github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-23 23:51:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,485,739 Commits 2 Branches 953 Tags 16 GiB
58aeff92ee
Commit Graph

1485739 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds
58aeff92ee vfs-7.4-rc1.shared.super 
Please consider pulling these changes from the signed vfs-7.4-rc1.shared.super tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc
 ojDwAP9WqfdL1zdLrCVIEGuIlAuCIBHlqx0WGuafrPYgZd8PmgD/f0qdhXyDaZs4
 e9HXjY41WhrC032FwBMkJ3MzCKcCSwE=
 =GdeH
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.shared.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull superblock updates from Christian Brauner:
 "This renames vfs_get_super() to get_tree_super() and exports it so a
  filesystem that needs its own superblock matching policy can reuse it
  instead of open-coding sget_fc() plus fill_super().

  erofs uses it to share a superblock between file-backed mounts"

* tag 'vfs-7.4-rc1.shared.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fs: rename vfs_get_super() to get_tree_super() and export it
 2026-10-19 20:55:04 -10:00
Linus Torvalds
a6656aefd3 vfs-7.4-rc1.shared.net-next.pidfd 
Please consider pulling these changes from the signed vfs-7.4-rc1.shared.net-next.pidfd tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc
 ooS3AP9/x0Naa93wtIOgcrAYPdb61lcqtH9ktLlKMsi5jhE64wEAiFS7qzGjZMJ4
 H7sq/Qmjt63nyB44LFrHI0z0K62IHAQ=
 =Z9oc
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull pidfd updates from Christian Brauner:
 "This adds thread specific pidfds to af_unix sockets.

  SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group
  leader. A coredump server on the coredump socket can't get a handle on
  the thread that took the signal and is writing the dump, and anything
  doing per-thread authentication has the same problem. The sending and
  the connecting thread are recorded in addition to the thread-group
  leader and sk_peer_pid becomes an array indexed by pid type.

  SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an
  SCM_PIDFD_THREAD cmsg for the sending thread. Both options are
  independent so a receiver can ask for both. On SOCK_STREAM sockets
  recvmsg() only stops merging data at a thread boundary when the
  receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd
  for the thread that called connect(), listen() or socketpair(). pidfs
  records the coredump on the dumping thread's struct pid too so its
  pidfd reports it like the leader's does. Selftests for af_unix and the
  coredump socket are included"

* tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/coredump: check the dumping thread's pidfd
  pidfs: record the coredump on the dumping thread's pid too
  selftests/net: SO_PEERPIDFD_THREAD
  net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd
  af_unix: record the pid of the connecting thread
  net: turn sk_peer_pid into an array indexed by pid type
  selftests/net: SO_PASSPIDFD_THREAD
  net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD
  af_unix: record the pid of the sending thread
  pid: add helpers to operate on a struct pid array
 2026-10-19 20:32:52 -10:00
Linus Torvalds
2a49d49159 vfs-7.4-rc1.netfs 
Please consider pulling these changes from the signed vfs-7.4-rc1.netfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc
 oqmyAQDBxxJ69Ve2Op0/xHMSheI6dMZ7sLddKEARiZ1sBbKfaAEAscxpRMN+yRjE
 pt7GqzUAm6cdxadcwQPojsV8ZieNmww=
 =35YD
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull netfs updates from Christian Brauner:
 "This contains the netfs and cachefiles changes for this cycle from
  David.

  Cachefiles learns to cache the most common class of files properly,
  files that are created or truncated, written once sequentially and
  closed. So far it relied on the backing filesystem's idea of what is
  stored and asked with SEEK_DATA and SEEK_HOLE before every read it
  prepared, two seeks per read, and the backing filesystem is free to
  insert or remove runs of zeros which produces false positives and
  false negatives. The object type in the state xattr is now actually
  set to CACHEFILES_CONTENT_{SINGLE,ALL,BACKFS_MAP} instead of zero. For
  files written contiguously the type is ALL, the backing file's i_size
  tracks how much is cached and the object size lives in the xattr, and
  reads skip the seeks entirely. Netfslib queries the cache occupancy
  through a new ->query_occupancy() method that returns up to two
  extents at once, ->prepare_read() only limits the size of a cache read
  anymore and a new ->collect_write() lets the cache update its metadata
  once a contiguous run of writes completes. The state xattr is preset
  when the tmpfile is created so ENOSPC from setxattr can't scrap a
  fully written cache file. Two fixes for this followed, one for resize
  handling where the cache's idea of the size can be stale and one for
  an unset error that hung a request on a failed cache write.

  Preparatory work converts file positions that can't be negative to
  uoff_t, removes the writethrough code whose locking looked like it
  could deadlock with ceph snapshots, makes the deprecated PG_private_2
  support opt-in so mm can get its page bit back, adds helpers for the
  NETFS_RREQ_ALL_QUEUED barriers and adds the cache object id to the
  read and write tracepoints. Plus an unused header removal and two
  documentation fixes"

* tag 'vfs-7.4-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fscache, cachefiles: Fix resize handling
  cachefiles: Fix unset error when calling netfs_prepare_write_failed()
  netfs: remove unused fscache_internal.h header
  cachefiles: Preset the state xattr when creating a new file
  cachefiles: Don't rely on backing fs storage map for most use cases
  netfs: Document the remote size member and its accessors
  cachefiles: Add a tracepoint to log insufficient space errors
  netfs, cachefiles: Add a couple of traces for write failure
  cachefiles: Clean up cachefiles_do_prepare_read()
  netfs: Set subrequest->source at alloc before trace emission
  netfs: Add some functions to wrap the all-queued handling
  netfs: Make deprecated PG_private_2 support opt-in
  netfs: Add the cache object ID to netfs_read/write tracepoints
  netfs: trace: Rejig a couple of the tracepoints
  cachefiles: Fix path of the "debug" module parameter in help paragraph
  netfs: trace: Change the "clear" folio traces to "endwb"
  netfs: Remove the writethrough code
  netfs: Use uoff_t instead of unsigned long long and loff_t
 2026-10-19 20:12:19 -10:00
Linus Torvalds
0cbcaf75a1 vfs-7.4-rc1.mount 
Please consider pulling these changes from the signed vfs-7.4-rc1.mount tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc
 okTnAP42ymJnRxXT0sSaNQ8Sk9PIRQ+1evElkdr0LfGkBp5ApAEAjtRL+o4LCjd9
 WRE1+n+xwuQyPHUv9UghlPi8Qnr7ggU=
 =nfhQ
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull mount updates from Christian Brauner:
 "This adds OPEN_TREE_DROP_MNTNS_MOUNTS.

  crun started using OPEN_TREE_NAMESPACE to set up the container's mount
  namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind
  mounts. That fails on any host with a mount namespace pinned below
  such a source. The recursive clone picks the pinned namespace up and
  move_mount() refuses to attach the tree with ELOOP. Only a younger
  mount namespace may ever be bound into an older one or mount namespace
  references could form a loop. A namespace created with
  OPEN_TREE_NAMESPACE is younger than everything else on the system so
  from inside it every pinned namespace is older. By the time this fails
  setns() has run and the host tree is out of reach, so the runtime has
  to predict the situation beforehand and lose the optimization. snapd
  pins mount namespaces under /run/snapd/ns so on Ubuntu that is any
  container bind mounting the host root.

  Every other path crossing a mount namespace boundary already leaves
  these mounts behind, copy_mnt_ns() and create_new_namespace() both do.
  Only get_detached_copy() asks for them.

  The new flag lets a caller get a clone without them. It stays opt-in
  because open_tree(OPEN_TREE_CLONE) plus move_mount() is mount --rbind
  through a file descriptor and dropping them by default would silently
  lose /run/snapd/ns/*.mnt on a live system. It requires AT_RECURSIVE,
  is a no-op with OPEN_TREE_NAMESPACE and skips locked nsfs mounts the
  way copy_mnt_ns() does, so nothing new is exposed. Selftests are
  included"

* tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS
  mount: add OPEN_TREE_DROP_MNTNS_MOUNTS
 2026-10-19 20:06:27 -10:00
Linus Torvalds
7ed37e9d5c vfs-7.4-rc1.misc 
Please consider pulling these changes from the signed vfs-7.4-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 oiocAQDQrd6xDocGA55sJ45KSw1tHYQh5CYH8zml+T9D1agMmwEA5oGUQWEJAoN3
 Y2zXG7WoZcdnKQv3FWRYWhjRmXNxUQk=
 =dbn3
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
 "Fixes:

   - aio: a keyed poll completion on an epoll instance could recurse
     into the same epoll waitqueue lock when the result eventfd is
     watched by that very instance. An unprivileged process could make a
     CPU spin on the recursive lock. eventfd-backed poll completions are
     always deferred now.

   - fsnotify_inoderemove() is only called once the inode is really
     dead, no nlink and no aliases, and open_by_handle_at() can't add an
     alias to a dead inode anymore. The race could crash fsnotify or
     lose inode mark notifications.

   - devtmpfs: the conversion of the public instance to ->get_tree()
     broke reconfiguring the shared superblock's options on later mounts
     which made the boot time defaults permanent. A reconfigure context
     is kept in fc->fs_private so the parse ops can forward options to
     the underlying filesystem.

   - ufs truncated the 64-bit directory size to an unsigned int in
     ufs_last_byte(). A crafted image with a 4 GiB directory produced an
     out-of-folio read in ufs_find_entry() and, with
     CONFIG_UFS_FS_WRITE, a write into an adjacent page.

   - devpts rejects max=0 instead of silently lifting the per-instance
     pty limit. The value wrapped into ida_alloc_max() and became
     unlimited.

   - fs_pin publishes pins with the rcu list helpers so the kill paths
     reading the lists under rcu see the initialization.

   - dentry_kill() reports a Tasks-RCU quiescent state. Its
     cond_resched() is the only reschedule point on the dentry teardown
     path and cond_resched() isn't a quiescent state for Tasks-RCU, so
     Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.

   - writeback sizes foreign flushes by the target wb's dirty pages
     instead of the memcg-wide count which over or undersized a single
     bdi flush.

   - nfsd READ emitted two fsnotify access events on the iterator path
     since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
     krb5p mount showed up twice in inotify.

   - pipe and splice pass a poll key when waking readers and writers so
     epoll, poll() and select() waiters only wake for the event they
     asked for.

   - the iso8859-14 Unicode to charset tables had page01 duplicated as
     page1e so 29 code points mapped to the wrong bytes and 22 that
     aren't in the charset were accepted.

   - orangefs doesn't wait for an unmount service operation that never
     returns on system shutdown and uses ssize_t for strscpy() errors.

   - __register_chrdev() checks the kobject_set_name() return value.

   - selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
     which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
     mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
     file_stressor moves into its own directory with a 30 minute
     timeout, the kernfs listxattr test skips when SELinux exposes
     security.selinux, the namespaces active reference tests wait for
     the thread via a PIDFD_THREAD pidfd since pthread_join() returns
     before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
     its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
     test adds CLONE_VM so it fails for the intended reason, the pidfd
     PPID error message prints the values it compares and fscontext_ns
     gets a .gitignore.

  Cleanups:

   - vmcore prints the release of the crashed kernel from the VMCOREINFO
     note so a kdump that dies before the dump lands still says which
     kernel it was for.

   - initramfs allocates hardlink hash entries with the validated cpio
     name length instead of PATH_MAX, which put every entry in
     kmalloc-8k.

   - the unused dax_layout_busy_page() is removed,
     dax_layout_busy_page_range() becomes static and dax_folio_init()
     drops a redundant list initialization.

   - vfs_empty_path() is removed, it has had no callers since
     getname_maybe_null().

   - comment and documentation fixes in aio, bpf_fs_kfuncs,
     fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
     struct file_system_type"

* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
  selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
  selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
  writeback: size foreign flushes by target wb dirty pages
  initramfs: Reduce hardlink hash allocation sizes
  fs: remove unused vfs_empty_path()
  dcache: report a Tasks-RCU quiescent state in dentry_kill()
  vmcore: report the release of the crashed kernel
  splice: pass a poll key when waking pipe readers and writers
  pipe: pass a poll key when waking writers after a resize
  orangefs: use ssize_t instead of size_t for error codes...
  orangefs_super: don't wait on service operation on system shutdown.
  docs/vfs: Fix the struct file_system_type copy
  nls: fix the Unicode to charset tables of iso8859-14
  selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
  selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
  fs: fix misleading comments in read_write.c
  squashfs: fix inode number description in documentation
  fs: fix typos in comments
  fs/dax: Make dax_layout_busy_page_range() static
  fs/dax: Remove unused dax_layout_busy_page()
  ...
 2026-10-19 19:30:45 -10:00
Linus Torvalds
96a377ba00 vfs-7.4-rc1.lookup 
Please consider pulling these changes from the signed vfs-7.4-rc1.lookup tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ohALAP95TywGM0X9vNlKadgGMzD4ISQ0lo9xrdWVZ+eKN3DHSwEA/F9DnWdCX+gs
 pNVcTf8cqjRUEUSDN8TcLSV12LOIBgc=
 =yoIV
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull path lookup updates from Christian Brauner:
 "This prepares for Neil's changes to directory locking. The goal is for
  the VFS to lock the dentry and not the parent directory and to push
  the i_rwsem parent locking down into the filesystems where it can be
  kept, removed or adjusted as each filesystem sees fit.

  The next step in that is to swap the lock order of d_alloc_parallel()
  and i_rwsem so code can wait on i_rwsem while holding an in-lookup
  dentry. Two things have to change before that can happen. Nobody may
  call d_alloc_parallel() while holding i_rwsem, and nobody may d_drop()
  a dentry while it is being worked on since that effectively unlocks an
  in-lookup dentry and lets another one be allocated too early.

  So d_splice_alias() learns to handle hashed dentries in addition to
  unhashed and in-lookup ones, which is what ->atomic_open() needs and
  removes the reason filesystems d_drop() first. d_alloc_trylock() is a
  non-blocking d_alloc_parallel() for the filesystems that prime the
  dcache from readdir, smb, nfs, fuse and ceph, where waiting for a
  concurrent lookup is pointless. d_duplicate() creates an in-lookup
  dentry with the name of an existing one for silly-rename and
  whiteouts. LOOKUP_SHARED tells ->lookup() how the parent is locked so
  it can drop and retake it. DCACHE_PAR_LOOKUP is tracked by lockdep now
  with a per filesystem type key, and overlayfs gets its own class since
  it stacks over itself. And a d_flags bit is reserved for filesystem
  private use.

  Also included is Mateusz's fix for the spurious dentry reference cycle
  on open. __legitimize_path() grabs a reference, do_dentry_open() grabs
  another and terminate_walk() drops the first. do_dentry_open()
  consumes the held reference now. Opening the same file read-only on a
  20-core VM goes from 4,043,375 to 5,629,378 ops/s in will-it-scale"

* tag 'vfs-7.4-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  VFS: d_duplicate: repair comments to avoid kernel-doc warnings
  ovl: provide private lockdep class for dentry->dep_map
  VFS: rename lookup_map to dep_map
  VFS: per-fs-type lockdep key for dentry in-lookup locking
  VFS: reserve a d_flags bit for fs-specific usage
  VFS: add lockdep monitoring of DCACHE_PAR_LOOKUP lock.
  VFS: Add LOOKUP_SHARED flag.
  VFS: add d_duplicate()
  VFS: introduce d_alloc_trylock()
  VFS: enhance d_splice_alias() to handle hashed dentries
  VFS: fix various typos in documentation for start_creating start_removing etc
  fs: avoid spurious dentry ref/unref cycle on open
 2026-10-19 18:59:41 -10:00
Linus Torvalds
0ddc887102 vfs-7.4-rc1.kernfs 
Please consider pulling these changes from the signed vfs-7.4-rc1.kernfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ojr5AP42ZHmQU1u1W2WZvSp0d7z2i9Hp9j5ezK1JJjZQSE6FcgD+KalCPX7v9jB8
 OQ0fQnauE2Ji3+qXO0tbIwij7gWP2wc=
 =9ucf
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.kernfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull kernfs updates from Christian Brauner:
 "This contains kernfs scalability work from Shakeel driven by what Meta
  sees in their fleet. kernfs_rwsem is per kernfs root, so sysfs and
  cgroupfs each have one for the whole machine, and every create, remove
  and rename takes it for writing. rwsems don't let readers steal the
  lock once a writer is queued, so one cgroup being created or a device
  being renamed parks the entire incoming reader stream in
  uninterruptible sleep. Daemons that poll cgroup files in a loop turn
  that into a convoy and the two that hurt most, oomd and below, are the
  ones that are supposed to relieve memory pressure and record what
  happened.

  kernfs_dop_revalidate() took kernfs_rwsem for read once per path
  component of every walk into a kernfs mount. Nothing it reads needs
  the semaphore. kn->active is an atomic_t, kn->__parent and kn->name
  are rcu pointers, kn->ns can be compared instead of dereferenced and
  the directory revision is a plain counter. The callback runs under rcu
  now. Readers walking cgroupfs and sysfs while another thread churns
  cgroups, renames netdevs and plugs devices went from 48,593,360 read
  acquisitions and 1,744,517 contentions to 1,280,280 and 429,846 on an
  8-CPU VM and path walk throughput improved 35-53%. LOOKUP_RCU still
  returns ECHILD because kernfs_iop_permission() forces every walk out
  of rcu-walk anyway. That is left for later.

  kernfs_fop_readdir() held the semaphore across dir_emit(). dir_emit()
  copies to userspace and under memory pressure that fault goes to
  reclaim with the lock every create, remove and rename needs held for
  reading. Meta sees 120 second allocation stalls in filldir64() from
  below and systemd-oomd stuck behind it. The lock is dropped around
  dir_emit() now. Since the entry the listing stopped on can disappear
  in that window and two entries can share a hash, readdir resumes on
  the full (hash, ns, name) key and the fallback search lands after the
  missing entry instead of repeating or skipping one. The repeat was a
  pre-existing bug between two getdents(2) calls.

  Three more lock holds are shortened. kernfs_notify_workfn() no longer
  holds kernfs_rwsem across fsnotify() which allocates against the memcg
  of the watching cgroup that is already under pressure. The open node
  is allocated outside the hashed open file mutex, the most contended
  lock in kernfs on their fleet with 2.19M waiters over 29 days and a
  77ms median hold. A new node is activated without dropping and
  retaking the write lock, lock_stat says 1200 -> 830 write acquisitions
  for five dummy netdevs, and kernfs_rename_ns() allocates the new name
  before and frees the old one after the lock so a rename can't enter
  reclaim or wait out a grace period with it held.

  Three standalone fixes come with selftests. Same-parent renames take
  kernfs_rename_lock too so kernfs_path_from_node() can't build a path
  that never existed. Decoding a file handle takes the semaphore so a
  decode racing rmdir() can't hash an inode after the removal's
  ilookup() pass and lose IN_DELETE_SELF. And kernfs_create_link() reads
  the target's uid and gid under kernfs_iattr_rwsem so a chown in
  between can't give the link an owner the target never had. The kernfs
  selftests grew from two xattr checks to coverage of dentry
  revalidation, rename, namespace tagging, file handles and readdir
  under churn"

* tag 'vfs-7.4-rc1.kernfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  kernfs: free the old name outside kernfs_rwsem
  kernfs: allocate the new name outside kernfs_rwsem
  kernfs: activate a new node without dropping kernfs_rwsem
  selftests: cover readdir resuming at a removed entry
  kernfs: don't hold kernfs_rwsem across dir_emit()
  kernfs: resume readdir on the full entry key
  kernfs: don't repeat or skip an entry when readdir resumes
  kernfs: don't hold kernfs_rwsem across notification delivery
  kernfs: allocate the open node outside the open file mutex
  kernfs: fix up the unlocked attribute reads on the creation paths
  kernfs: don't lose IN_DELETE_SELF when decoding a file handle
  kernfs: take kernfs_rename_lock for same-parent renames too
  selftests: cover kernfs file handles and same-parent rename
  selftests: cover kernfs dentry revalidation
  kernfs: Remove kernfs_rwsem from dentry revalidation
  kernfs: Avoid namespace dereference in d_revalidate()
  kernfs: Prepare directory revisions for lockless reads
  kernfs: Use VFS lookup context in d_revalidate()
 2026-10-19 18:52:22 -10:00
Linus Torvalds
27dd2772e6 vfs-7.4-rc1.iomap 
Please consider pulling these changes from the signed vfs-7.4-rc1.iomap tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 okLFAQDtL+joq4F75iD2qaULpmj7kWby23E7u88ccIVUONbpWgD+L0S5lPCd4upL
 fGyRMlQOybiRX1uHH13xGPU9wZ2Iggk=
 =ZSC6
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull iomap updates from Christian Brauner:
 "This contains the iomap changes for this cycle.

  The bulk is lazy bounce buffering for checksummed reads. XFS bounce
  buffers every direct read on a device that requires stable pages for
  checksumming so that userspace modifying the buffer while the read is
  in flight can't corrupt the data and fail the checksum.

  That burns DRAM bandwidth and CPU for copies that are almost never
  needed and, since the bounce buffer was a bio_vec, produced smaller
  and unaligned I/Os with 4k pages, i.e. 1 MB minus 4k.

  Now the read goes to the user buffer first and only a checksum failure
  allocates a bounce buffer and reads again. Integrity verification
  moves out of iomap into the filesystem so it can handle errors its own
  way, T10 PI handling for direct I/O moves into ->submit_io() to match
  buffered I/O, and a sysfs knob restores the old behaviour for the rare
  application that really does modify in-flight buffers.

  The block side gains bio_prepare_reissue(), exports
  fs_bio_integrity_{alloc,free}(), caps atomic writes by the PI buffer
  size and fixes an integer overflow in max_integrity_io_size() and a PI
  verification bug with an initial bvec offset. The old read side bounce
  buffering in the block layer is removed. This is a branch shared with
  the block tree and may also reach you through the block pull request.

  Three error handling regressions are fixed:
   - A failed ->writeback_submit() left wpc->wb_ctx pointing at an
     already completed ioend which was then submitted a second time and
     corrupted ip->i_ioend_list on XFS
   - iomap_fiemap() lost an iteration error when it flushed the pending
     extent and marked a truncated list as complete
   - A failed direct I/O bio lost its error when the sub-block tail
     zeroing succeeded. An XFS error tag to inject the writeback failure
     comes with it.

  iomap_dio_hole_iter() respects the block size alignment when
  iov_iter_zero() stops short at a page boundary, which btrfs with 8k
  blocks on 4k pages hit as an assertion since it disables page faults
  during direct I/O. The homegrown deferral of error completions to task
  context is replaced with bio_complete_in_task(). Plus an unused
  parameter, two typo fixes and a kernel-doc fix"

* tag 'vfs-7.4-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (34 commits)
  fs/iomap: document ret parameter of iomap_iter_continue
  iomap: follow the alignment requirement for iomap_dio_hole_iter()
  iomap: don't lose a failed direct I/O bio's error when zeroing the tail
  iomap: don't lose a fiemap iteration error when emitting the last extent
  xfs: add an error tag to inject a ->writeback_submit() failure
  iomap: don't resubmit an ioend after ->writeback_submit() failed
  iomap: use bio_complete_in_task for buffered simple dio read failures
  iomap: use bio_complete_in_task for buffered write failures
  iomap: use bio_complete_in_task for buffered read failures
  block,iomap: remove the old read side bounce buffering support
  xfs: log a message at mount time when using integrity protection
  xfs: add error injection for lazy bounce buffering
  xfs: add support for lazy direct read bounce buffering
  iomap,xfs: move integrity verification to the file system
  xfs: use BIO_COMPLETE_IN_TASK for bounce buffered read I/Os
  iomap: better read bounce buffering support
  block,iomap: fix protection information verification with initial bvec offset
  xfs: move PI generation into xfs_submit_zoned_bio
  iomap,xfs: move T10 PI handling for direct I/O into ->submit_io
  iomap: add a IOMAP_IOEND_INTEGRITY flag
  ...
 2026-10-19 18:33:02 -10:00
Linus Torvalds
00b04f4495 vfs-7.4-rc1.idmap 
Please consider pulling these changes from the signed vfs-7.4-rc1.idmap tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 opFuAPwLL5l3D3GSRyD+SyOjKYThylgowvH9c2BcLWbSAIO6yQD9F05GX+rrcbUq
 9ijolxAaQZYpEWsemZIIHx6BBwdDBA4=
 =IH8Z
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs idmap constification from Christian Brauner:
 "This makes struct mnt_idmap const throughout the tree.

  A mount's idmapping is immutable. The only thing modified after
  alloc_mnt_idmap() is the reference count and that is hidden behind
  mnt_idmap_get() and mnt_idmap_put(). Everything else only reads from
  it. That is the same model struct cred uses and the idmapping is
  sensitive enough to deserve it.

  The conversion goes bottom up through the vfs{g,u}id and fs{g,u}id
  helpers, the privilege checks, acl, xattr and quota and then every
  inode operation that takes an idmap, so ->permission(), ->getattr(),
  ->setattr(), ->create(), ->mkdir(), ->mknod(), ->symlink(),
  ->rename(), ->tmpfile(), ->get_acl(), ->set_acl() and ->fileattr_set()
  with their implementations in every filesystem, plus the LSM hooks.

  struct vfsmount, struct mount_kattr and struct kstatmount store a
  const pointer and nop_mnt_idmap and invalid_mnt_idmap live in rodata,
  so anything that tries to modify them faults instead of silently
  corrupting the initial idmapping"

* tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits)
  fs: make nop_mnt_idmap and invalid_mnt_idmap const
  fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
  fs: port vfs_*() helpers to const mnt_idmap
  fs: port ->setattr() to pass const mnt_idmap
  fs: port ->getattr() to pass const mnt_idmap
  fs: port ->create() to pass const mnt_idmap
  fs: port ->symlink() to pass const mnt_idmap
  fs: port ->mkdir() to pass const mnt_idmap
  fs: port ->rename() to pass const mnt_idmap
  fs: port ->mknod() to pass const mnt_idmap
  fs: port ->tmpfile() to pass const mnt_idmap
  fs: port ->get_acl() to pass const mnt_idmap
  fs: port ->set_acl() to pass const mnt_idmap
  fs: port ->fileattr_set() to pass const mnt_idmap
  fs: port xattr to const mnt_idmap
  fs: port ->permission() to pass const mnt_idmap
  fs: port acl to const mnt_idmap
  fs: port inode_init_owner() to const mnt_idmap
  fs: port inode_owner_or_capable() to const mnt_idmap
  fs: port privilege checking helpers to const mnt_idmap
  ...
 2026-10-19 17:57:49 -10:00
Linus Torvalds
a1d4585be1 vfs-7.4-rc1.file 
Please consider pulling these changes from the signed vfs-7.4-rc1.file tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 osd6AP4nuqrNhsMzcp4zPk4rbMVhvJL9O3ccnoE6TLn8Mg7uLwD/WtjKIVtKAPkv
 gz58C2i14vDLLbKAAGK0P8c1EF0ZuAE=
 =jY1x
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull file table updates from Christian Brauner:
 "This annotates struct fdtable's fd array with __counted_by_ptr so
  KASAN and the fortified functions can bounds check it against max_fds
  and adds a KUnit suite for fdtable. A follow-up uses __struct_size()
  in the test since sparse doesn't know __builtin_dynamic_object_size().

  FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on
  infrastructure that was never needed. The ACQUIRE machinery and
  CLASS_INIT() go away, the variable is declared with __cleanup()
  directly, struct fd_prepare loses its err field since the fd either
  holds the descriptor or the error, and callers get a const pointer to
  the guard behind a UNIQUE_ID() name so they can't shadow it. Code
  generation is identical"

* tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  file: make struct fd_prepare const and kill its err field
  cleanup: remove CLASS_INIT()
  file: declare the FD_PREPARE() variable with __cleanup() directly
  file: simplify FD_PREPARE()
  vfs: use __struct_size() in the fdtable KUnit test
  vfs: Add KUnit tests for fdtable
  vfs: Annotate struct fdtable's fd field with __counted_by_ptr
 2026-10-19 17:35:50 -10:00
Linus Torvalds
ada21d495c vfs-7.4-rc1.coredump 
Please consider pulling these changes from the signed vfs-7.4-rc1.coredump tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ouhIAP9q03aGe3fMs3tnLWC+JzSc1D48MMmo71rPxGnV6G6V+AEAzZV6Xkq8eFTU
 Zbwq6FhYvhptWeNGyNa9phUDFcBQIw4=
 =Pt3z
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull coredump updates from Christian Brauner:
 "This adds sparse coredumps and per-request memory type selection to
  the coredump socket protocol.

  A coredump sent over the socket transfers every zero of every hole in
  every mapping. For a process with 128 threads that's 1 GB of mostly
  thread stacks, 8 MB reservations with a few pages touched, and the
  holes sit in the middle of the dump rather than at the end. The
  coredump_filter bit that was proposed for this stops each PT_LOAD at
  the last populated page. But that mask says which kinds of memory to
  include and propagates across fork and exec, whereas what is selected
  here is an encoding. The usermodehelper isn't salvagable for this
  either. The coredump socket already has a handshake for exactly this.

  A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
  coredump as a sequence of records, each a struct
  coredump_record_header followed by what it describes. The stream ends
  explicitly with an end record that reports the size, so a missing one
  means truncation.

  With COREDUMP_SPARSE holes cross the socket as a bare header that says
  how many zero bytes were skipped. Reassembling the records gives back
  the same coredump, so a debugger and everything else still see an
  ordinary core file. Numbers from the selftests: the 128 thread process
  sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
  mapping with the first and the last page touched sends 188793 bytes
  for 268890112 bytes, and with COREDUMP_RECORDS alone the record
  overhead is under one percent.

  The selftests also simulate a server uploading to a blob store that
  can't seek and rewrites the program headers so the object is an
  ordinary ELF core file without the holes.

  COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
  request instead of relying on the static /proc/<pid>/coredump_filter
  of the crashing task. The request carries the default types and a mask
  of every type the kernel knows about, the ack carries the selection.
  Zero is valid and dumps the program headers and notes and nothing but
  the mappings that are always dumped.

  Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
  every write at a page so a pipe or a socket never takes a short write
  in the middle of a record, make the dump helpers return bool and
  replace the core_dumped integer with COREDUMP_STATE_STARTED and
  COREDUMP_STATE_TRUNCATED flags.

  Also included is a fix for coredump_parse() reading core_pattern while
  it is being modified. The sysctl handler now validates a copy and
  publishes it under a spinlock and the parser works on a snapshot, so a
  rejected pattern is never visible and the rollback logic goes away.
  And to_kthread()'s lockless flags read is annotated with READ_ONCE()"

* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
  kthread: Annotate lockless to_kthread() flags access
  coredump: parse a snapshot of core_pattern
  selftests/coredump: test failed handshakes
  selftests/coredump: improve coredump size negotiation tests
  selftests/coredump: test COREDUMP_MEMORY_TYPES
  selftests/coredump: simplify the refusal tests
  tools: sync coredump.h header
  coredump: select memory types to include
  selftests/coredump: show how to inspect the task to decide how the coredump should be sent
  selftests/coredump: simulate a blob store
  selftests/coredump: put a hole in the middle of a sparse mapping
  selftests/coredump: hand the record stream to a sink
  selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
  coredump: describe the holes when COREDUMP_SPARSE is negotiated
  coredump: send the coredump in records if requested
  tools: sync coredump.h header
  coredump: add COREDUMP_SPARSE to the coredump socket protocol
  coredump: add COREDUMP_RECORDS to the coredump socket protocol
  coredump: clean up coredump state handling
  coredump: always chunk writes
  ...
 2026-10-19 17:21:24 -10:00
Linus Torvalds
4effd80841 vfs-7.4-rc1.close_range 
Please consider pulling these changes from the signed vfs-7.4-rc1.close_range tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ouFoAP9oJWCJRlKwbki5KP0P3O6/gnQXUz8gR07qxzWk8Gz/NgD/V3+MHkU8fX2w
 oTOGPuwrbbRNBTK/cmRG2kF6xxOPSw8=
 =jDl8
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull close_range updates from Christian Brauner:
 "This adds two new close_range() flags.

  CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
  outside of [fd, max_fd] instead of the ones inside. Alone it closes
  everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
  but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
  takes a reference on what is dropped. So a task between
  clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
  descriptors for the child in one window can shed the rest of the
  shared table in one call and nothing outside of the window is
  referenced by the child at any point.

  CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
  range and leaves everything else alone. Whatever the caller
  deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
  where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
  close-on-exec descriptors that have to survive, the executable or an
  error pipe, and closes every other close-on-exec descriptor.

  Along the way dup_fd() stops copying a range in the middle of the
  table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only
  avoided the copy when the range sat at the end of the table.

  Descriptors in a skipped range are never copied and no reference is
  taken on them, so ->flush() isn't called anymore for files from a
  table they were never part of. The flags are turned into an enum and
  selftests cover the window positions, the shared and the private table
  and the unshare form"

* tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
  file: add CLOSE_RANGE_CLOEXEC_ONLY
  file: let dup_fd() drop only close-on-exec descriptors
  selftests/core: test CLOSE_RANGE_EXCEPT
  file: add CLOSE_RANGE_EXCEPT
  close_range: turn the flags into an enum
  file: let dup_fd() drop everything outside of the range
  file: rename dup_fd()'s punch_hole to range
  selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
  file: let dup_fd() leave the punched hole behind
 2026-10-19 17:11:41 -10:00
Linus Torvalds
550a7e28d8 vfs-7.4-rc1.binfmt 
Please consider pulling these changes from the signed vfs-7.4-rc1.binfmt tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ohI7AP95N3Ty6xsiT14eGKl2jT6x265bpC4fodnQB098QdVNAQEA40ttNCy6j+i/
 ZR4Hy5e8OAqWdj87h7m4EW9ED5yUog8=
 =2LN3
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull binfmt updates from Christian Brauner:
 "This only lets punctuation delimit a binfmt_misc register string.

  Arbitrary delimiters never made sense and nothing uses them. Every new
  flag shrank the set of possible delimiters and made extensions more
  hazardous than they need to be. Letters, digits, whitespace, control
  characters, bytes above 0x7f and the backslash now get EINVAL.

  Everything deployed uses ':' anyway. This extends the fix that
  rejected a flag character as the delimiter.

  Selftests and documentation are included"

* tag 'vfs-7.4-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  binfmt_misc: document the field delimiter
  selftests/exec: test delimiter restrictions
  binfmt_misc: only let punctuation delimit a register string
 2026-10-19 17:02:56 -10:00
Linus Torvalds
b9a3eae945 vfs-7.4-rc1.bh 
Please consider pulling these changes from the signed vfs-7.4-rc1.bh tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ouV5AP0WoJkt78dAg29c1s5oPtTmeDzjZwXRcgG95LVb2V2x1gD7BKccTzIoivKQ
 BY+KdHWFpTrDD78+wWEkVosik2exxAw=
 =x2FH
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.bh' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull buffer_head updates from Christian Brauner:
 "This stops the buffer_head write completion handlers from clearing
  BH_Uptodate when a write fails.

  A buffer whose write failed still holds exactly the data the
  filesystem asked to be written. It's the disk that is stale, not the
  buffer. Claiming otherwise has consequences. mark_buffer_dirty() warns
  when a filesystem redirties the buffer to retry the write, a buffer
  that isn't up to date gets re-read from disk which silently replaces
  the data with the stale on-disk copy, and the window between the write
  completing and BH_Uptodate being cleared is visible to anyone holding
  the folio lock.

  BH_Write_EIO already records that the last write failed. Every
  consumer is moved over to buffer_write_io_error(): the two core
  helpers in fs/buffer.c, adfs, ext2, omfs, exfat, fat, ext4, ocfs2,
  gfs2 and jbd2. Then write completion stops touching BH_Uptodate in
  both directions and BH_Write_EIO is cleared on successful completion
  instead of at submission, so a resubmission no longer hides an error
  that hasn't been fixed yet. bforget() and invalidation drop the flag
  so a reused block doesn't inherit someone else's write error.

  The groundwork for this removes b_page from struct buffer_head and
  lets a buffer_head point at memory outside the page cache. jbd2's
  shadow buffers sit on a slab folio today. A slab folio overloads
  ->mapping so mark_buffer_write_io_error() couldn't be called on them
  at all. They now point at the frozen data directly with b_folio NULL.

  Also included are documentation updates from Matthew for sb_bread(),
  sb_breadahead() and mmb_mark_buffer_dirty() and the removal of stale
  references to unmap_buffer() and mark_buffer_dirty_inode()"

* tag 'vfs-7.4-rc1.bh' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits)
  buffer: Rename label
  buffer: Refer to folios in comments
  buffer: Document mmb_mark_buffer_dirty()
  buffer: Document sb_bread(), sb_bread_unmovable() and sb_breadahead()
  fs: Remove references to mark_buffer_dirty_inode()
  buffer: clear BH_Write_EIO when a write succeeds, not when one starts
  buffer: Remove reference to unmap_buffer()
  buffer: stop touching BH_Uptodate on write completion
  jbd2: check for a fast commit write error with buffer_write_io_error()
  jbd2: say what jbd2_freeze_jh_data()'s assertion is actually checking
  jbd2: report journal write errors with BH_Write_EIO
  gfs2: check for a metadata write error with buffer_write_io_error()
  ocfs2: check for a stale write error before reusing a metadata buffer
  ocfs2: check for a metadata write error with buffer_write_io_error()
  ext4: check for a metadata write error with buffer_write_io_error()
  fat: check for a metadata write error with buffer_write_io_error()
  exfat: check for a directory write error with buffer_write_io_error()
  omfs: check for an inode write error with buffer_write_io_error()
  ext2: check for an xattr block write error with buffer_write_io_error()
  adfs: check for a directory write error with buffer_write_io_error()
  ...
 2026-10-19 16:57:24 -10:00
Linus Torvalds
355da270c1 vfs-7.4-rc1.bfs 
Please consider pulling these changes from the signed vfs-7.4-rc1.bfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 opHiAP0csRVd+U4nqcrpNanoYj4nTG6lvgiiBzD+hzUFBLJ2KQD6Aj8akdbzxCMz
 ScnMxAqO1blX4NLZ+jpJvRCe0XTdBw0=
 =fkoW
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.bfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull bfs removal from Christian Brauner:
 "This removes bfs, the filesystem UnixWare uses for its boot partition.

  It only supports contiguous files and has no subdirectories. The only
  data on such a partition are kernels and bootloader settings so there
  is no reason to access it from Linux anymore. The uapi header stays"

* tag 'vfs-7.4-rc1.bfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  bfs: remove the filesystem
 2026-10-19 16:55:31 -10:00
Linus Torvalds
018cf9bf78 kernel-7.4-rc1.signal 
Please consider pulling these changes from the signed kernel-7.4-rc1.signal tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc
 ol44AP9GXKnV7oRC5J2uldXgoE7GQRjf790BwJSFf2qHGPJeUwD6AzK4IH2KIEmW
 XB8DEzDKabDKCt0bsTgM7NPqMXPOyA8=
 =o2lX
 -----END PGP SIGNATURE-----

Merge tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull signal handling updates from Christian Brauner:
 "This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
  restarted and fixes a bunch of coredump and signal bugs.

  TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
  returns to userspace, runs its task work and goes back to sleep. That
  breaks coredumps: dump_interrupted() only lets fatal signals interrupt
  a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
  pipe and the socket paths check signal_pending() Adeep down in code
  that is shared with regular syscalls and bail. So a crashing process
  with io_uring requests in flight loses most of its coredump.

  In the selftest an unfixed kernel delivers 357324 of at least 5111808
  bytes. And io_uring isn't the only source. klp_send_signals(),
  bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
  the printk kunit test raise the bit as well, some of them from irq
  context against any task. So this can't be fixed per subsystem and the
  state has to be per-task and ambient.

  Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
  modelled on memalloc_nofs_save(). Inside such a section
  signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
  path, which hand-rolled its own version of this, and the pid namespace
  reaper, which busy-looped when the bit kept getting raised, are
  converted.

  The second part is a set of fixes that fell out of looking at the
  coredump code with kres and modelling it in TLA+:

  - coredump_finish() woke the parked threads without holding rcu. A
    parked thread can exit on a spurious wakeup and be freed before
    wake_up_process() takes its pi_lock.

  - Only SIGKILL and the freezers interrupt a dump now and the three
    freezers agree. Power management and cgroup v1 freezing aborted a
    dump while a cgroup v2 freeze either waited for the dump or cut it
    short depending on where the core went.

  - io-wq set its exit bit without a barrier against the task work that
    creates workers. On weakly ordered architectures exit could hang on
    worker_done.

  - retarget_shared_pending() slingshotted a shared signal to the dumper
    when a zapped sibling restored its signal mask. That set
    TIF_SIGPENDING on the dumper and truncated the core.

  - A tracer could clear the signal mask of a user worker with
    PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
    an SQPOLL ring dumping core deadlocks the whole group.
    PTRACE_SETSIGMASK is refused for user workers now and
    __set_task_blocked() enforces the fork-time mask.

  - exec cancels io_uring requests before de_thread() so a worker
    creation queued as task work can't add a thread to a thread group
    that de_thread() just took down.

  - No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
    creator anymore. Such a worker was invisible to zap_process() but
    still decremented threads_remaining on exit so the dumper could
    leave coredump_wait_inactive() early.

  Also included are a comment that do_each_pid_task() needs
  tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
  fork() into a pid namespace whose ancestor lost its init"

* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
  pid: use READ_ONCE() in pid_alive()
  selftests: pid_namespace: test fork with dead ancestor
  pid: document that do_each_pid_task() needs tasklist_lock
  signal: enforce the user worker signal mask in __set_task_blocked()
  fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
  fork: don't create io threads once PF_POSTCOREDUMP is set
  fork: move the coredump and exec checks into create_io_thread()
  exec: cancel io_uring requests before de_thread()
  selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
  selftests/coredump: test a user worker as the coredumping thread
  ptrace: refuse to change the signal mask of a user worker
  selftests/coredump: test shared signal retargeting during a dump
  signal: only SIGKILL and the freezers interrupt a coredumping task
  signal: don't retarget shared signals in a dying thread group
  io-wq: order the exit bit against worker creation task work
  coredump: hold RCU while releasing parked threads
  pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
  smb: prevent TIF_NOTIFY_SIGNAL from interrupting
  selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
  coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
  ...
 2026-10-19 16:22:15 -10:00
Linus Torvalds
e86d265826 namespace-7.4-rc1.misc 
Please consider pulling these changes from the signed namespace-7.4-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc
 okOqAP98o3UxyJOsSJfNJpr0OnHzk/WHbt8Qm7Lmk0Xgt2h6BgD/Ypf5v68wiCaS
 eg6X3g3wR4tLMbdTkEy5tekLG80Alg4=
 =36S+
 -----END PGP SIGNATURE-----

Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull namespace updates from Christian Brauner:

 - Reject uid_map, gid_map and projid_map values that don't fit in a
   u32.

   map_write() parsed with simple_strtoul() and truncated modulo 2^32 on
   64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an
   error. Each field is parsed with kstrtou32() now and selftests cover
   the out-of-range, negative and in-range cases. This isn't a security
   fix. The truncated values were valid ids and every later check still
   applied to them.

 - Annotate struct uid_gid_map's forward and reverse pointers with
   __counted_by_ptr and add a KUnit suite for inserting and sorting
   extents.

   insert_extent() wrote to forward[nr_extents] before bumping the count
   which the annotation flags, so it bumps first now. Two follow-up
   fixes rename the now global helpers to uid_gid_map_insert_extent()
   and uid_gid_map_sort(), since the btrfs self-tests have their own
   insert_extent(), and guard the declarations on CONFIG_KUNIT.

 - Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
   create_new_namespaces() always passes a valid pointer and the other
   copy_*_ns() helpers don't check either.

 - Remove a dead key_put() on the create_user_ns() error path.

* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/namespaces: add uid_map/gid_map range tests
  userns: reject uid_map/gid_map values that do not fit in u32
  userns: declare the KUnit-visible helpers whenever KUnit is enabled
  userns: rename insert_extent() and sort_idmaps()
  userns: Add KUnit test suite for uid_gid_map
  userns: Add __counted_by_ptr attribute to struct uid_gid_map
  fs: namespace: drop BUG_ON() in copy_mnt_ns()
  uts: drop BUG_ON() in copy_utsname()
  userns: remove dead key_put() on the create_user_ns() error path
 2026-10-19 16:09:10 -10:00
Linus Torvalds
def41b7bd4 ipc-7.4-rc1.misc 
Please consider pulling these changes from the signed ipc-7.4-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc
 omTYAPkBx1efHh/CYYRuxLKrV91qPXudLFky3pnQg7TnOJseTQD+OhT3Dk53T0CN
 46LdledXlcU7uiCG7gSMY72XWXvL1Ac=
 =M1pi
 -----END PGP SIGNATURE-----

Merge tag 'ipc-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull ipc fix from Christian Brauner:
 "This fixes a leak in mqueue.

  A task in another thread group sharing the file table could register
  an mq_notify() and exit without closing the queue. The registration
  was never torn down and pinned the notification skb, the netlink
  socket, a pid reference and a user namespace reference forever.

  Stale registrations are released on inode eviction now"

* tag 'ipc-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  ipc/mqueue: release notification resources during inode eviction
 2026-10-19 15:57:25 -10:00
Linus Torvalds
c03c1a1450 Linux 7.3 2026-10-18 13:14:58 -10:00
Linus Torvalds
f909e534f5 SCSI fixes on 20261018 
All fixes in drivers (or the tape ULD) and one core fix to bsg (the
 block ioctl equivalent of sg_io).  The biggest is the race in auth
 updates fix in iscsi configfs, but the next biggest one is in bsg but
 the generic pieces of that are mostly threading reply_len.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCatTZmRsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIWZfAD/ZC6Pwo0OMS8MuYYGwb+fF2YM0Msr+zAG
 4gDRU5yDWl0A/jEw1iFbmGyoNTtBTHSE9I38j/nRAaa+UT/JeS4q0g1E
 =wBqG
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "All fixes in drivers (or the tape ULD) and one core fix to bsg (the
  block ioctl equivalent of sg_io).

  The biggest is the race in auth updates fix in iscsi configfs, but the
  next biggest one is in bsg but the generic pieces of that are mostly
  threading reply_len"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
  scsi: libsas: Fix SMP IO deadlock during HA resume
  scsi: libiscsi: Validate the task named by a management response
  scsi: libiscsi: Validate the ITT reflected in a Reject PDU
  scsi: libiscsi: Reject a negative task index from parse_pdu_itt
  scsi: target: iscsi: Fix race in discovery auth updates
  scsi: target: Disable interrupts while holding delayed_cmd_lock
  scsi: st: Fix use-after-free race between st_remove() and st_open()
  scsi: st: Save the visited block for the partition the drive is in
  scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
 2026-10-18 09:06:02 -10:00
Linus Torvalds
8486d35712 spi: Fixes for v7.3 
A small collection of driver specific fixes, all quite important if you
 have the relevant hardware.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatTACAAKCRAv73Ows9A4
 if2lAQDfQLZHMIvrU2wGNFBX2CUe2repS3JyRnmRalP9nXSVkAEAgS4wY/wU8wzQ
 o+7ajrnUAZjgx/IK3HKoV0fXMOvlTAw=
 =1PL3
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A small collection of driver specific fixes, all quite important if
  you have the relevant hardware"

* tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()
  spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible
  spi: imx: fix slab corruption from undersized DMA bounce buffers
  spi: tegra114: assert CS GPIO for every transfer in a message
 2026-10-18 08:59:16 -10:00
Linus Torvalds
3d679a244e regmap: Fixes for v7.3 
The main thing here is a fix for lockdep warnings with MMIO regmaps that
 use a raw spinlock and a cache, some other lockdep fixes we'd done for
 the benefit of the maple tree on sleeping buses meant that we were doing
 allocations for those MMIO regmaps under a raw spinlock.  While fixing
 that Michael Reeves also noticed that the debugfs files were briefly
 available without the cache structures backing them.
 
 There's also a fix for interrupt freeing on error in regmap-irq which
 had been hanging around because it's not super urgent.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatS/PwAKCRAv73Ows9A4
 idqeAP4y6bdFUzY0e9Ntiixana3IyzJ2dxzrjHIFHcOZl02UhwD8D2jWwFIw0CIs
 izZUkBabg5UyIeM1NkzZWtmDhkZTaAk=
 =AS9J
 -----END PGP SIGNATURE-----

Merge tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap fixes from Mark Brown:
 "The main thing here is a fix for lockdep warnings with MMIO regmaps
  that use a raw spinlock and a cache, some other lockdep fixes we'd
  done for the benefit of the maple tree on sleeping buses meant that we
  were doing allocations for those MMIO regmaps under a raw spinlock.

  While fixing that Michael Reeves also noticed that the debugfs files
  were briefly available without the cache structures backing them.

  There's also a fix for interrupt freeing on error in regmap-irq which
  had been hanging around because it's not super urgent"

* tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Drop map lock during cache init and exit
  regmap: Remove debugfs before cache teardown
  regmap: irq: Free the irqdomain we create
 2026-10-18 08:36:29 -10:00
Linus Torvalds
72732cbee6 i2c-fixes for v7.3-rc8 
Three independent clock management fixes, plus one for a simple
 reset mask blunder in the qcom-cci interrupt handler.
 
 - qcom-cci: prevent lost reset requests during interrupt handling
 
 - qcom-geni: preserve the selected source clock
 
 - viai2c-wmt: fix clock reference leak
 
 - xiic: fix clock disable warnings during removal
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCatTkqQAKCRDaeAVmJtMt
 bmntAQCohnAvbkYQh6VfaPl5TzQPytHWTMg3AiqyLeDWs7MuAAD/RQS6vFQMyzvj
 kD1fK/ocHIs/D59T21JiOzhhiNSSNwo=
 =SdHD
 -----END PGP SIGNATURE-----

Merge tag 'i2c-fixes-7.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

Pull i2c fixes from Andi Shyti:
 "Three independent clock management fixes, plus one for a simple
  reset mask blunder in the qcom-cci interrupt handler"

* tag 'i2c-fixes-7.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
  i2c: qcom-cci: Fix HALT_ACK reset request being dropped
  i2c: qcom-geni: Restore the source-clock selection policy
  i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
 2026-10-18 08:16:56 -10:00
Linus Torvalds
a0ff06b3a7 firewire fixes for 7.3-final 
Fix a regression introduced in v6.19. It affects cancellation of the
 timer for split transaction timeout when handling a response. The issue
 is unlikely to occur in practice.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCatQ4OwAKCRCsLtaWM8Lw
 E2sNAP49Zw/nOmC9OaYKthJtKUup5Oi+4kxQnNjnDDNIraa/2gEAnhum0sbs/PHt
 VCRl5/WMsHPQRgNMrihFO6G+2+KACgQ=
 =F+OT
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fixes-7.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fix from Takashi Sakamoto:
 "Fix a regression introduced in v6.19. It affects cancellation of the
  timer for split transaction timeout when handling a response. The
  issue is unlikely to occur in practice"

* tag 'firewire-fixes-7.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: core: fix race condition in split transaction handling
 2026-10-18 08:13:58 -10:00
Linus Torvalds
53cbbb09c1 x86/core update: 
- Emit the FineIBT paranoid "cs" prefix as a byte,
    to work around a GNU toolchain build warning (Kees Cook)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUo24RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1i2PhAAm4V2NsF3knhwSQ2WC55RTZbXmlYLAJAq
 57rUJejuVM7eHrNhsT0FJIesMLbIDHz5RzVSllN7ESBB5zEkbiyIxRonaG6WTiKk
 G0y/IyPsA4BWFp9Ojq5NyDhD95do0gTc08Oxd8eEeJULBzGAaErGl8ExX15SQJkh
 eMVdAN4RcathkVrgKbdTklXkECa9j4I+rfBlkX4g8bJ22mbi8h8nfYNrlkX9vncf
 IxWNwUh3eKAamLHnKeqbmDUOUrP7ss/hWGWRG0La7G+8jWoX3YlWQdzJeMtWzdV6
 unNeFIjjP4lvBtKDkfUBf0JZN+mKo/Zwl5dWNQ/A26vOJTJmmFx03YsuWYDXR0+Q
 Vqvm09PSSPbKdGWT7MmlJNhEdBUPOLmCSOT06hfHYKsk+Qkx8XMUIz/bTbNW5gVP
 eeok5YWMBn3dQ2B4+LfBqxwMeu+jripgJjN0bj1JOHwkMzYthRce3SHyWRW6hsIh
 oOReFnmxaImkh22ia1RLnPscp2efkV9InL5IpNXIH3MXpvlNiUfd0OiDMSGS6ici
 AnErf5LK1aXLI+agmBx+7XovUb7umnWpUyvLy3f93E6i6o3urGJ2Tg9Eq+pLJPOR
 OAYkzsdJiLCVZqiFm+S+8xNCmlnOs76rKk9bOElOBXUej80q0zwQXHzJ8Pl+yBU1
 zw54ecYyK8A=
 =xZLR
 -----END PGP SIGNATURE-----

Merge tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86/core update from Ingo Molnar:

 - Emit the FineIBT paranoid "cs" prefix as a byte,
   to work around a GNU toolchain build warning (Kees Cook)

* tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
 2026-10-18 07:48:22 -10:00
Linus Torvalds
23a38e7bb2 x86 fix: 
- Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
    kCFI mode (Kees Cook)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUkT8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1i61BAAiBzFw9ztotYF8xYfsdETueYkK9Qh04sz
 7zPFIe6XcGUCKO25EScQlG49wuLFO/n+tGuAEw4MgLsaM6wlzsAz1AY4xTVbkj4T
 G7dckQWn0gYt3kooqO+YyTLpko1EGWSngGvLFEEGHpP6rTYVzI3sckfWcJvM1GJ1
 UmfPnlOAJDDlzUeGzTJz6J7S5y5/Cb/AWTaktnHb2oiQo0TQFlo5vm2uWR7s4uRp
 80WesVJi+lWpCf3BS+qDovXI0wsJCV7g4DpaxZGKuLUspOUjAOqG0/X2LJuNz0jD
 PTZT4JZOf3q7k5av10nNRyu3FwSHm/6zR99UXeJgQDq6aLtaOAoEgOz7W0si10gS
 uEzzwL0JaavDDtaSUMI6x12bcGmBddCXT4+w+/xWyPSQEj+26JJ0cj5RG1KvXUg/
 iTHKd7PZHC6v2B1/8w6hexBxrYvpSb08eO/8w5kOO82fhhS/os5mvaPd1NafeUSM
 xqiQYRvGUjJPywdYAFZFeTU7HMZQAa9N3dhA0T1G4ERjqHhd/MufNgiFadh/1DA1
 VF+ManJ3KsG+BN0DcP9si5l9MTUJsy6f2n7BRjU4vvx7sCuhsAcQYNhGvAy1F7/0
 VsYIpFvFkyUY4SDGEoZw+5t5goAcWDFDZxdjsbXvjdsDpDIHfbWRwU6KpfcoQ7Qr
 s5STEOpNHhY=
 =vXkY
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:

 - Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
   kCFI mode (Kees Cook)

* tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/kcfi: Decode the kCFI check from the trap address
 2026-10-18 07:38:37 -10:00
Linus Torvalds
88328f850d Scheduler fixes: 
- Fix __sched_setscheduler() class change race causing
    lost reschedules, exposed by recent RCU changes (K Prateek Nayak)
 
  - Fix s64 multiplication overflow in place_entity()'s vlag
    scaling code that can corrupt an entity's placement (Hui Su)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUkEcRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1j67g/+NaApCtC988ZaWipMkUyRsdYBQAxP+Nhy
 TkodntDpFgL4rqLe5guo8d3NXMLJwnvhygcAC7pVy0dfVzWai+ExAUiABggjtrjF
 mADPsPmhnzM/gNsgz//2hjJIpam5mivF9aIr20X04UtD9Dtn950RzKYqDibA6nv5
 wH7xeB8+vfBElH++le/8NmRCH+6IjVMvpzpDqphbtzssdUutDHkQQRC2epXzIm1/
 wjA0qoqoLWqyw1KgIcvP+ixvH1LT57b8K8NzJxnS4lsx62NzHiN+ZahkSmM9JNIY
 WEjqOC1C3NyjwyKcroTuaWLuvjxa0R6Rp5mWabEGHXbhQjDJmWiPgacsmYS1ywFz
 e5bzwpklcYqq/3x0JaYIhEt41zZ9HkN4X0TZzTsjDOotdxq8v3A81At39YycRRUZ
 l6cFvxbQZbCXBAHdIKVzQAAy3t19zK8xsj1mgyffseFGXXMrJucw+IHBL3ExxmSA
 WVZW9GRxStFvqzEBu0TxNFjH+VBBi4WGWotmQq4gRH1+gSQIbttwXYXZkt+B8nAT
 u9M/CKFeFqGzqF6wZWMjPo8l1sOo9lzdCwFjU78Tjz2tGsL1tuA1Uia8rCxE7Hnw
 josNULOdpiRhjrz9G0ycOyMtxu6GJ/sgoFeQiuKQ6MWsDI1xfdg/kM0EkWMkfXK2
 Lhc0okwHz5o=
 =bK3k
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:

 - Fix __sched_setscheduler() class change race causing
   lost reschedules, exposed by recent RCU changes (K Prateek Nayak)

 - Fix s64 multiplication overflow in place_entity()'s vlag
   scaling code that can corrupt an entity's placement (Hui Su)

* tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Avoid overflow in place_entity()
  sched/core: Call wakeup_preempt() for queued tasks during class change
 2026-10-18 07:35:30 -10:00
Linus Torvalds
8573787061 Perf events fixes: 
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
    that erroneously always-cleared the invert bit (Guixiong Wei)
 
  - Fix accounting bug in the perf mlock 'gift' code causing
    unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
 
  - Fix perf_pmu_migrate_context() bug leaving events behind during
    CPU hot-unplug (Haris Okanovic)
 
  - Update cgroup time when rotating multiplexed events, to fix
    time_running & scaled counts accounting bug (Antoine Huret)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUjygRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jyHg/9EZ9g8CN+qf0pOiLM3yOZbyoe88VMZ2ZH
 QBYGc1JgBVrrjT6JQYjuNQLakv9BJmbgQ1S/xtpaD93CtzJDzK/Jsg4SwuTINlE7
 wB+P8lpoTMhE1tfP7rwOaGdZD9qmkJIwALaDmTFayk5z87MzEbSmlLzRRC2TlB8g
 R3hF4KOtYtBwQKCrPIXiHi/LbHmx0c0zP4J9M/MbRvNLM8iZ47mF5PL++mpLyuTS
 z+YhUu21cp5SAotOZNsgD1VrVOcPy0vpIdJVYSSC9+OWfvuENoqkcciyoSXWNkT0
 O7RbMtBwfS7k2+wA2JgQ8ETcGVB0+G45NWXwHBmLHuU5XK5/Whbzn5cUKhvIdS0J
 xnr1MCWm/R+cC6i/wgfH1ysd8VACI/51Lng88ckXaVmkUajj6RZPo+VB2FRG4pvq
 FMC/Ap/fSjk2SdAjKHRMp87g19aOsoz+aWb6nGZPApMj0EGcxpPAZAcMSi+HUNyI
 N5MmAOiD5imMPWB6UX3OCeDgjwUD2Hnbn3NkZeK2Glm7dUUr1MZTEgQ1QlnBv+Ou
 vYMkVVEVEq9NJVA2ShnBF5+wRwUpLzI0+9w8L7ZUQPkiYL9tXAB988qYaQ5k08SZ
 iUo9EVj48QFqR4ILNY4iAyp9AuT7LuKMF0cnO+O8rEGR8gxHBOBYLxVzR/xB12lq
 48D1b2q3EiQ=
 =AxtL
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
   that erroneously always-cleared the invert bit (Guixiong Wei)

 - Fix accounting bug in the perf mlock 'gift' code causing
   unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)

 - Fix perf_pmu_migrate_context() bug leaving events behind during
   CPU hot-unplug (Haris Okanovic)

 - Update cgroup time when rotating multiplexed events, to fix
   time_running & scaled counts accounting bug (Antoine Huret)

* tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Update cgroup time when rotating multiplexed events
  perf: Fix perf_pmu_migrate_context() leaving events behind
  perf: Track the perf mlock gift separately
  perf/x86/intel/uncore: Fix DMR CXL CM invert filter
 2026-10-18 07:20:03 -10:00
Linus Torvalds
cf20e7f96a Locking fixes: 
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
    missed wakeups or spurious wakeups on futex-waiting
    tasks (Jann Horn)
 
  - Fix lockdep context tracking bug in the deferred hrtimer
    rearming entry code, which causes a lockdep chain leak
    that will eventually turn lockdep off (Mikhail Gavrilov)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUjUgRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gmPg//W4D6TwoPAhod8ExaSApVeP9vrqUnMkEg
 hf5GsvwT+0wW8cD8xaBnUVA2ylcLDurmu+eXedurOdc3VcRh/BSvJlBpPXMLA5pc
 L+iiGI8sMK6koNQrDXtFcHJbcdm5CSmNVc7sv0Vodi+7Q4EjZWL1SLI34F/5EbMd
 mvgJ1NDVVr/2L1gc1ojsPo6CUWnFTaq8sp48kYDrmpllo8epECQptJ248wfP2Grv
 1v43UYjprCjCY/KOvWz6O5wsXL+25vGk5JX2mY9BemmWJEoq7QOlBceJGpZiFmCf
 hO2b1a9aI7pKC7lBRBdeQF/GZHF5AF1E7NPmwR7nSSSGfG6z1rVeoq6e4/lewgui
 irvPDY2EDz4F5eQxDxZXTXzS7oKddEha4pB2L50/q9leFXdR1JG5Xh5D5p2lK5K0
 pUvo0ODt4TEVriX00sH8Q+2SBOyXhAGXfM2lwS0J5LMY9J+yexqn9MldM8ulg6Dm
 BoHYw5FXMuJrcUeNA4RM410bN4YGwKRNSzV8JlngQsfMX3EH0m8aorDYJ8TlLd91
 Tv3CfK0pIgNe0r2Tvx5xlNHjbypWk6a7GZBrWbQIeRvS1y60xFyus2kqd6OuF4W/
 iELs6ZM732881GXtRIQFQz9GbijA5FfSSpL3iPyKO71e/OsOLZGezQi7LXqZ1ZgF
 dk7g5R52Vb4=
 =V72L
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fixes from Ingo Molnar:

 - Fix FUT_OFF_MMSHARED futex hashing bug that can cause
   missed wakeups or spurious wakeups on futex-waiting
   tasks (Jann Horn)

 - Fix lockdep context tracking bug in the deferred hrtimer
   rearming entry code, which causes a lockdep chain leak
   that will eventually turn lockdep off (Mikhail Gavrilov)

* tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  entry: Account the deferred hrtimer rearm as hardirq context for lockdep
  futex: Fix mm reuse handling for FUT_OFF_MMSHARED
 2026-10-18 07:03:51 -10:00
Takashi Sakamoto
7f9f2d6abc firewire: core: fix race condition in split transaction handling 
For a split transaction, either fw_core_handle_response() or
split_transaction_timeout_callback() may manipulate the same transaction
entry in the pending transaction list. The return value of timer_delete()
is used to determine which function handles the entry. If the transaction
is a split transaction and timer_delete() returns zero, the timeout
callback may already be running. In this case, the response handler must
leave the entry in the list for the timeout callback to remove.

A previous code refactoring broke this behavior, introducing a race
condition in which both functions could process the same transaction.
This could lead to a use-after-free on the transaction initiator side.

Fix the regression by ensuring that the response handler does not process
the transaction when timer_delete() returns zero. The timeout callback is
responsible for removing the entry from the pending transaction list.

Fixes: fa2dc27100 ("firewire: core: code refactoring to find and pop transaction entry")
Link: https://lore.kernel.org/r/20261018025504.290598-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
 2026-10-18 11:59:35 +09:00
Lukas Zobernig
32c52ec87d x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() 
Commit 45e1dccc06 ("x86/insn: Simplify for_each_insn_prefix()") made
for_each_insn_prefix() declare its own loop counter named idx.
get_seg_reg_override_idx() keeps its result in a local of the same name,
so the assignments in the loop body now write the loop counter:

 - the function always returns INAT_SEG_REG_DEFAULT, so FS and GS
   overrides are ignored;

 - a CS override sets the counter to INAT_SEG_REG_CS (2), the increment
   makes it 3, and prefixes.bytes[3] holds the last prefix, 0x2e again,
   so the loop never terminates.

The UMIP emulation reaches this from the #GP handler for user space: an
SGDT, SIDT or SMSW with a memory operand and a CS prefix leaves the task
spinning in the kernel, never returning to user space, with a SIGKILL
that is never delivered.  Any user can thus tie up CPUs until reboot.
With an FS or GS prefix, the emulated result is written to the wrong
address.

Rename the internal macro iterator variable.

[ Lukas' original patch renamed the use site, I changed it to rename the
  iterator in the macro instead, but left Lukas' commit message and
  authorship   - Linus ]

Fixes: 45e1dccc06 ("x86/insn: Simplify for_each_insn_prefix()")
Signed-off-by: Lukas Zobernig <lukas.zobernig@gmail.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2026-10-17 06:36:20 -10:00
Linus Torvalds
58161ead29 drm fixes for 7.3 final 
MAINTAINERS update
 
 dma-buf:
 - revert dma-debug y on debug kernel due to msm interaction
 
 core:
 - fix drm_exec prelocked object interaction
 
 i915:
 - Fix ARL-S host bridge detection
 - Add sanity checks for malformed DMC firmware
 
 xe:
 - OA uAPI fix
 - shrinker fix
 - fix eviction of object with no bo resource
 - fix LRU for external objects
 
 amdgpu:
 - UVD fix
 - TTM sched entity fixes
 - SMU 14 fix
 - Userptr leak fixes
 - Runpm ref count fix
 - CRIU fix
 - UserQ fixes
 - USB4 fix
 - SDMA 3 fix
 
 virtio-gpu:
 - revert double setting blend property
 - reset device before deleting vqs on freeze
 
 vc4:
 - fix hdmi audio runtime_pm interaction
 
 amdxdna:
 - fix Kconfig invalid configuration
 
 rocket:
 - fix error path for failed init
 - fix core unbinding and scheduler lookup paths
 
 panthor:
 - fix immortalis configuration
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrSnhgACgkQDHTzWXnE
 hr6LQA//T8IJaQ42T8wr4zCjWMzF03fzpZAXRLs+2pV0CfRr3vqsu3onVJn1+Ulw
 XuKP2jIt3kBHP2ai9G3C1yrkMNj3umM94SKTmH+96tDAilOe1NZ/MVUN7Yg6Ioi4
 +E5SykvytJhx2bqCmFN7eFVK+4oIAW01YNNoCCwxzjY75qQuWhzKeQ4ULfA/Qwe4
 JgIsKctCoXMfdw4Zt5MEFAN2wFgG2A31VyeYW9eVvR9N7FpwDztwi0VaOb3DzJkx
 1SyvS8VQQnxX6KYxsRvylXV+rsg5sA1vJ28Yh403PciHEHmWqBlzJsiqyI13zKXk
 s5nfB/6fflICQT32qnbNnpLhBmaHUYez7hwuiFHKRxiLC4AikB3LX0NQII6uXlLg
 1lmaOt/B9pNM8gpZAS/GqzERE2GoUP628vQ8bWmViD8zqVLij/fAebhQcqnlT3mm
 O/q7dlsztWEYyDif8Z5sXJ0ZDpbrTMRHlAIcxx5qQTjTxdRiwxoHU8Rb5OB3f6nX
 7MGmVFPSIa+i29cfBROSm7XH0DcihHpGaylu5RlXJvP5oHYftVtn/9Pki4HNEof5
 FGg9JOviyQ3UWc4TEDX1paLclASzUi4urPiR2eCuMHE5PWYVoQIv1SVX06wIYTjI
 OxjS/GqV984vyuH65dnMy+XxRMxMTeQHuhVLfIMq5sJ7e41GZIQ=
 =5s8l
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Last set of fixes, mostly amdgpu, some i915 and xe.

  I think the dma-buf revert is probably the most important: while it is
  technically correct the fallout from it means we shouldn't enable
  DMABUF_DEBUG like that yet, and fix the fallout first.

  Summary:

  MAINTAINERS update

  dma-buf:
   - revert dma-debug y on debug kernel due to msm interaction

  core:
   - fix drm_exec prelocked object interaction

  i915:
   - Fix ARL-S host bridge detection
   - Add sanity checks for malformed DMC firmware

  xe:
   - OA uAPI fix
   - shrinker fix
   - fix eviction of object with no bo resource
   - fix LRU for external objects

  amdgpu:
   - UVD fix
   - TTM sched entity fixes
   - SMU 14 fix
   - Userptr leak fixes
   - Runpm ref count fix
   - CRIU fix
   - UserQ fixes
   - USB4 fix
   - SDMA 3 fix

  virtio-gpu:
   - revert double setting blend property
   - reset device before deleting vqs on freeze

  vc4:
   - fix hdmi audio runtime_pm interaction

  amdxdna:
   - fix Kconfig invalid configuration

  rocket:
   - fix error path for failed init
   - fix core unbinding and scheduler lookup paths

  panthor:
   - fix immortalis configuration"

* tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel: (31 commits)
  drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
  drm/amdgpu: keep the eviction fence until the last handle is closed
  drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
  drm/amdgpu/userq: actually validate userq BOs
  drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES
  drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
  drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
  drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
  drm/amd/pm: add zero fan stop temperature support on smu 14.0.2
  drm/amdgpu: destroy mutex when tearing down ttm buffer entity
  drm/amdgpu: fix sched entity leak in ttm buffer entity init
  drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set
  drm/panthor: fix immortalis condition
  drm/i915/cx0_phy: Fix ARL-S host bridge detection
  drm/i915/dmc: Add sanity check for DMC load address
  drm/i915/dmc: Harden DMC firmware payload parsing
  drm/exec: don't immediately add prelocked obj to array of locked objs
  drm/virtio: Reset device before deleting virtqueues on freeze
  drm/xe: Bump LRU for external objects on exec and rebind
  drm/xe/oa: Zero OA buffer at allocation
  ...
 2026-10-16 15:33:36 -10:00
Linus Torvalds
a3bb7a0184 sound fixes for 7.3 
Here are the (hopefully) last bits for 7.3.
 At this time, all changes are small and device-specific ASoC fixes.
 Not super-urgent, but should be fairly safe to take.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrSViUOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/VwRAAkan0lCo3yf6j+dvU3iyR2qYF+9s98dZLlaaw
 wRQk8ZtPdrSh40NwQ56GTkbbYGuXaKiKU9+YeYnvqodwOE88qpOJHHxy4Li8s3Gx
 CKg0TfGYSrtzKvDgEGF01EoKbHw8/r+YL6rWi6p3A+FD1bInwkl9qNYnmZWNq/gM
 tKsRWNgKsSP5jeFAuEAapSNzlaxoQp86Iz+AYGtVaFKK1tImotzvTuz9SUI9dTEv
 r5QbjvanR1QtPc15iQwTcyKNQIg8C9+LWqA1Lw4aI6dYVVDyIc2UsucFG2Ndnt3Y
 yeuIK1LIBJPGwc0A76YimztPk/fHOMk5xZPXi2Z6xy0mofN3ACwD8VKhktVVO0kF
 7SVWWaGqCIDbCPpY2jpa7Kim9uqdefc18Jg8zHusO7+TU4NvuO8Iih0D1kLQ++WO
 5C0O43OIuIvvN5hAiKXdv8wKPz4/BKufn2/RwuwwaRrfTnczsXOXXiHJQhd11gJ8
 iGgVQc+1XAYR/u91LC6ilNx7l6dAosgaCiU9aCeL4o1BgeLG738OtObqFuxTRgfo
 5Yjr6v5X3CXZB/7gBIhHcsCIwiWcP/iiEBlqifvUdbjJ8qy3z9de9tis2yg/1KFp
 1Oqp2V3UTL3sq3xv6eBVXr1w78yR7kXkF8d5LKmTZL0nyjFV7IJRNFNtOsIfPZfO
 eGS4CFk=
 =AOo0
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Here are the (hopefully) last bits for 7.3.

  At this time, all changes are small and device-specific ASoC fixes.
  Not super-urgent, but should be fairly safe to take"

* tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: amd: yc: disable MSI on resume
  ASoC: nau8822: Fix the 128x oversampling switch bits
  ASoC: wm8978: Fix the 128x oversampling switch bits
  ASoC: max98371: Fix the Speaker DHT Min Volume bits
  ASoC: pcm3168a: Fix the DAC zero flag polarity bit
  ASoC: cs42l52: Fix the NG Type Switch bit
  ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
  ASoC: stm32: spdifrx: fix synchronization state check
  ASoC: Intel: avs: Reset the stream unless it is already prepared
  ASoC: SOF: sof-client: Use event-handler mutex consistently
  ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
 2026-10-16 15:29:02 -10:00
Linus Torvalds
4766082b79 pci-v7.3-fixes-6 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrSWyQUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vxZfg/9G4QxTP/m2gpQW6P+lMmU2xcACa08
 K/lNG3HWLg08a0sqgveAv6Kb1dHw6OeUeCprGmZjjSFhkZMALsDiTZgU2pvE3a9m
 00L0qKqb6oWRS2qOqULOchlCK8f10MUKJLlc823SKIRw+UEGCzxd+Qk91U3r+jX6
 3J9e760m/pRFxmEoVEoW0Hcd1DDIDNII1wHB89J5JdSKJ9qMDSJQjiUoQy7aTWJo
 ig9bVyq7Rrx6pHBK7oGC/Ua7BRFw0yx8IEda4CbqIg+aj5vciTyaNIMVQkWyMpVT
 v+YKEIn4jb6zqI9Ei+joswYYq7XvTBe/r8TDLz/ZMqDoNpdRWyNQxkL4Z/hViMGf
 51OoLBbXDZH9wi99DWyQrav5R2aGFpNDDOQRsPcNNiEboWu77DAALkPACoIBZvoS
 gc777dnY+D48vAl1e3wfCzlSReoEHMOm5ROYzBR4jQHTN7DN83nL7eyw/GilcoG4
 JcCTaceKp79MngOHmiVGUUyEOfllZvdUq/dneMLRNNvZe9HvjvTnf+0TY4u/9ubb
 8/O7hxbEeYqYcW/dk++0Pd02M0qTarvGL5okdajj8FtEzhnTs66Ka/lb4Ekuyxah
 CEKFeqpI5qzAlsmfkbpu6RCXcg4/gd7jcCe/0LrbMWjebzorPKsy0XVVyoXct5W4
 8ZqkJoa8C78lreg=
 =RsGW
 -----END PGP SIGNATURE-----

Merge tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull PCI fixes from Bjorn Helgaas:

 - Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe,
   which falsely advertise it; removal of unrelated delays in v7.2
   caused post-FLR state restoration to fail, resulting in a VFIO
   passthrough regression (Alexander Gruhlke)

  -Don't treat ~0 as 'device is ready' in pci_dev_wait(); with RRS SV, a
   device may respond with RRS (resulting in data of 0x0001) or may not
   respond at all (typically resulting in ~0 data). A v6.12 change
   treated ~0 as 'ready', resulting in a regression with Intel and
   Samsung NVMe SSDs (Alexander Gruhlke)

* tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
  PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe
 2026-10-16 14:51:21 -10:00
Linus Torvalds
9d586910e3 printk hotfixes for 7.3 
-----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmrSRhIbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTyms0P/jeEH1xJq001K8uAfPeH
 +wXdGRlKNuN+0ZRxR+RqjF0KRhgdjG0CBGUZu4ZdhKwaPlTy0ooeZSxohpOeBc/E
 tEzblYRX7bueoOxHd/5Do2O22qPNxgWvAF1hGChHL/CasPpYjQYE2y5JH9yKsTum
 R7MpkEbWcn4MR5Dcnd4Kc267bJ1+5xSSppXgfaBPUFhdSR0LsNJ4bB4q59KUDBRy
 Kx4HS+bBVW7GP6+VwrZ0GdtPr/ztk5BRqVeZt1oETvxQKN7/BV7KWXDRIYjzjqcF
 f4EeUKgUCWFxa0VG7J+EzghfUu7qJjld5qQKeSMra49xpERgN2KgA3CudZKAvyDe
 +YHp76U51XD37PXRnNBCy+B0N1o4zzmw06p0sRD2Ka/XVHoWSptRDPV/YLYaihrW
 lhZkPcNai7U/vJKF8pExbAsfYIY38ai3ZecLCQr9NRdtuZceOl7JpdadW5mDPI0Y
 1JJSuC4lt/fUDkcCquruZANLoe8CtE9ueCMGkUQv7yxa77tySoRjZ7GgsZczyyFd
 orrUhtiSPddepjRFRBf5Sz9msUiKXMFKCvj8v2gtH7ID1NooLh1auHM5bqKrgnag
 Ohp0HV+oXQ+vo5Gg0rksIxla5JnTbApICp41ksDiKVWeLXchMyL8NGzeo1eZ6wyv
 2hbh85lj2TkmSkJOfd6vkYxl
 =nY7x
 -----END PGP SIGNATURE-----

Merge tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux

Pull printk fixes from Petr Mladek:

 - Switch NBCON consoles to the emergency mode in emergency_restart() to
   see messages even in this shutdown code path

 - Postpone the start of printk kthreads after smp_init(). It prevents
   boot stalls on some HW

 - Typo fix in a previous hot-fix patch

* tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  printk: Postpone kthread startup
  printk: fix kernel-doc name for nbcon_write_context_is_braille
  nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()
 2026-10-16 14:37:20 -10:00
Linus Torvalds
e2c278bc37 tracing fixes for v7.3: 
- Fix NULL dereference when copying histogram field variable
 
   If event_hist_trigger_parse() creates an action that uses one of pseudo
   fields for its keys, the hist_data field element will have a NULL for its
   field member. When looking to match that key, the lookup uses
   key_field->field->name which will dereference a NULL pointer.
   Instead use the helper function that handles such cases: expr_field_str().
 
 - Take the trace_types_lock when dropping the buffer_meta reference
 
   The tracing_buffer_meta_open() error return drops the trace_array
   reference with __trace_array_put() instead of trace_array_put() where the
   former doesn't take the lock and the latter does.
 
 - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta
 
   These files are created for every possible CPU. But it only contains data
   for CPUs that have come online. If one is read for a CPU that hasn't come
   online yet, it triggers a NULL pointer dereference.
 
   Have reading of CPUs that have not come on line yet return -ENODEV.
 
 - Fix an out-of-bounds shift in the log2 histogram modifier
 
   Histograms can take a log2 modifier to have the buckets defined by log2
   increments. If a shift is greater than ULONG_MAX or above 2^63, the key
   falls into a lower order bucket.
 
   Use order_base_2() instead of "ilog2(n - 1) + 1" to have all overflowed
   keys go into the top bucket.
 
 - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting
 
   The algorithm for finding the index of a sub-buffer in a persistent ring
   buffer buffer did not take into account the meta data at the beginning of
   the buffer causing the wrong index to be returned.
 
   As rb_subbufs_from_meta() does the proper accounting to find the first
   sub-buffer, use that function instead of repeating the logic (incorrectly)
   and make the calculations based off of that.
 
 - Fix the symbol name checks for the remote buffer code
 
   The remote ring buffer has a build time check to make sure its not using
   any code that will not be in the hypervisor. For various architectures,
   there has been false positive reports from this checker.
 
   Fix them.
 
 - Fix false warning in ring_buffer_map_get_reader()
 
   There is a WARN_ON() after rb_get_reader_page() if no reader is returned.
   But there are legitimate cases where this can happen. Remove the WARN_ON()
   and also a check that covers one of the legitimate cases that tries to
   exit out early. There's no need for the check if it just simply allows the
   return of NULL from rb_get_reader_page().
 
 - Fix the ignored return value from resize_buffer_duplicate_size()
 
   Some clean up of the code in tracing_snapshot_write() removed checking the
   return value of resize_buffer_duplicate_size() and if that failed it would
   not be detected.
 
 - Fix the histogram timestamps for buffered events
 
   The histogram timestamps are taken from the events that are recorded.
   It currently reads ring_buffer_event_time_stamp() but if the event is
   buffered it does not read it properly. Use tracing_event_time_stamp()
   which handles both buffered and normal events.
 
 - Do not initialize tracefs if tracing is disabled at boot
 
   If tracing fails to allocate or some other error is detected,
   tracing_disabled is set. Do not initialize tracefs in this case as it may
   expect data to be initialized but is not.
 
 - Free eventfs inode after an RCU grace period
 
   Currently eventfs_inodes are freed after a SRCU grace period as the
   iterations in the code use SRCU. There are locations that the inode may
   still be accessed from the VFS that uses RCU which does not have the same
   synchronization as SRCU. Add an RCU wait before free eventfs inodes.
 
 - Do not fail persistent and remote buffers under memory pressure
 
   As persistent and remote buffers have their own pre-allocated memory,
   there's no reason to check how much memory is available before created
   them. By checking the memory pressure, these buffers may fail to be
   created even though their memory is already present.
 
 - Account for subbuffer size when checking how much memory is available
 
   Before allocating a ring buffer, the size is checked against the current
   memory pressure of the system. But it assumes every sub-buffer is of page
   size. This is no longer the case. Use the actual sub-buffer size when
   calculating how much memory will be used.
 
 - Reject non-stack fields for synthetic stacktrace fields
 
   Stack traces are special fields and the checks currently do not do enough
   to make sure that the fields being processed as stack traces are indeed
   stack traces. Update the logic to properly detect what is or is not a
   stack trace.
 
 - Fix a crash in print_graph_function_event()
 
   When a tracer does not define static or default flags the
   tr->current_trace_flags is set to NULL. If the ring buffer is
   not cleared when switching tracers, the previous tracers events
   could be read. The function_graph entries will dereference the
   tr->current_trace_flags and cause a crash.
 
   Set the tr->current_trace_flags to a empty set of flags to prevent
   it from being NULL.
 
 - Separate tracing filter predicate count from allocation
 
   The amount allocated for the predicate program is the number of predicates
   defined plus two for adding "true" and "false" at the end. The nr_preds is
   incremented by two to accommodate the booleans but is then used as the
   limit check for number of predicates. This is incorrect as it is now two
   higher than what is expected.
 
   Use a separate variable for the size of the predicate array.
 
 - Fix the filter operator stack check
 
   The operator stack increments the pointer and then writes the content onto
   the stack. The check for overflow compared the current pointer to see if
   it was greater than the stack size before doing so. This is an off by 2
   error as the write will be at the size - 1 and the compare is done before
   the increment. Adjust the check accordingly.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatItoRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qmfsAP9XviDyrl49/PBpuanB2qQzlMGqYQlb
 CwISmzgWoO1jKQEArNiSpKsIdPLfSJSLfIHAGxAZfmT42SugA4M5jqhW3Qc=
 =7KiP
 -----END PGP SIGNATURE-----

Merge tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fixes from Steven Rostedt:

 - Fix NULL dereference when copying histogram field variable

   If event_hist_trigger_parse() creates an action that uses one of
   pseudo fields for its keys, the hist_data field element will have a
   NULL for its field member. When looking to match that key, the lookup
   uses key_field->field->name which will dereference a NULL pointer.
   Instead use the helper function that handles such cases:
   expr_field_str().

 - Take the trace_types_lock when dropping the buffer_meta reference

   The tracing_buffer_meta_open() error return drops the trace_array
   reference with __trace_array_put() instead of trace_array_put() where
   the former doesn't take the lock and the latter does.

 - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta

   These files are created for every possible CPU. But it only contains
   data for CPUs that have come online. If one is read for a CPU that
   hasn't come online yet, it triggers a NULL pointer dereference.

   Have reading of CPUs that have not come on line yet return -ENODEV.

 - Fix an out-of-bounds shift in the log2 histogram modifier

   Histograms can take a log2 modifier to have the buckets defined by
   log2 increments. If a shift is greater than ULONG_MAX or above 2^63,
   the key falls into a lower order bucket.

   Use order_base_2() instead of "ilog2(n - 1) + 1" to have all
   overflowed keys go into the top bucket.

 - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting

   The algorithm for finding the index of a sub-buffer in a persistent
   ring buffer buffer did not take into account the meta data at the
   beginning of the buffer causing the wrong index to be returned.

   As rb_subbufs_from_meta() does the proper accounting to find the
   first sub-buffer, use that function instead of repeating the logic
   (incorrectly) and make the calculations based off of that.

 - Fix the symbol name checks for the remote buffer code

   The remote ring buffer has a build time check to make sure its not
   using any code that will not be in the hypervisor. For various
   architectures, there has been false positive reports from this
   checker.

   Fix them.

 - Fix false warning in ring_buffer_map_get_reader()

   There is a WARN_ON() after rb_get_reader_page() if no reader is
   returned. But there are legitimate cases where this can happen.
   Remove the WARN_ON() and also a check that covers one of the
   legitimate cases that tries to exit out early. There's no need for
   the check if it just simply allows the return of NULL from
   rb_get_reader_page().

 - Fix the ignored return value from resize_buffer_duplicate_size()

   Some clean up of the code in tracing_snapshot_write() removed
   checking the return value of resize_buffer_duplicate_size() and if
   that failed it would not be detected.

 - Fix the histogram timestamps for buffered events

   The histogram timestamps are taken from the events that are recorded.
   It currently reads ring_buffer_event_time_stamp() but if the event is
   buffered it does not read it properly. Use tracing_event_time_stamp()
   which handles both buffered and normal events.

 - Do not initialize tracefs if tracing is disabled at boot

   If tracing fails to allocate or some other error is detected,
   tracing_disabled is set. Do not initialize tracefs in this case as it
   may expect data to be initialized but is not.

 - Free eventfs inode after an RCU grace period

   Currently eventfs_inodes are freed after a SRCU grace period as the
   iterations in the code use SRCU. There are locations that the inode
   may still be accessed from the VFS that uses RCU which does not have
   the same synchronization as SRCU. Add an RCU wait before free eventfs
   inodes.

 - Do not fail persistent and remote buffers under memory pressure

   As persistent and remote buffers have their own pre-allocated memory,
   there's no reason to check how much memory is available before
   created them. By checking the memory pressure, these buffers may fail
   to be created even though their memory is already present.

 - Account for subbuffer size when checking how much memory is available

   Before allocating a ring buffer, the size is checked against the
   current memory pressure of the system. But it assumes every
   sub-buffer is of page size. This is no longer the case. Use the
   actual sub-buffer size when calculating how much memory will be used.

 - Reject non-stack fields for synthetic stacktrace fields

   Stack traces are special fields and the checks currently do not do
   enough to make sure that the fields being processed as stack traces
   are indeed stack traces. Update the logic to properly detect what is
   or is not a stack trace.

 - Fix a crash in print_graph_function_event()

   When a tracer does not define static or default flags the
   tr->current_trace_flags is set to NULL. If the ring buffer is not
   cleared when switching tracers, the previous tracers events could be
   read. The function_graph entries will dereference the
   tr->current_trace_flags and cause a crash.

   Set the tr->current_trace_flags to a empty set of flags to prevent it
   from being NULL.

 - Separate tracing filter predicate count from allocation

   The amount allocated for the predicate program is the number of
   predicates defined plus two for adding "true" and "false" at the end.
   The nr_preds is incremented by two to accommodate the booleans but is
   then used as the limit check for number of predicates. This is
   incorrect as it is now two higher than what is expected.

   Use a separate variable for the size of the predicate array.

 - Fix the filter operator stack check

   The operator stack increments the pointer and then writes the content
   onto the stack. The check for overflow compared the current pointer
   to see if it was greater than the stack size before doing so. This is
   an off by 2 error as the write will be at the size - 1 and the
   compare is done before the increment. Adjust the check accordingly.

* tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: Check operator stack capacity before pushing
  tracing: Keep the predicate limit separate from program capacity
  tracing: Fix crash in print_graph_function_event()
  tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
  ring-buffer: Use subbuf_order in available memory estimation
  ring-buffer: Skip si_mem_available() for persistent and remote buffers
  eventfs: Free the eventfs_inode after an rcu grace period too
  tracing: Do not initialize tracefs work if tracing is disabled
  tracing: Fix hist trigger timestamps for buffered events
  tracing: Fix ignored return value of resize_buffer_duplicate_size()
  ring-buffer: Fix false warning in ring_buffer_map_get_reader()
  tracing: Fix simple_ring_buffer undef check on sparc64
  tracing: Fix simple_ring_buffer undef check on parisc
  tracing: Fix empty symbol names in simple_ring_buffer undef check
  ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
  tracing: Fix the shift out of bounds in the log2 histogram modifier
  ring-buffer: Do not show buffer_meta for CPUs without a buffer
  tracing: Take trace_types_lock when dropping the buffer_meta reference
  tracing: Fix NULL dereference when copying keys for a field variable
 2026-10-16 14:27:22 -10:00
Linus Torvalds
2d2fe9fd50 Probes fixes for v7.3-rc7: 
- tracing: probes: error if BTF is required but unavailable
   Fix to return an error instead of NULL if BTF is not available when
   user specify '$args*' meta fetch argument for probe events.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrSAywbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bY14IAIQNGUIk12JDJMKWAhZp
 Zv9jt7ER+3ei2v9qnhnykEvzbMA9PiuPu/6I8u1z+vTkJg7n7YK27DWWZ1o14E1m
 CRMgo/c+s5H+vWaBwCuxxwYBEWBFNGzB2LFBrb8L6n4cMq07AqSfIRmbz83fZHNl
 N8nxqK2aENVmnM3wvSM210TuZnYwihPQncRgSAsco6Y260G+LZbPdfDZXYbfWMTD
 pxkSbjdVGueiowz0zszkDyFMqIR5mtLW1hRMn8qMZaEdeZAPDeruo69hXSRyd2ny
 X379NoSSNjog2efWmXEzb3OYo5PuGVU1If5eGEBraDRgBiK18nB4a13HVkvfYWWW
 AM8=
 =vDMe
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes fix from Masami Hiramatsu:

 - error out if BTF is required but unavailable

   Fix to return an error instead of NULL if BTF is not available when
   user specify '$args*' meta fetch argument for probe events.

* tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: probes: error if BTF is required but unavailable
 2026-10-16 14:25:25 -10:00
Alexander Gruhlke
e8df1d194c PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV 
With RRS Software Visibility, pci_dev_wait() considers a device ready as
soon as reading the Vendor ID doesn't return the RRS value.  Devices aren't
required to respond with RRS while they aren't ready, so the read may
return ~0 and pci_dev_wait() stops waiting too early.  This was seen with
Intel [8086:0a54] and Samsung [144d:a80c] NVMe SSDs.

Also wait while the Vendor ID reads ~0.  A VF's Vendor ID always reads ~0,
so check its Command register instead, as is done without RRS SV.

Fixes: d591f6804e ("PCI: Wait for device readiness with Configuration RRS")
Link: https://lore.kernel.org/r/20250611101442.387378-1-hui.wang@canonical.com
Suggested-by: Lukas Wunner <lukas@wunner.de>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Alexander Gruhlke <gruhlke@mailbox.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20261011190145.23621-3-gruhlke@mailbox.org
 2026-10-16 12:11:15 -05:00
Alexander Gruhlke
0f8b5d90d1 PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe 
The Samsung 990 PRO [144d:a80c] advertises Immediate Readiness, so
pcie_flr() doesn't wait after FLR, but the drive returns ~0 for up to 7 ms.
Since commit 10baa9b4df ("PCI: Drop unnecessary retries when restoring
BARs"), the config restore after FLR is lost, which breaks VFIO passthrough
of the drive.  Firmware 8B2QJXD7 responds right after FLR, but older
firmware such as 1B2QJXD7 doesn't, and the firmware version isn't visible
here.

[bhelgaas: The Samsung 990 EVO Plus [144d:a80d] with 2B2QKXG7 firmware
seems to have the same problem.]

Ignore Immediate Readiness on these devices, so pcie_flr() waits.

Fixes: 10baa9b4df ("PCI: Drop unnecessary retries when restoring BARs")
Link: https://bbs.archlinux.org/viewtopic.php?id=314833
Link: https://bbs.archlinux.org/viewtopic.php?pid=2312085#p2312085
Suggested-by: Lukas Wunner <lukas@wunner.de>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Alexander Gruhlke <gruhlke@mailbox.org>
[bhelgaas: squashed in Samsung 990 EVO Plus from
https://lore.kernel.org/all/20261016102042.641801-1-gruhlke@mailbox.org]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20261011190145.23621-2-gruhlke@mailbox.org
Link: https://patch.msgid.link/20261016102042.641801-1-gruhlke@mailbox.org
 2026-10-16 12:05:18 -05:00
Petr Mladek
54e1e89a97 Merge branch 'for-7.3-hotfix' into for-linus 2026-10-16 17:38:25 +02:00
Linus Torvalds
70dd4ee72e Pin control fixes for v7.3: 
- AMD: Clear S4 wake bits when firmware has _AEI, this is
   important for some AMD systems.
 
 - Do not accumulate sunxi npins across probe() attempts with
   deferred probe. (desc->npins just went ++ and ++...)
 
 - Qualcomm patch galore: split QUP functions on the Nord pin
   controller, fix an OF module alias on IPQ5210 so the module
   modprobes, fix two groups on the IPQ5018, make direction
   changes exclusive on the SPMI-GPIO, and fix the interrupt
   target width on four different SoCs.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmrR5asACgkQQRCzN7AZ
 XXNTFg//S2kHTNXB1aZgHjo1bt0F82kFT0sFVsuddhxXW05Ss4ij27/qPCIRqgaU
 QY9cT8TRiLlM4eUZyehTeuBwSKT+sgjC8DlBNQj4omsWSK963h78RSbrBD3VpjEi
 Zra5XBOKvYcUF9DSiP6b+koQ2DgTxy+s7haQQ9wGqV12jGIKa7qrx69I+ERa7zc3
 er+zC7ze05Tm3fm5reGKrn0aL4d1OnLrOUIlvsQsKI7CfwnPLf4dh767IUOHTHbD
 ewyAwZZI/X1cL7JlJ9qqPM33lBsNL1xUq61rJ+c5vhCNyO7XTAD4KuxrUCo03bQA
 MiNVXJBkPF89y47TNuiSp1evJvRLTf/gWpsLqMg8UwNw8n3huXZXDHQWhmkw2fAC
 6Tkk1Te63fiQsaDhSYtT16vLApd1eSld5Fg/MD/7kPgb6me46vV2F4pniF3utF48
 Xy+P5AEiMkajnkip6j80e9yiHor8bRh6MfTKRO+GbJcS05Rs42uUNZTZSQrV+pbs
 t6fml/k9H/pC95rABjHJmC9NMd0SOZz+xNRhC18PdnC7A17s4+e5eRyJ+VMcF9qL
 jJnIER084wgVnd3yaCai4xEOXKhWXTa7ctR74FxM1iIr8sFj1a0fYp8TAHJngS18
 rDDZ0FIL/dPCwU1CRfHF0bOUdYg5dAUxvraxINl0lL8obCshXIE=
 =jqbg
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - AMD: Clear S4 wake bits when firmware has _AEI, this is important for
   some AMD systems.

 - Do not accumulate sunxi npins across probe() attempts with deferred
   probe. (desc->npins just went ++ and ++...)

 - Qualcomm patch galore: split QUP functions on the Nord pin
   controller, fix an OF module alias on IPQ5210 so the module
   modprobes, fix two groups on the IPQ5018, make direction changes
   exclusive on the SPMI-GPIO, and fix the interrupt target width on
   four different SoCs.

* tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: sunxi: dt: do not accumulate npins across probe attempts
  pinctrl: amd: Clear S4 wake bits when firmware has _AEI
  pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
  pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions
  pinctrl: qcom: spmi-gpio: make direction changes exclusive
  pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
  pinctrl: qcom: qcs8300: Fix intr_target_width
  pinctrl: qcom: maili: Fix intr_target_width
  pinctrl: qcom: hawi: Fix intr_target_width
  pinctrl: qcom: nord: fix GPIO interrupt target width
  pinctrl: qcom: ipq5210: Publish the OF module alias
  pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions
 2026-10-16 08:21:06 -07:00
Linus Torvalds
7b441fe5a6 power sequencing fixes for v7.3 
- with the PCIe code reworked to power the endpoint via pwrctl before it
   starts the link training, we can now remove the workaround for WLAN
   power which instead started causing an issue with endpoint enumeration
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR5D4ACgkQBZ0uy/82
 hMOEaxAApBLm3IqWdD5Ll1u63o09TXi1+vhgrdu3OkDekzhuI3gGDU8zfKNNuFpf
 UNZbGcf2HNIz3mWaKMZflt9BPnA4z/ruFp7coWTL2ytpz65StOZ500BtfVv2+/bX
 bm07lojdDini1IT0gvKSy3QdW2ygvIXDe78AhWZWYybwnFN+HRoOIj8Dzg13lJAb
 B4JAckLJZT4XEs5UvxTt97gn0KRDsr91XNlF6ADVP17VKo5MloYgeUsczlidYdeg
 P3w7OWNuqdvCXD0OZBN8oggGiiFljm7OFqjvQMAOyuMQ/CYev6qWE2FWVhglTMNc
 Xnvu9aLz4yKlP6oTs1k9InPvbD5mhOYXwyckyg7+FpvQyehsSBZ2qv8JraD6gNVi
 gQiB0WG04khhvYhxG/OYNLY1vEWw1zcVSKSYmLzv3YV/geF/qkFZ1x+l0s4PoCez
 ShiFDNnn5tkxMATJn14t8lNzZkXoWZvVXaER06hjsR2MTjf1bJc6K5rerw47KG1y
 FKMvwrnc07zslnB8GksXIHMFe6GAbXzoWIUwlZzrzwZ3GXXsB6xNMaz9dnzlkPEc
 vSo8wUT6LBuV17/6fXZMr4kI2M4nI6wiiF78c+fP0jyKw33HI0s9ybRyMzCKFW6L
 n9BZ2EbOlHs/N66UCcZQZs2/4KiPAvG5+dBOIGxeYU4MOxkyVug=
 =SaiM
 -----END PGP SIGNATURE-----

Merge tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull power sequencing fix from Bartosz Golaszewski:

 - with the PCIe code reworked to power the endpoint via pwrctl before
   it starts the link training, we can now remove the workaround for
   WLAN power which instead started causing an issue with endpoint
   enumeration

* tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  power: sequencing: qcom-wcn: power off WLAN at probe
 2026-10-16 08:17:30 -07:00
Linus Torvalds
586a28a179 gpio fixes for v7.3 
- gracefully handle unsupported fwnode-only, no-device GPIO lookup for
   shared pins
 - mark the GPIO controller as sleeping in gpio-nct6694
 - fix a GPIO device reference leak in kunit tests
 - fix memory leak in error path in gpiod_set_array_value_complex()
 - fix races in GPIO controller and its associated irqchip setup in
   gpio-mxc
 - use atomic bitops where races can occur in gpio-mxc
 - fix build failure in gpio tools
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR4iEACgkQBZ0uy/82
 hMNndxAAmWw+V/POtQI8MUVVpp9vvmxSbBA+E//owQRKE8+67RR42pxvVyL1KDj1
 laLUX/ZEWSe4jfLwK11hSbqona3wcGTzgzNJIpDfix70QNwY2rKaJ9xx5xAF8+LJ
 v1do7Et54FYJyhhuoeMNgLvaULpSXw4Vg9FeO6yHlLdUmkbKRSEgxlBN2UZ70Wgb
 +7xeYgZpzN9OHQ/ldIsdsFwZTn8Zc7zx1a+dxlUy6OZ/ndXBBE5FOOOBCj97qCbN
 AdDhNuIxH72l9dMgGJ9uvgVYU0ZVFl6RXYG4XB239dVsX80ewDP/XolOJM9wlxVT
 p3i/zgv4SaTn8n/oKeUojvCNcR9dXrDouL/Fo2iRSEwwv87mVWyBMVAyWmTKAo9b
 tvi3F2cZeSLYrvf0ZKGz08BbOxtxToATWxHq303PYRExFWq1h5l9n5D0XairNZrZ
 cFeqP5rAOxWkB44aQRT1xU9LCZjYDO+LYYvevwfANrDseMpeJJmue/hBFPsIfWfs
 I2gWNpKC9cG1R5H/pNsEn9JqO7VwQCuYx6QswTIDUlE4Wca11qZcz3APeriDIO67
 PAHBOSm7jwKJ9nuXp9PfLYjqGss+uT1o6pYiJfYOA8PtvZofwqkeXvU0B8G2OIFt
 KxcvHDg+soCqpaoYOBJLNAnMlvaJLg6ABHHi4SLrjUxsY1SiTAQ=
 =ZNMF
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - gracefully handle unsupported fwnode-only, no-device GPIO lookup for
   shared pins

 - mark the GPIO controller as sleeping in gpio-nct6694

 - fix a GPIO device reference leak in kunit tests

 - fix memory leak in error path in gpiod_set_array_value_complex()

 - fix races in GPIO controller and its associated irqchip setup in
   gpio-mxc

 - use atomic bitops where races can occur in gpio-mxc

 - fix build failure in gpio tools

* tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: mxc: fix race between gpiochip registration and IRQ domain setup
  gpio: mxc: fix wakeup_pads bit operations
  gpio: mxc: fix both_edges bit operations
  gpio: mxc: fix race between chained IRQ handler install and probe completion
  gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
  gpio: kunit: fix GPIO device reference leak with __free()
  gpio: shared: gracefully handle no-device lookup of shared GPIOs
  gpio: shared: fix use-after-free bug when adding shared proxies
  tools: gpio: fix building from the top level with O=
  gpio: nct6694: Mark the GPIO controller as sleeping
 2026-10-16 08:14:37 -07:00
John Ogness
5f339c46f1 printk: Postpone kthread startup 
There have been various bug reports related to SMP systems hanging
on boot. The reports vary but seem to have some overlap with regard
to missed IPI's during SMP setup. The reports also show that
reverting NBCON console usage allows the bugs to disappear.

The NBCON kthreads for console printing are started very early
during boot using early_initcall(). Since these kthreads are
asynchronously enabling/disabling interrupts during early boot, they
may be interfering with early SMP setup on some hardware platforms.

Starting the console printing kthreads later has shown to avoid the
hanging on systems that could previously reproduce the issue.

Postpone kthread starting until after all arch initcalls have
completed.

Reported-by: Derek Barbosa <debarbos@redhat.com>
Closes: https://lore.kernel.org/linux-rt-users/arPmYPbFLf2EldIl@debarbos-thinkpadt14gen5.rmtusma.csb
Fixes: 76f258bf3f ("printk: nbcon: Introduce printer kthreads")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Tested-by: Derek Barbosa <debarbos@redhat.com>
Link: https://patch.msgid.link/20261016085441.857695-1-john.ogness@linutronix.de
Signed-off-by: Petr Mladek <pmladek@suse.com>
 2026-10-16 17:07:29 +02:00
Linus Torvalds
1dbb742205 vfs-7.3-rc8.fixes 
Please consider pulling these changes from the signed vfs-7.3-rc8.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc
 ooBKAQCaO0P/WCAUk+nHRuqKMT5Wjpcb+RKbZEDYxMt+JobeOwEAhx4ThOT8eOwX
 D2x/HjeOJ66fkbtFP1dXJzKaySf/PAs=
 =g2mr
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
   frees.

   Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
   and ->d_compare() read in rcu mode has to be freed after a grace
   period. umount(2) hides most of it because namespace_unlock() waits
   for one, but a chdir() out of a lazily unmounted directory or the
   close() of the last file on it drops the last reference without.

    * ext4_get_link() reads the sbi and the extent status counters for a
      symlink stored in a data block. Both are freed after a grace
      period now.

    * The unicode map of casefolded ext4, f2fs and tmpfs was freed under
      generic_ci_d_hash() and generic_ci_d_compare().

    * ntfs3 with nocase freed its sbi and mount options under its dentry
      hash and compare. A remount freed the old options right away too.

    * eventfs freed an eventfs_inode after an SRCU grace period only
      while tracefs_d_revalidate() reads it under rcu_read_lock().

    * afs and 9p are only saved by the grace period their private bdi
      gets in bdi_unregister(). They stop depending on it.

    * create_ipc_ns() leaked the mqueue mount and its superblock on a
      late failure. A long-term mount needs kern_unmount().

 - Don't let idle threads pin the initramfs.

   The idle threads of the secondary cpus are forked from PID 1 with a
   private copy of its fs_struct, aren't on the task list so
   pivot_root() never moves them and never exit. So the initramfs stayed
   pinned forever on every machine with more than one cpu, 70 to 150 MB
   in the reports. They share init_fs now like init_task does.

 - A mount that copy_tree() leaves out can't take over a lock.

   copy_tree() drops mounts of mount namespace files from the copies it
   makes for unshare(CLONE_NEWNS) and propagation without looking at
   MNT_LOCKED. So root in a user namespace could bind a child's
   /proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
   unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
   EPERM now and the move beneath a locked mount is refused up front.

 - Revert "namei: don't reveal overmounted entries in refwalk" from the
   rc7 fixes. The bug class is bigger than that patch.

 - namei: lookup_fast_for_open() checked ->d_inode while
   traverse_mounts() checks the type in d_flags, which is set second, so
   a refwalk racing the instantiation could fail an O_CREAT open with
   ENOENT. Use d_is_negative() in both places.

 - Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
   that mnt_get_count()'s own barrier made redundant.

 - fsnotify: a mark added while fsnotify_destroy_marks() walks the
   connector could be missed and the connector detached, so an fdinfo
   read called igrab(NULL). New marks are refused during teardown.

 - pipe: a failed second fasync enable on an O_RDWR FIFO removed the
   existing reader entry and cleared FASYNC while the writer entry
   stayed, a use-after-free in send_sigio() later.

 - watch_queue: post_one_notification() could see nr_notes before the
   note pool behind it and dereference a NULL array. An unprivileged
   user can trigger that with a key watch. Publish nr_notes last.

 - pid_namespace: zap_pid_ns_processes() waits without bound for a
   tracer outside the namespace to reap its zombies and neither wait was
   freezable, so every suspend attempt failed.

 - exit: is_child_subreaper and has_child_subreaper shared a word with
   other bitfields written without a common lock, so racing prctl()s
   lost a bit. They are separate bools now.

 - autofs: a notification write that failed on a pipe the daemon had
   already replaced put the superblock into catatonic mode again and
   closed the replacement. Only do that for the current pipe.

 - ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
   instead of a confusing ENOENT later.

 - ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
   the recovery participant list.

 - samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
   being built.

* tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  Revert "namei: don't reveal overmounted entries in refwalk"
  selftests/filesystems: test that a mntns file can't take over a lock
  fs: let idle threads share init_fs
  namespace: a mount that copy_tree() leaves out can't take over a lock
  namei: test for a negative dentry the way traverse_mounts() does
  fs: pass flags to copy_fs()
  ovl: reject lowerdir ending with unescaped backslash
  fsnotify: prevent mark additions during connector teardown
  pid_namespace: make zap_pid_ns_processes() freezable
  fs: drop the smp_mb()s that mnt_get_count() made redundant
  autofs: ignore notification errors from a replaced pipe
  ntfs3: free replaced mount options after a grace period
  ntfs3: free the sbi after a grace period
  unicode: free the map after a grace period
  ipc: drop the mqueue mount with kern_unmount() on setup failure
  eventfs: free the eventfs_inode after an rcu grace period too
  9p: free the session after a grace period
  watch_queue: Fix note pool publication race in watch_queue_set_size()
  afs: free the super info after a grace period
  pipe: preserve existing fasync readers on writer setup failure
  ...
 2026-10-16 07:53:16 -07:00
Darrick J. Wong
519abe8d9a MAINTAINERS: remove myself 
After 14 years at Oracle and 23 years working on Linux, I've decided to
step back for a while.

Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2026-10-16 07:50:11 -07:00
Toke Høiland-Jørgensen
90201351a8 wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" 
This reverts commit 93ce8ea704.

Mehmet reported that the offending commit breaks his AR9271 USB adapter
which uses zero-length replies to commands that don't return a value.
Revert the whole thing to restore the functionality.

Cc: stable@vger.kernel.org # the offending commit is in 6.12.113
Reported-by: Mehmet Fide <mehmet.fide@gmail.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2026-10-16 04:46:43 -07:00
Randy Dunlap
31fbbc8bb1
VFS: d_duplicate: repair comments to avoid kernel-doc warnings 
Use a typical list style for comments to prevent kernel-doc warnings:

Documentation/filesystems/api-summary:20: ../fs/dcache.c:2029: ERROR: Unexpected indentation. [docutils]
Documentation/filesystems/api-summary:20: ../fs/dcache.c:2030: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils]

Also, modify the spelling of "whiteout" to match all other uses in
the kernel source tree and to be consistent on the same line.

Fixes: 33d76519f0 ("VFS: add d_duplicate()")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20261001021745.2160005-1-rdunlap@infradead.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-16 11:14:51 +02:00
David Howells
b6134f7674
fscache, cachefiles: Fix resize handling 
Fix the resize handling in fscache and cachefiles by passing down a flag to
indicate if the file is being shrunk as the cache's idea of how big the
file should be may be stale and thus not useful in comparison to the
object's size.

The issue is that netfs_perform_write() updates the network filesystem's
file's i_size as it adds data to the pagecache, but the cache isn't updated
until writeback flushes that data.  A truncation may then scrap that data
and so the cache never sees it and doesn't update before it is told to
resize.  In the resize, cachefiles was comparing the new size against the
current cache size and then thinking the file was being expanded.

Note that this is a bit more complicated for ceph than other filesystems as
ceph splits the truncation of the local pagecache and fscache to after the
RPC reply handler has updated the inode record - the reply handler
communicates the need for the truncation finalisation through ceph inode
flags.

To this end, ceph is changed such that the outstanding truncation count in the
inode turns into a bool and just set instead of being incremented (the code
only cares if it's zero or non-zero) and then a second bool is added to record
if the file was being shrunk.

Reported-by: Marc Dionne <marc.dionne@auristor.com>
Fixes: 1a9fe4b6e787 ("cachefiles: Don't rely on backing fs storage map for most use cases")
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/1091807.1791483394@warthog.procyon.org.uk
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
cc: Ilya Dryomov <idryomov@gmail.com>
cc: Alex Markuze <amarkuze@redhat.com>
cc: Viacheslav Dubeyko <slava@dubeyko.com>
cc: Paulo Alcantara <pc@manguebit.org>
cc: Matthew Wilcox <willy@infradead.org>
cc: v9fs@lists.linux.dev
cc: linux-afs@lists.infradead.org
cc: ceph-devel@vger.kernel.org
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-16 11:02:26 +02:00
David Howells
9310c6d7cd
cachefiles: Fix unset error when calling netfs_prepare_write_failed() 
Fix cachefiles to set subreq->error before calling
netfs_prepare_write_failed() otherwise netfslib will try (and fail) to
retry the subrequest (it shouldn't retry writes to the cache, but rather
abandon them).  This causes it to hang waiting for the request to complete.

Reported-by: Marc Dionne <marc.dionne@auristor.com>
Fixes: 1a9fe4b6e787 ("cachefiles: Don't rely on backing fs storage map for most use cases")
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/3227746.1790772118@warthog.procyon.org.uk
Tested-by: Marc Dionne <marc.dionne@auristor.com>
cc: Paulo Alcantara <pc@manguebit.org>
cc: Matthew Wilcox <willy@infradead.org>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-16 11:02:25 +02:00