55896 Commits

Author	SHA1	Message	Date
Linus Torvalds	542fed2ef2	nolibc changes for v7.4 ... Changes: * New architectures: Hexagon, 64-bit parisc * New library functionality: sendfile(), pread(), pwrite() * Various bugfixes and cleanups -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTg4lxklFHAidmUs57B+h1jyw5bOAUCatSDYwAKCRDB+h1jyw5b OJZOAP4vAP8wrFSsy0JqraUM2zxITIwX9bdqxlrgY4Yq8EECgwD/YT/GdjkJgVew HKIMnggJGIsNloLPeKlDiHEoKF8zgws= =Nzb1 -----END PGP SIGNATURE----- Merge tag 'nolibc-20261018-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: - New architectures: Hexagon, 64-bit parisc - New library functionality: sendfile(), pread(), pwrite() - Various bugfixes and cleanups * tag 'nolibc-20261018-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (28 commits) selftests/nolibc: explicitly disable position independent executables selftests/nolibc: use the configured kernel header directory tools/nolibc: fix the function argument order of calloc() tools/nolibc: check for overflow in malloc() tools/nolibc: stop rounding malloc() sizes up to 4096 bytes tools/nolibc: add support for pread() and pwrite() tools/nolibc: introduce __NOLIBC_BITS_PER_SYSCALL_ARG tools/nolibc: move __NOLIBC_LLARGPART() to compiler.h tools/nolibc: make 64-bit systemcall argument padding generic selftests/nolibc: make the broken MIPS N32 argument detection reusable tools/nolibc: add 64-bit parisc support selftests/nolibc: test the FD_* macros tools/nolibc: fix FD_SET(), FD_CLR() and FD_ISSET() on 64-bit tools/nolibc: fix readdir_r() with 64-bit directory offsets tools/nolibc: fix verrx() and errx() message formatting selftests/nolibc: add tests for the wait status macros tools/nolibc: fix WIFSIGNALED() for status 0 tools/nolibc/parisc: consistently use %dp to refer to register %r27 selftests/nolibc: validate ENOTDIR return values from opendir()/fdopendir() tools/nolibc: verify that a directory is opened ...	2026-10-20 14:36:18 -10:00
Linus Torvalds	742f62b639	alpha updates for v7.4 ... - alpha: add bounded Clipper console-log scanning - alpha: decode Clipper environmental events - alpha: decode and acknowledge Tsunami system machine checks - alpha: bound EV6 logout decoding by the processor area - alpha: describe the Tsunami system machine check frame - alpha: move Tsunami machine check handling to err_tsunami.c - alpha: fill in pc for software event samples - alpha: add HAVE_PERF_REGS and HAVE_PERF_USER_STACK_DUMP support - alpha: use user_stack_pointer() in KSTK_ESP() and dump_elf_thread() - alpha: stop storing the user stack pointer in pt_regs - alpha: fix stale user_stack_pointer() - selftests/seccomp: add Alpha support to seccomp_bpf - alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms - alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() - alpha: invalidate the local context in flush_icache_user_page() - alpha: invalidate the local context in flush_tlb_mm() - alpha: fix the local TLB invalidate in the UP flush_tlb_page() - alpha: fix the local TLB invalidate in flush_tlb_page() - alpha: invalidate the local context in flush_tlb_page() - alpha: only use a targeted tbi() when the target mm is really current - alpha: run check_mmu_context() from finish_arch_post_lock_switch() - alpha: load the MMU context when switch_mm() switches the current task - alpha: implement hugetlb support - alpha: align hugetlb mappings in arch_get_unmapped_area() - alpha: define granularity hint PTE bits - alpha: describe the PTE read and write enable bits - alpha: handle VM_FAULT_HWPOISON in do_page_fault() - alpha: add missing page_table_check_pte_clear() to ptep_get_and_clear() - alpha: default NR_CPUS to 32 for Wildfire - alpha: link platform help text to the alphalinux.org wiki - alpha: correct system descriptions in Kconfig help text - alpha: replace dead links in Kconfig help text - alpha: support the remaining kernel compression formats - alpha: add self-extracting compressed kernel boot stub - xz: add arch-specific tuning for alpha - alpha: select SPARSE_IRQ - alpha: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM - alpha: select ARCH_WANT_LD_ORPHAN_WARN - alpha: discard .eh_frame and the relocation sections - alpha: select SYSCTL_EXCEPTION_TRACE - alpha: select ARCH_USE_MEMTEST - alpha: select HAVE_GUP_FAST - alpha: select ARCH_HAS_DEBUG_VM_PGTABLE - alpha: add ARCH_SUPPORTS_PAGE_TABLE_CHECK support - alpha: add ARCH_HAS_PTE_SPECIAL support - alpha: add HAVE_ARCH_THREAD_STRUCT_WHITELIST support - alpha: select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE - alpha: select HAVE_ARCH_COMPILER_H - alpha: select ARCH_SUPPORTS_INT128 - alpha: select ARCH_HAS_FAST_MULTIPLIER - alpha: select ARCH_SUPPORTS_ATOMIC_RMW - alpha: select EDAC_SUPPORT - alpha: select HAVE_DEBUG_KMEMLEAK - alpha: select ARCH_HAS_GCOV_PROFILE_ALL - alpha: select ARCH_HAS_UBSAN - alpha: enter hardirq context before looking up the irq descriptor - alpha: enable GENERIC_ENTRY -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTIw07U9ivnHy+tugnaDr6nZQzE/AUCatZIQgAKCRDaDr6nZQzE /AqTAP9RHaiXEn9o6NkcvCfiCLin7UUQmDb0GVBMQCO6elERWQEAoTYaCYWB0cKj wsF8DtzdXBKHZt7MKy56uiuESF7zlwk= =1yco -----END PGP SIGNATURE----- Merge tag 'alpha-for-v7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha Pull alpha updates from Magnus Lindholm: "This completes Alpha's conversion to GENERIC_ENTRY and enables a range of kernel features through Kconfig updates, including UBSAN, gcov, kmemleak, page-table checking, fast GUP and sparse IRQs. It includes TLB and MMU context fixes prompted by glibc test-suite failures, HugeTLB support for 64KB, 512KB and 4MB pages, and fixes for poisoned-page faults and page-table checking. Machine-check handling is improved on Tsunami platforms, with bounded EV6 logout decoding, Clipper environmental event reporting and safer firmware console-log scanning. Other changes add self-extracting compressed kernels with support for all kernel compression formats, Alpha-specific XZ tuning, perf register and user-stack sampling, and Alpha support in the seccomp selftests. The series also fixes user stack-pointer reporting and IRQ entry ordering, adds 128-bit shift helpers, cleans up linker sections, and updates Kconfig help" * tag 'alpha-for-v7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: (57 commits) alpha: add bounded Clipper console-log scanning alpha: decode Clipper environmental events alpha: decode and acknowledge Tsunami system machine checks alpha: bound EV6 logout decoding by the processor area alpha: describe the Tsunami system machine check frame alpha: move Tsunami machine check handling to err_tsunami.c alpha: fill in pc for software event samples alpha: add HAVE_PERF_REGS and HAVE_PERF_USER_STACK_DUMP support alpha: use user_stack_pointer() in KSTK_ESP() and dump_elf_thread() alpha: stop storing the user stack pointer in pt_regs alpha: fix stale user_stack_pointer() selftests/seccomp: add Alpha support to seccomp_bpf alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() alpha: invalidate the local context in flush_icache_user_page() alpha: invalidate the local context in flush_tlb_mm() alpha: fix the local TLB invalidate in the UP flush_tlb_page() alpha: fix the local TLB invalidate in flush_tlb_page() alpha: invalidate the local context in flush_tlb_page() alpha: only use a targeted tbi() when the target mm is really current ...	2026-10-20 14:31:24 -10:00
Linus Torvalds	5b6dca02b3	Objtool updates: ... - Add unit test suite for objtool klp functionality and known failure modes (by Song Liu and Puranjay Mohan, with fixes by Joe Lawrence) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUlv4RHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1jQ2BAAiGEOosOHD2L8dDfFFv8NSZgXRmyg+aEI S23orkCIvFBEVrvyvE707E7Oqunfd0KXbOINIm8SpI/HokhgEm5DJlx6dbuHjP0p RcPwtNANeXdh9WkEhkQb152FITXc2R/K5EyLk4HwyzEqj8jTOoa1y7Yk9lu7LIPO aS753iOmJUbmUAkUVq+sHBcJU1PsWlFUiea3hcQ9+IL3taVtUOC3veBP4vFj4ags bcrupHeIbeBJ8Jbh9vuWOsLfDDQDY82RLgf6pPc4A5vJETvfRiMuLP8jPShZaVmr XxvrUaFxm8DsKuuGDoKMQWTO6LJc56BxVOYABQyw8ey/xSpd8uaTvnAReRak3Hbw wSs2yBEXZe4uUB/RtTdjqk43okNvPAFtxlwsPnE3SlEsdMXv+EM2dPSf6E5Wc/Dl /fgOmaPi6y4HgZywwaJk9kwJ1maCk4DCDG6N9R+CVGAHvuJAwdIGWzpz3rcJsDp3 REAaX0uqXMkr+AjXMU4Gtjj05sX4uvIjljAHvDup4VSCeTsSMIEy/IuXE6Zv4qq8 CIYjyfE43CMQ0QvsDJdQe6XTsYdWva6I5g28O5EimMiuGhVrmztiytlPO2Ua5ikN s8U8Vi7e9ILYNuU2cplf9yY2sG75vueIm0EZd5dpa54fCXl90iUyEcIoemgW1Sid VsyAljFdSsE= =dN+w -----END PGP SIGNATURE----- Merge tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - Add unit test suite for objtool klp functionality and known failure modes (by Song Liu and Puranjay Mohan, with fixes by Joe Lawrence) * tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits) objtool/klp: Add test for ThinLTO symbols sharing a demangled name objtool/klp: Add test for Clang switch jump tables objtool/klp: Add test for UBSAN metadata in an unchanged function objtool/klp: Add test for absolute and __ADDRESSABLE symbols objtool/klp: Add test for a patch which strips a data annotation objtool/klp: Add test for the alignment of cloned data sections objtool/klp: Add test for alternative replacement code in checksums objtool/klp: Add test for instruction operand checksums objtool/klp: Add test for a static call introduced by the patch objtool/klp: Add test for tracepoint and pr_debug static branch keys objtool/klp: Add test for a static branch introduced by the patch objtool/klp: Add test for symbols with no checksum entry of their own objtool/klp: Add test for data object checksums objtool/klp: Test text annotations on alternative replacements objtool/klp: Test a hand-built livepatch module's static call keys objtool/klp: Test rejection of a file-local static branch key objtool/klp: Add test for symbols whose linkage the patch changes objtool/klp: Add test for kCFI prefix symbols and traps objtool/klp: Add test for __bug_table, __ex_table and __mcount_loc extraction objtool/klp: Add test for static locals which must not be correlated ...	2026-10-20 12:55:04 -10:00
Linus Torvalds	cb95904b47	Scheduler updates: ... Kconfig updates: - Simplify PREEMPT_DYNAMIC (Mark Rutland) Fair scheduler updates: - Remove redundant RUN_TO_PARITY check (Elif Topuz) - Declare augmented callbacks per field, fix rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra) - Restart fair hrtick after same-task repicks (Shubhang Kaushik) - Improve the scheduling latency of short slice tasks (Vincent Guittot) Deadline/RT scheduler updates: - Check start_dl_timer expiry with ktime_before() (Liang Hao) - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej Siewior) Energy-aware scheduling updates: - Implement the steal_governor, introduce preferred CPUs and steal-driven vCPU backoff (Shrikanth Hegde) Multi-processor load-balancing updates: - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi) - Randomize equally shallow idle CPU picks (Christian Loehle) - Remove redundant core_sched_seq (Hui Su) Cache-aware scheduling updates: - Avoid publishing partial LLC utilization (Jemmy Wong) NUMA-balancing updates: - Reset NUMA fault locality after scan period update (Eric Kim) Proxy execution updates: - Ongoing work to implement sleeping owner handling for proxy execution (John Stultz, Vasily Gorbik) - Preparatory steps to make sched_ext compatible with proxy execution (Andrea Righi) Scheduler infrastructure updates & fixes: - Remove the RCU wait from PSI trigger destruction (Shakeel Butt) - Avoid modifying wait-entry on failed priority registration (Hui Su) - Use the new static key API for sched_feat (Hongyan Xia) - Convert paravirt_steal to new static key APIs (Hongyan Xia) - cputime: Don't account idle time twice after dyntick-idle (Stian Halseth) Scheduler debugging updates: - Set TIF_NEED_RESCHED before calling __trace_set_need_resched() (Sechang Lim) - Fix context analysis errors in non-preferred CPU push (Shrikanth Hegde) Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik, Thomas Huth and Vladimir Zapolskiy. Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUomIRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1ik+Q/+Jx0tXmwOm/wk1ba50zz/tkUL17APJzD1 0TdHSf0sqssyVnQVmGBNWoKfp30zzrnd8Yf46PH5kUmyIxX0LqazAXsPA/0lxAY6 jB2b5ZGosyQQPqyjM1q48K/BMB+GGO9xDKlFxxkBsICi+vS+6diBzXM70xla9M4O CcAO5DHb50otN/TljfnkmbxG7vgssCVZyS7XG6bSyhd6tUrcr4DVD7gYOMbSVcaL 8Cgu+b54rOAcrcWU1454YKHI5etUOTjblCbFgISrdw7lwf4dKVtTAKSanFX9n522 q9sQ1vzuRz6JfSak9nxFkCy5SMjuHJ53DkVNR4eUXNmM0tHdAcVd8jOexmQVBrug Yjloo/WydUqGT2TYYEVQPi4J+jMqMRyDIp3TL9UuQjwcjHRnUpd8EVmoNme0TOi+ e3SoS+xOSVBLgbMFwrjJR/tQuqDPjgBrgIyg8wL+ed5cY6Equ+J3467wp8lO7RBN uGwChvxQAOaMlkh5tIR38Zjq9kzs79y85vz3uD2SNk17TcvijVw9UsmQKfAkpdZo 5FUDM2AdyOhOtZkzMNLHfjjBLSMVCBRo726c6WbELibhuWN7xTAJSJx8o8JNOCrC vOBcNNAHpU7BwqA0gFIA3lL1uMXvKn9npKKjnB2C4WxhFGf23NF6uPapyA4sMZ00 YwRGvOeDvu4= =cPCx -----END PGP SIGNATURE----- Merge tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Kconfig updates: - Simplify PREEMPT_DYNAMIC (Mark Rutland) Fair scheduler updates: - Remove redundant RUN_TO_PARITY check (Elif Topuz) - Declare augmented callbacks per field, fix rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra) - Restart fair hrtick after same-task repicks (Shubhang Kaushik) - Improve the scheduling latency of short slice tasks (Vincent Guittot) Deadline/RT scheduler updates: - Check start_dl_timer expiry with ktime_before() (Liang Hao) - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej Siewior) Energy-aware scheduling updates: - Implement the steal_governor, introduce preferred CPUs and steal-driven vCPU backoff (Shrikanth Hegde) Multi-processor load-balancing updates: - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi) - Randomize equally shallow idle CPU picks (Christian Loehle) - Remove redundant core_sched_seq (Hui Su) Cache-aware scheduling updates: - Avoid publishing partial LLC utilization (Jemmy Wong) NUMA-balancing updates: - Reset NUMA fault locality after scan period update (Eric Kim) Proxy execution updates: - Ongoing work to implement sleeping owner handling for proxy execution (John Stultz, Vasily Gorbik) - Preparatory steps to make sched_ext compatible with proxy execution (Andrea Righi) Scheduler infrastructure updates & fixes: - Remove the RCU wait from PSI trigger destruction (Shakeel Butt) - Avoid modifying wait-entry on failed priority registration (Hui Su) - Use the new static key API for sched_feat (Hongyan Xia) - Convert paravirt_steal to new static key APIs (Hongyan Xia) - cputime: Don't account idle time twice after dyntick-idle (Stian Halseth) Scheduler debugging updates: - Set TIF_NEED_RESCHED before calling __trace_set_need_resched() (Sechang Lim) - Fix context analysis errors in non-preferred CPU push (Shrikanth Hegde) Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik, Thomas Huth and Vladimir Zapolskiy" * tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits) sched: Replace nr_iowait_cpu() with a bool accessor Revert "sched/fair: Remove dead code on enqueue_task_fair()" sched/cache: Avoid publishing partial LLC utilization sched/cputime: Don't account idle time twice after dyntick-idle sched/psi: Remove the RCU wait from trigger destruction sched/eevdf: Remove redundant RUN_TO_PARITY check sched/wait: Avoid modifying entry on failed priority registration rbtree_test: Use rb_add_augmented_cached() for the cached augmented test rbtree: Update augmented data on the way down in rb_add_augmented_cached() rbtree: Declare augmented callbacks per field with RB_AUG() rbtree_test: Use rb_add() and rb_add_cached() for the basic tests smpboot: Don't park the thread if work is pending irq_work: Flush lazy work CPU down on PREEMPT_RT irq_work: Update a comment regarding CPU hotplug invocation sched/topology: Add asymmetric SMT packing override sched/fair: Honor asymmetric SMT priority in idle selection sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched() sched/core: Fix context analysis errors in non-preferred CPU push virt/steal_governor: Enable the driver virt/steal_governor: Implement steal_governor policy loop ...	2026-10-20 12:35:35 -10:00
Linus Torvalds	dd8845db6d	- Document and cleanup the signal frame handling with the goal to allow ... process migration between CPUs with different FPU capabilities but which use only a common set of FPU features, i.e., think checkpoint/restore. By Andrei Vagin - Consolidate how XSTATE features are checked by doing them once during boot with the intent of removing cpu_has_xfeatures(). Latter will happen in the next cycle. Work by Eric Biggers - Other cleanups -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrW6K8ACgkQEsHwGGHe VUqFJg//WXn5Lu71l3TnoucbDjvdKoTvYH1zwrvxJirPsWK5+12Hvr2psTwh2GPF 6xEYJJEJHMt5VzSo+vjA5aHwqZOFhgQefBEpZqzgWYUBZ7q0ALsGbVzF1iVYNRTW MHYg8V7OMdlq6mgB06sdTJbIG+EfiQch2EiefMK7PdBa+fU2oxBMbSDvCPl537ug yF6+Qv/sKDKPZdZNvA6d5Vy/k0UpV4Cd1YyWhFjJtiYU1bSBjL1AazM5b9qMbl4E t2hlZ+Agi7yucsoZ+tD1IMJsjYyRByZPPQAGNvqZv1YOYWp6LnbHi8cKSpY+N8zS RnVao7PkfyZzjcV0q4fYpzzGIiZZWwpa9k1y98F7MBVEi7hWG5VaguNDI6+2xvs8 FQDNGG1TWtjPltgxsO4ouy2QzbrwzRiWfpP2YHAx5BsYUue5IFeIF3LlwPz0pKz6 2tfsIuMQe5kr43Q3g/LwJuaISLS0rhAXXPceWI8Oiz+sJSsjadnQgOG/tLyySfpF Kea3OIexbpzQ+DtaxQXzPeGp80sOdG9QontV1Ce4HpieWizKSN3ggqcbhae3aUlh P0fGALhhlLZFpwkyRkcCbRcyu0yrCaNmfwG9KWa4gajGVCfr9Y/WvyBhsT7nTfaQ +ngSKg968mDmgdD0SwJ/ejpJg4cGeAAMj7q/VN15qUlEgomkTEg= =OJI1 -----END PGP SIGNATURE----- Merge tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 FPU state updates from Borislav Petkov: - Document and cleanup the signal frame handling with the goal to allow process migration between CPUs with different FPU capabilities but which use only a common set of FPU features, i.e., think checkpoint/restore (Andrei Vagin) - Consolidate how XSTATE features are checked by doing them once during boot with the intent of removing cpu_has_xfeatures(). Latter will happen in the next cycle (Eric Biggers) - Other cleanups * tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Remove additional remnants of math emulation x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU selftests/x86: Add tests for signal frame FPU portability x86/fpu: Pre-fault only required size of xstate buffer x86/fpu: Fix potential underflow in xstate_calculate_size() x86/fpu: Document reasoning of FX-only fallback x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig() x86/fpu: Clean up and rename variables in signal frame handling x86/fpu: Document signal frame layout and portability xor: Add AVX-512 optimized xor_gen() xor: Remove redundant X86_FEATURE_OSXSAVE check lib/crc: x86: Stop using cpu_has_xfeatures() lib/crypto: x86: Stop using cpu_has_xfeatures() crypto: x86 - Stop using cpu_has_xfeatures() um: Check for missing AVX and AVX-512 xstate bits x86/fpu: Check for missing AVX and AVX-512 xstate bits	2026-10-20 11:03:51 -10:00
Linus Torvalds	303bff3637	Core features: ... - Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has depended on BROKEN for a while, so drop the remaining code (BE hypervisor object, BPF JIT, assembly/crypto/library routines, endianness helper macros, selftests) and force a little-endian build - Add preemptible this_cpu_*() operations (read/write, RMW, xchg, cmpxchg and cmpxchg128) that no longer need to disable preemption around the per-CPU address generation and access - Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on arm64 Memory management: - Treat faults taken by EFI runtime firmware as kernel faults - Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty state management enabled, this is not truly read-only) - Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA configurations (28/26/24 bits for 4K/16K/64K pages) - Implement clear_page[s]() using memset() - Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU Perf and PMU: - Support for HiSilicon's ITS PMU - Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs and a cycle counter for the latest version of HiSilicon's MN PMU hardware - A bunch of fixes to the CXL PMU driver to address pre-existing issues from Sashiko - Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM drivers - Reduce excessive stack consumption in the Marvell DDR PMU driver - Minor driver updates and cleanups all over Arm Confidential Compute Architecture (CCA): - Add an Arm SMCCC bus for firmware services discovered through SMCCC and move the TRNG and CCA guest (TSM provider) drivers onto it, removing the dummy CCA platform device and adding a sysfs ABI for Realm guests - Move the Realm Service Interface (RSI) code out of arch/arm64/ into drivers/firmware/arm_rmm/ - Add the host side of the Realm Management Interface (RMI): detect, configure and activate the RMM, add SRO support and wrappers for the Realm RMI commands - Block hibernation (new arch hook in the PM core) and kexec while the RMM is active. To be revisited in the future with proper support for deactivation - Handle Granule Protection Faults (GPFs) taken by the host, caused by accesses to memory delegated to the RMM. In a future patch, the exception table lookup will be limited to is_kdump_kernel() cases MPAM (Memory Partitioning And Monitoring): - Add support for the MPAM firmware-backed (Fb) interface, allowing MSC accesses to be mediated by firmware - Fix a list of theoretical issues with the driver (MSC access error propagation, MBWU monitor save/restore and locking, resctrl class handling, error interrupt restore, maximum number of PARTIDs) - Add the mailing list and a missing file to the MAINTAINERS entry - Document when to set arm64.nompam Errata and CPU features: - Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM capability type for SoC-level errata Miscellaneous: - Mask debug exceptions (DAIF) around the hardware breakpoint register manipulations when called from generic kernel code - Don't zero the SVE state buffer when the SVE state is live - Return -EPERM instead of -EBUSY from the GCS prctl() locking failures (matching x86), with the selftest updated. Slight ABI change but no software deployment yet - kselftest: fix unsound MTE fault skipping by introducing MTE-safe memory accessors, avoid copying each signal test binary more than once - Update sysreg definitions (fix three enum values and two field names, mark architecturally dropped fields as RES0) and remove the TME transaction state check from the BRBE driver - Fix the description of ARM64_HAS_LPA2 and remove a redundant ID_AA64MMFR0 define -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmrRImIACgkQa9axLQDI XvG+mw/+Lu/PONW1zxo4M65u3vR2bTBqhx8Xo3MP15ANaNVEb3guiUX0ZGAMVdz7 NgN5NAQFQ5lwb8V8F5LSPGPlHTZ/KEYbiu2IRqwNvUrr2xU+Bz2AZKGvTfScEokO PiNfe84I7pWG+U77eBotZ5TxBQiLRe+8VWetIlPOQK9QUm0PG6Z50vhBBahg5kvJ b0nf2K3mSIscQRskykkCfIAwTShJM1NvW4+Ygfz6UjHaTtvPg+wsHPMZunKLJW5F tbXjZxcJQPziTl7lsRZuKbBrW7Sm5XRl54Q5Tl5ToXQ/C8h2jKjaNoqyXfV+ETJx MnFMQfmSIXuKlPuhZTiZK1viVXJe886iCi0vavMwKIR1zNJBKWLWeFz7cepe/jfq PHnZo9dX9dNRS7vzBGVq1aYUe/pn5eVeYrUQjMWCyKF2aLvSLm5n4Tf+XtvDUrkA O5EuP7sHL8xY9wCJ+Mw45gX1sQiJRy2jBOBbUvZ2/F6ACgG8dvKS9lhpbIn8IsKU rFkwacTcsUCoKCnthOwupRApUU/S2fiyzEoUc/R/gDubmnDET3nLcSsspg/FacqP OOq/6ErxAQ3HA5ltK0Siq8/qud9mnpYa0xyoxs7EED3jpX2A3lLf9UZduZ+r/2IP k5KI+4yRkYPBqGoFjwO8nMrk8jgvZzAtTMh86EOI4LZkcNEvuzU= =YdKt -----END PGP SIGNATURE----- Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "Here are the arm64 updates for 7.4. The more interesting bits are the removal of big-endian kernel support (already marked BROKEN for some time), preemptible this_cpu_*() operations and MPAM support for the firmware-backed (Fb) interface. CCA (Arm's confidential compute) is slowly trickling in with host RMI (Realm Management Interface) support and some refactoring, including a dedicated SMCCC bus to advertise firmware services. There are also the usual PMU updates for new hardware and a few fixes/cleanups. Core features: - Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has depended on BROKEN for a while, so drop the remaining code (BE hypervisor object, BPF JIT, assembly/crypto/library routines, endianness helper macros, selftests) and force a little-endian build - Add preemptible this_cpu_*() operations (read/write, RMW, xchg, cmpxchg and cmpxchg128) that no longer need to disable preemption around the per-CPU address generation and access - Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on arm64 Memory management: - Treat faults taken by EFI runtime firmware as kernel faults - Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty state management enabled, this is not truly read-only) - Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA configurations (28/26/24 bits for 4K/16K/64K pages) - Implement clear_page[s]() using memset() - Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU Perf and PMU: - Support for HiSilicon's ITS PMU - Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs and a cycle counter for the latest version of HiSilicon's MN PMU hardware - A bunch of fixes to the CXL PMU driver to address pre-existing issues from Sashiko - Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM drivers - Reduce excessive stack consumption in the Marvell DDR PMU driver - Minor driver updates and cleanups all over Arm Confidential Compute Architecture (CCA): - Add an Arm SMCCC bus for firmware services discovered through SMCCC and move the TRNG and CCA guest (TSM provider) drivers onto it, removing the dummy CCA platform device and adding a sysfs ABI for Realm guests - Move the Realm Service Interface (RSI) code out of arch/arm64/ into drivers/firmware/arm_rmm/ - Add the host side of the Realm Management Interface (RMI): detect, configure and activate the RMM, add SRO support and wrappers for the Realm RMI commands - Block hibernation (new arch hook in the PM core) and kexec while the RMM is active. To be revisited in the future with proper support for deactivation - Handle Granule Protection Faults (GPFs) taken by the host, caused by accesses to memory delegated to the RMM. In a future patch, the exception table lookup will be limited to is_kdump_kernel() cases MPAM (Memory Partitioning And Monitoring): - Add support for the MPAM firmware-backed (Fb) interface, allowing MSC accesses to be mediated by firmware - Fix a list of theoretical issues with the driver (MSC access error propagation, MBWU monitor save/restore and locking, resctrl class handling, error interrupt restore, maximum number of PARTIDs) - Add the mailing list and a missing file to the MAINTAINERS entry - Document when to set arm64.nompam Errata and CPU features: - Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM capability type for SoC-level errata Miscellaneous: - Mask debug exceptions (DAIF) around the hardware breakpoint register manipulations when called from generic kernel code - Don't zero the SVE state buffer when the SVE state is live - Return -EPERM instead of -EBUSY from the GCS prctl() locking failures (matching x86), with the selftest updated. Slight ABI change but no software deployment yet - kselftest: fix unsound MTE fault skipping by introducing MTE-safe memory accessors, avoid copying each signal test binary more than once - Update sysreg definitions (fix three enum values and two field names, mark architecturally dropped fields as RES0) and remove the TME transaction state check from the BRBE driver - Fix the description of ARM64_HAS_LPA2 and remove a redundant ID_AA64MMFR0 define" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits) arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code kselftest/arm64: signal: copy each test binary only once kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store ...	2026-10-20 07:55:19 -10:00
Linus Torvalds	c3134590a8	Microblaze patches for 7.4-rc1 ... - Add Kunit support - Update signal handling Small changes: - coding style, typos - don't use "new" ASM pseudocode - fix refcount leak in cpuinfo code - prevent ptrace writes to MSR and pt_mode - enable Xilinx DMA driver by default - build userprogs for the correct endianness -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQSXAixArPbWpRanWW+rB/7wTvUR9QUCatXqTwAKCRCrB/7wTvUR 9dVPAQDoX+aAPWQMEYOCOmY7NDNPKoSVMz5Q9Ex0ISroB953fAEAt6wkHIMPLkkg rytGQfkiGaJiUvHl+7kiUzkoKpx9XwU= =loPP -----END PGP SIGNATURE----- Merge tag 'microblaze-v7.4' of git://git.monstr.eu/linux-2.6-microblaze Pull arch/microblaze updates from Michal Simek: "Some issues were found by AI but nothing dramatic. The signal changes are related to upgrading the toolchains supported by AMD. Hardened MicroBlaze cores are used in AMD/Xilinx chips, and they will be supported for another 10+ years. New tests were run as part of this effort, and that's how the signal stack issues were found. The KUnit patches have been reviewed by David, and he agreed that they can go through my tree. Summary: - Add Kunit support - Update signal handling Small changes: - coding style, typos - don't use "new" ASM pseudocode - fix refcount leak in cpuinfo code - prevent ptrace writes to MSR and pt_mode - enable Xilinx DMA driver by default - build userprogs for the correct endianness" * tag 'microblaze-v7.4' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Build userprogs for the correct endianness microblaze: Enable xilinx dmas and axi emac drivers kunit: qemu_configs: Add microblaze configurations microblaze: reset: Provide a power off handler through an unaligned PC microblaze: reset: Call POWER_OFF handlers microblaze: Pass -m{big,little}-endian through KBUILD_CPPFLAGS microblaze: uaccess: Zero out destination on failed get_user() microblaze: fix typo "multipler" in comment microblaze: prevent ptrace writes to MSR and pt_mode microblaze: CCF: fix refcount leak microblaze: preserve the MSR carry flags across signals microblaze: restore the ABI argument home area below pt_regs (PTO) microblaze: don't clobber r3/r4 restored by rt_sigreturn microblaze: reserve the ABI argument-home area in the signal frame microblaze: wire up sigaltstack microblaze: drop unneeded semicolon microblaze: Fix MB_MANAGER build with older binutils	2026-10-20 07:52:21 -10:00
Linus Torvalds	a6656aefd3	vfs-7.4-rc1.shared.net-next.pidfd ... Please consider pulling these changes from the signed vfs-7.4-rc1.shared.net-next.pidfd tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc ooS3AP9/x0Naa93wtIOgcrAYPdb61lcqtH9ktLlKMsi5jhE64wEAiFS7qzGjZMJ4 H7sq/Qmjt63nyB44LFrHI0z0K62IHAQ= =Z9oc -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfd updates from Christian Brauner: "This adds thread specific pidfds to af_unix sockets. SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group leader. A coredump server on the coredump socket can't get a handle on the thread that took the signal and is writing the dump, and anything doing per-thread authentication has the same problem. The sending and the connecting thread are recorded in addition to the thread-group leader and sk_peer_pid becomes an array indexed by pid type. SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an SCM_PIDFD_THREAD cmsg for the sending thread. Both options are independent so a receiver can ask for both. On SOCK_STREAM sockets recvmsg() only stops merging data at a thread boundary when the receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd for the thread that called connect(), listen() or socketpair(). pidfs records the coredump on the dumping thread's struct pid too so its pidfd reports it like the leader's does. Selftests for af_unix and the coredump socket are included" * tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/coredump: check the dumping thread's pidfd pidfs: record the coredump on the dumping thread's pid too selftests/net: SO_PEERPIDFD_THREAD net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd af_unix: record the pid of the connecting thread net: turn sk_peer_pid into an array indexed by pid type selftests/net: SO_PASSPIDFD_THREAD net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD af_unix: record the pid of the sending thread pid: add helpers to operate on a struct pid array	2026-10-19 20:32:52 -10:00
Linus Torvalds	0cbcaf75a1	vfs-7.4-rc1.mount ... Please consider pulling these changes from the signed vfs-7.4-rc1.mount tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc okTnAP42ymJnRxXT0sSaNQ8Sk9PIRQ+1evElkdr0LfGkBp5ApAEAjtRL+o4LCjd9 WRE1+n+xwuQyPHUv9UghlPi8Qnr7ggU= =nfhQ -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull mount updates from Christian Brauner: "This adds OPEN_TREE_DROP_MNTNS_MOUNTS. crun started using OPEN_TREE_NAMESPACE to set up the container's mount namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind mounts. That fails on any host with a mount namespace pinned below such a source. The recursive clone picks the pinned namespace up and move_mount() refuses to attach the tree with ELOOP. Only a younger mount namespace may ever be bound into an older one or mount namespace references could form a loop. A namespace created with OPEN_TREE_NAMESPACE is younger than everything else on the system so from inside it every pinned namespace is older. By the time this fails setns() has run and the host tree is out of reach, so the runtime has to predict the situation beforehand and lose the optimization. snapd pins mount namespaces under /run/snapd/ns so on Ubuntu that is any container bind mounting the host root. Every other path crossing a mount namespace boundary already leaves these mounts behind, copy_mnt_ns() and create_new_namespace() both do. Only get_detached_copy() asks for them. The new flag lets a caller get a clone without them. It stays opt-in because open_tree(OPEN_TREE_CLONE) plus move_mount() is mount --rbind through a file descriptor and dropping them by default would silently lose /run/snapd/ns/*.mnt on a live system. It requires AT_RECURSIVE, is a no-op with OPEN_TREE_NAMESPACE and skips locked nsfs mounts the way copy_mnt_ns() does, so nothing new is exposed. Selftests are included" * tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS mount: add OPEN_TREE_DROP_MNTNS_MOUNTS	2026-10-19 20:06:27 -10:00
Linus Torvalds	7ed37e9d5c	vfs-7.4-rc1.misc ... Please consider pulling these changes from the signed vfs-7.4-rc1.misc tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc oiocAQDQrd6xDocGA55sJ45KSw1tHYQh5CYH8zml+T9D1agMmwEA5oGUQWEJAoN3 Y2zXG7WoZcdnKQv3FWRYWhjRmXNxUQk= =dbn3 -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "Fixes: - aio: a keyed poll completion on an epoll instance could recurse into the same epoll waitqueue lock when the result eventfd is watched by that very instance. An unprivileged process could make a CPU spin on the recursive lock. eventfd-backed poll completions are always deferred now. - fsnotify_inoderemove() is only called once the inode is really dead, no nlink and no aliases, and open_by_handle_at() can't add an alias to a dead inode anymore. The race could crash fsnotify or lose inode mark notifications. - devtmpfs: the conversion of the public instance to ->get_tree() broke reconfiguring the shared superblock's options on later mounts which made the boot time defaults permanent. A reconfigure context is kept in fc->fs_private so the parse ops can forward options to the underlying filesystem. - ufs truncated the 64-bit directory size to an unsigned int in ufs_last_byte(). A crafted image with a 4 GiB directory produced an out-of-folio read in ufs_find_entry() and, with CONFIG_UFS_FS_WRITE, a write into an adjacent page. - devpts rejects max=0 instead of silently lifting the per-instance pty limit. The value wrapped into ida_alloc_max() and became unlimited. - fs_pin publishes pins with the rcu list helpers so the kill paths reading the lists under rcu see the initialization. - dentry_kill() reports a Tasks-RCU quiescent state. Its cond_resched() is the only reschedule point on the dentry teardown path and cond_resched() isn't a quiescent state for Tasks-RCU, so Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion. - writeback sizes foreign flushes by the target wb's dirty pages instead of the memcg-wide count which over or undersized a single bdi flush. - nfsd READ emitted two fsnotify access events on the iterator path since vfs_iocb_iter_read() already sends one. A READ on a krb5i or krb5p mount showed up twice in inotify. - pipe and splice pass a poll key when waking readers and writers so epoll, poll() and select() waiters only wake for the event they asked for. - the iso8859-14 Unicode to charset tables had page01 duplicated as page1e so 29 code points mapped to the wrong bytes and 22 that aren't in the charset were accepted. - orangefs doesn't wait for an unmount service operation that never returns on system shutdown and uses ssize_t for strscpy() errors. - __register_chrdev() checks the kobject_set_name() return value. - selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000 which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a mountpoint so RESOLVE_NO_XDEV has a boundary to trip over, file_stressor moves into its own directory with a 30 minute timeout, the kernfs listxattr test skips when SELinux exposes security.selinux, the namespaces active reference tests wait for the thread via a PIDFD_THREAD pidfd since pthread_join() returns before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND test adds CLONE_VM so it fails for the intended reason, the pidfd PPID error message prints the values it compares and fscontext_ns gets a .gitignore. Cleanups: - vmcore prints the release of the crashed kernel from the VMCOREINFO note so a kdump that dies before the dump lands still says which kernel it was for. - initramfs allocates hardlink hash entries with the validated cpio name length instead of PATH_MAX, which put every entry in kmalloc-8k. - the unused dax_layout_busy_page() is removed, dax_layout_busy_page_range() becomes static and dax_folio_init() drops a redundant list initialization. - vfs_empty_path() is removed, it has had no callers since getname_maybe_null(). - comment and documentation fixes in aio, bpf_fs_kfuncs, fs-writeback, inode, read_write, squashfs and the vfs.rst copy of struct file_system_type" * tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits) selftests/filesystems: Fix idmapped_tmpfile layer dir ownership selftests/namespaces: Wait for thread exit via pidfd in active-ref tests writeback: size foreign flushes by target wb dirty pages initramfs: Reduce hardlink hash allocation sizes fs: remove unused vfs_empty_path() dcache: report a Tasks-RCU quiescent state in dentry_kill() vmcore: report the release of the crashed kernel splice: pass a poll key when waking pipe readers and writers pipe: pass a poll key when waking writers after a resize orangefs: use ssize_t instead of size_t for error codes... orangefs_super: don't wait on service operation on system shutdown. docs/vfs: Fix the struct file_system_type copy nls: fix the Unicode to charset tables of iso8859-14 selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures fs: fix misleading comments in read_write.c squashfs: fix inode number description in documentation fs: fix typos in comments fs/dax: Make dax_layout_busy_page_range() static fs/dax: Remove unused dax_layout_busy_page() ...	2026-10-19 19:30:45 -10:00
Linus Torvalds	0ddc887102	vfs-7.4-rc1.kernfs ... Please consider pulling these changes from the signed vfs-7.4-rc1.kernfs tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc ojr5AP42ZHmQU1u1W2WZvSp0d7z2i9Hp9j5ezK1JJjZQSE6FcgD+KalCPX7v9jB8 OQ0fQnauE2Ji3+qXO0tbIwij7gWP2wc= =9ucf -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.kernfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull kernfs updates from Christian Brauner: "This contains kernfs scalability work from Shakeel driven by what Meta sees in their fleet. kernfs_rwsem is per kernfs root, so sysfs and cgroupfs each have one for the whole machine, and every create, remove and rename takes it for writing. rwsems don't let readers steal the lock once a writer is queued, so one cgroup being created or a device being renamed parks the entire incoming reader stream in uninterruptible sleep. Daemons that poll cgroup files in a loop turn that into a convoy and the two that hurt most, oomd and below, are the ones that are supposed to relieve memory pressure and record what happened. kernfs_dop_revalidate() took kernfs_rwsem for read once per path component of every walk into a kernfs mount. Nothing it reads needs the semaphore. kn->active is an atomic_t, kn->__parent and kn->name are rcu pointers, kn->ns can be compared instead of dereferenced and the directory revision is a plain counter. The callback runs under rcu now. Readers walking cgroupfs and sysfs while another thread churns cgroups, renames netdevs and plugs devices went from 48,593,360 read acquisitions and 1,744,517 contentions to 1,280,280 and 429,846 on an 8-CPU VM and path walk throughput improved 35-53%. LOOKUP_RCU still returns ECHILD because kernfs_iop_permission() forces every walk out of rcu-walk anyway. That is left for later. kernfs_fop_readdir() held the semaphore across dir_emit(). dir_emit() copies to userspace and under memory pressure that fault goes to reclaim with the lock every create, remove and rename needs held for reading. Meta sees 120 second allocation stalls in filldir64() from below and systemd-oomd stuck behind it. The lock is dropped around dir_emit() now. Since the entry the listing stopped on can disappear in that window and two entries can share a hash, readdir resumes on the full (hash, ns, name) key and the fallback search lands after the missing entry instead of repeating or skipping one. The repeat was a pre-existing bug between two getdents(2) calls. Three more lock holds are shortened. kernfs_notify_workfn() no longer holds kernfs_rwsem across fsnotify() which allocates against the memcg of the watching cgroup that is already under pressure. The open node is allocated outside the hashed open file mutex, the most contended lock in kernfs on their fleet with 2.19M waiters over 29 days and a 77ms median hold. A new node is activated without dropping and retaking the write lock, lock_stat says 1200 -> 830 write acquisitions for five dummy netdevs, and kernfs_rename_ns() allocates the new name before and frees the old one after the lock so a rename can't enter reclaim or wait out a grace period with it held. Three standalone fixes come with selftests. Same-parent renames take kernfs_rename_lock too so kernfs_path_from_node() can't build a path that never existed. Decoding a file handle takes the semaphore so a decode racing rmdir() can't hash an inode after the removal's ilookup() pass and lose IN_DELETE_SELF. And kernfs_create_link() reads the target's uid and gid under kernfs_iattr_rwsem so a chown in between can't give the link an owner the target never had. The kernfs selftests grew from two xattr checks to coverage of dentry revalidation, rename, namespace tagging, file handles and readdir under churn" * tag 'vfs-7.4-rc1.kernfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: kernfs: free the old name outside kernfs_rwsem kernfs: allocate the new name outside kernfs_rwsem kernfs: activate a new node without dropping kernfs_rwsem selftests: cover readdir resuming at a removed entry kernfs: don't hold kernfs_rwsem across dir_emit() kernfs: resume readdir on the full entry key kernfs: don't repeat or skip an entry when readdir resumes kernfs: don't hold kernfs_rwsem across notification delivery kernfs: allocate the open node outside the open file mutex kernfs: fix up the unlocked attribute reads on the creation paths kernfs: don't lose IN_DELETE_SELF when decoding a file handle kernfs: take kernfs_rename_lock for same-parent renames too selftests: cover kernfs file handles and same-parent rename selftests: cover kernfs dentry revalidation kernfs: Remove kernfs_rwsem from dentry revalidation kernfs: Avoid namespace dereference in d_revalidate() kernfs: Prepare directory revisions for lockless reads kernfs: Use VFS lookup context in d_revalidate()	2026-10-19 18:52:22 -10:00
Linus Torvalds	ada21d495c	vfs-7.4-rc1.coredump ... Please consider pulling these changes from the signed vfs-7.4-rc1.coredump tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc ouhIAP9q03aGe3fMs3tnLWC+JzSc1D48MMmo71rPxGnV6G6V+AEAzZV6Xkq8eFTU Zbwq6FhYvhptWeNGyNa9phUDFcBQIw4= =Pt3z -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull coredump updates from Christian Brauner: "This adds sparse coredumps and per-request memory type selection to the coredump socket protocol. A coredump sent over the socket transfers every zero of every hole in every mapping. For a process with 128 threads that's 1 GB of mostly thread stacks, 8 MB reservations with a few pages touched, and the holes sit in the middle of the dump rather than at the end. The coredump_filter bit that was proposed for this stops each PT_LOAD at the last populated page. But that mask says which kinds of memory to include and propagates across fork and exec, whereas what is selected here is an encoding. The usermodehelper isn't salvagable for this either. The coredump socket already has a handshake for exactly this. A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the coredump as a sequence of records, each a struct coredump_record_header followed by what it describes. The stream ends explicitly with an end record that reports the size, so a missing one means truncation. With COREDUMP_SPARSE holes cross the socket as a bare header that says how many zero bytes were skipped. Reassembling the records gives back the same coredump, so a debugger and everything else still see an ordinary core file. Numbers from the selftests: the 128 thread process sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB mapping with the first and the last page touched sends 188793 bytes for 268890112 bytes, and with COREDUMP_RECORDS alone the record overhead is under one percent. The selftests also simulate a server uploading to a blob store that can't seek and rewrites the program headers so the object is an ordinary ELF core file without the holes. COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per request instead of relying on the static /proc/<pid>/coredump_filter of the crashing task. The request carries the default types and a mask of every type the kernel knows about, the ack carries the selection. Zero is valid and dumps the program headers and notes and nothing but the mappings that are always dumped. Preparatory cleanups refuse negative skips in dump_skip_to(), chunk every write at a page so a pipe or a socket never takes a short write in the middle of a record, make the dump helpers return bool and replace the core_dumped integer with COREDUMP_STATE_STARTED and COREDUMP_STATE_TRUNCATED flags. Also included is a fix for coredump_parse() reading core_pattern while it is being modified. The sysctl handler now validates a copy and publishes it under a spinlock and the parser works on a snapshot, so a rejected pattern is never visible and the rollback logic goes away. And to_kthread()'s lockless flags read is annotated with READ_ONCE()" * tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits) kthread: Annotate lockless to_kthread() flags access coredump: parse a snapshot of core_pattern selftests/coredump: test failed handshakes selftests/coredump: improve coredump size negotiation tests selftests/coredump: test COREDUMP_MEMORY_TYPES selftests/coredump: simplify the refusal tests tools: sync coredump.h header coredump: select memory types to include selftests/coredump: show how to inspect the task to decide how the coredump should be sent selftests/coredump: simulate a blob store selftests/coredump: put a hole in the middle of a sparse mapping selftests/coredump: hand the record stream to a sink selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE coredump: describe the holes when COREDUMP_SPARSE is negotiated coredump: send the coredump in records if requested tools: sync coredump.h header coredump: add COREDUMP_SPARSE to the coredump socket protocol coredump: add COREDUMP_RECORDS to the coredump socket protocol coredump: clean up coredump state handling coredump: always chunk writes ...	2026-10-19 17:21:24 -10:00
Linus Torvalds	4effd80841	vfs-7.4-rc1.close_range ... Please consider pulling these changes from the signed vfs-7.4-rc1.close_range tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc ouFoAP9oJWCJRlKwbki5KP0P3O6/gnQXUz8gR07qxzWk8Gz/NgD/V3+MHkU8fX2w oTOGPuwrbbRNBTK/cmRG2kF6xxOPSw8= =jDl8 -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull close_range updates from Christian Brauner: "This adds two new close_range() flags. CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors outside of [fd, max_fd] instead of the ones inside. Alone it closes everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never takes a reference on what is dropped. So a task between clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the descriptors for the child in one window can shed the rest of the shared table in one call and nothing outside of the window is referenced by the child at any point. CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the range and leaves everything else alone. Whatever the caller deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of close-on-exec descriptors that have to survive, the executable or an error pipe, and closes every other close-on-exec descriptor. Along the way dup_fd() stops copying a range in the middle of the table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only avoided the copy when the range sat at the end of the table. Descriptors in a skipped range are never copied and no reference is taken on them, so ->flush() isn't called anymore for files from a table they were never part of. The flags are turned into an enum and selftests cover the window positions, the shared and the private table and the unshare form" * tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY file: add CLOSE_RANGE_CLOEXEC_ONLY file: let dup_fd() drop only close-on-exec descriptors selftests/core: test CLOSE_RANGE_EXCEPT file: add CLOSE_RANGE_EXCEPT close_range: turn the flags into an enum file: let dup_fd() drop everything outside of the range file: rename dup_fd()'s punch_hole to range selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind file: let dup_fd() leave the punched hole behind	2026-10-19 17:11:41 -10:00
Linus Torvalds	550a7e28d8	vfs-7.4-rc1.binfmt ... Please consider pulling these changes from the signed vfs-7.4-rc1.binfmt tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc ohI7AP95N3Ty6xsiT14eGKl2jT6x265bpC4fodnQB098QdVNAQEA40ttNCy6j+i/ ZR4Hy5e8OAqWdj87h7m4EW9ED5yUog8= =2LN3 -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull binfmt updates from Christian Brauner: "This only lets punctuation delimit a binfmt_misc register string. Arbitrary delimiters never made sense and nothing uses them. Every new flag shrank the set of possible delimiters and made extensions more hazardous than they need to be. Letters, digits, whitespace, control characters, bytes above 0x7f and the backslash now get EINVAL. Everything deployed uses ':' anyway. This extends the fix that rejected a flag character as the delimiter. Selftests and documentation are included" * tag 'vfs-7.4-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: binfmt_misc: document the field delimiter selftests/exec: test delimiter restrictions binfmt_misc: only let punctuation delimit a register string	2026-10-19 17:02:56 -10:00
Linus Torvalds	355da270c1	vfs-7.4-rc1.bfs ... Please consider pulling these changes from the signed vfs-7.4-rc1.bfs tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc opHiAP0csRVd+U4nqcrpNanoYj4nTG6lvgiiBzD+hzUFBLJ2KQD6Aj8akdbzxCMz ScnMxAqO1blX4NLZ+jpJvRCe0XTdBw0= =fkoW -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.bfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull bfs removal from Christian Brauner: "This removes bfs, the filesystem UnixWare uses for its boot partition. It only supports contiguous files and has no subdirectories. The only data on such a partition are kernels and bootloader settings so there is no reason to access it from Linux anymore. The uapi header stays" * tag 'vfs-7.4-rc1.bfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: bfs: remove the filesystem	2026-10-19 16:55:31 -10:00
Linus Torvalds	018cf9bf78	kernel-7.4-rc1.signal ... Please consider pulling these changes from the signed kernel-7.4-rc1.signal tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc ol44AP9GXKnV7oRC5J2uldXgoE7GQRjf790BwJSFf2qHGPJeUwD6AzK4IH2KIEmW XB8DEzDKabDKCt0bsTgM7NPqMXPOyA8= =o2lX -----END PGP SIGNATURE----- Merge tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull signal handling updates from Christian Brauner: "This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be restarted and fixes a bunch of coredump and signal bugs. TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it returns to userspace, runs its task work and goes back to sleep. That breaks coredumps: dump_interrupted() only lets fatal signals interrupt a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the pipe and the socket paths check signal_pending() Adeep down in code that is shared with regular syscalls and bail. So a crashing process with io_uring requests in flight loses most of its coredump. In the selftest an unfixed kernel delivers 357324 of at least 5111808 bytes. And io_uring isn't the only source. klp_send_signals(), bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and the printk kunit test raise the bit as well, some of them from irq context against any task. So this can't be fixed per subsystem and the state has to be per-task and ambient. Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers modelled on memalloc_nofs_save(). Inside such a section signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send path, which hand-rolled its own version of this, and the pid namespace reaper, which busy-looped when the bit kept getting raised, are converted. The second part is a set of fixes that fell out of looking at the coredump code with kres and modelling it in TLA+: - coredump_finish() woke the parked threads without holding rcu. A parked thread can exit on a spurious wakeup and be freed before wake_up_process() takes its pi_lock. - Only SIGKILL and the freezers interrupt a dump now and the three freezers agree. Power management and cgroup v1 freezing aborted a dump while a cgroup v2 freeze either waited for the dump or cut it short depending on where the core went. - io-wq set its exit bit without a barrier against the task work that creates workers. On weakly ordered architectures exit could hang on worker_done. - retarget_shared_pending() slingshotted a shared signal to the dumper when a zapped sibling restored its signal mask. That set TIF_SIGPENDING on the dumper and truncated the core. - A tracer could clear the signal mask of a user worker with PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of an SQPOLL ring dumping core deadlocks the whole group. PTRACE_SETSIGMASK is refused for user workers now and __set_task_blocked() enforces the fork-time mask. - exec cancels io_uring requests before de_thread() so a worker creation queued as task work can't add a thread to a thread group that de_thread() just took down. - No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP creator anymore. Such a worker was invisible to zap_process() but still decremented threads_remaining on exit so the dumper could leave coredump_wait_inactive() early. Also included are a comment that do_each_pid_task() needs tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for fork() into a pid namespace whose ancestor lost its init" * tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits) pid: use READ_ONCE() in pid_alive() selftests: pid_namespace: test fork with dead ancestor pid: document that do_each_pid_task() needs tasklist_lock signal: enforce the user worker signal mask in __set_task_blocked() fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask fork: don't create io threads once PF_POSTCOREDUMP is set fork: move the coredump and exec checks into create_io_thread() exec: cancel io_uring requests before de_thread() selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker selftests/coredump: test a user worker as the coredumping thread ptrace: refuse to change the signal mask of a user worker selftests/coredump: test shared signal retargeting during a dump signal: only SIGKILL and the freezers interrupt a coredumping task signal: don't retarget shared signals in a dying thread group io-wq: order the exit bit against worker creation task work coredump: hold RCU while releasing parked threads pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper smb: prevent TIF_NOTIFY_SIGNAL from interrupting selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps ...	2026-10-19 16:22:15 -10:00
Linus Torvalds	e86d265826	namespace-7.4-rc1.misc ... Please consider pulling these changes from the signed namespace-7.4-rc1.misc tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc okOqAP98o3UxyJOsSJfNJpr0OnHzk/WHbt8Qm7Lmk0Xgt2h6BgD/Ypf5v68wiCaS eg6X3g3wR4tLMbdTkEy5tekLG80Alg4= =36S+ -----END PGP SIGNATURE----- Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace updates from Christian Brauner: - Reject uid_map, gid_map and projid_map values that don't fit in a u32. map_write() parsed with simple_strtoul() and truncated modulo 2^32 on 64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an error. Each field is parsed with kstrtou32() now and selftests cover the out-of-range, negative and in-range cases. This isn't a security fix. The truncated values were valid ids and every later check still applied to them. - Annotate struct uid_gid_map's forward and reverse pointers with __counted_by_ptr and add a KUnit suite for inserting and sorting extents. insert_extent() wrote to forward[nr_extents] before bumping the count which the annotation flags, so it bumps first now. Two follow-up fixes rename the now global helpers to uid_gid_map_insert_extent() and uid_gid_map_sort(), since the btrfs self-tests have their own insert_extent(), and guard the declarations on CONFIG_KUNIT. - Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname(). create_new_namespaces() always passes a valid pointer and the other copy_*_ns() helpers don't check either. - Remove a dead key_put() on the create_user_ns() error path. * tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/namespaces: add uid_map/gid_map range tests userns: reject uid_map/gid_map values that do not fit in u32 userns: declare the KUnit-visible helpers whenever KUnit is enabled userns: rename insert_extent() and sort_idmaps() userns: Add KUnit test suite for uid_gid_map userns: Add __counted_by_ptr attribute to struct uid_gid_map fs: namespace: drop BUG_ON() in copy_mnt_ns() uts: drop BUG_ON() in copy_utsname() userns: remove dead key_put() on the create_user_ns() error path	2026-10-19 16:09:10 -10:00
Thomas Weißschuh	700ce4da6f	selftests/nolibc: explicitly disable position independent executables ... nolibc does not support position independent executables (PIE). However a toolchain might generate these by default depending on various circumstances. Recently clang started to do so for hexagon. See LLVM commit ab43cb8520c0 ("[Hexagon] Pass -pie to linker when PIE is the toolchain default (#189723)"). As clang can also be configured to create PIE for other architectures by default disable it globally. While we are at it also pass the argument for GCC to be on the safe side. If PIE is disabled already, clang will generate -Wunused-command-line-argument warnings. Inhibit those. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Reviewed-by: Willy Tarreau <w@1wt.eu> Link: https://patch.msgid.link/20261018-nolibc-unused-arguments-v1-1-6cba71555fe8@weissschuh.net	2026-10-18 10:23:42 +02:00
Magnus Lindholm	b9fad53a62	selftests/seccomp: add Alpha support to seccomp_bpf ... Enable the seccomp BPF selftests on Alpha with a fallback seccomp syscall number and architecture-specific syscall register accessors. Use the NT_PRSTATUS register layout rather than struct pt_regs. The register set contains r0-r30 followed by pc and unique. Read and update the syscall number in r1, and set both r0 and the r19/a3 error flag when synthesizing syscall results. At syscall entry, r19 still contains the fourth syscall argument, so callers setting a synthetic return value must also set the syscall number to -1 to skip execution. Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20261010134214.974565-1-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>	2026-10-18 00:44:45 +02:00
Lukas Zobernig	32c52ec87d	x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() ... Commit 45e1dccc06 ("x86/insn: Simplify for_each_insn_prefix()") made for_each_insn_prefix() declare its own loop counter named idx. get_seg_reg_override_idx() keeps its result in a local of the same name, so the assignments in the loop body now write the loop counter: - the function always returns INAT_SEG_REG_DEFAULT, so FS and GS overrides are ignored; - a CS override sets the counter to INAT_SEG_REG_CS (2), the increment makes it 3, and prefixes.bytes[3] holds the last prefix, 0x2e again, so the loop never terminates. The UMIP emulation reaches this from the #GP handler for user space: an SGDT, SIDT or SMSW with a memory operand and a CS prefix leaves the task spinning in the kernel, never returning to user space, with a SIGKILL that is never delivered. Any user can thus tie up CPUs until reboot. With an FS or GS prefix, the emulated result is written to the wrong address. Rename the internal macro iterator variable. [ Lukas' original patch renamed the use site, I changed it to rename the iterator in the macro instead, but left Lukas' commit message and authorship - Linus ] Fixes: 45e1dccc06 ("x86/insn: Simplify for_each_insn_prefix()") Signed-off-by: Lukas Zobernig <lukas.zobernig@gmail.com> Acked-by: Peter Zijlstra <peterz@infradead.org> Acked-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2026-10-17 06:36:20 -10:00
Linus Torvalds	586a28a179	gpio fixes for v7.3 ... - gracefully handle unsupported fwnode-only, no-device GPIO lookup for shared pins - mark the GPIO controller as sleeping in gpio-nct6694 - fix a GPIO device reference leak in kunit tests - fix memory leak in error path in gpiod_set_array_value_complex() - fix races in GPIO controller and its associated irqchip setup in gpio-mxc - use atomic bitops where races can occur in gpio-mxc - fix build failure in gpio tools -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR4iEACgkQBZ0uy/82 hMNndxAAmWw+V/POtQI8MUVVpp9vvmxSbBA+E//owQRKE8+67RR42pxvVyL1KDj1 laLUX/ZEWSe4jfLwK11hSbqona3wcGTzgzNJIpDfix70QNwY2rKaJ9xx5xAF8+LJ v1do7Et54FYJyhhuoeMNgLvaULpSXw4Vg9FeO6yHlLdUmkbKRSEgxlBN2UZ70Wgb +7xeYgZpzN9OHQ/ldIsdsFwZTn8Zc7zx1a+dxlUy6OZ/ndXBBE5FOOOBCj97qCbN AdDhNuIxH72l9dMgGJ9uvgVYU0ZVFl6RXYG4XB239dVsX80ewDP/XolOJM9wlxVT p3i/zgv4SaTn8n/oKeUojvCNcR9dXrDouL/Fo2iRSEwwv87mVWyBMVAyWmTKAo9b tvi3F2cZeSLYrvf0ZKGz08BbOxtxToATWxHq303PYRExFWq1h5l9n5D0XairNZrZ cFeqP5rAOxWkB44aQRT1xU9LCZjYDO+LYYvevwfANrDseMpeJJmue/hBFPsIfWfs I2gWNpKC9cG1R5H/pNsEn9JqO7VwQCuYx6QswTIDUlE4Wca11qZcz3APeriDIO67 PAHBOSm7jwKJ9nuXp9PfLYjqGss+uT1o6pYiJfYOA8PtvZofwqkeXvU0B8G2OIFt KxcvHDg+soCqpaoYOBJLNAnMlvaJLg6ABHHi4SLrjUxsY1SiTAQ= =ZNMF -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - gracefully handle unsupported fwnode-only, no-device GPIO lookup for shared pins - mark the GPIO controller as sleeping in gpio-nct6694 - fix a GPIO device reference leak in kunit tests - fix memory leak in error path in gpiod_set_array_value_complex() - fix races in GPIO controller and its associated irqchip setup in gpio-mxc - use atomic bitops where races can occur in gpio-mxc - fix build failure in gpio tools * tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mxc: fix race between gpiochip registration and IRQ domain setup gpio: mxc: fix wakeup_pads bit operations gpio: mxc: fix both_edges bit operations gpio: mxc: fix race between chained IRQ handler install and probe completion gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths gpio: kunit: fix GPIO device reference leak with __free() gpio: shared: gracefully handle no-device lookup of shared GPIOs gpio: shared: fix use-after-free bug when adding shared proxies tools: gpio: fix building from the top level with O= gpio: nct6694: Mark the GPIO controller as sleeping	2026-10-16 08:14:37 -07:00
Linus Torvalds	1dbb742205	vfs-7.3-rc8.fixes ... Please consider pulling these changes from the signed vfs-7.3-rc8.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc ooBKAQCaO0P/WCAUk+nHRuqKMT5Wjpcb+RKbZEDYxMt+JobeOwEAhx4ThOT8eOwX D2x/HjeOJ66fkbtFP1dXJzKaySf/PAs= =g2mr -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a range of use-after-frees during rcu pathwalk caused by non-rcu frees. Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash() and ->d_compare() read in rcu mode has to be freed after a grace period. umount(2) hides most of it because namespace_unlock() waits for one, but a chdir() out of a lazily unmounted directory or the close() of the last file on it drops the last reference without. * ext4_get_link() reads the sbi and the extent status counters for a symlink stored in a data block. Both are freed after a grace period now. * The unicode map of casefolded ext4, f2fs and tmpfs was freed under generic_ci_d_hash() and generic_ci_d_compare(). * ntfs3 with nocase freed its sbi and mount options under its dentry hash and compare. A remount freed the old options right away too. * eventfs freed an eventfs_inode after an SRCU grace period only while tracefs_d_revalidate() reads it under rcu_read_lock(). * afs and 9p are only saved by the grace period their private bdi gets in bdi_unregister(). They stop depending on it. * create_ipc_ns() leaked the mqueue mount and its superblock on a late failure. A long-term mount needs kern_unmount(). - Don't let idle threads pin the initramfs. The idle threads of the secondary cpus are forked from PID 1 with a private copy of its fs_struct, aren't on the task list so pivot_root() never moves them and never exit. So the initramfs stayed pinned forever on every machine with more than one cpu, 70 to 150 MB in the reports. They share init_fs now like init_task does. - A mount that copy_tree() leaves out can't take over a lock. copy_tree() drops mounts of mount namespace files from the copies it makes for unshare(CLONE_NEWNS) and propagation without looking at MNT_LOCKED. So root in a user namespace could bind a child's /proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over, unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with EPERM now and the move beneath a locked mount is refused up front. - Revert "namei: don't reveal overmounted entries in refwalk" from the rc7 fixes. The bug class is bigger than that patch. - namei: lookup_fast_for_open() checked ->d_inode while traverse_mounts() checks the type in d_flags, which is set second, so a refwalk racing the instantiation could fail an O_CREAT open with ENOENT. Use d_is_negative() in both places. - Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount() that mnt_get_count()'s own barrier made redundant. - fsnotify: a mark added while fsnotify_destroy_marks() walks the connector could be missed and the connector detached, so an fdinfo read called igrab(NULL). New marks are refused during teardown. - pipe: a failed second fasync enable on an O_RDWR FIFO removed the existing reader entry and cleared FASYNC while the writer entry stayed, a use-after-free in send_sigio() later. - watch_queue: post_one_notification() could see nr_notes before the note pool behind it and dereference a NULL array. An unprivileged user can trigger that with a key watch. Publish nr_notes last. - pid_namespace: zap_pid_ns_processes() waits without bound for a tracer outside the namespace to reap its zombies and neither wait was freezable, so every suspend attempt failed. - exit: is_child_subreaper and has_child_subreaper shared a word with other bitfields written without a common lock, so racing prctl()s lost a bit. They are separate bools now. - autofs: a notification write that failed on a pipe the daemon had already replaced put the superblock into catatonic mode again and closed the replacement. Only do that for the current pipe. - ovl: reject a lowerdir ending with an unescaped backslash with EINVAL instead of a confusing ENOENT later. - ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks the recovery participant list. - samples/pidfd: fix the userprogs typo that kept pidfd-metadata from being built. * tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits) Revert "namei: don't reveal overmounted entries in refwalk" selftests/filesystems: test that a mntns file can't take over a lock fs: let idle threads share init_fs namespace: a mount that copy_tree() leaves out can't take over a lock namei: test for a negative dentry the way traverse_mounts() does fs: pass flags to copy_fs() ovl: reject lowerdir ending with unescaped backslash fsnotify: prevent mark additions during connector teardown pid_namespace: make zap_pid_ns_processes() freezable fs: drop the smp_mb()s that mnt_get_count() made redundant autofs: ignore notification errors from a replaced pipe ntfs3: free replaced mount options after a grace period ntfs3: free the sbi after a grace period unicode: free the map after a grace period ipc: drop the mqueue mount with kern_unmount() on setup failure eventfs: free the eventfs_inode after an rcu grace period too 9p: free the session after a grace period watch_queue: Fix note pool publication race in watch_queue_set_size() afs: free the super info after a grace period pipe: preserve existing fasync readers on writer setup failure ...	2026-10-16 07:53:16 -07:00
Catalin Marinas	34fa781e25	Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', 'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core ... * arm64/for-next/perf: (22 commits) drivers/perf: apple_m1: Add macOS 27 M2 Event perf/marvell: cn10k_tad: Publish the OF module alias perf: xgene: initialize lock before requesting IRQ perf: marvell: avoid large stack variables perf/dwc_pcie: Fix PCI device reference leak in probe coresight: perf: Suppress ITRACE start records perf: arm_spe: Suppress redundant ITRACE start records perf/core: Export perf_event_itrace_started() perf/cxl: Clear stale overflow status before using a counter perf/cxl: Don't log through pmu.dev in the overflow interrupt handler perf/cxl: Validate the hardware-reported counter width perf/cxl: Unfreeze counters after handling an overflow interrupt perf/cxl: Don't share the overflow interrupt, and keep it pinned cxl/pci: Add the PMUs after configuring events perf/cxl: Split the MSI vector out of info->irq perf/cxl: Accept an overflow interrupt on MSI message number 0 perf/cxl: Fix the counter overflow delta fixup perf/cxl: Clear stale event fields before reprogramming a counter perf/cxl: Program the requested event group on configurable counters drivers/perf: hisi: Add cycle event for new MN PMU ... * for-next/misc: arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code arm64: clear_page[s] using memset arm64/sve: Don't zero the SVE state buffer when the SVE state is live arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2) arm64: Use proper include variant arm64: include: fix repeated word 'to' in comment selftests: arm64: fix typo "hander" in comment arm64: fix typos in comments docs: arm64: Fix typo "initalised" in booting.rst arm64: alternative: Remove 'cfg' parameter arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter arm64/cpufeature: Change description for ARM64_HAS_LPA2 * for-next/be-gone: drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN arm64: Kbuild: Remove vestigial big-endian support gve: Add explicit ARM64 dependency to Kconfig crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN arm64: Remove all usage of __AARCH64EB__ arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN KVM: arm64: Remove support for a big-endian hypervisor object arm64: vdso32: Always build compat vDSO object as little-endian arm64: assembler: Remove endianness helper macros arm64: lib: Assume a little-endian kernel in optimised string routines arm64: lib: Assume a little-endian kernel in custom library routines arm64: crypto: Assume a little-endian kernel arm64: bpf: Remove big-endian support from the JIT compiler selftests/arm64: Remove big-endian support * for-next/smccc-bus: : Switch Arm SMCCC firmware services to an SMCCC bus arm64: rsi: Correct type of realm_config::hash_algo firmware: smccc: Pass only the required device probe arguments firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries coco: guest: arm64: Remove dummy CCA platform device coco: guest: arm64: Add sysfs ABI for CCA Realm guests firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device virt: coco: arm-cca-guest: Rename TSM report source file arm64: realm: Move Realm memory encryption ops to RSI code firmware: arm_rmm: Move RSI support out of arch/arm64 firmware: hwrng: arm_smccc_trng: Register as an SMCCC device firmware: smccc: Add an Arm SMCCC bus * for-next/preemptible-this-cpu: : Preemptible this_cpu_*() operations arm64: percpu: Remove _pcp_protect*() wrappers arm64: percpu: Implement preemptible CMPXCHG128 ops arm64: percpu: Implement preemptible CMPXCHG ops arm64: percpu: Implement preemptible XCHG ops arm64: percpu: Implement preemptible return RMW ops arm64: percpu: Implement preemptible void RMW ops arm64: percpu: Implement preemptible read/write ops arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops arm64: entry: sdei: Make 'tsk' available arm64: entry: sdei: Restore all clobberable GPRs arm64: gpr-num: add __GPR_NUM() helper arm64: gpr-num: Add wxN aliases for wN registers arm64: percpu: Factor out percpu offset asm arm64: ptrace: Always inline pt_regs_{read,write}_reg() arm64: preempt: Treat should_resched() as unlikely arm64: preempt: Simplify and optimize __preempt_count_dec_and_test() arm64: cmpxchg128: LSE: Remove redundant operands arm64: cmpxchg: LL/SC: Avoid redundant extension * for-next/cpu-errata: : Various CPU errata workarounds arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata * for-next/mpam: (30 commits) : MPAM updates arm_mpam: make the mon_sel guard conditional only arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL arm_mpam: detect and enable MPAM-Fb PCC support arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler arm_mpam: add MPAM-Fb MSC firmware access support arm_mpam: prepare mon_sel locking for MPAM-Fb arm_mpam: propagate MSC access errors in mpam_reset_class_locked() arm_mpam: propagate MSC access errors for interrupt control arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid() arm_mpam: propagate MSC access errors for state saving function arm_mpam: propagate MSC access errors for __ris_msmon_read() arm_mpam: propagate MSC access errors for msmon helpers arm_mpam: propagate MSC access errors for MBWU counters arm_mpam: propagate MSC access errors for hw_probe functions arm_mpam: let low level MSC accessors return an error MAINTAINERS: Use linux-arm-kernel list for the MPAM driver MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry arm_mpam: resctrl: Don't stop early when tearing down a class arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs ... * for-next/kselftest: : arm64 kselftest updates kselftest/arm64: signal: copy each test binary only once kselftest/arm64/mte: Use MTE safe memory accessors kselftest/arm64/mte: Introduce MTE safe memory accessors kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked * for-next/efi: : arm64 EFI updates/fixes arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO * for-next/secondary-boot-prep: : cpuinfo cleanup in preparation for parallel secondary bring-up arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store * for-next/sysreg: : sysreg updates perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values * for-next/gcs: : GCS updates/fixes kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures	2026-10-15 19:09:10 +01:00
Sasha Levin	7b3b147c41	kselftest/arm64: signal: copy each test binary only once ... The signal tests are built in testcases/ and then copied to the output directory. The copy rule lists every generated program as a target and copies all of them in each recipe: $(TEST_GEN_PROGS): $(PROGS) cp $(PROGS) $(OUTPUT)/ In a parallel build make runs that recipe once for each program, so several cp processes write the same destination files at the same time. cp then fails with "cannot create regular file ...: File exists", which fails the arm64 build even though every test compiled. A cross build of the arm64 signal tests at -j8 hit this in all of 8 runs. Use a static pattern rule so that each output depends on, and copies, only its own binary. Fixes: f96bf43403 ("kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>	2026-10-15 18:32:59 +01:00
Mark Brown	8c831e5cd3	kselftest/arm64: Check for -EPERM not -EBUSY in the locking test ... The API has been updated to return the more descriptive -EPERM rather than -EBUSY, update the selftest to reflect this. Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>	2026-10-15 16:45:08 +01:00
Linus Torvalds	6a66840a68	Hyper-V fixes for 7.3-rc8 ... -----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmrQiJsTHHdlaS5saXVA a2VybmVsLm9yZwAKCRB2FHBfkEGgXp1UB/4uruLK5Zg/Sf4PguV7WgO9hrEYCTnk urzYhnkOB3G8w0/2p9HVVQUXX29E6oz5w5V/h5piPLXNUSLyei119qhIaZx5BbTe EjCbsIMaqSzI3cGojUNEp6F93wl4ztrKFHQ6nELOfJtFu07R9dr00FRjP8qvJdcn IPCTDotMtRseV/ALG6DCfvWxykmmxGG0odKYQKJTT80q8GEPdDDo+p5SL/4RtxtO h+S2VZ21VgHoU4N6qdJH/dFj0g58wwIMYgj5j2mhpiriXPBMVAQjK1kiMRM7n1xP JvhrKoW794vCMJBHFSTPRl2oxUwbLU1FYacshNcIa8TRm9YAnIhO+Nef =Vqks -----END PGP SIGNATURE----- Merge tag 'hyperv-fixes-signed-20261015' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Wei Liu: - Typo and comment fixes (Hemanth Selam, Jiangshan Yi) - Update maintainers list (Wei Liu, Long Li) - Two Hyper-V PCI driver fixes (Naman Jain, Sahil Chandna) - Small fixes for core Hyper-V code (Hardik Garg, Michael Kelley, Waiman Long) * tag 'hyperv-fixes-signed-20261015' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: MAINTAINERS: drop KY from Hyper-V maintainers list PCI: hv: Warn when wait_for_response() waits indefinitely PCI: hv: Probe vPCI buses asynchronously MAINTAINERS: remove myself from the Hyper-V entries mshv_vtl: Check per-CPU register page before mmap tools/hv: fix typo "retrive" in comment Drivers: hv: vmbus: fix typo "substract" in comment Drivers: hv: Don't reset VMBus connection state on error/exit paths x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() x86/hyperv: Fix stale comments after stimer message mode removal Drivers: hv: Avoid infinite retry loop in init_vp_index()	2026-10-15 08:06:26 -07:00
Sasha Levin	f9532b372e	selftests/nolibc: use the configured kernel header directory ... The freestanding build hardcodes the source tree's usr/include even when selftests exports KHDR_INCLUDES for an output-directory build. Use the exported header location while preserving -nostdlib, -nostdinc and static linkage. GCC 14 and Clang 21 builds then find the generated UAPI headers. Fixes: eb13531108 ("selftests/nolibc: integrate with kselftests") Signed-off-by: Sasha Levin <sashal@kernel.org> Link: https://patch.msgid.link/20261014200142.1364761-1-sashal@kernel.org Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>	2026-10-14 22:54:16 +02:00
Christian Brauner	eadfe727dd	selftests/filesystems: test that a mntns file can't take over a lock ... Add a case to the locked mount test: - a bind of the mount namespace file of a grandchild moved beneath a locked cover must fail with EINVAL - a bind of an ordinary file beneath it takes the lock over, the old cover can go and the new one can't - the file is still covered after unshare(CLONE_NEWNS) Link: https://patch.msgid.link/20261014-work-namei-locked-mnt_ns_file-v1-2-24035bd5d8e9@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-14 22:08:06 +02:00
Linus Torvalds	ca3e345926	Bootconfig fixes for v7.3-rc7: ... - bootconfig: give the footer size static_assert a message Add a message to static_assert() macro because it is required for the compiler before C23. This fixes a warning. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrOu6YbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8b35gH/RzXQDziJaIHlRzShWV0 sHmbcfpI9exgNWn49g5CrmGTaCwTp9Ejmg9VoOxCTMSeZsd5/WDNSJj4vU0lwkYY 1UgKUhCbvNjuoXT2hrlMcYPldHYbQHpcD70cnnQKVqS3YlEMMXGxzhdyRYwwY16+ OaS8IQKvlUOgRAPIvMjbYXJCcwJHwceErkkXcEaIzchemu77Oo/Av5QcaB6/8mLu FLN9VcK8ddDQvSaM/zMfpQ/Hg/DJf35/rYp4pXpkoSeA0EkXPuuQP/20/sL6+XzP dVymgUr4aomEk+jHv41tf4u/tRAssKNLyido36Zb5jGD2FDJascmvECZCfu+umRq kJk= =jayF -----END PGP SIGNATURE----- Merge tag 'bootconfig-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fix from Masami Hiramatsu: - bootconfig: give the footer size static_assert a message Add a message to static_assert() macro because it is required for the compiler before C23. This fixes a warning. * tag 'bootconfig-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: give the footer size static_assert a message	2026-10-13 16:53:40 -07:00
Linus Torvalds	cbc08c2047	turbostat-2026.09.28 ... Since turbostat-2026.04.21: bug fixes -----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEE67dNfPFP+XUaA73mB9BFOha3NhcFAmrBOeQUHGxlbi5icm93 bkBpbnRlbC5jb20ACgkQB9BFOha3Nhd3HBAAswLnK3kpYJ9hv/DzeH1vBpZBxXM4 fS3hydlvPHjnJ0XCxnCfpITzzJm9VRVdBm4cVKYbzZe/KPC8IqhaPN1/mxa226JB wGNg5GaWqmHyCnd0oTEnqnsp1xSIubAOCsAbJiqxvJaNvLfJ2x329WAD87MSjkSD OWiJJyOWno57ZnriC8S6HjqVbc15luDh0Iu/OsuVbGo85cbLh/jgfok4MmGEEQma ms/csuE4Fz7xnM3bgezs5xyr+Mk6AYlGKFJQsjNnmplWKS31UIw//DW4c0ESmpan 0xYwkJL8S/+/fZxZVHDsIHqUTolaTEH6P99fpvaVhUo/ewrUX8uUpJJM017+kvCD 2ZmLqwwqsZ8cDU27eoyv0lCKEkO5kyesXmmx5pfxLEYZNPS2NpASlAmgC7iONQdR MRVTrgbaUs1L1u8jlpPG6mWJwrAE9LXNVkoDeVCtEmSHJk+GbRFN/NoBeUck9iwT 5YHUWjU1Ccs4Ac04eoa2YB8yM51nDyeb8CAgUTHSZ/hRjy+fzFt2rblf3IIjRti7 1PFsG+vTGK82PqwGwq3mHew5K8302x1rvwIt9VJk89DLYHHjR7pGkyuYVLNUe75a XTTDTxCv8pBC8wJNW5HTOUhdl4gcM+2P1pouNkoCFU79/V9m5u/HJkv7mrZYybIW 9VmBSMFKV0y87FE= =5B9V -----END PGP SIGNATURE----- Merge tag 'turbostat-2026.09.28' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat fixes from Len Brown. * tag 'turbostat-2026.09.28' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: turbostat 2026.09.28 tools/power turbostat: Fix add_counter issue if > 24 counters. tools/power turbostat: Fix PMT error path fd handling tools/power turbostat: Fix CWF PMT off-by-one tools/power turbostat: Fix fd_perf leak on reset tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages tools/power turbostat: add NULL check after calloc() tools/power turbostat: Warn, but don't Err on out-dated perf systems tools/power turbostat: Read complete CPU lists	2026-10-13 16:51:44 -07:00
Peter Zijlstra	840e23085b	Merge branch 'tip/sched/urgent' ... Pickup dependencies; notably the RB-tree fix. Signed-off-by: Peter Zijlstra <peterz@infradead.org>	2026-10-13 13:51:24 +02:00
Sasha Levin	52336337f1	tools: gpio: fix building from the top level with O= ... "make O=<dir> tools/gpio" fails: Makefile:27: /tools/build/Makefile.include: No such file or directory tools/Makefile clears srctree, and the gpio Makefile only works it out again when building_out_of_srctree is not set, which the top-level Makefile sets for O= builds. Also work out srctree when it is empty, as tools/bpf/Makefile does since commit a89b2cbf71 ("tools, bpf: Fix build for 'make -s tools/bpf O=<dir>'"). Fixes: 4a6a6f5c4a ("tools: gpio: Use !building_out_of_srctree to determine srctree") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Sasha Levin <sashal@kernel.org> Link: https://patch.msgid.link/20261011223358.2327625-5-sashal@kernel.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>	2026-10-12 16:08:35 +02:00
Kir Kolyshkin	e6e54e7117	selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS ... Pin a mount namespace below a tmpfs mount, the way snapd does under /run/snapd/ns, and attach a recursive clone of that tmpfs inside a younger mount namespace created with OPEN_TREE_NAMESPACE. Without OPEN_TREE_DROP_MNTNS_MOUNTS move_mount(2) fails with ELOOP; with it, it succeeds. Also check that the flag is rejected without OPEN_TREE_CLONE or OPEN_TREE_NAMESPACE, and accepted with the latter. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Link: https://patch.msgid.link/20261006-nsfs-prune-rfc-v3-2-adb97ea52868@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 11:33:19 +02:00
Bjoern Doebel	9ba6627ef6	selftests/filesystems: Fix idmapped_tmpfile layer dir ownership ... The recent idmapped_tmpfile selftest creates a new directory in tmpfs owned by user ID 0. It then idmaps the mount as caller [0,10000) to disk [10000,20000). The original uid 0 owner does not exist in the mapped range. As a result, mapped_caller_creates_and_links fails at the O_TMPFILE open because inode_permission() rejects MAY_WRITE access: idmapped_tmpfile.c:145:mapped_caller_creates_and_links: Expected fd (-1) >= 0 (0) Chown the directory into the mapped range to satisfy the UID requirement. Fixes: d943e68edc ("selftests/filesystems: test O_TMPFILE creation on idmapped mounts") Cc: stable@vger.kernel.org # 7.2+ Signed-off-by: Bjoern Doebel <doebel@amazon.de> Link: https://patch.msgid.link/20261001082411.1493072-1-doebel@amazon.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 11:24:28 +02:00
Ricardo B. Marlière (SUSE)	123dcfe87d	selftests/namespaces: Wait for thread exit via pidfd in active-ref tests ... pthread_join() returns once exit_mm() wakes the CLEARTID futex, but the exiting thread drops its namespace reference later, in exit_nsproxy_namespaces(). The joining thread can therefore still see the namespace as active, making the final open_by_handle_at() check in thread_ns_inactive_after_exit and thread_ns_fd_keeps_active fail intermittently. Have the thread open a PIDFD_THREAD pidfd on itself and poll it before pthread_join(). A pidfd becomes readable from exit_notify(), which runs after exit_nsproxy_namespaces(). Fixes: 29f083c499 ("selftests/namespace: first threaded active reference count test") Fixes: ee86103238 ("selftests/namespace: second threaded active reference count test") Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net> Link: https://patch.msgid.link/20261001-selftests-namespaces-nsid_race-v1-1-25f542cf0b9c@marliere.net Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 11:23:47 +02:00
Sahaj Chaudhari	2ec5a07094	selftests: pid_namespace: test fork with dead ancestor ... Add a regression test for fork() into a PID namespace whose parent namespace has lost its init process. Since the kernel cannot assign the new process a PID in that dead ancestor, fork() must fail with ENOMEM. Create the nested PID namespaces, keep the child namespace handle open after its init process exits, then enter it and verify fork() fails. Register the test with the PID namespace selftests and ignore its generated binary. Skip when namespace operations are denied or procfs cannot provide the pid_for_children handle. Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com> Link: https://patch.msgid.link/20261007114914.1668934-1-sahaj123.sc@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 11:05:53 +02:00
Natasha Klaus	8b7b7739ea	selftests/namespaces: add uid_map/gid_map range tests ... Check that a uid_map or gid_map line with a value that does not fit in u32, or with a negative value, is rejected with EINVAL and installs nothing, for each of the three fields. Check that in-range lines are still accepted and read back unchanged: a plain single-id mapping, first id 0, the largest valid first id 4294967294, and a line with extra spaces between the fields. When run as root in the initial user namespace, also check that the largest count, "0 0 4294967295", is accepted when written by the parent into the uid_map of a child namespace; an unprivileged writer can only map a single id. Signed-off-by: Natasha Klaus <natalie.klaus@runtimeverification.com> Link: https://patch.msgid.link/20260930112854.373184-3-natalie.klaus@runtimeverification.com Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 11:01:20 +02:00
Christian Brauner	1f47b275d5	selftests/coredump: check the dumping thread's pidfd ... Crash from a non-leader thread and verify that the pidfd from SO_PEERPIDFD_THREAD on the coredump socket refers to that thread and reports the coredump like the thread-group leader's pidfd does. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-10-350183b6e02a@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 10:58:22 +02:00
Christian Brauner	02e658dffe	selftests/net: SO_PEERPIDFD_THREAD ... Add tests for SO_PEERPIDFD_THREAD. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-8-350183b6e02a@amutable.com Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 10:58:21 +02:00
Christian Brauner	4e2446c83f	selftests/net: SO_PASSPIDFD_THREAD ... Extend the af_unix scm_pidfd selftest with SO_PASSPIDFD_THREAD tests. Co-developed-by: Andrew Halaney <andrew@amutable.com> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-4-350183b6e02a@amutable.com Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 10:58:21 +02:00
Christian Brauner	fd0349aadb	pid: add helpers to operate on a struct pid array ... We're about to extend af_unix sockets and coredump code with the ability to hand out thread-specific pidfds. Add a few simple helpers that allow to operate on multiple struct pids up to PIDTYPE_MAX with automatic bounds checking. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-1-350183b6e02a@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-12 10:58:20 +02:00
Sasha Levin	a1ddc27214	bootconfig: give the footer size static_assert a message ... static_assert() without a message is a C23 feature, so clang warns: main.c:498:56: warning: '_Static_assert' with no message is a C23 extension [-Wc23-extensions] Add a message. Link: http://lkml.kernel.org/r/20261011223358.2327625-13-sashal@kernel.org Fixes: 6ed5e20466 ("bootconfig: Fix unaligned access when building footer") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>	2026-10-12 12:35:10 +09:00
Linus Torvalds	f99005fbed	vfs-7.3-rc7.fixes ... Please consider pulling these changes from the signed vfs-7.3-rc7.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCasilxwAKCRCRxhvAZXjc ooQTAQD6awSrQcUIG0ca5hbowpn7sLi8kWGnmzf2yydKSyp3bwEAnpSQEw3BXUKH 0O7JEyZFL0VcMTTceSPKkKCqGg5nugI= =Wc48 -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "This contains fixes for the current development cycle. All of them came out of a review of the mount code that started with a bug report. The review modeled the corner cases of mount propagation, unmounting and mount reference counting and turned up a lot of bugs. Most of them years old. Most fixes come with a selftest. - Rework connected mounts. A mount that is unmounted together with its parent can stay attached to the parent to keep its mountpoint covered. That happens when the mountpoint is removed with rmdir(), unlink() or rename(), when a detached tree is dissolved, and for locked mounts in any umount that isn't synchronous, including the teardown of their mount namespace. The parent then owns the child and drops it on its own final mntput(). So any reference from the child's superblock back to one of its ancestors becomes a cycle that is never freed. A loop device backed by an image on a tmpfs and mounted on that same tmpfs is enough. Remove the directory the tmpfs is mounted on from the host, let the container's mount namespace exit, and the loop device, the tmpfs and the filesystem on the loop device are leaked for good. The same works with autofs, zram, ecryptfs, binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md, and the selftests have reproducers for them. This has been possible since v4.1. It is also why "put_mnt_ns(): leave mounts connected" was reverted in -rc5. Keeping every mount of a dying mount namespace connected made these cycles trivial to create. Every unmounted mount is now detached from its parent. Where the mountpoint has to stay covered the mount leaves a cover on the parent instead, allocated together with the mount. A lookup on the unmounted parent that hits a cover finds an empty immutable directory or file on the private nullfs instance. Nothing leads from a cover to another mount, so no unmounted mount owns another one and no cycle can form. This is visible to userspace. A formerly connected mount can no longer be reached through its unmounted parent and ".." inside it leads nowhere, as for every other lazily unmounted mount. With that the private nullfs instance becomes reachable from userspace, so it now refuses mounts on top, is mounted read-only, and refuses fsnotify marks and file locks. Its inodes are shared by every holder and a watch or a lock would otherwise reach across users. may_decode_fh() now also decides its subtree check under a single mount_lock hold, as a racing umount could otherwise let it decode into what a locked child covered. - umount: * Don't silently unmount busy mounts. Since v4.13 propagate_umount() takes down propagated copies of the victim with children as long as each child is an overmount or another copy of the victim, but propagate_mount_busy() only ever checked copies without children or with just an overmount. A container that moved a tree beneath its copy of a host mount lost that tree from under its open file descriptor to a plain umount() on the host. propagate_mount_busy() now applies the same rules, walking each chain of copies once. * Don't let a migrating task hide its reference from umount(). mnt_get_count() sums the per-cpu counters under mount_lock but the mntget() and mntput() fast paths don't take it. A task that takes a reference on a cpu the sum has already passed and drops it after migrating to one the sum hasn't reached yet hides the reference it held to begin with, and umount() succeeds with the file still open. Gets and puts now live in separate per-cpu counters and all puts are summed before all gets with a full barrier in between, the way srcu_readers_active_idx_check() does it. mntget() is unchanged and mntput() gains an smp_wmb(). * Check each submount for references right before unmounting it. shrink_submounts() and mark_mounts_for_expiry() checked all their victims up front. Unmounting the first could move a busy overmount to where the next victim's propagated copy is looked up and it was then unmounted without a check. * Never expire a locked mount. A shrinkable mount moved beneath a locked mount with MOVE_MOUNT_BENEATH takes over the lock, and umount() of an unlocked ancestor expired it and revealed what it covered. That umount() now fails with EBUSY as it does for any other locked child. A lazy umount still takes the whole tree. - Overmounts and locked mounts: * Unhash a dentry before detaching the mounts on it. unlink(), rmdir() and rename() detach the mounts on the victim but only d_delete() it once its inode is unlocked, a window that includes an expedited RCU grace period. In between, a lookup from a mount namespace in which the dentry is a mountpoint found it hashed, positive and uncovered. Drop the dentry first, as d_invalidate() already does. * Don't reveal overmounted entries in refwalk. A refwalk that had grabbed the dentry before the unlink never rechecked it the way rcuwalk does with d_seq and mount_lock. Without any artificial widening three walkers read the covered file 27 times in a minute. step_into() now fails an unhashed dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is retried. * Keep covered mounts covered in OPEN_TREE_NAMESPACE. Creating such a mount namespace only takes a user namespace and the copy followed bind mount rules: no children without AT_RECURSIVE and no unbindable mounts with it. An unprivileged user could see what mounts covered in the source, such as the parts of /proc and /sys that container runtimes mask. If the caller doesn't own the source mount namespace a non-recursive copy of a mount with something mounted below the requested directory is now refused and a recursive copy includes unbindable mounts, the way unshare() copies. * Keep the lock on a mount that a propagated copy is moved beneath. MNT_LOCKED moved to any mount that ended up beneath a locked mount, propagated copies included. A host mount and umount on a directory covered by a locked mount in a less privileged mount namespace left that cover unlocked for the namespace's owner to remove. Only mounts the caller places beneath take over the lock now. * Handle mount locking for automounts correctly. Which copies to lock was decided by the mount namespace of the task that triggered the automount. A task in a user namespace that triggered one on a host mount through a file descriptor got the host's own automount locked while its own copy stayed unlocked and could have nosuid, nodev and noexec cleared. Use the owner of the mount namespace the mount lands in. - Use-after-free and crashes: * Refuse an automount below a mount that is in no namespace. The private clones overlayfs uses for its layers have the MNT_NS_INTERNAL error pointer as their namespace, which finish_automount() let through and count_mounts() dereferenced. A fanotify filesystem mark on an overlayfs lower layer hands out file descriptors on such a clone. With debugfs as the lower layer opening "tracing" oopses with namespace_sem held for writing and every mount operation on the system blocks from then on. * Reset the old parent's ->overmount in mnt_change_mountpoint(). When propagate_umount() moved an overmount off a mount that a file descriptor kept alive, MOVE_MOUNT_BENEATH through that descriptor later followed the stale pointer into the freed overmount. * statmount() with STATMOUNT_BY_FD and pivot_root() read the parent of a mount that may be unmounted and only held by a file descriptor, while the parent's final mntput() can free it. statmount() now reads it under mount_lock and pivot_root() first checks that both mounts are in the caller's mount namespace. * Queue a mount only once for mount notifications. A mount reparented by one umount_tree() and taken down by the next under the same namespace_sem hold, as in shrink_submounts(), was queued twice. That cut the mounts queued in between out of notify_list while it still pointed at them, and once they were freed every later mount operation walked freed memory. * Don't let a pseudo dentry become the root of a mount. A bind mount of a bpf token file did that with a DCACHE_NORCU dentry, which is freed without an RCU grace period while lockless path walks may still look at it. Refuse to clone such a mount. * Don't inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily unmounted nsfs or pidfs mount through its file descriptor started out flagged as unmounted. Among other things __detach_mounts() then dropped the namespace's reference on it, the mount outlived its namespace and mount_setattr() through the descriptor read the freed namespace. A recursive bind mount of such a mount also copied the unmounted stack still attached to it. That now fails with EINVAL, copying the mount itself still works. * Remove the fsnotify marks of a mount namespace in free_mnt_ns() instead of the RCU callback that frees the namespace, where taking the group mutexes meant sleeping in softirq context. - Propagation and copies: * Keep a copied mount unbindable. Since v6.17 clone_mnt() didn't copy the unbindable flag, so every mount namespace created with CLONE_NEWNS had bindable copies of all unbindable mounts. This had been fixed once before. * Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the mount an unbindable slave, a state nothing else can produce, or silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE after restoring sharing and isn't affected. * Check a recursive bind mount for mount namespace loops. Recursively bind mounting a tree from another mount namespace could put a mount of a namespace's file inside that same namespace, which then pins itself and all its mounts. Repeating it leaks without limit, the reproducer took Shmem from 380 kB to 65916 kB. The copy is now checked with check_for_nsfs_mounts() before it is grafted, as move_mount() does. * Look at the topmost mount for a mount namespace file. attach_recursive_mnt() never looked at the topmost mount of the source's chain of overmounts. If that was the chain's only mount namespace file an existing mount at a propagated destination got buried below the root of the nsfs file where no path walk reaches it. * Don't put a mountpoint on a dentry that's being removed. attach_recursive_mnt() makes a mountpoint of the source's root without its inode lock, so a racing rmdir() of that directory could leave a mount on it that nothing ever detaches. d_set_mounted() now checks cant_mount() as well. - nullfs: * Take no inode lock for readdir of an immutable directory. The root of every empty mount namespace is the same nullfs directory and iterate_dir() held its i_rwsem across ->iterate_shared(). A reader whose buffer faults on a FUSE mount of its own holds it for as long as its server wants, and with an exclusive locker queued behind it every lookup that misses the dcache, every create and every mount in that directory waits. One user of an empty mount namespace stalls all others. Directories with the new FOP_IMMUTABLE flag skip the lock. * Refuse to reconfigure internal superblocks through fspick(), MS_REMOUNT or the read-only remount that a synchronous umount() of the root does. For nullfs only root in the initial user namespace could do it, but the superblock is shared by every mount namespace and the flags showed up in statfs() for all of them. * Don't update the access time on nullfs and refuse F_SET_RW_HINT on an immutable inode. - unshare: Free an nsproxy that was never installed with nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped active references that were never taken, which triggered a warning and hid the caller's own namespaces from listns(). - Smaller changes: mount_setattr() checks the target before it walks the tree to allocate peer group ids, unshare() puts the old fs_struct before the old namespaces, dissolve_on_fput() drops the file's reference to the tree itself, disconnect_mount() is simplified and the documentation of the propagated unmount rule is brought up to date" * tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits) namespace: simplify disconnect_mount() selftests/filesystems: test covered mounts namespace: rework connected mounts nullfs: add an empty immutable regular file selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody selftests/filesystems: add a helper that holds a readdir in a page fault readdir: take no inode lock on an immutable directory nullfs: refuse file locks fsnotify: let a filesystem refuse marks on its objects namespace: nothing is mounted on or written through knullfs namespace: keep the private nullfs instance in knullfs fhandle: decide the subtree check under mount_lock selftests/filesystems: check that an automount below an overlay layer is refused selftests/filesystems: check the atime of the empty mount namespace root selftests/filesystems: check that a lock lands on the right mount and stays namespace: keep the lock on a mount that a propagated copy is moved beneath namespace: never expire a locked mount nullfs: don't update the access time namespace: handle mount locking for automounts correctly namespace: refuse an automount below a mount that is in no namespace ...	2026-10-09 23:37:44 +02:00
Linus Torvalds	af32da41b0	Including fixes from wireless, wireguard, CAN and Bluetooth. ... We have one known regression to wrap up in VLAN handling. Current release - regressions: - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex Previous releases - regressions: - can: fix regression in handling RPS after migrating metadata to skb_ext - eth: iavf: fix regressions in reconfig impacting bonding - eth: mana: fix packet forwarding performance regression - eth: stmmac: remove buggy VLAN acceleration support Previous releases - always broken: - a few high prio fixes for tun, and af_packet - amt: fix a UaF on tunnel teardown - eth: bnxt: fix PCIe AER recovery and FLR handling issues - eth: macb: don't modify Tx skbs before taking ownership - eth: axienet: don't leak Tx skbs on interface stop - wifi: nxpwifi: number of LLM-ish fixes - wifi: assorted mt76 fixes Signed-off-by: Jakub Kicinski <kuba@kernel.org> -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmrH6sMACgkQMUZtbf5S IrtsDg//UvqATFotE+zcXa9yD3Pdg35wSH3uGZJYWIr+ZzEFW3hQdbh9rZy5ulX3 XUhFKlFSeEIarV4UstlvEbkLXSEqbaaFMfYBw03L6os3mGVQqMwi+C+7gn3aoqd4 NE1ct2NChnryr8ORCRjZW3OXjAguGuQBXZ4BFRnDWatbY0Cfuf35ap/RdNKztcEd hct5rsd3LCNgGspjKq19LvD3npEcURebD9Do7mpwoIlw/AECLdCqUW0QkIJW/F6L qZic95CyZXy39guuhI88cmfnSiZfz2grm8az4nlF9cDoJS1CW7peor6KzzisbT6m Iltkwwj6v0NcVKE3f86oSSE5RS8kOJx+YcftNe0S+flZmCLpxopbF6VGfTJUmlyJ CsQ6+n7iQd+1MoZZDGaJjgx14se5pqnnkJ38dVVi1OhomS/jpFYuw2U1dw1GzrJN hLjPxmeF+HIFIKEbVjMyMbTCQGb8CfCQnH0qQ7XJnezImln+oA9ub66b/Zgwbubl k8elLxkiFKgjT9bnwm4/+ZtI5VW8QRgV6sxPxpxD4tyVIaKrs2b9sqv9do3YPjPa HGzMcRL9YMtGcv87gS8gjJRlAdkOWWzVDzw3nf3gMvAiedHIqvtUBcjB22+ueXqg mJ0dT46BBTNbzrl8gljVTU5zm6ZYHxKm2vTTgbMdGJTzASNKfmE= =+sxU -----END PGP SIGNATURE----- Merge tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless, wireguard, CAN and Bluetooth. We have one known regression to wrap up in VLAN handling. Current release - regressions: - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex Previous releases - regressions: - can: fix regression in handling RPS after migrating metadata to skb_ext - eth: - iavf: fix regressions in reconfig impacting bonding - mana: fix packet forwarding performance regression - stmmac: remove buggy VLAN acceleration support Previous releases - always broken: - a few high prio fixes for tun, and af_packet - amt: fix a UaF on tunnel teardown - eth: - bnxt: fix PCIe AER recovery and FLR handling issues - macb: don't modify Tx skbs before taking ownership - axienet: don't leak Tx skbs on interface stop - wifi: - nxpwifi: number of LLM-ish fixes - assorted mt76 fixes" * tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits) net: macb: copy shared skbs before appending the FCS net: macb: check TX ring before modifying skb vsock: Fix memory leak in vmci_transport_recv_dgram_cb() wireguard: noise: reject response consumption after intermediate initiation wireguard: queueing: preserve tstamp_type when encapsulating packet net: openvswitch: validate transport header presence in set_ipv6_addr net/smc: protect clcsock lifetime in smc_getname ipv6: do not warn on route notification size race ipv4: do not warn on route notification size race ipv4: validate checksum_start before completing checksum ptp: ocp: fix PCIe delay estimation calculation xen/netfront: don't leak the skb when xennet_fill_frags() fails net/packet: call packet_parse_headers after virtio_net_hdr_to_skb xen/netfront: drop RX packets with a short Ethernet header net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() net: sparx5: free the matchall entry on destroy selftests: mlxsw: Test port range occupancy on template create mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() net: dsa: microchip: fix KSZ8765 fiber detection net/mlx5e: Order ICOSQ cc update after CQ doorbell ...	2026-10-09 06:40:28 +02:00
Petr Machata	71198b59df	selftests: mlxsw: Test port range occupancy on template create ... Add a test that creates a tc chain template matching on both source and destination port ranges and verifies via devlink-resource occupancy that this does not leak port range registers, neither while the template exists nor after it is deleted. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/e7b37b80adb7ac8b0ef20a22d7654a6656c1c545.1791294384.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2026-10-08 10:49:24 -07:00
Tianyi Gao	c017800af5	selftests: net: veth: test peer ndo-xmit after GRO toggle while down ... Test that toggling GRO on a veth device while it is down updates the peer's ndo-xmit XDP feature once the device comes up, for both GRO on and GRO off. xdp-features is only visible through netlink, so read it with the ynl CLI, as double_udp_encap.sh does. Skip the checks if the CLI is not found, as in an installed kselftest tree. Signed-off-by: Tianyi Gao <tianyi@cloudflare.com> Link: https://patch.msgid.link/20261006173241.65945-3-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2026-10-08 10:43:14 -07:00
Linus Torvalds	b732c98215	7 hotfixes. 4 are cc:stable. ... - Update .mailmap entries for Andy Yan and John Garry. - Fix read-only MAP_SHARED /dev/zero mappings so they retain shared-file semantics instead of being treated as anonymous memory, also avoiding a CONFIG_DEBUG_VM assertion. - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by using the wrong printf format for size_t values. - Fix a boot-time crash when early function tracing causes CPA to free kernel page tables before the workqueues used for deferred freeing are available. - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by an mlock-on-fault VMA self-merging, and one caused by partially remapping a locked VMA. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCascg4wAKCRDdBJ7gKXxA jjLCAP4ygLUaOZmgJVAmD8loFAa/AB0CE1V+LZwBUyzqCogY6wD/Sp+JbhE+mZDS vjp7soYnDoqv7Gi872WTUx2rnjaLxAg= =qjI7 -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-10-07-21-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: - Update .mailmap entries for Andy Yan and John Garry - Fix read-only MAP_SHARED /dev/zero mappings so they retain shared-file semantics instead of being treated as anonymous memory, also avoiding a CONFIG_DEBUG_VM assertion - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by using the wrong printf format for size_t values - Fix a boot-time crash when early function tracing causes CPA to free kernel page tables before the workqueues used for deferred freeing are available - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by an mlock-on-fault VMA self-merging, and one caused by partially remapping a locked VMA * tag 'mm-hotfixes-stable-2026-10-07-21-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: update entry for Andy Yan drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly selftests/mm: cleanup -Wformat issues in hugetlb-mmap mm: don't schedule deferred kernel page table freeing while booting mailmap: update addresses for John Garry mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge	2026-10-08 12:35:20 +02:00
Victor Nogueira	6fa2e7db99	selftests: tc-testing: add cls_route no-routing-attribute change tests ... Add a boundary pair for route4 change without a routing attribute: - a classid-only change of a wildcard filter (handle 0xffff8000) is a metadata-only update and must succeed; - the same change on a non-wildcard handle (0x10001) would rekey the filter to the wildcard bucket, leaving the handle userspace stored stale, and must be rejected with -EINVAL. The change of a wildcard filter is the flow iproute2 uses by default ("tc filter add ... route classid X:Y" gives handle 0xffff8000). Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/QDISC-0JB3.v1.20260923100921@mojatatu.com.2 Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2026-10-06 17:59:06 -07:00
Linus Torvalds	762122d75e	sched_ext: Fixes for v7.3-rc6 ... - Taking a CPU offline could hang, or stall until the watchdog ejected the BPF scheduler, when tasks on the dying CPU were still held by the scheduler or sitting on a user dispatch queue. Re-enqueue them onto the local queue when the runqueue goes offline so that the CPU pushes them off like the other sched classes. - The sequence number guarding against stale dispatches was per runqueue, so a task re-enqueued on another CPU could get the same number and a dispatch meant for its earlier instance was applied to the new one. Use a per-task counter. - A task dispatched to another CPU's local queue got its ops.dequeue() only when picked to run and flagged as a core-sched pick. Call it at insertion like for same-CPU dispatches. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCasUtpQ4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGSu5AQDwrICXDyQlGjzAXzFq+bEKVhtMkHxuk8hm5tAy za4AwwD9FjhJHRy5x89TAmea5Cj++AToL6npdEHv7KDcgqNxsAU= =/aDw -----END PGP SIGNATURE----- Merge tag 'sched_ext-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Taking a CPU offline could hang, or stall until the watchdog ejected the BPF scheduler, when tasks on the dying CPU were still held by the scheduler or sitting on a user dispatch queue. Re-enqueue them onto the local queue when the runqueue goes offline so that the CPU pushes them off like the other sched classes. - The sequence number guarding against stale dispatches was per runqueue, so a task re-enqueued on another CPU could get the same number and a dispatch meant for its earlier instance was applied to the new one. Use a per-task counter. - A task dispatched to another CPU's local queue got its ops.dequeue() only when picked to run and flagged as a core-sched pick. Call it at insertion like for same-CPU dispatches. * tag 'sched_ext-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Generate qseq from a per-task counter selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler	2026-10-07 02:03:46 +02:00
Carlos Llamas	28eed9906e	selftests/mm: cleanup -Wformat issues in hugetlb-mmap ... Commit ae571cd601 ("selftests/mm: hugetlb-mmap: add setup of HugeTLB pages") and commit 9c5a65f374 ("selftests/mm: merge map_hugetlb into hugepage-mmap") added logs of 'hugepage_size' which has a size_t type. However, the incorrect format specifier '%lu' was used which triggers -Wformat warnings when building for 32-bit: hugetlb-mmap.c:125:55: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat] 125 | ksft_print_msg("Default size hugepages (%lu kB)\n", hugepage_size >> 10); | ~~~ ^~~~~~~~~~~~~~~~~~~ | %zu hugetlb-mmap.c:134:47: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat] 134 | ksft_exit_skip("Not enough %lu Kb pages\n", hugepage_size >> 10); | ~~~ ^~~~~~~~~~~~~~~~~~~ | %zu Fix this by switching to the expected '%zu' format specifier. Link: https://lore.kernel.org/20260927162419.820609-1-cmllamas@google.com Fixes: ae571cd601 ("selftests/mm: hugetlb-mmap: add setup of HugeTLB pages") Fixes: 9c5a65f374 ("selftests/mm: merge map_hugetlb into hugepage-mmap") Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com> Reviewed-by: SJ Park <sj@kernel.org> Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Cc: Mike Rapoport <rppt@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Shuah Khan <shuah@kernel.org> Cc: <stable@vger.kernel.org>	2026-10-06 16:44:18 -07:00