Try to detect lock issues
  A number of syzbot reports are incorrectly pointing to the mm exit as
  a source of the locking error.  The first three patches attempt to
  help users detect errors in their locking - but they still have to use
  LOCKDEP.  I guess it's still down to hope and prayers.

2. Documentation fixes
  The documentation was lacking clarity, there are updates to try and
  help the users, especially around the erase() cases.

3. Two benign issues
  The cyclic allocator may have a race, although no in-kernel user can
  hit it.
  The erase functions may cause allocation issues if used with the
  incorrect locking type, but none are present in-tree.

4. The erase gfp uses
  mas_erase() and mtree_erase() do not take a gfp argument.  To improve
  reliability of the erase, the first attempt to allocate will be
  GFP_NOWAIT, followed by a retry (if necessary of GFP_KERNEL |
  GFP_NOFAIL.  This will ensure the data is gone.  I've updated the
  documentation to make it more clear as well.  mas_store() is not
  addressed in the same way, but may need to be updated at a later date,
  but that may require changing callers so it is out of scope here.

Beyond these goals there are some test fixes, some general speed-up
patches targeting extra work and cycles, and dropping dead code.


This patch (of 19):

When CONFIG_LOCKDEP and CONFIG_RCU_STRICT_GRACE_PERIOD is enabled, check
for rcu locking issues by recording the grace period in the maple state
and checking the rcu window is still valid whenever the maple state is
reused with a state that is not MA_START or MA_PAUSED.

Link: https://lore.kernel.org/20260821192627.4085470-1-liam@infradead.org
Link: https://lore.kernel.org/20260821192627.4085470-2-liam@infradead.org
Signed-off-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Chuck Lever <cel@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joe Perches <joe@perches.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:27 -07:00
Qiang Liu
0d0878fd7c lib/test_hmm: fix garbage pfn and wrong direction in devmem fault debug
Move pr_debug() inside the `if (dpage)` block to avoid printing garbage
pfn for NULL dpage, and correct the direction label from "sys to dev" to
"dev to sys".

Link: https://lore.kernel.org/20260812092856.55296-1-liuqiangneo@163.com
Signed-off-by: Qiang Liu <liuqiang@kylinos.cn>
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:24 -07:00
Tejun Heo
f525001b33 percpu: drop CONFIG_DEBUG_FORCE_WEAK_PER_CPU
alpha requires percpu variables in modules to be defined as weak so that the
compiler generates GOT based external references for them. This puts two
extra restrictions on percpu variable definitions. The symbol must be
globally unique even when static and a static percpu variable can't be
defined inside a function. DEBUG_FORCE_WEAK_PER_CPU exists to give generic
code build coverage for these restrictions without building for alpha.

MEM_ALLOC_PROFILING defines a static percpu counter at each allocation call
site and thus can't be built with weak percpu definitions, so it depends on
!DEBUG_FORCE_WEAK_PER_CPU. As allmodconfig enables DEBUG_FORCE_WEAK_PER_CPU,
this knocks MEM_ALLOC_PROFILING out of allmodconfig build coverage.

allmodconfig coverage for MEM_ALLOC_PROFILING is worth more than build
coverage for restrictions which only matter to alpha module builds. Drop
DEBUG_FORCE_WEAK_PER_CPU. Restriction violations will now show up only on
alpha builds.

Link: https://lore.kernel.org/178656406317.2437052.7257990869957704195@slm.duckdns.org
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: Gabriele Monaco <gmonaco@redhat.com>	[include/rv/da_monitor.h]
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:24 -07:00
Mark Sercombe
cdd719b3f2 maple_tree: fix comment typo
Fix a spelling mistake n a code comment.  This is a comment only change
with no functional impact.

Link: https://lore.kernel.org/20260813183847.474357-1-sercombe.joel.mark@gmail.com
Signed-off-by: Mark Sercombe <sercombe.joel.mark@gmail.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:19 -07:00
Suren Baghdasaryan
1d581ab234 alloc_tag: add ioctl to /proc/allocinfo
Patch series "alloc_tag: introduce IOCTL-based filtering for MAP", v8.

Currently, memory allocation profiling data is primarily exposed through
/proc/allocinfo.  While useful for manual inspection, this text-based
interface poses challenges for production monitoring and large-scale
analysis:

1. Userspace must parse large amounts of text to extract specific
fields.
2. To find specific tags, userspace must read the entire dataset,
requiring many context switches and high data copying.
3. The kernel currently aggregates per-CPU counters for every allocation
size, even those the user intends to filter out immediately.

This series introduces a new IOCTL-based binary interface for allocinfo
that supports kernel-side filtering.  By allowing the user to specify a
filter mask, we significantly reduce the work performed in-kernel and the
amount of data transferred to userspace.  The IOCTL mechanism was chosen
for allocinfo to address the per-CPU counter aggregation bottleneck.  A
traditional read() operation must report the total allocation count and
sizes for every code tag in the system.  Doing so requires iterating
across all CPUs to sum their per-CPU counters for thousands of tags, which
introduces substantial runtime overhead.

The IOCTL interface allows userspace to push selective filtering criteria
directly into the kernel before the per-CPU counter aggregation.  The
kernel aggregates per-CPU counters only for a small subset of tags that
match the filter.  This results in significant performance improvement.

Beyond fast filtered retrieval, the IOCTL foundation allows introducing a
context capture mechanism in the future to capture the context for
specific allocations.

Performance measurements were conducted on an Intel Xeon Platinum 8481C
(224 CPUs) with caches dropped before each run.

The IOCTL mechanism shows a ~20x performance improvement for
filtered queries. The kernel avoids the expensive per-CPU counter
aggregation (alloc_tag_read) for any tags that fail the initial string
or location filters.

Scenario 1: Specific File Filtering (arch/x86/events/rapl.c)
1. Traditional (cat /proc/allocinfo | grep): 22ms (sys)
2. IOCTL Interface: 1ms (sys)

Scenario 2: Compound Filtering (Filename + Size)
1. Traditional: (cat ... | grep | awk): 21ms (sys)
2. IOCTL Interface: 1ms (sys)

Scenario 3: Size-Based Filtering (min_size = 1MB)
1. Traditional: (cat ... | awk): 21ms (sys)
2. IOCTL Interface: 14ms (sys)


This patch (of 6):

Add the following ioctl commands for /proc/allocinfo file:

ALLOCINFO_IOC_CONTENT_ID - gets content identifier which can be used to
check whether the file content has changed specifically due to module
load/unload.  Every time a module is loaded / unloaded, the returned value
will be different.  By comparing the identifier value at the beginning and
at the end of the content retrieval operation, users can validate
retrieved information for consistency.

ALLOCINFO_IOC_GET_AT - gets the record at the specified position.  This is
the position of a record in /proc/allocinfo.

ALLOCINFO_IOC_GET_NEXT - gets the record next to the last retrieved one. 
If no records were previously retrieved, returns the first record.

Note, function file and module names often have the same prefixes,
therefore when filtering for them, we compare the last 64 characters to
minimize the chances of name collisions.

[akpm@linux-foundation.org: include compat.h, per Suren]
  Closes: https://lore.kernel.org/oe-kbuild-all/202607091820.qbjlGhKK-lkp@intel.com/
Link: https://lore.kernel.org/cover.1783532853.git.abhishekbapat@google.com
Link: https://lore.kernel.org/15596de2607ef13e7c77c6d74763f4ae992ec475.1783532853.git.abhishekbapat@google.com
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Abhishek Bapat <abhishekbapat@google.com>
Acked-by: Hao Ge <hao.ge@linux.dev>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Sourav Panda <souravpanda@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:12 -07:00
Zhan Xusheng
36a9799b2c maple_tree: remove unused mas_is_root_limits()
The last callers of mas_is_root_limits() were removed by commit
b8852ef30c ("maple_tree: remove maple big node and subtree structs"),
together with the maple subtree state (mast_*) code that used it.  As a
static inline it does not trigger -Wunused-function, so it went unnoticed.

Remove it. No functional change.

Link: https://lore.kernel.org/20260805070529.4118794-1-zhanxusheng@xiaomi.com
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Liam R. Howlett (Oracle) <liam@infradead.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:08 -07:00
Zi Yan
789763523f xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
XArray operations that allocate xa_nodes, such as xas_nomem() and
xas_alloc(), add __GFP_ACCOUNT when the array has XA_FLAGS_ACCOUNT set. 
This charges the allocated memory and avoids the workingset convergence
issue described by commit 7b785645e8 ("mm: fix page cache convergence
regression").

xas_split_alloc() does not add _GFP_ACCOUNT when XA_FLAGS_ACCOUNT is
present.  Fix it.

Link: https://lore.kernel.org/20260804-add-gfp_account-to-xas_split_alloc-v3-2-38cb3ff325c5@nvidia.com
Fixes: 6b24ca4a1a ("mm: Use multi-index entries in the page cache")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: William Kucharski <william.kucharski@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:42:59 -07:00
Linus Torvalds
918e25291c slab changes for 7.3
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmqMSHQbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYiaC8EH/ihctMRDnqbUxyc3cSIZ
 cuy3ocSSu8UnHzSNarylY8sVYIYflgY6owV7UvaUKmXGYHiHIDdI5NMDzpjola7X
 Ct7mpIuobFHpFhTQMqvYkeEQ3EytS7NPHKs3jd6t2HSOYJdY4lghjRZcxOlo7+GA
 5EJa468TSHswWbT34e3NY7gpoHCXTucR6FBqoVtluLOliQWNMkWbeDQ9hEnMoyNy
 hEdooWDxt8vBuSqVRCZxrgJRK2nauf1P/CHZm4HcNttOQp0iwr8Q7GER7dBpW0jR
 1b1zM9YPH4g6CSll5V6sWSMUNAaDx3Akx3ZyKhd3G2kyP3HkPXKSag/fS8xxCFLN
 hh0=
 =6lTR
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab updates from Vlastimil Babka:

 - Add kfree_rcu_nolock() that can be used from contexts where spinning
   on a lock might be unsafe, such as a BPF program attached to an
   arbitrary function, or in NMI context. This complements the existing
   kfree_nolock() support (Harry Yoo)

 - Runtime instead of compile-time slabobj_ext sizing.

   Avoid wasting memory when memory allocation profiling is compiled but
   not enabled, with initial partial support to also avoid wasting
   memory for objcg pointers when those are not needed, while profiling
   is enabled (Vlastimil Babka)

 - Various non-urgent fixes, cleanups and optimizations (Hao Li,
   Hongling Zeng, Li RongQing, Li Xiasong, Seongjun Hong, Shengming Hu)

* tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (31 commits)
  mm/slab, kfence, memcg: completely remove obj_ext for kfence objects
  mm/slab: stop allocating objcg pointers when unnecessary
  mm/slab: add cache_ and slab_needs_objcg() helpers
  mm/slab: stop exporting kvfree_rcu_barrier[_on_cache]()
  slub_kunit: extend the test for kfree_rcu_nolock()
  mm/slab: introduce kfree_rcu_nolock()
  mm/slab: introduce struct kvfree_rcu_head for kvfree_rcu batching
  mm/slab: reduce slabobj_ext memory with allocation profiling disabled
  mm/slab: introduce slab_obj_ext_has_codetag()
  mm/slab: allow kfree_rcu_sheaf() on PREEMPT_RT
  mm/slab: extend deferred free mechanism to handle rcu sheaves
  mm/slab: use call_rcu() in unknown context if irqs are enabled
  mm/slab: handle the !allow_spin case in kfree_rcu_sheaf()
  mm/slab: change struct slabobj_ext to a union
  mm/slab: replace slab.stride with obj_exts_in_object
  mm/slab: abstract slabobj_ext.ref access
  mm/slab: abstract slabobj_ext.objcg access
  mm/slab: make slab_obj_ext() determine object index
  mm: move struct slabobj_ext to mm/slab.h
  mm/slab: remove objs_per_slab()
  ...
2026-08-24 10:58:57 -07:00
Linus Torvalds
e5f9260615 mm.git review status for master..mm-nonmm-stable
Total patches:       95
 Reviews/patch:       0.63
 Reviewed rate:       56%
 
 Summary of patch series in this merge:
 
 - "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam Vargas):
 
   Validate and bound all input lengths and count fields in the o2dlm
   migration and recovery receive handlers to prevent memory corruption and
   kernel panics from malformed cluster messages
 
 - "ocfs2: validate xattr entry bounds" (Cen Zhang):
 
   Validate OCFS2 extended attribute entry name and value bounds during
   metadata reads to prevent out-of-range memory accesses during retrieval
   or listing operations.
 
 - "taskstats: fix cgroupstats invalid fd handling and add selftests"
   (Yiyang Chen):
 
   Return -EBADF when cgroupstats receives an invalid file descriptor to
   prevent caller hangs and misleading success ACKs.  Add a kselftest to
   validate valid cgroup v1 queries and verify proper error handling across
   different Netlink flag combinations.
 
 - "misc lib/raid/ improvements v2" (Christoph Hellwig):
 
   Improve benchmark-based algorithm selection for the XOR and RAID6
   libraries, add KUnit benchmark tests, and cleanup minor implementation
   details.
 
 - "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi):
 
   Fix sleeping-in-atomic, lock order inversion and error-path cleanup
   bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping
   configfs_depend_item() calls and using unlocked variants from callback
   context.  Ensure failed pin attempts properly decrement user counts and
   unpin partially initialized heartbeat regions to prevent memory leaks
   and unprotected states.
 
 - "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()" (Vincent
   Mailhol)
 
   Fix an off-by-one which could cause an out-of-bounds read.
 
 - "ocfs2: harden heartbeat teardown races" (Cen Zhang):
 
   Fix two OCFS2 heartbeat/o2net teardown races found by KASAN.
 
 - "taskstats: tidy up the cpumask command path" *Bradley Morgan)
 
   make two small cleanups in kernel/taskstats.c.
 
 - "ocfs2: validate active orphan slots during inode read" (ZhengYuan Huang):
 
   Validate active ordinary and append-DIO orphan slots read from OCFS2
   dinodes at the metadata boundary to prevent corrupted slot indices from
   causing out-of-bounds array accesses.
 
 - "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng)
 
   Enforce strict boundary checks on directory entry record lengths and
   offset calculations during OCFS2 directory re-scans to prevent
   out-of-bounds memory reads and directory position corruption.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoo38wAKCRDdBJ7gKXxA
 jnKuAP9tIUJoYIzxG7zr00qJj95gczgE0+GikN1wXfO9Cvh8QAEAqr5InWrANTBB
 l4qW3/o4hM9TlBdr84oT3RNnvBicuwA=
 =BY1d
 -----END PGP SIGNATURE-----

Merge tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull non-MM updates from Andrew Morton:

 - "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam
   Vargas)

   Validate and bound all input lengths and count fields in the o2dlm
   migration and recovery receive handlers to prevent memory corruption
   and kernel panics from malformed cluster messages

 - "ocfs2: validate xattr entry bounds" (Cen Zhang)

   Validate OCFS2 extended attribute entry name and value bounds during
   metadata reads to prevent out-of-range memory accesses during
   retrieval or listing operations.

 - "taskstats: fix cgroupstats invalid fd handling and add selftests"
   (Yiyang Chen)

   Return -EBADF when cgroupstats receives an invalid file descriptor to
   prevent caller hangs and misleading success ACKs. Add a kselftest to
   validate valid cgroup v1 queries and verify proper error handling
   across different Netlink flag combinations.

 - "misc lib/raid/ improvements v2" (Christoph Hellwig)

   Improve benchmark-based algorithm selection for the XOR and RAID6
   libraries, add KUnit benchmark tests, and cleanup minor
   implementation details.

 - "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi)

   Fix sleeping-in-atomic, lock order inversion and error-path cleanup
   bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping
   configfs_depend_item() calls and using unlocked variants from
   callback context. Ensure failed pin attempts properly decrement user
   counts and unpin partially initialized heartbeat regions to prevent
   memory leaks and unprotected states.

 - "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()"
   (Vincent Mailhol)

   Fix an off-by-one which could cause an out-of-bounds read.

 - "ocfs2: harden heartbeat teardown races" (Cen Zhang)

   Fix two OCFS2 heartbeat/o2net teardown races found by KASAN.

 - "taskstats: tidy up the cpumask command path" *Bradley Morgan)

   make two small cleanups in kernel/taskstats.c.

 - "ocfs2: validate active orphan slots during inode read" (ZhengYuan
   Huang)

   Validate active ordinary and append-DIO orphan slots read from OCFS2
   dinodes at the metadata boundary to prevent corrupted slot indices
   from causing out-of-bounds array accesses.

 - "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng)

   Enforce strict boundary checks on directory entry record lengths and
   offset calculations during OCFS2 directory re-scans to prevent
   out-of-bounds memory reads and directory position corruption.

* tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (95 commits)
  mailmap: fix bouncing address for Taniya Das
  ocfs2: bound-check dir entries in the inline-data re-validation scan
  ocfs2: bound-check dir entries in the readdir re-validation scan
  squashfs: avoid thundering-herd cache wakeups
  prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
  mailmap: update email address for Linfeng Sun
  lib/interval_tree: fix allocation warning messages
  checkpatch: add NOKPROBE_SYMBOL to the whitelist of lines that can occur immediately after functions
  Squashfs: check block offset is not negative
  signal: factor out the kernel reserved si_code check
  ocfs2: fix readdir position truncation on 32-bit kernels
  ocfs2: fix cached cluster count after suballocator reclaim
  ocfs2: fix circular locking dependency in ocfs2_init_acl()
  ocfs2: validate DIO orphan slot during inode read
  ocfs2: validate orphan slot during inode read
  selftests/prctl: fix non-anonymous VMA mapping in set-anon-vma-name test
  MAINTAINERS: add IRC and patchwork for LTP
  include/linux/list.h: mark list_add and __list_add as __always_inline
  tools/mm: prevent page_owner_sort from truncating input
  hung_task: update DETECT_HUNG_TASK_BLOCKER Kconfig help
  ...
2026-08-23 08:07:11 -07:00
Linus Torvalds
4e69c1856b drm for 7.3-rc1
perf:
 - export perf_allow_ APIs for xe
 
 udmabuf:
 - remove default size limit of 64MB
 
 rust:
 - i/o rework (signed tag from driver-core tree)
 - add registration guard and registration data
 - fix unbounded lifetimes in ioctl handler args
 - fix a drm_dev_register race
 - gem_shmem: add DmaResvGuard helper
 - gpuvm: require send/sync for driver data
   - implement send/sync for GpuVaAlloc and GpuVmBo
   - add SmContext lifetime
 - rename dma_handle to dma_address
 - change pci_sriov_get_totalvfs return to unsigned int
 
 core:
 - create drm_of_get_panel_orientation
 - send per-connector hotplug events
 - add thunderbolt UBHR tunneling support
 
 connector:
 - add color format property
 
 dmem:
 - introduce a peak file
 - accept one region per limit
 - add dmemcg support for eviction
 
 gpusvm:
 - reorg code to give drivers more flexibility
 
 atomic:
 - add create_state callback and helper
 - add documentation on atomic commit lifetime
 
 buddy:
 - add per-order free
 - add used block scoreboard
 - fix UAF
 - test buffer clearance on resume
 - add phys_addr->block helper
 
 gem:
 - drop DRIVER_GEM_GPUVA flag
 
 ttm:
 - be more aggressive allocating below protection limit
 
 sched:
 - add test suite for concurrent job submissions
 
 hdmi:
 - hook the color format property in helpers
 
 mipi-dsi:
 - add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT
 
 bridge:
 - add atomic create callbacks
 - drop atomic reset
 - display-connector: don't autoenable HPD IRQ
 - trigger initial HPD for DP
 - ti-sn65dsi83: remove NO_HFP and NO_HBP mode flags
 - analogix_dp: switch to DP link training helpers
 
 dp:
 - add support for DSC max delta BPP
 
 edid:
 - parse panel type from DisplayID 2.x Display Parameters
 
 sysfb:
 - improve panel, stride, framebuffer size validation
 
 panel:
 - implement ref counting for struct drm_panel
 - himax-hx83121a: add backlight regulator support
 - novatek-nt36672a: Inline panel init sequences
 - visionox-vtdr6130: enable DSC
 - novatek-nt37801: Use mipi_dsi_*_multi() functions
 - samsung-s6d16d0: Fix prepare error handling
 - support Novatek NT36536 plus DT bindings
 - sofef00: fix backlight updates
 - osd101t2587: use mipi_dsi_*_multi interface
 - panel-edp: adjust timing for AUO displays
 - panel-lvds: support Opto Logic SCX1001511GGC49
 - panel-simple: support Kyocera tcg070wvlq
 - panel-edp: quirks
   - AUO B116XAT04.3, CMN N116BCP-EA2, CSW MNB601LS1-8
   - BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31
   - BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25
   - BOE NE160QDM-NY1, MB116AS01
 - new:
   - Samsung ATNA40HQ08-0, Anbernic TD4310
   - Chipone ICNA35XX, Ilitek ILI9488
   - Ilitek ILI7807S, Renesas R63419
   - MNE001BS6-2, MNF601BS4-1, Sharp LQ120P1JX51
 
 virtio:
 - add support for save/restore virtio_gpu_objects
 - abort vq wait on device removal
 
 amdgpu:
 - add color format DRM property
 - initial compute pipe reset support
 - add GFX 6-8 modifier support
 - initial DCN 6.0.0 support
 - dmemcg eviction support
 - improved boundary checking for bios parsing
 - RAS updates and rework
 - VCN secure submission fixes
 - 8K panel fix
 - Display KUNIT tests
 - parse panel type from DisplayID
 - Align IP discovery to pci device lifetime
 - SOC15 register macro cleanups
 - UVD memory placement fixes
 - GFX9 mode2 reset fixes
 - drop unnecessary BUG/BUG_ON
 - GFX8 soft reset rework
 - enable soft reset on GFX8
 - PSP/SMU 15.0.9 update
 - VI ASPM fix
 - userq fixes
 - amdgpu_vm_get_task_info_pasid lifetime fix
 - DC CACP support
 - change system_unbound_wq with system_dfl_wq
 - Loosen VFCT bios parsing to deal with pci=realloc
 - SI/SMU7 AC/DC switch fix
 - VM fence handling fix
 - GEM close optimisation
 - Apple Studio Display fixes
 - DC FRL fixes
 
 amdkfd:
 - initial compute pipe reset support
 - allow applications to opt out of sigbus on fatal errors
 - improve CRIU boundary checks
 - MQD handling rework
 - move TBA/TMA from system to device memory
 - avoid topology-lock in kfd_mmap
 - SVM eviction fixes
 
 radeon:
 - fix unset CONFIG_ACPI build
 
 i915:
 - Novalake (NVL display version 35) timing generator enabling
 - NVL DC3CO enabling
 - enable UBHR link rates on thunderbolt tunnels
 - Reduce Xe3+ PM demand peak bandwidth
 - enable pipe DMC error interrupts for display 30+
 - add kunit tests for DP link config selection
 - refactor and document DP link recovery
 - i915/xe driver display probe/remove/suspend/resume/shutdown cleanup and unification
 - i915/xe display runtime PM unified
 - Break i915 and xe panic dependency on struct intel_framebuffer
 - Streamline Pre/Post-CSC LUT loops
 - drop TGL DC3DO support
 - CDCLK santization
 - fix HDMI scrambling enable
 - fix phys bo pread/pwrite with offset
 - add missing nospec on parallel submit slot
 - fix some NULL derefs
 
 xe:
 - drop force_execlist module param
 - gate observation streams with perf_allow_cpu
 - skip FORCE_WC and vm_bound check for external dma-bufs
 - dmemcg eviction support
 - remove unused NVL-S GuC
 - TLB invalidation improvements
 - NVL-S updated PCI-IDs and w/a
 - madvise: optimise invalidation path
 - fix infinite gt-reset loop in timeout recovery
 - update TTM device benefical_order
 - wait on external BO kernel fences in exec ioctl
 - add/use more KLV helpers
 - sriov: disable display in admin only PF mode
 - add RAS GPU health indicator
 - optimise TTM populate for DONTNEED BO
 - drop force_probe for NVL-s
 - add debugfs for pcode info
 
 amdxdna:
 - disable device buffer export
 
 nova:
 - build nova-core/nova-drm from drivers/gpu
 - export nova-core rust symbols (workaround)
 - GSP boot process consolidation
 - Boot GSP with vGPU enabled
 - TLV firmware image format support
 - Hopper/Blackwell fixes and cleanups
 - I/O projection adoption
 
 tyr:
 - firmware loading and MCU boot
 - add generic slot manager + MMU
 - GPU VM support ARM64 LPAE page tables
 - add kernel buffer object for internal allocations
 - add parser for Mali CSF
 - add MCU booting
 
 nouveau:
 - race fixes
 - check instmem iomapping at first use
 - add dmemcg support
 - expose NVDEC channels
 - add scanline position/head state support for GSP
 
 qxl:
 - convert simple encoder to regular
 
 ethosu:
 - add perf counter support
 
 etnaviv:
 - force flush on power register ops
 
 msm:
 - support DSC configuration with slice_per_pkt > 1
 
 mxsfb:
 - fix disable sequence
 
 panthor:
 - support sparse mappings
 
 rockchip:
 - switch away from simple helpers
 - support YUV background color
 - fix layer config timeout
 - add edp support for rk3576
 - add batch command submission function
 
 rocket:
 - error handling and NULL ptr deref fixes
 
 sun4i:
 - switch away from simple helpers
 
 imagination:
 - mark BXM-4-64 MC1 as support
 
 host1x:
 - support tegra264
 
 tegra:
 - add DSI for tegra 20/30
 
 v3d:
 - reduce PM runtime autosuspend delay
 - scheduler fixes and refactoring
 - deprecate v3d 3.3 and 4.1
 - validate CPU job query boundaries
 
 hibmc:
 - improve plane format handling
 - switch to gem shmem
 
 mediatek:
 - cec: correct compat for mt7623-8167?
 
 exynos:
 - remove simple dependency
 - add error handling to encoder paths
 - take i2c adapter module reference
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqGlb0ACgkQDHTzWXnE
 hr7l9A//TnfntEghigEEFobfJX+p9FzaOTPPia8paooAj52OBK8Z86WpbYwEo4K9
 X+vPXPYpqgKSiGkkC33swAlylWs2v3JoZQ+CESERBk176Ql3ZKhicBINH+k8jIcX
 uaFoDgpgMoV1JCcvF/m48de8YRcejSN43rIucS0aIH5/r/YEyRsE4d4dzCXw/qD8
 92tjbmH20mChfeo8MUNatZx+t8ssSOrVdqouLmmFB8tYTcca6qwN60uA+9VESVtd
 nZLCEiZD0FUI73oT7fmK/zL2rTb2pZRPFNdz0mb6f7UUpu7f8RYnroHrNsGa/FHl
 K5RD1/gSVpfc6CbrhPnePaRKvIGeEC4ief8YRRyeoNVT3cmkf+citpOoKN2JajF1
 bub/ni2z1FGA3y1ckJb4Z6HmGHt5gki/KoAKCmZkJ7bb7WJq/JHMWEFfq4LuNjTA
 FSSxPozM4pb69DL02wwRJIEe8cYcc/gVTgrSkzR/tsVUoE6XI4AwZJ/Exa43+jVe
 hjNkAOMrl/+ma/WGQ4BPUVeTRPZP6RlNM4cSWvG1YA2Pf6+O+XLjukac6t+Ozj0X
 Fz1ePqYxELKSOYkZKxdpxRDyzY6SxvtyDHfHblo4p+BUvaXKP4wfNRexXETD6Qow
 P7rqYN6riDMRPI9CoPd25V7cbfYbvoV0iJzv3EQwU3pvB9Vu1ho=
 =TGZ1
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-08-20' of https://gitlab.freedesktop.org/drm/kernel

Pull drm updates from Dave Airlie:
 "Highlights:

   - dmemcg eviction support is good for low VRAM things like Steam
     Machine

   - AMD adds gfx6-8 modifier support for older GPUs that enables a
     bunch of wayland stuff

   - i915/xe has some new hw support but also a lot of display
     refactoring

  Everything:

  perf:
   - export perf_allow_ APIs for xe

  udmabuf:
   - remove default size limit of 64MB

  rust:
   - i/o rework (signed tag from driver-core tree)
   - add registration guard and registration data
   - fix unbounded lifetimes in ioctl handler args
   - fix a drm_dev_register race
   - gem_shmem: add DmaResvGuard helper
   - gpuvm: require send/sync for driver data
       - implement send/sync for GpuVaAlloc and GpuVmBo
       - add SmContext lifetime
   - rename dma_handle to dma_address
   - change pci_sriov_get_totalvfs return to unsigned int

  core:
   - create drm_of_get_panel_orientation
   - send per-connector hotplug events
   - add thunderbolt UBHR tunneling support

  connector:
   - add color format property

  dmem:
   - introduce a peak file
   - accept one region per limit
   - add dmemcg support for eviction

  gpusvm:
   - reorg code to give drivers more flexibility

  atomic:
   - add create_state callback and helper
   - add documentation on atomic commit lifetime

  buddy:
   - add per-order free
   - add used block scoreboard
   - fix UAF
   - test buffer clearance on resume
   - add phys_addr->block helper

  gem:
   - drop DRIVER_GEM_GPUVA flag

  ttm:
   - be more aggressive allocating below protection limit

  sched:
   - add test suite for concurrent job submissions

  hdmi:
   - hook the color format property in helpers

  mipi-dsi:
   - add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT

  bridge:
   - add atomic create callbacks
   - drop atomic reset
   - display-connector: don't autoenable HPD IRQ
   - trigger initial HPD for DP
   - ti-sn65dsi83: remove NO_HFP and NO_HBP mode flags
   - analogix_dp: switch to DP link training helpers

  dp:
   - add support for DSC max delta BPP

  edid:
   - parse panel type from DisplayID 2.x Display Parameters

  sysfb:
   - improve panel, stride, framebuffer size validation

  panel:
   - implement ref counting for struct drm_panel
   - himax-hx83121a: add backlight regulator support
   - novatek-nt36672a: Inline panel init sequences
   - visionox-vtdr6130: enable DSC
   - novatek-nt37801: Use mipi_dsi_*_multi() functions
   - samsung-s6d16d0: Fix prepare error handling
   - support Novatek NT36536 plus DT bindings
   - sofef00: fix backlight updates
   - osd101t2587: use mipi_dsi_*_multi interface
   - panel-edp: adjust timing for AUO displays
   - panel-lvds: support Opto Logic SCX1001511GGC49
   - panel-simple: support Kyocera tcg070wvlq
   - panel-edp: quirks
       - AUO B116XAT04.3, CMN N116BCP-EA2, CSW MNB601LS1-8
       - BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31
       - BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25
       - BOE NE160QDM-NY1, MB116AS01
   - new:
       - Samsung ATNA40HQ08-0, Anbernic TD4310
       - Chipone ICNA35XX, Ilitek ILI9488
       - Ilitek ILI7807S, Renesas R63419
       - MNE001BS6-2, MNF601BS4-1, Sharp LQ120P1JX51

  virtio:
   - add support for save/restore virtio_gpu_objects
   - abort vq wait on device removal

  amdgpu:
   - add color format DRM property
   - initial compute pipe reset support
   - add GFX 6-8 modifier support
   - initial DCN 6.0.0 support
   - dmemcg eviction support
   - improved boundary checking for bios parsing
   - RAS updates and rework
   - VCN secure submission fixes
   - 8K panel fix
   - Display KUNIT tests
   - parse panel type from DisplayID
   - Align IP discovery to pci device lifetime
   - SOC15 register macro cleanups
   - UVD memory placement fixes
   - GFX9 mode2 reset fixes
   - drop unnecessary BUG/BUG_ON
   - GFX8 soft reset rework
   - enable soft reset on GFX8
   - PSP/SMU 15.0.9 update
   - VI ASPM fix
   - userq fixes
   - amdgpu_vm_get_task_info_pasid lifetime fix
   - DC CACP support
   - change system_unbound_wq with system_dfl_wq
   - Loosen VFCT bios parsing to deal with pci=realloc
   - SI/SMU7 AC/DC switch fix
   - VM fence handling fix
   - GEM close optimisation
   - Apple Studio Display fixes
   - DC FRL fixes

  amdkfd:
   - initial compute pipe reset support
   - allow applications to opt out of sigbus on fatal errors
   - improve CRIU boundary checks
   - MQD handling rework
   - move TBA/TMA from system to device memory
   - avoid topology-lock in kfd_mmap
   - SVM eviction fixes

  radeon:
   - fix unset CONFIG_ACPI build

  i915:
   - Novalake (NVL display version 35) timing generator enabling
   - NVL DC3CO enabling
   - enable UBHR link rates on thunderbolt tunnels
   - Reduce Xe3+ PM demand peak bandwidth
   - enable pipe DMC error interrupts for display 30+
   - add kunit tests for DP link config selection
   - refactor and document DP link recovery
   - i915/xe driver display probe/remove/suspend/resume/shutdown cleanup
     and unification
   - i915/xe display runtime PM unified
   - Break i915 and xe panic dependency on struct intel_framebuffer
   - Streamline Pre/Post-CSC LUT loops
   - drop TGL DC3DO support
   - CDCLK santization
   - fix HDMI scrambling enable
   - fix phys bo pread/pwrite with offset
   - add missing nospec on parallel submit slot
   - fix some NULL derefs

  xe:
   - drop force_execlist module param
   - gate observation streams with perf_allow_cpu
   - skip FORCE_WC and vm_bound check for external dma-bufs
   - dmemcg eviction support
   - remove unused NVL-S GuC
   - TLB invalidation improvements
   - NVL-S updated PCI-IDs and w/a
   - madvise: optimise invalidation path
   - fix infinite gt-reset loop in timeout recovery
   - update TTM device benefical_order
   - wait on external BO kernel fences in exec ioctl
   - add/use more KLV helpers
   - sriov: disable display in admin only PF mode
   - add RAS GPU health indicator
   - optimise TTM populate for DONTNEED BO
   - drop force_probe for NVL-s
   - add debugfs for pcode info

  amdxdna:
   - disable device buffer export

  nova:
   - build nova-core/nova-drm from drivers/gpu
   - export nova-core rust symbols (workaround)
   - GSP boot process consolidation
   - Boot GSP with vGPU enabled
   - TLV firmware image format support
   - Hopper/Blackwell fixes and cleanups
   - I/O projection adoption

  tyr:
   - firmware loading and MCU boot
   - add generic slot manager + MMU
   - GPU VM support ARM64 LPAE page tables
   - add kernel buffer object for internal allocations
   - add parser for Mali CSF
   - add MCU booting

  nouveau:
   - race fixes
   - check instmem iomapping at first use
   - add dmemcg support
   - expose NVDEC channels
   - add scanline position/head state support for GSP

  qxl:
   - convert simple encoder to regular

  ethosu:
   - add perf counter support

  etnaviv:
   - force flush on power register ops

  msm:
   - support DSC configuration with slice_per_pkt > 1

  mxsfb:
   - fix disable sequence

  panthor:
   - support sparse mappings

  rockchip:
   - switch away from simple helpers
   - support YUV background color
   - fix layer config timeout
   - add edp support for rk3576
   - add batch command submission function

  rocket:
   - error handling and NULL ptr deref fixes

  sun4i:
   - switch away from simple helpers

  imagination:
   - mark BXM-4-64 MC1 as support

  host1x:
   - support tegra264

  tegra:
   - add DSI for tegra 20/30

  v3d:
   - reduce PM runtime autosuspend delay
   - scheduler fixes and refactoring
   - deprecate v3d 3.3 and 4.1
   - validate CPU job query boundaries

  hibmc:
   - improve plane format handling
   - switch to gem shmem

  mediatek:
   - cec: correct compat for mt7623-8167?

  exynos:
   - remove simple dependency
   - add error handling to encoder paths
   - take i2c adapter module reference"

* tag 'drm-next-2026-08-20' of https://gitlab.freedesktop.org/drm/kernel: (2074 commits)
  drm/xe/mcr: Take vcs1/vecs1 into account for first media slice
  drm/xe: Fix a bug in pc_adjust_freq_bounds()
  drm/xe: Fix xe_device_probe() failure
  drm/xe/drm_ras: Move has_drm_ras check to drm_ras layer
  drm/xe/ras: Fix boot-time ras error processing
  drm/amd/display: make DC_RUN_WITH_PREEMPTION_ENABLED misuse a build error
  drm/amd/pm: silence uninitialized variable warnings
  drm/amdgpu: skip BOs being torn down during GTT recovery
  drm/amdgpu: Reject UVD message with invalid number of h265 refs
  drm/amdgpu: keep PRT mappings off the vm_bo state lists
  drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
  drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
  drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
  drm/amdgpu: Implement insert_end for VCE 3
  drm/amdgpu: Fix UVD min buffer sizes
  drm/amdgpu: Fix UVD decode image min size calculation
  drm/amdgpu: Fix UVD dpb min size calculation for H264
  drm/amdgpu: Reject UVD message with dimensions above 4096
  drm/amdgpu: check ASPM on the dGPU host link
  drm/radeon: fix autosuspend cleanup during teardown
  ...
2026-08-21 08:41:00 -07:00
Linus Torvalds
ed3b875bea mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
 
 Total patches:       501
 Reviews/patch:       1.66
 Reviewed rate:       70%
 
 Excluding DAMON:
 
 Total patches:       356
 Reviews/patch:       2.26
 Reviewed rate:       90%
 
 Excluding DAMON and selftests:
 
 Total patches:       329
 Reviews/patch:       2.31
 Reviewed rate:       92%
 
 Excluding DAMON, selftests and maple_tree:
 
 Total patches:       328
 Reviews/patch:       2.31
 Reviewed rate:       92%
 
 Summary of patch series in this merge:
 
 - The 2 patch series "mm: drop "sub" prefix from various places" from
   Dev Jain implements some page->folio conversion and a naming cleanup.
 
 - The 2 patch series "mm/kasan: remove redundant initialization for
   kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
 
 - The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
   from Chi Zhiling provides a small speedup in the pagecaache read code.
 
 - The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
   recursion" from Kaitao Cheng improves a few things in the vmalloc code -
   mainly the avoidance of GFP_KERNEL allocations when the caller asked for
   GFP_NOFS or GFP_NOIO.
 
 - The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
   stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
   kmemleak scanning code in extreme situations.
 
 - The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
   collection of unrelated cleanups to the page_owner code.  For some
   reason lots of people have been working on the page_owner code this
   cycle.
 
 - The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
   find_vma()" from Kefeng Wang simplifies and accelerates the page walking
   library function.
 
 - The 3 patch series "mm/migrate: preparatory cleanups for batch copy
   and offload" from Shivank Garg implements cleanups in the migration
   code.
 
 - The 4 patch series "mm/page_owner: add per-fd filter infrastructure
   for print_mode and NUMA filtering" from Zhen Ni provides per-fd
   filtering to page_owner in order to reduce the sometimes vast amount of
   output it can produce.
 
 - The 19 patch series "mm: Refactor bootmem gigantic hugepage
   allocation" from Muchun Song is a "set of fixes and preparatory cleanups
   around bootmem HugeTLB handling, sparse initialization ordering, and
   related vmemmap setup".
 
 - The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
   from Wenchao Hao reduces lock contention in zs_free(), which dominates
   the unmap path under memory pressure on Android (LMK kills) and on x86
   servers running zswap-heavy workloads.  Up to 1.83x improvement in
   microbenchmarking.
 
 - The 2 patch series "move alloc_tag.c file under mm/" from Suren
   Baghdasaryan does that.
 
 - The 6 patch series "samples/damon: handle damon_{start,stop}()
   failures" from SJ Park fixes improper handling of damon_start(),
   damon_stop(), and damon_call() failures across DAMON sample modules to
   prevent potential memory leaks, operation disruptions and use-after-free
   bugs.
 
 - The 11 patch series "mm/damon/sysfs: kobject_del() directories that
   users can create/remove" from SJ Park resolves an issue where delayed
   sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
   creation failures due to duplicate directory names by adding missing
   kobject_del() calls before creating new directories.
 
 - The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
   David Hildenbrand cleans up the core pte handling code.
 
 - The 3 patch series "selftests/damon: misc fixes for test bugs" from
   Kunwu Chan fixes several bugs in the DAMON selftests.
 
 - The 2 patch series "selftests/damon: fix memcg_path staging handling"
   from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
   memcg_path setup, and adds a test case for it in sysfs.py.
 
 - The 2 patch series "selftests/damon: test kdamond refresh_ms" from
   Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
   feature by updating the test control module and verifying that scheme
   stats update automatically without manual intervention.
 
 - The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
   contains miscellaneous DAMON fixups.
 
 - The 2 patch series "mm/damon/core: detect internal variation above
   max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
   behavior when region counts exceed half the maximum budget by
   dynamically scaling down the split fraction as the limit approaches,
   preventing large regions from staying un-split, and adds corresponding
   KUnit test coverage.
 
 - The 6 patch series "mm: preparatory patches for PMD level swap
   entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
   call sites, and architecture flags to lay the groundwork for a follow-up
   series that introduces PMD page table swap entries.
 
 - The 11 patch series "mm/damon: update, optimize, and clean up doc,
   tests, and code" from SJ Park updates DAMON design and ABI
   documentation, expands unit and selftest coverage, optimizes
   damon_commit_target_regions(), and cleans up recently added sysfs
   interface code for better readability.
 
 - The 2 patch series "mm/vmpressure: reduce CPU, memory and code
   overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
   skipping unnecessary work on cgroup v2 for userspace event notifications
   and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
   memory overhead and code complexity.
 
 - The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
   error handling" from Hongfu Li refactors pkeys shared tracing and
   assertion helpers into a common file, unifies protection key selftests
   to use consistent diagnostic logging and assertions, and enforces
   standardized MAP_FAILED return checks for mmap() calls across the tests.
 
 - The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
   Park replaces the error-prone, continuously updated nr_accesses_bp field
   in damon_region with an on-demand moving sum function
   (damon_nr_accesses_mvsum()), reducing structure memory overhead and
   avoiding state corruption bugs.
 
 - The 6 patch series "Open HugeTLB allocation routine for more generic
   use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
   dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
   like guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs.
 
 - The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
   from SJ Park integrates DAMON's probe_hits attribute counter into the
   pseudo moving sum infrastructure, enabling real-time, online monitoring
   without waiting for full aggregation intervals.
 
 - The 18 patch series "mm: Some cleanups for page allocator APIs" from
   Brendan Jackman simplifies and refactors the page allocator entry points
   and flags by unifying allocation paths, adding internal alloc_flags
   arguments, and eliminating redundant __ prefixed alloc_pages variants.
 
 - The 5 patch series "Fix incorrect access of hugetlb pte entries" from
   Dev Jain enforces the consistent use of huge_ptep_get() instead of
   ptep_get() for HugeTLB entries and fixes an unaligned address issue in
   arm64's huge_ptep_get() implementation.
 
 - The 8 patch series "mm/damon: validate all parameters in the core"
   from SJ Park consolidates parameter validation into the DAMON core
   specifically within damon_start() and damon_commit_ctx() to centralize
   error checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency.
 
 - The 3 patch series "tools/mm/page_owner_sort: fix filtering and
   cleanup issues" from Yichong Chen renames is_need() to filter_record()
   for clearer return semantics, fixes per-record allocation memory leaks
   and bounds output copies in search_pattern() to address an existing
   buffer issue.
 
 - The 4 patch series "memcg: bail out reclaim when memcg is dying" from
   Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
   removed while one of its memory control files is doing synchronous
   reclaim.
 
 - The 5 patch series "mm/memory-failure: add panic option for
   unrecoverable pages" from Breno Leitao introduces an opt-in
   vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
   the kernel on unrecoverable memory errors in kernel-owned pages to
   preserve error context and prevent delayed, silent data corruption.
 
 - The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
   for simple error handling" from SJ Park refactors the DAMON core API
   functions to guarantee that all contexts are fully stopped when
   damon_start(), damon_stop(), or damon_commit() fail, eliminating the
   need for complex and error-prone caller-side cleanup code.
 
 - The 5 patch series "Keep tail page private zero at free and folio
   split" from Zi Yan adds checks to ensure tail_page->private is zero when
   freeing compound or high-order pages and when promoting tail pages
   during large folio splits.  By validating these fields at free and split
   time, it allows the removal of redundant private field clearing inside
   prep_compound_tail().
 
 - The 4 patch series "mm: drop redundant lru_add_drain in anon folio
   reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
   in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead.
 
   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads.
 
 - The 3 patch series "mm: clean up folio LRU and swap declarations" from
   Jianyue Wu reorganizes folio LRU and swap code by relocating
   page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
   and moving MM-internal reclaim declarations into mm/internal.h.
 
 - The 15 patch series "userfaultfd: working set tracking for VM guest
   memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
   working set of VM guest memory, so a VMM can identify hot pages and
   reclaim cold ones to tiered or remote storage.
 
 - The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
   2)" from David Hildenbrand removes the remaining pieces of
   CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
   freeing of reserved vmemmap pages on the way.
 
 - The 7 patch series "mm/damon: update probe hits for runtime parameter
   commits" from SJ Park ensures that DAMON's probe_hits attribute counter
   is properly updated when monitoring intervals are changed at runtime,
   matching the behavior of nr_accesses.  To achieve this, it refactors and
   renames existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.
 
 - The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
   from xu xin resolves a severe KSM reverse-mapping performance bottleneck
   where thousands of split VMAs sharing a single anon_vma cause extended
   lock contention.  By adding an interval-filtering check during the rmap
   walk, it reduces worst-case anon_vma lock hold times from over 500ms
   down to under 2ms, preventing application freezes and latency spikes
   under memory pressure.
 
 - The 3 patch series "mm: split a couple of headers from internal.h"
   from Mike Rapoport splits declarations related to mm_init, memblock,
   vmalloc and sparse into new headers.
 
 - The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
   from xu xin applies the interval tree optimization from rmap_walk_ksm()
   to collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.  It hoists loop-invariant address
   initialization and restricts the anon_vma_interval_tree_foreach walk to
   a targeted page offset range, reducing redundant checks and improving
   lookup efficiency.
 
 - The 3 patch series "selftests/mm: avoid false failures in hugetlb and
   KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
   selftest categories that can report failures when the prerequisites for
   the tests are not satisfied.
 
 - The 19 patch series "mm/damon: introduce data attributes only
   monitoring" from SJ Park introduces attribute-weighted region management
   in DAMON, allowing users to prioritize specific data attributes (such as
   page sizes or cgroups) over or instead of access monitoring.
 
   By assigning weights to attribute probes, DAMON can completely disable
   access tracking and adjust monitoring regions based on weighted
   probe-hit counters to optimize monitoring quality for attribute-focused
   workloads.
 
 - The 8 patch series "mm/hmm: Add mmap lock-drop support for
   userfaultfd-backed mappings" from Stanislav Kinsburskii extends
   hmm_range_fault() to support userfaultfd-backed regions by allowing the
   mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.
 
   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd regions
   while preserving backward compatibility for existing callers.
 
 - The 33 patch series "mm: make VMA page offset handling more
   consistent" from Lorenzo Stoakes cleans up and standardizes how
   vma->vm_pgoff is accessed and manipulated across file-backed and
   anonymous mappings in the kernel.
 
   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
   rmap interval tree helpers to better reflect their functionality.
 
   These changes establish a cleaner foundation for future work that will
   unify virtual page offset indexing for all anonymous and CoW'd folios.
 
 - The 3 patch series "mm: handle device-private PMDs in walk callbacks"
   from Usama Arif addresses kernel panics and state corruption caused by
   MM walk callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations.
 
   It ensures that functions which acquire pmd_trans_huge_lock() properly
   recognize device-private PMDs instead of assuming a present THP or a
   standard migration entry.
 
 - The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
   refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
   and anonymous-swapbacked logic into dedicated functions, laying the
   structural groundwork for batched anonymous large folio unmapping.
 
 - The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
   additions" from Song Hu fixes typos and fills in missing entries in the
   DAMON sysfs ABI document.
 
 - The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
   from Gregory Price introduces an atomic sysfs state attribute and
   supporting DAX/MM infrastructure to prevent userland races when
   offlining and removing entire memory regions.
 
   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.
 
 - The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
   from Lorenzo Stoakes continues transitioning the kernel from the
   deprecated vm_flags_t type to vma_flags_t across core memory management
   infrastructure.
 
   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.
 
 - The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
   xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
   duplicate slot deletion sequences in khugepaged and KSM.  It also adds
   code documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.
 
 - The 10 patch series "mm/damon/core: hide core-private struct fields"
   from SJ Park cleans up DAMON core structures by consistently marking
   internal-only fields with private: comment tags to prevent improper
   direct access from outer layers.
 
   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.
 
 - The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
   de-ref and races" from SJ Park addresses potential infinite loops, NULL
   dereferences, and race conditions identified in DAMON.
 
   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.
 
 - The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
   RT/UP" from Brendan Jackman fixes an NMI safety flaw in
   __free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
   kernels can bypass can_spin_trylock() checks via non-PCP or isolated
   migration paths.
 
   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.
 
 - The 4 patch series "mm/page_alloc: couple of followups for recent
   cleanups" from Brendan Jackman cleans up and updates page allocator
   nomenclature, documentation, and debug assertions.
 
   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
   assertions in allocation paths.
 
 - The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
   refactors and simplifies the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.
 
   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
   mm_struct parameters to enforce that sealing applies only to
   current->mm, and streamlines overall logic and comments with no
   functional changes intended.
 
 - The 4 patch series "mm/vmscan: fix swappiness=max and clean up
   per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
   bugs and cleans up function parameters across memory reclaim paths.
 
   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead of
   collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
   parameter from __node_reclaim().
 
 - The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
   cleans up and simplifies the mincore code.  Most importantly, it removes
   the historical special behavior that always reports VM_PFNMAP pages as
   non-resident.
 
 - The 2 patch series "mm/huge_memory: drop dead split helper variants"
   from Kiryl Shutsemau implements two trivial cleanups in the folio split
   API.
 
 - The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
   exec expectation bugs" from SJ Park resolves minor operational and
   testing bugs in DAMON identified by Sashiko.  It initializes the
   damos->last_applied field to prevent occasional efficiency degradation
   and fixes invalid memory accesses in DAMON KUnit tests during test
   failure handling.
 
 - The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
   cleans up and refactors stable_page_flags() used by /proc/kpageflags
   without altering functionality.
 
   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
 
 - The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
   extends batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
   to pte_install_uffd_wp_if_needed().
 
   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.
 
 - The 3 patch series "mm/early_ioremap: clarify and clean up
   early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
   architecture-specific usage of __late_set_fixmap() and
   __late_clear_fixmap() after early_ioremap_reset().
 
   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset calls
   in the RISC-V and ARM64 architectures.
 
 - The 4 patch series "mm: fix reclaim storms in defrag_mode" from
   Johannes Weiner addresses severe performance regressions, swap storms,
   and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
   in Meta production.
 
   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.
 
 - The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
   optimizes and fixes lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolating lock classes across multiple instances.
 
   It reduces memory overhead by replacing per-entry lockdep_map instances
   with a single map per struct zram, and assigns a dynamic lock_class_key
   to each instance to prevent false deadlock reports when different zram
   devices are backed by distinct filesystems.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
 jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
 THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
 =QTyb
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

 - "mm: drop "sub" prefix from various places" (Dev Jain)

   page->folio conversion and a naming cleanup

 - "mm/kasan: remove redundant initialization for kasan_flag_write_only"
   (Igor Putko)

   KASAN cleanup work

 - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)

   Small speedup in the pagecaache read code

 - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)

   Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
   allocations when the caller asked for GFP_NOFS or GFP_NOIO

 - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
   Leitao)

   Avoid a soft lockup watchdog trigger from the kmemleak scanning code
   in extreme situations

 - "mm/page_owner: misc cleanups" (Ye Liu)

   Cleanups to the page_owner code. For some reason lots of people have
   been working on the page_owner code this cycle.

 - "mm: convert to walk_page_range_vma() to eliminate find_vma()"
   (Kefeng Wang)

   Simplify and accelerate the page walking library function

 - "mm/migrate: preparatory cleanups for batch copy and offload"
   (Shivank Garg)

   Cleanups in the migration code

 - "mm/page_owner: add per-fd filter infrastructure for print_mode and
   NUMA filtering" (Zhen Ni)

   Per-fd filtering to page_owner in order to reduce the sometimes vast
   amount of output it can produce

 - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)

   Fixes and preparatory cleanups around bootmem HugeTLB handling,
   sparse initialization ordering, and related vmemmap setup

 - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)

   Reduce lock contention in zs_free(), which dominates the unmap path
   under memory pressure on Android (LMK kills) and on x86 servers
   running zswap-heavy workloads.

   Up to 1.83x improvement in microbenchmarking.

 - "move alloc_tag.c file under mm/" (Suren Baghdasaryan)

 - "samples/damon: handle damon_{start,stop}() failures" (SJ Park)

   Fix improper handling of damon_start(), damon_stop(), and
   damon_call() failures across DAMON sample modules to prevent
   potential memory leaks, operation disruptions and use-after-free
   bugs

 - "mm/damon/sysfs: kobject_del() directories that users can
   create/remove" (SJ Park)

   Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
   causeing creation failures due to duplicate directory names by adding
   missing kobject_del() calls before creating new directories

 - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)

   Clean up the core pte handling code

 - "selftests/damon: misc fixes for test bugs" (Kunwu Chan)

   Fix several bugs in the DAMON selftests

 - "selftests/damon: fix memcg_path staging handling" (Cheng Nie)

   Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
   add a test case for it in sysfs.py.

 - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)

   Selftest coverage for DAMON's refresh_ms sysfs feature by updating
   the test control module and verifying that scheme stats update
   automatically without manual intervention

 - "mm/damon: five misc fixups" (Akinobu Mita)

   Miscellaneous DAMON fixups.

 - "mm/damon/core: detect internal variation above max_nr_regions/2"
   (Jiayuan Chen)

   Fix DAMON's region splitting behavior when region counts exceed half
   the maximum budget by dynamically scaling down the split fraction as
   the limit approaches, preventing large regions from staying un-split,
   and add corresponding KUnit test coverage

 - "mm: preparatory patches for PMD level swap entries" (Usama Arif)

   Refactor and clean up PMD softleaf helpers, call sites, and
   architecture flags to lay the groundwork for a follow-up series that
   introduces PMD page table swap entries

 - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
   Park)

   Update DAMON design and ABI documentation, expands unit and selftest
   coverage, optimize damon_commit_target_regions(), and clean up
   recently added sysfs interface code for better readability

 - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
   (Usama Arif)

   Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
   userspace event notifications and refactor v1-only eventfd handling
   into mm/memcontrol-v1.c to reduce memory overhead and code complexity

 - "selftests/mm: refactor pkey helpers and fix mmap error handling"
   (Hongfu Li)

   Refactor pkeys shared tracing and assertion helpers into a common
   file, unify protection key selftests to use consistent diagnostic
   logging and assertions, and enforce standardized MAP_FAILED return
   checks for mmap() calls across the tests

 - "mm/damon: optimize out nr_accesses_bp" (SJ Park)

   Replace the error-prone, continuously updated nr_accesses_bp field in
   damon_region with an on-demand moving sum function, reducing
   structure memory overhead and avoiding state corruption bugs

 - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)

   Decouple HugeTLB folio allocation from VMA dependencies by
   introducing hugetlb_alloc_folio(), enabling subsystems like
   guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs

 - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)

   Integrate DAMON's probe_hits attribute counter into the pseudo moving
   sum infrastructure, enabling real-time, online monitoring without
   waiting for full aggregation intervals

 - "mm: Some cleanups for page allocator APIs" (Brendan Jackman)

   Simplify and refactor the page allocator entry points and flags by
   unifying allocation paths, adding internal alloc_flags arguments, and
   eliminating redundant __ prefixed alloc_pages variants.

 - "Fix incorrect access of hugetlb pte entries" (Dev Jain)

   Enforce the consistent use of huge_ptep_get() instead of ptep_get()
   for HugeTLB entries and fixes an unaligned address issue in arm64's
   huge_ptep_get() implementation

 - "mm/damon: validate all parameters in the core" (SJ Park)

   Consolidate parameter validation into the DAMON core specifically
   within damon_start() and damon_commit_ctx() to centralize error
   checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency

 - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
   Chen)

   Rename is_need() to filter_record() for clearer return semantics, fix
   per-record allocation memory leaks and bound output copies in
   search_pattern() to address an existing buffer issue

 - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)

   Mitigate a system-wide stall which occurs when a cgroup is removed
   while one of its memory control files is doing synchronous reclaim

 - "mm/memory-failure: add panic option for unrecoverable pages" (Breno
   Leitao)

   Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
   that immediately panics the kernel on unrecoverable memory errors in
   kernel-owned pages to preserve error context and prevent delayed,
   silent data corruption

 - "mm/damon: refactor damon_{start,stop,commit}() for simple error
   handling" (SJ Park)

   Refactor the DAMON core API functions to guarantee that all contexts
   are fully stopped when damon_start(), damon_stop(), or damon_commit()
   fail, eliminating the need for complex and error-prone caller-side
   cleanup code

 - "Keep tail page private zero at free and folio split" (Zi Yan)

   Add checks to ensure tail_page->private is zero when freeing compound
   or high-order pages and when promoting tail pages during large folio
   splits. By validating these fields at free and split time, it allows
   the removal of redundant private field clearing inside
   prep_compound_tail()

 - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
   Song)

   Eliminate redundant lru_add_drain() calls in
   wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead

   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads

 - "mm: clean up folio LRU and swap declarations" (Jianyue Wu)

   Reorganize folio LRU and swap code by relocating page-cluster state
   to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
   MM-internal reclaim declarations into mm/internal.h.

 - "userfaultfd: working set tracking for VM guest memory" (Kiryl
   Shutsemau)

   Add userfaultfd support for tracking the working set of VM guest
   memory, so a VMM can identify hot pages and reclaim cold ones to
   tiered or remote storage

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
   Hildenbrand)

   Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   performing some smaller cleanups around freeing of reserved vmemmap
   pages on the way.

 - "mm/damon: update probe hits for runtime parameter commits" (SJ Park)

   Ensure that DAMON's probe_hits attribute counter is properly updated
   when monitoring intervals are changed at runtime, matching the
   behavior of nr_accesses. To achieve this, it refactors and renames
   existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.

 - "KSM: performance optimizations for rmap_walk_ksm" (xu xin)

   Resolve a severe KSM reverse-mapping performance bottleneck where
   thousands of split VMAs sharing a single anon_vma cause extended lock
   contention.

   By adding an interval-filtering check during the rmap walk, it
   reduces worst-case anon_vma lock hold times from over 500ms down to
   under 2ms, preventing application freezes and latency spikes under
   memory pressure.

 - "mm: split a couple of headers from internal.h" (Mike Rapoport)

   Split declarations related to mm_init, memblock, vmalloc and sparse
   into new headers

 - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)

   Apply the interval tree optimization from rmap_walk_ksm() to
   collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.

   It hoists loop-invariant address initialization and restricts the
   anon_vma_interval_tree_foreach walk to a targeted page offset range,
   reducing redundant checks and improving lookup efficiency.

 - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
   Patil)

   Fix issues in the hugetlb and KSM MM selftest categories that can
   report failures when the prerequisites for the tests are not
   satisfied

 - "mm/damon: introduce data attributes only monitoring" (SJ Park)

   Introduce attribute-weighted region management in DAMON, allowing
   users to prioritize specific data attributes (such as page sizes or
   cgroups) over or instead of access monitoring.

   By assigning weights to attribute probes, DAMON can completely
   disable access tracking and adjust monitoring regions based on
   weighted probe-hit counters to optimize monitoring quality for
   attribute-focused workloads.

 - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
   (Stanislav Kinsburskii)

   Extend hmm_range_fault() to support userfaultfd-backed regions by
   allowing the mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.

   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd
   regions while preserving backward compatibility for existing callers.

 - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)

   Clean up and standardize how vma->vm_pgoff is accessed and
   manipulated across file-backed and anonymous mappings in the kernel

   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
   renaming rmap interval tree helpers to better reflect their
   functionality.

   These changes establish a cleaner foundation for future work that
   will unify virtual page offset indexing for all anonymous and CoW'd
   folios.

 - "mm: handle device-private PMDs in walk callbacks" (Usama Arif)

   Address kernel panics and state corruption caused by MM walk
   callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations

   It ensures that functions which acquire pmd_trans_huge_lock()
   properly recognize device-private PMDs instead of assuming a present
   THP or a standard migration entry.

 - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)

   Refactor try_to_unmap_one by modularizing Hugetlb,
   anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
   functions, laying the structural groundwork for batched anonymous
   large folio unmapping.

 - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)

   Fix typos and fills in missing entries in the DAMON sysfs ABI
   document

 - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)

   Introduce an atomic sysfs state attribute and supporting DAX/MM
   infrastructure to prevent userland races when offlining and removing
   entire memory regions

   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.

 - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)

   Continue transitioning the kernel from the deprecated vm_flags_t type
   to vma_flags_t across core memory management infrastructure.

   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.

 - "Two small patches to clean up mm/mm_slot.h" (xu xin)

   Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
   slot deletion sequences in khugepaged and KSM. It also adds code
   documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.

 - "mm/damon/core: hide core-private struct fields" (SJ Park)

   Clean up DAMON core structures by consistently marking internal-only
   fields with private: comment tags to prevent improper direct access
   from outer layers.

   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.

 - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
   (SJ Park)

   Address potential infinite loops, NULL dereferences, and race
   conditions identified in DAMON

   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.

 - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
   Jackman)

   Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
   on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
   via non-PCP or isolated migration paths.

   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.

 - "mm/page_alloc: couple of followups for recent cleanups" (Brendan
   Jackman)

   Clean up and update page allocator nomenclature, documentation, and
   debug assertions.

   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete
   VM_BUG_ON() assertions in allocation paths.

 - "mm/mseal: further cleanups" (Lorenzo Stoakes)

   Refactor and simplify the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.

   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
   eliminates mm_struct parameters to enforce that sealing applies only
   to current->mm, and streamlines overall logic and comments with no
   functional changes intended.

 - "mm/vmscan: fix swappiness=max and clean up per-node proactive
   reclaim" (Ridong Chen)

   Resolve reclaim behavior bugs and clean up function parameters across
   memory reclaim paths

   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead
   of collapsing all failures into -EAGAIN, and removes the obsolete
   gfp_mask parameter from __node_reclaim().

 - "mm: mincore: misc cleanups" (Kefeng Wang)

   Clean up and simplifies the mincore code. Most importantly, it
   removes the historical special behavior that always reports VM_PFNMAP
   pages as non-resident.

 - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)

   Two trivial cleanups in the folio split API

 - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
   bugs" (SJ Park)

   Resolve minor operational and testing bugs in DAMON identified by
   Sashiko. It initializes the damos->last_applied field to prevent
   occasional efficiency degradation and fixes invalid memory accesses
   in DAMON KUnit tests during test failure handling.

 - "cleanup for stable_page_flags()" (Jinjiang Tu)

   Clean up and refactor stable_page_flags() used by /proc/kpageflags
   without altering functionality.

   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.

 - "Batch unmap of uffd-wp file folios" (Dev Jain)

   Extend batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching
   capabilities to pte_install_uffd_wp_if_needed().

   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.

 - "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
   (Sang-Heon Jeon)

   Clarify and clean up the architecture-specific usage of
   __late_set_fixmap() and __late_clear_fixmap() after
   early_ioremap_reset()

   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset
   calls in the RISC-V and ARM64 architectures.

 - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)

   Address severe performance regressions, swap storms, and spurious
   OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
   production

   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.

 - "zram: lockmap tweaks" (Sebastian Siewior)

   Optimize and fix lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolate lock classes across multiple instances

   This reduces memory overhead by replacing per-entry lockdep_map
   instances with a single map per struct zram, and assigns a dynamic
   lock_class_key to each instance to prevent false deadlock reports
   when different zram devices are backed by distinct filesystems.

* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
  selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
  selftests/mm: unpoison pages in memory-failure teardown
  mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
  mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
  mm/zsmalloc: fix release order of locks in zs_page_migrate()
  Documentation: zram: remove sections numbering
  ksm: stop iterating VMAs when ksm_test_exit returns true
  mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
  mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
  zram: use a custom key for each zram object
  zram: move lockmap to be per-zram instead per table
  selftests/mm: fix gup_longterm EINVAL error message
  mm: page_alloc: fix non-movable reclaim storm in defrag_mode
  mm: page_alloc: move capture_control to the page allocator
  mm: compaction: support non-movable compaction for pageblock requests
  mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
  hugetlb: evaluate subpool free state while locked
  mm/damon: remove trailing semicolons after function definitions
  mm/damon/ops-common: prevent migration fallback to non-target nodes
  mm/damon: update outdated comment about DAMOS filter handling
  ...
2026-08-20 18:17:08 -07:00