Commit Graph

85966 Commits

Author SHA1 Message Date
Tao Cui
6586705bc2 docs/sched_ext: document that cgroup CPU knobs are scheduler-dependent
The scheduler core communicates the initial cpu controller settings
to the BPF scheduler through ops.cgroup_init() and reports subsequent
changes through the corresponding ops.cgroup_set_*() callbacks.
Whether and how a knob takes effect is up to the loaded scheduler:
it may implement the corresponding callback partially or not at all,
so cpu.max, cpu.weight and friends can silently have no effect.

Document this in the basics section of sched-ext.rst.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-24 07:05:33 -10:00
Liang Luo
72c5ae18eb Docs/admin-guide/cgroup-v2: document BPF scheduler callbacks for cpu.max and cpu.idle
The cpu.weight and cpu.weight.nice entries already state that the files
also affect a BPF scheduler through the cgroup_set_weight callback.
However, cpu.max, cpu.max.burst and cpu.idle only mention the fair-class
scheduler, even though sched_ext implements the cgroup_set_bandwidth
(notified with the period/quota from cpu.max and the burst from
cpu.max.burst) and cgroup_set_idle callbacks from these interfaces.

Mirror the cpu.weight wording for the three entries and generalize the
category preamble to refer to the corresponding cgroup_set_* callback so
it keeps covering the entries below.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Liang Luo <luoliang@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-20 07:45:22 -10:00
Liang Luo
4fb8d6379d sched_ext: Fix nonexistent field in sched-ext.rst example
The ops.exit() example in sched-ext.rst reads ei->type, but
struct scx_exit_info has never had a type field - the exit reason is
exposed as ei->kind since the struct was introduced. A scheduler
written following the example fails to compile with

    error: no member named 'type' in 'struct scx_exit_info'

Use ei->kind.

Fixes: fa48e8d2c7 ("sched_ext: Documentation: scheduler: Document extensible scheduler class")
Signed-off-by: Liang Luo <luoliang@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-19 10:04:11 -10:00
Tejun Heo
fab183d632 sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3
Pull to receive the __arena argument conversion:

 67f1f4a48c ("sched_ext: Pass kernel arena pointers to ops_cid callbacks")
 a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")
 a05c5b5cb5 ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments")

along with the bpf-next branch carrying the __arena argument support they
depend on.

Conflict in kernel/sched/ext/ext.c between:

 c384ab8a0b ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c")

and:

 a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")

which updated the stubs in their old ext.c location. Resolved by keeping
ext.c without the stubs and applying the prototype conversion to the
relocated stubs in sub.c.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-17 11:20:34 -10:00
Tao Cui
273ce3b12f Documentation: sched_ext: fix events sysfs path and show_state example
The events file is under the scheduler's sysfs kobject
(/sys/kernel/sched_ext/root/events for the root scheduler), not the
nonexistent "<scheduler-name>/events" path. Also add the missing "aborting"
line to the scx_show_state.py example.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 09:10:03 -10:00
Tejun Heo
872a8f6b08 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-args
Pull bpf-next d114bb9893 ("Merge branch
'add-arena-argument-support-to-kfuncs-and-struct_ops'") to make the __arena
and __arena__nullable kfunc and struct_ops argument suffixes available. The
suffixed arguments will be used to convert sched_ext kfuncs and struct_ops
callbacks that currently pass arena pointers as scalars and rebase them by
hand.
2026-08-10 12:38:03 -10:00
Tejun Heo
f6c33c4479 bpf: Support __arena and __arena__nullable on struct_ops arguments
A struct_ops callback cannot receive an arena pointer directly, so
passing one takes two steps. The pointer arrives as a bare u64 that the
callback casts, and because the two sides address the arena through
different bases it also has to be rebased by hand on the way in.

Add the __arena and __arena__nullable stub argument suffixes to make this
convenient. The callback declares the parameter as an arena pointer,
receives it as a PTR_TO_ARENA register, and dereferences it directly,
while the kernel caller just passes the natural kernel arena address
(kaddr). The trampoline converts the value while saving the arguments
into the BPF ctx, ctx[slot] = (u32)(kaddr - kern_vm_start), so the
program never sees a kernel address and nothing rewrites the ctx after
the fact. The converted value keeps the upper 32 bits clear as the JITs
require of arena pointer registers and behaves like any cast_kern'ed
arena pointer, so cast_user recovers the full user-visible address.

__arena converts unconditionally and the kernel caller must not pass
NULL. __arena__nullable preserves NULL, tested on the full 64-bit kernel
pointer, and surfaces to the verifier as PTR_TO_ARENA (but not as a
PTR_TO_ARENA | PTR_MAYBE_NULL). The reason is that PTR_TO_ARENA in the
program's type state already encompasses NULL-ness, so it is not
meaningful to force a NULL check for the program.

The composite suffix intentionally ends in __nullable. Classify
__arena__nullable before the generic suffix so scalar arena pointees do
not take the generic nullable BTF pointer path.

This patch adds the generic side. prepare_arg_info() records arena and
nullable argument flags in the struct_ops function model, and
bpf_tramp_arena_base() returns the arena base for a single-program
struct_ops indirect trampoline. Only that trampoline converts: its
program's arena is fixed at generation time. Generic trampolines can mix
programs with different arenas and reject arena context arguments
defensively, which is unreachable today as only struct_ops programs
carry them. Architectures that do not implement the conversion are
gated out at verification time with bpf_jit_supports_arena_args().

Co-developed-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-6-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Tejun Heo
252d367163 bpf: Support __arena and __arena__nullable kfunc argument suffixes
Passing an arena pointer to a kfunc takes two steps today. There is no
arena pointer argument type, so the pointer crosses the boundary as a
bare scalar, and the kfunc then offsets it by the arena base and casts
it before it can touch the memory. Every such kfunc open-codes the same
translation.

Add the __arena and __arena__nullable argument suffixes to make this more
convenient. The kfunc declares the parameter by its real pointer type
and dereferences it directly, with the JIT rebasing the value at the
call site, rN = kern_vm_start + (u32)rN. No bounds check is needed: the
u32 offset stays within the guard-padded arena kernel mapping, and a
fault on an unpopulated page recovers through the per-arena scratch
page. A suffixed argument accepts a PTR_TO_ARENA or scalar register,
matching global subprog arena arguments.

__arena rebases unconditionally, so the kfunc never sees NULL and a
value with zero in the low 32 bits arrives as the arena base.
__arena__nullable preserves NULL for optional arguments by skipping the
rebase when the truncated value, arena offset 0, is zero. Keeping the
plain form NULL-free saves the NULL test on every call.

The double separator makes the annotations composable:
__arena__nullable also ends in __nullable and naturally follows the
common nullable argument path. Plain __arena follows that path too for
verifier type checking because both forms accept a constant zero; the
function-model flag still determines whether the JIT preserves NULL or
rebases it to the arena base.

This patch adds the verifier side: the suffixes are recognized in
check_kfunc_args() and distilled into argument flags in the function
model stored in the kfunc descriptor. JITs retrieve the model while
emitting the call, avoiding per-call state in insn_aux_data.

JITs declare support with bpf_jit_supports_arena_args() and verification
fails with -ENOTSUPP elsewhere.

Co-developed-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-5-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Daniel Borkmann
e1d9b82db5 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7
Cross-merge BPF and other fixes after downstream PR.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2026-08-07 23:04:17 +02:00
Ihor Solodrai
fd5425b673 docs, resolve_btfids: Document kfunc BTF annotation emission
resolve_btfids now emits the bpf_kfunc and bpf_fastcall BTF decl tags and
the arena address_space(1) type attribute for kfuncs, which were
previously produced by pahole.

Reflect this in the in-tree comments and documentation.

Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://patch.msgid.link/20260807032029.78092-7-ihor.solodrai@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-06 22:01:28 -07:00
Linus Torvalds
315f4bd234 Including fixes from netfilter.
Looks like our attempt to keep the PRs smaller have only prevented
 this one from getting even bigger. In the last 9 days there were
 405 postings explicitly tagged with [PATCH net], vs 687
 with [PATCH net-next]. 37% of posted patches being fixes is pretty
 crazy, and that's likely undercounting because LLM "researchers"
 more often post fixes without knowing to tag the patches for specific
 trees. I don't have historic data.
 
 In any case, we keep adjusting the criteria. The next PR will be smaller.
 
 Current release - regressions:
 
  - net: defer netdev KOBJ_ADD uevent until the device is published,
    previously rtnl_lock would serialize the accesses vs publishing
 
  - net: explicitly cancel work to avoid races with ref tracker exit
 
  - qrtr: ns: raise lookup limit to 128
 
  - eth: hns3: fix speed configuration residue after driver reload
 
 Previous releases - regressions:
 
  - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(),
    regressed flows with MSS and scaling_ratio variability
 
  - Revert "net: thunderbolt: Enable end-to-end flow control also
    in transmit", broke some platforms (no packets coming thru)
 
  - eth: stmmac: resume PHY before hardware setup when opening
    the interface
 
 Previous releases - always broken:
 
  - another pile of fixes for less common protocols (SCTP, TLS, SMC etc.)
 
  - close a couple of AF_PACKET bugs and ways it can build skbs
    problematic for the rest of the stack
 
  - bridge: mrp: fix uninitialised bytes on the wire
 
  - net: devmem: prevent net-iov / page mixing, avoid crashes
 
  - eth: atlantic: free RX pages of consumed but not refilled buffers
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmp0z8gACgkQMUZtbf5S
 Irs6QQ//cpHnTe8YpK7XTLak9zsKXep0ObNybwFeGVtO9ZwpIvUJnW0+DQQOto/f
 iaWJd+6kqXo4nOBvJMdMm+xT/xLVVFPscAfnOhi7P4FsHPFecGxP4lsN+Gtn1afL
 bgJ92IUTPfM0LZ5vvOxCIFPsUpNvtm0MNk/AacRKedUJf5JrelkHYKBIz8qNCEOR
 jwdrlrhUMhAozWX1SmPXO9Hx1cKhx5g5CuZ2vDWkca5ofWkOsUb7sXdC/jdMYsFx
 j0JchO8D54Ej5SrO/0z8tojRfPWgmfTlCr3kARu0b70KCV1p2Ep8HnGVGEmMLZGQ
 dvTBB4MzLfCZuakC9yNwSLh4nA1ShOvMj02vxgN61vlFiKKhIFWkeW/EtfGx2E9s
 XStCg+X1FY0r49oKPu7oF7oUQFRP4QGWNpWP1opVEeOsWNRYgu2ZXmvaHD4862K/
 ZylNHnHOu+3Ig+xc+BWFS0T2yi20tGa3LHJgDO3uGwMVlGKKh7tcF0RoyQlalzZg
 RNI8T7u6EJFCaJHTToBK/O1ImroiaBBgTCrxHqEWbP6S7Gkx51UHP7sp2Ggp3n0+
 pYIQGxWogAtkkNHtap4p6WuCmlMacH/CX32Nwl0v0tjEePxoyRSSc8HlbqSX1Ylv
 tJJJJ7t58PS2G4KGhw5H1WGggDuVCcFrwW1bSzHHO+qcz5MoDug=
 =wJxf
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter.

  Looks like our attempt to keep the PRs smaller have only prevented
  this one from getting even bigger. In the last 9 days there were
  405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH
  net-next]. 37% of posted patches being fixes is pretty crazy, and
  that's likely undercounting because LLM "researchers" more often post
  fixes without knowing to tag the patches for specific trees. I don't
  have historic data.

  In any case, we keep adjusting the criteria. The next PR will be
  smaller.

  Current release - regressions:

   - net: defer netdev KOBJ_ADD uevent until the device is published,
     previously rtnl_lock would serialize the accesses vs publishing

   - net: explicitly cancel work to avoid races with ref tracker exit

   - qrtr: ns: raise lookup limit to 128

   - eth: hns3: fix speed configuration residue after driver reload

  Previous releases - regressions:

   - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed
     flows with MSS and scaling_ratio variability

   - Revert "net: thunderbolt: Enable end-to-end flow control also in
     transmit", broke some platforms (no packets coming thru)

   - eth: stmmac: resume PHY before hardware setup when opening the
     interface

  Previous releases - always broken:

   - another pile of fixes for less common protocols (SCTP, TLS, SMC
     etc.)

   - close a couple of AF_PACKET bugs and ways it can build skbs
     problematic for the rest of the stack

   - bridge: mrp: fix uninitialised bytes on the wire

   - net: devmem: prevent net-iov / page mixing, avoid crashes

   - eth: atlantic: free RX pages of consumed but not refilled buffers"

* tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits)
  igc: fix netdev not re-attached after resume if interface is down
  tls: don't abort the connection on signal-interrupted sends
  net: avoid theoretical races with ref drain
  net: Defer netdev KOBJ_ADD uevent until the device is published
  MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
  sctp: clear control chunk transport if it is being removed
  net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
  s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
  packet: use consistent hard_header_len in TX_RING send path
  packet: use consistent hard_header_len in non-ring send paths
  net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
  bnge: Fix resource leak in bnge_init_nic() error path
  ptp: ocp: Fix board ID over-read
  tls: rx: restore msg_iter before TLS 1.3 optimistic retry
  selftests: tls: add a test for splicing onto a full plaintext record
  tls: don't leave a full plaintext sk_msg ring unpushed
  xdp: reject clones that overrun skb_shared_info tailroom
  mptcp: reclaim forward-allocated memory on RX path errors
  mptcp: fastopen: only mark MPTFO subflows with SYN data
  mptcp: pm: fix memory leak from alloc-during-teardown race
  ...
2026-08-06 11:39:20 -07:00
Jakub Kicinski
e31420642d Included fixes:
* use rcu_dereference_bh() instead of rcu_access_pointer() where the
   pointer is actually dereferenced
 * ensure TCP global variables are initialized before they can be
   accessed via netlink (e.g. when attaching a TCP socket)
 * actually disable IPv4 redirects on multipeer interfaces (the
   previous attempt was a no-op and did not survive netns moves)
 * hash a floated peer by its transport identity only, consistently
   with the add and lookup paths
 * zero the sockaddr padding before learning a floated endpoint so it
   does not leak into the by_transp_addr hash key
 * ensure the socket is owned by ovpn before dereferencing
   sk_user_data
 * rehash a peer in the by_transp_addr table when its remote endpoint
   is updated via CMD_PEER_SET
 * avoid re-adding to the hashtables a peer that was concurrently
   removed (use-after-free)
 * limit keepalive values to one day to avoid overflowing the
   delayed-work delay on 32-bit systems
 * add the missing rtnl_link_ops->get_size callback so link messages
   account for the nested mode attribute
 -----BEGIN PGP SIGNATURE-----
 
 iJEEABYIADkWIQQr0db7q+Rc7Zog28Fc8QQzwdnOtwUCamsZiRsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQXPEEM8HZzrdjhQD/SJjvWsxHurn7vQJ8VFw9
 wb8Q06TpSjdHkd5xXpQzohoA/joMlAYnVhSlYDcDaF3DCzmCAW6fG/bpPoI4bpFj
 i8UD
 =Oppi
 -----END PGP SIGNATURE-----

Merge tag 'ovpn-net-20260730' of https://github.com/OpenVPN/ovpn-net-next

Antonio Quartulli says:

====================
Included fixes:

* use rcu_dereference_bh() instead of rcu_access_pointer() where the
  pointer is actually dereferenced
* ensure TCP global variables are initialized before they can be
  accessed via netlink (e.g. when attaching a TCP socket)
* actually disable IPv4 redirects on multipeer interfaces (the
  previous attempt was a no-op and did not survive netns moves)
* hash a floated peer by its transport identity only, consistently
  with the add and lookup paths
* zero the sockaddr padding before learning a floated endpoint so it
  does not leak into the by_transp_addr hash key
* ensure the socket is owned by ovpn before dereferencing
  sk_user_data
* rehash a peer in the by_transp_addr table when its remote endpoint
  is updated via CMD_PEER_SET
* avoid re-adding to the hashtables a peer that was concurrently
  removed (use-after-free)
* limit keepalive values to one day to avoid overflowing the
  delayed-work delay on 32-bit systems
* add the missing rtnl_link_ops->get_size callback so link messages
  account for the nested mode attribute

* tag 'ovpn-net-20260730' of https://github.com/OpenVPN/ovpn-net-next:
  ovpn: fix incorrect use of rcu_access_pointer()
  ovpn: ensure TCP vars are initialized first
  ovpn: disable IPv4 redirects on MP interfaces
  ovpn: hash floated peer by transport identity only
  ovpn: zero-initialize sockaddr before learning a floated endpoint
  ovpn: ensure socket is owned by ovpn before deref sk_user_data
  ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
  ovpn: skip rehash for peers already removed from by_id
  ovpn: limit keepalive values to one day
  ovpn: add missing rtnl_link_ops->get_size callback
====================

Link: https://patch.msgid.link/20260730094624.4102963-1-antonio@openvpn.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04 17:32:37 -07:00
Linus Torvalds
35e66f03de cgroup: Fixes for v7.2-rc6
- A pressure trigger's poll timer could be re-armed while the last trigger
   was being torn down and then fire after the cgroup was freed. Tie the
   timer to the cgroup's lifetime and shut it down when the cgroup is freed.
 
 - Writing to a pressure file forked a worker kthread while holding the
   cgroup mutex, creating lock dependencies from the mutex to the whole fork
   path. A pressure write racing a sched_ext scheduler enable, which blocks
   forks before grabbing the mutex, deadlocked. Fork the worker with the
   mutex dropped.
 
 - Documentation fix for io.latency behavior on non-rotational devices.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCam/mlw4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGVhRAQCyNBHCHpaY9erKTezenGDK6D+LqbfLWiWuIntB
 swiwLQEA6h6Rgob2GDDRHOey7+XwF6PHh6xoh4FhSYboeEZd1wc=
 =Re+7
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:

 - A pressure trigger's poll timer could be re-armed while the last
   trigger was being torn down and then fire after the cgroup was freed.

   Tie the timer to the cgroup's lifetime and shut it down when the
   cgroup is freed.

 - Writing to a pressure file forked a worker kthread while holding the
   cgroup mutex, creating lock dependencies from the mutex to the whole
   fork path. A pressure write racing a sched_ext scheduler enable,
   which blocks forks before grabbing the mutex, deadlocked.

   Fork the worker with the mutex dropped.

 - Documentation fix for io.latency behavior on non-rotational devices.

* tag 'cgroup-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  Docs/admin-guide/cgroup-v2: document io.latency rotational vs non-rotational behavior
  sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
  sched/psi: Create the psimon kthread outside of cgroup_mutex
2026-08-03 08:28:01 -07:00
Amery Hung
c82b998777
bpf: Split kfunc map argument into __const_map and __map
Kfuncs used a single '__map' suffix (KF_ARG_PTR_TO_MAP) for two different
things: a verifier-known map matched by map_uid against a bound
timer/wq/task_work object (bpf_wq_init, bpf_task_work_schedule*), and an
opaque 'struct bpf_map *' used only at runtime (bpf_arena_*), which may be a
map fd or a PTR_TO_BTF_ID struct bpf_map (e.g. a bpf_map iterator's ctx->map).

That combined path only accepted the btf map form due to type confusion. The
'if (!reg->map_ptr)' check reads reg->map_ptr, which aliases reg->btf in the
bpf_reg_state union. A PTR_TO_BTF_ID register always has a non-NULL reg->btf,
so the guard silently passed and validation fell through to
process_kf_arg_ptr_to_btf_id(). It also recorded PTR_TO_BTF_ID info in
meta->map, which would be meaningless.

Split the annotation to avoid such type confusion and to align with
helper:

- '__const_map' -> KF_ARG_CONST_MAP_PTR: verifier-known map, handled by
  process_map_ptr_arg() like helper ARG_CONST_MAP_PTR.

- '__map' -> KF_ARG_PTR_TO_BTF_ID: opaque struct bpf_map, validated by
  process_kf_arg_ptr_to_btf_id(). A map fd still matches via
  reg2btf_ids[CONST_PTR_TO_MAP], so bpf_arena_alloc_pages(&map) keeps
  working.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260801074633.1595644-4-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-03 00:29:11 +02:00
Tao Cui
2fd9b4cfce Docs/admin-guide/cgroup-v2: document io.latency rotational vs non-rotational behavior
io.latency is documented only in terms of average latency and the avg_lat
stat, which matches rotational devices.  On non-rotational devices a group
misses its target once enough of the IOs in the window individually exceed
it, and io.stat reports missed/total rather than avg_lat/win.

Describe both cases: how a miss is detected, note that the avg_lat tuning
guidance is rotational-only, and update the io.stat field list (mark
avg_lat/win as rotational-only, document missed/total).

Acked-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-02 11:29:33 -10:00
Linus Torvalds
a84c804215 SCSI fixes on 20260802
No core changes.  The largest driver fix is the reversion of threaded
 interrupt handlers in UFS and the next is the resume deadlock fix in
 hisi_sas which extends into libsas.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCam86+xsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIVcnwD/QWD/DCvLd533SY0vE2fZYVYnUVi3uzAy
 OGkbmxKtCSABAO/djRxNN1CTDtVXnhUhp/VLn0niXfy4jLmCkoWpnD2N
 =ERuj
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley"
 "No core changes. The largest driver fix is the reversion of threaded
  interrupt handlers in UFS and the next is the resume deadlock fix in
  hisi_sas which extends into libsas"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
  scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
  scsi: target: Clear cmd_cnt when initial counter enrollment fails
  scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  scsi: ufs: core: Cancel RTC work in active-active suspend
  scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
  scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
2026-08-02 09:32:07 -07:00
Linus Torvalds
c5d3fe9d25 sound fixes for 7.2-rc6
A collection of sound fixes for the 7.2-rc6 cycle.  Again, it became
 far larger than wished; I'll throttle from now on.
 
 There are no major changes, just a normal flow of small fixes.
 The majority of them are device-specific quirks and ASoC SDCA/codec
 updates, but it includes a few ALSA core fixes as well.
 
 ALSA Core:
 - Fix for ALSA sequencer timer division-by-zero
 - Fix potential race in ALSA timer core
 - Wake up linked drain waiters on PCM stream unlink
 - Fix double-free of converter objects on UMP rawmidi error path
 
 USB-audio:
 - Fix a few potential out-of-bounds access bugs
 - Prevent stack info leak in RME Digiface status
 - Fix UAF during UMP endpoint destruction
 - Fix UAF at error handling during probe in Line6 6fire driver
 - Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4,
   JKY Technology, and generic USB headphones
 
 HD-audio:
 - Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP
   Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and
   HP Pavilion All-in-One
 
 ASoC:
 - Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers
 - DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI
   Crosshair A16, and ASUS ExpertBook
 - ACPI match table entry for SOF RT5682 on Intel Nova Lake
 - Device-specific mixer / clock, irq fixes for TI TAS2562, TI TAS2781,
   Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC and Realtek
   RT5640
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmprXj0OHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/G4hAApuJ3FolNsTbzn3POYf/gFFngvfCNLnZPQumi
 XTMDq/G1tgRBHHFpKvkadWmqB/8MnxhfofKycIfQIAwzs6zIAz8ED/p1MXL/pPj7
 A7Mrn6pb583TXMeo9tt+8UTOGGECDNswUoaYfpObFBeqdGKWZdx51bpZz9KzBNee
 KAfbbijvleRJpHHumP0rPL/qMGazhlA8rBCIqWYcp+YBNLXPnEYbF4wq2hjP06Fo
 X9vNaBAuwuPAxjFVg+2LtaEQt4fAD+xOPSRlhlnPUPrmUKIe4kVTY5JYU9CW8Ywo
 8M+U3Z/gqw37Lkko/ctu6CZrgzvmsNQWjGzFmen2I0viCGklZtJrOPTGMdu3L13o
 tVoQ+nK5Pofjgk3ik5qxXu+kdZVDbSbvhQiRW50JAmhD/pLNRQxy1M6WZcS5RvDa
 6AnK0sTB6nlNVd+rfXRf6lbnOyk4JI10WEXb6eWyh1PvaGcOQm3D1Sq9sq7e+1se
 YWZJQsutOYv5wk+bnpfZMm+uhm3t61ibZYubz4nYqPDuC+yt3ZVSdDU3iIFTZwQ1
 oHAdWYbgSNd2OAVghjzomsPL+099HDgAk1uYUrIPtb2Q+pHQ8wIYSXKpGarPA5Kp
 pDnKcjfV80CT8hMGD00zOhgYXMnWNZmOPXQMq7jNaiDQPH+07Yo8tVhgg7HUxlXe
 i4oMZEk=
 =nkW9
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of sound fixes for the 7.2-rc6 cycle. Again, it became
  far larger than wished; I'll throttle from now on.

  There are no major changes, just a normal flow of small fixes. The
  majority of them are device-specific quirks and ASoC SDCA/codec
  updates, but it includes a few ALSA core fixes as well.

  ALSA Core:
   - Fix for ALSA sequencer timer division-by-zero
   - Fix potential race in ALSA timer core
   - Wake up linked drain waiters on PCM stream unlink
   - Fix double-free of converter objects on UMP rawmidi error path

  USB-audio:
   - Fix a few potential out-of-bounds access bugs
   - Prevent stack info leak in RME Digiface status
   - Fix UAF during UMP endpoint destruction
   - Fix UAF at error handling during probe in Line6 6fire driver
   - Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4,
     JKY Technology, and generic USB headphones

  HD-audio:
   - Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP
     Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and
     HP Pavilion All-in-One

  ASoC:
   - Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers
   - DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI
     Crosshair A16, and ASUS ExpertBook
   - ACPI match table entry for SOF RT5682 on Intel Nova Lake
   - Device-specific mixer / clock, irq fixes for TI TAS2562, TI
     TAS2781, Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC
     and Realtek RT5640"

* tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
  ASoC: rt722: reset codec to fix abnormal sound
  ASoC: dt-bindings: realtek,rt5640: Make interrupts optional
  ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
  ALSA: usb-audio: Add GET_SAMPLE_RATE quirk for C-Media CM6206
  ALSA: usb-audio: Clamp frame size in implicit-feedback mode
  ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
  ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
  ALSA: pcm: wake linked drain waiters on unlink
  ASoC: amd: acp: Add DMI quirk for Lenovo Legion 7 15ASH11
  ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
  ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
  ASoC: SDCA: Move kcontrol search out of IRQ
  ASoC: SDCA: Switch to fixup_controls callback for IRQ registration
  ASoC: Add a component fixup_controls callback
  ASoC: SDCA: Populate IRQ data earlier
  ASoC: SDCA: Remove devm from primary IRQ cleanup
  ASoC: SDCA: Add sdca_irq_cleanup_late()
  ASoC: SDCA: Rename sdca_irq_allocate() to include devm
  ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
  ALSA:hda/realtek:ALC269 fixup for Legion 7 15ASH11 Mic Mute LED
  ...
2026-07-31 09:32:39 -07:00
Linus Torvalds
a11f030c83 Power Supply Fixes for 7.2 cycle
* Documentation build fix for bd71828
 * max17040: handle missing status supplier
 * macsmc: Support macOS 27 SMC firmware
 * bq25890: fix the -10 C NTC lookup entry
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmpr0SAACgkQ2O7X88g7
 +prOoRAAgASEjdh5CoNT1PKA7rY8ER+u8mPaO4cQlPIzYC9Hw9S4H3E4/TKcm7DW
 fd7+w9cdLPrS3rRT/vqoofuIcdhtj0v9A6vd1lHi29njfwvj0DNvMu5Y1AludvOj
 P5rpSfgBM0pwMh/N58Y7alDnTy7q7v/ODA5MzsGGQy2MRPgWskozZdluuKL0C1ii
 vh+GWY2ua7CVKRLeH4IilVWWIzzLh2Fb0k1+FzgX+liOwmEvS56KQ3KOh0HXFxXX
 PTCD83WYIujuO9Sg7zQMm0uuxKXqXMhbtMjGsEdDPlHfc63ozYmycBdcev2pI7zL
 ERY0rkQ907y+9mRf7/EunLn8J2EUPd+Ilk5zQydgSFFpuz8/KXkRnwBds61Sl8KY
 n0WeF/r1UIgPikrCMnLWoEKqOYlm9MH+5OY6Aw49593eOR1D1Youc/GIUTILkjwV
 lyLcEkbJvF9I8eq4MPE4kJlX+lfEOM2Y+9UxU/ljGZneO37UGvPz6mAZAjSsdxlK
 qECboK4XRU6ZQmLJjFgV6sXMzxeRSXmzNRUIOSW6jdnnX/PLgKPUTZVJiKVEMcUJ
 yd3z8l7RsQSYLwpk09aaXFJbzadVqUFk4rvs4gtJETWVjbhS74fqlg443eTxQPRW
 AGVhDsLA/bD34YyEe5D4FBFIIgJp9Y+CXr7oboCzLDCsYEjopMU=
 =avMt
 -----END PGP SIGNATURE-----

Merge tag 'for-v7.2-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply

Pull power supply fixes from Sebastian Reichel:

 - Documentation build fix for bd71828

 - max17040: handle missing status supplier

 - macsmc: Support macOS 27 SMC firmware

 - bq25890: fix the -10 C NTC lookup entry

* tag 'for-v7.2-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply:
  power: supply: bq25890: fix the -10 C NTC lookup entry
  power: supply: macsmc: Support macOS 27 SMC firmware
  power: supply: max17040: handle missing status supplier
  power: supply: bd71828: add a terminating table border
2026-07-30 16:50:17 -07:00
Linus Torvalds
2812e64e15 This is again larger than usual: the backlog accumulated in the past weeks
is not done yet. I'm not aware of any known pending regression.
 
 Including fixes from netfilter, Bluetooth, WiFi and CAN.
 
 Current release - regressions:
 
   - eth: tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is present
 
   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync
 
   - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
 
 Previous releases - regressions:
 
   - core: do not send ICMP/NDISC Redirects when peer allocation fails
 
   - ipv6: take nexthop lock for f6i_list walks in replace check and notify
 
   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.
 
   - netfilter: nf_tables: make nft_object rhltable per table
 
   - af_unix: fix listen() succeeding on sockets in the wrong state
 
   - openvswitch: fix potential UAF on meter attach failure
 
   - bluetooth:
     - fix advertising data UAFs
     - avoid deadlocks in iso_sock_timeout
 
   - smc: fix socket use-after-free during link group termination
 
   - dpll: use pin owner's dpll ref for pin-level attribute reporting
 
   - eth: veth: convert frag_list skbs before running XDP
 
   - eth: ice: wait for reset completion in ice_resume()
 
   - eth: igc: remove napi_synchronize() in igc_down()
 
   - eth: vxlan: use pskb_network_may_pull() for transmit path header pulls
 
 Previous releases - always broken:
 
   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim
 
   - psp: fix NULL genl_sock deref race with concurrent netns teardown
 
   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()
 
   - can: peak_usb: fix double free of transfer buffer on URB submit error
 
   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
 
   - sctp: prevent peer transport count overflow
 
   - eth: idpf: bound interrupt-vector register fill to the allocated array
 
   - dsa: mt7530: error out on failed reads in MT7531 PHY polling
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmprXncSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOk1gIP/RUp/tHQX75kgUHHmWJTajPJA9tRjRVn
 7Ke6pr0Os4xmMP3ZsC6xo/se2fe1fOmoNoNpK9TdTThzp+AiBov/Vqdyxnlks06f
 9Y0L3JvffKJEJ8C2NhhKBZdIt0rFtED4PiqOxmht9NpQgNLeJpJSzg9ItPdgjG9S
 De5VNqbq3vFMPEF2AeAA6I8fUPwxneziGUxDHFJ0oarpkxUyQnv1vKAeDHFB1BGs
 IA04yVcqKmL9k/yY/rS0Lj4j568a5qygDnXikRwqFnrvOumqDn0DtAMDXaDgj9b1
 S0tQaFW6vAaA2fbxUlrkiaOpNrts1W0c1XtnMJcs5suU9CsJpyw3/QDYHA0QXSac
 fNVP9aqaPLEMw+84NMavpgdnW6l0jFY070SJ+WK3kXNwWSv+D1tumQgzqYo59Lut
 HDbu24TVJmLi+m6wrUBPLN4wHzpyBf7f3HOu+LARbPgK08J0JfiwPNgb2IUJEfE5
 czMc0Dy21JLR3C1uVrHKY3EeSodz7mcCKKAl+Cpbl83xkQjmCu+OJlJm18I5+oAI
 nTLO65RAKq0XvLEt1xHl0s1pp7fAJNWHVu167GdWS7l1AvbqtLeqz7VsPCN+Qj5+
 07YP+e7XRy3ODVTOl+XrwVK44Qd12ZXq/fTAm0ABULSMvRINOai6gy7I2aLx/sqK
 0xP7ex1tCG2I
 =jLD8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "This is again larger than usual: the backlog accumulated in the past weeks
  is not done yet. I'm not aware of any known pending regression.

  Including fixes from netfilter, Bluetooth, WiFi and CAN.

  Current release - regressions:

   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync

   - can: isotp: fix timer drain order, wakeup handling and tx_gen
     ordering

   - eth:
       - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is
         present

  Previous releases - regressions:

   - core: do not send ICMP/NDISC Redirects when peer allocation fails

   - ipv6: take nexthop lock for f6i_list walks in replace check and
     notify

   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.

   - netfilter: nf_tables: make nft_object rhltable per table

   - af_unix: fix listen() succeeding on sockets in the wrong state

   - openvswitch: fix potential UAF on meter attach failure

   - bluetooth:
       - fix advertising data UAFs
       - avoid deadlocks in iso_sock_timeout

   - smc: fix socket use-after-free during link group termination

   - dpll: use pin owner's dpll ref for pin-level attribute reporting

   - eth:
       - veth: convert frag_list skbs before running XDP
       - ice: wait for reset completion in ice_resume()
       - igc: remove napi_synchronize() in igc_down()
       - vxlan: use pskb_network_may_pull() for transmit path header pulls

  Previous releases - always broken:

   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim

   - psp: fix NULL genl_sock deref race with concurrent netns teardown

   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()

   - can: peak_usb: fix double free of transfer buffer on URB submit error

   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

   - sctp: prevent peer transport count overflow

   - dsa: mt7530: error out on failed reads in MT7531 PHY polling

   - eth:
       - idpf: bound interrupt-vector register fill to the allocated array"

* tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits)
  qede: sync udp_tunnel ports outside qede_lock in the recovery path
  net: openvswitch: fix potential UAF on meter attach failure
  octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  net: dsa: realtek: use devm_mutex_init for l2_lock
  net: dsa: realtek: use devm_mutex_init for vlan_lock
  net: dsa: realtek: use devm_mutex_init for regmap lock
  net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock
  ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  net: mana: Return error code from mana_create_rxq()
  net: openvswitch: fix skb leak on flow key update failure during ct
  net: openvswitch: fix skb leak on flow key update failure during recirculation
  net: stmmac: Fix E2E delay mechanism
  net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
  net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"
  Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"
  Revert "ptr_ring: move free-space check into separate helper"
  Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present"
  ...
2026-07-30 09:18:49 -07:00
Marco Baffo
935dc3bb20 ovpn: limit keepalive values to one day
Large keepalive values can overflow the delayed-work delay on 32-bit
systems, causing the keepalive worker to be repeatedly scheduled.

A correct configuration should not require such large keepalive values,
and an upper limit of one day is already generous and unnecessary in
practice. Limit both the keepalive interval and timeout to 86400 seconds.

Signed-off-by: Marco Baffo <marco@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-30 11:28:30 +02:00
Fabio Estevam
537601771a
ASoC: dt-bindings: realtek,rt5640: Make interrupts optional
The RT5640 GPIO1/IRQ pin can be configured either as GPIO1 or as the
codec interrupt output.

Some boards, such as the Firefly-RK3399, do not connect the codec
interrupt output. This causes the following binding validation warning:

'interrupts' is a required property

Make the interrupts property optional to support such hardware
configurations.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727185814.2599488-1-festevam@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29 14:42:32 +01:00
Paolo Bonzini
a7fe52b5ab KVM/arm64 fixes for 7.2, take #3
- Fix a tiny buglet when propagating the deactivation of an interrupt
   from a nested guest, which happened to trigger a gold plated CPU bug
   on a particular implementation
 
 - Fix a race between LPI unmapping and mapping, resulting in leaked
   LPIs
 
 - Make LPI mapping more robust on memory allocation failure
 
 - Fix the handling of the EL2 tracing clock being disabled
 
 - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing
   code
 
 - Add missing sysreg tracepoint for the EL2 code
 
 - Tidy-up the mutual exclusion of guest-memfd and MTE
 
 - Update Fuad's email address to point to @linux.dev
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmpiPKIACgkQI9DQutE9
 ekNhIA//SQCC53RVQjg5XjW/pfHLanEnQycyyYU7mY8Aw8+TstztgAL7TRTITuUY
 wPldTBIuBS/f49KP4FIqynUNznFrtsBEYNxpK6PaLzCAvszcc1SAHzkWbK7j8SRn
 cWm1Zq+0RIkH4pluLiqZZjsBb6gKz8dGJCD7k+qoYPrsPMccltMZtzn2db4zWfb7
 b5PRUNm2KncuHt/gHfPxCHo9RFe/71ll6V4XKNe3H5UY064OnCwVZ6ju8zKJu+MD
 5MLuyKy1lLbKHZEJibAI/Bn6GNU3q1V50GbpWmnAB66Kh4Vlj6ST+2qaxAmSxSho
 GqAA1Ba5NTSA8C7fh/+o9vFf13UJ5lAQRV9xOwH3lXnlHzGhtsd8+4H/bSte1uP8
 tMSzODn2QzTAO9V1ooIhbpQvlG085hjA1onzCs5F8Z+FVlkDOTV5ZTZb1wq2CP66
 1QKlcBDO5LaBu3zJBC0DugoB7bpeaeVeOf6U/a4+W4WzX3En0va0oMSmTZbpEhdu
 z97ttdadLIqL6a7oKwvZbXdQz4TtfExKFYVWxVrhydBpPR4AT6zNPFEJcEzt2zYb
 Gf9OzgwKbuJxgtz9dvMWVWEwB6awSfIv6spaSBHMrhWPbaeCt1vS8slA2aMnGQ9o
 UkcgIRULU7TKv/iilnEcXRuqnQkM94Rfz7rc3Ycp9sHweTXjRP0=
 =a3wu
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 7.2, take #3

- Fix a tiny buglet when propagating the deactivation of an interrupt
  from a nested guest, which happened to trigger a gold plated CPU bug
  on a particular implementation

- Fix a race between LPI unmapping and mapping, resulting in leaked
  LPIs

- Make LPI mapping more robust on memory allocation failure

- Fix the handling of the EL2 tracing clock being disabled

- A couple of Sashiko-driven fixes for corner cases in the EL2 tracing
  code

- Add missing sysreg tracepoint for the EL2 code

- Tidy-up the mutual exclusion of guest-memfd and MTE

- Update Fuad's email address to point to @linux.dev
2026-07-28 17:43:23 +02:00
Paolo Bonzini
70f526a0f9 KVM: s390: Fixes for 7.2
- several fixes for PCI passthru in s390 kvm
 - fix a 7.2-rc regression in the adapter interrupt mapping code
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+SKTgaM0CPnbq/vKEXu8gLWmHHwFAmpnFhcACgkQEXu8gLWm
 HHzskxAAqyjD4XcWZsqc5dUAMxhA5nTAStaJpS7pUj8//7fKUQFFDqW3KN7Og4c1
 XRaCrCbaTYN8OVJl6orogNlijcJLqOzgcITDcKEqWCwN9ukuI+Utwxkm1CkmXl6D
 Psjy6h63F34QCD51IHu86iNet18WnBz+TLxY0dVXTSXNsqj2nvaiU1p13pYNkoXK
 4liMXN5/kuZaJy2KqmeU0QwiQWI9SVHE2cjWZ0vhF3bryVwFB8SxW5zBZgHi+kX0
 ygPDBe44vVfPJF868s5bIbzZMn7pkt00ag9sr+BDtACcugiLSm9+HJUuvGpdJpmW
 a0OcNSQGl55zRHxVw531pZk/sYz/5Q93eZvVwF+5BezVfu/oR7F3Xh4mVkqPGQJT
 4KgrsRe98+N63mXts12LC8I6R8OWCkKeNrDibYJrPL9m6W/s3OboWj4oWzWhBmJ3
 59tCiMi+/p88VxR5vbdiwuUtOUUoKot0een3QmzWlgx8uULT4bliHQXwjRbv7VPQ
 3PnZ/QwXbtkPNak7pBmPYHZD/L8+4Xm3ciQNzKCgRgrp0N1dDxH5+9j9WwKKCHJu
 qiWbYf1+AKUCfvP9JqEp9LfhkSaynpI9U9ncTgBd+TXvqWVQNght1GZ+OaijGUjV
 Yl4fMAlWQmQUAJEb05h+HZmBu2t2JWbhBhArk1HJsVEwAFHMUtM=
 =Hi9l
 -----END PGP SIGNATURE-----

Merge tag 'kvm-s390-master-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

KVM: s390: Fixes for 7.2

- several fixes for PCI passthru in s390 kvm
- fix a 7.2-rc regression in the adapter interrupt mapping code
2026-07-28 17:43:18 +02:00
Jaehoon Kim
9972befc3e KVM: s390: Fall back to short-term pinning in MAP ioctl
FOLL_LONGTERM pinning fails for some memory types, such as file-backed
guest memory. As a result, kvm_s390_adapter_map() returns -EINVAL and
irqfd adapter registration fails even though interrupt delivery could
still work via the existing non-atomic path.

When FOLL_LONGTERM pinning fails, verify that the page is accessible
using a short-term pin instead. If the short-term pin succeeds, unpin
the page and add a map entry with pinned=false to preserve MAP/UNMAP
symmetry. The non-atomic irqfd path already performs short-term pinning
for interrupt delivery, so this restores the previous behavior for
memory that cannot be pinned long-term.

get_map_info() is updated to return NULL for unpinned entries so that
the atomic irqfd fast path falls back to the non-atomic path.
kvm_s390_adapter_unmap() and kvm_s390_unmap_all_adapters() skip dirty
marking and unpin for unpinned entries.

Update Documentation/virt/kvm/devices/s390_flic.rst to reflect the
new MAP/UNMAP behavior.

Fixes: c9a5688380 ("KVM: s390: Add map/unmap ioctl and clean mappings post-guest")
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Douglas Freimuth <freimuth@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-07-27 09:23:53 +02:00
Tejun Heo
7706d6e4f2 sched_ext: Bound per-task reenqueues and eject the owning scheduler
Unlike local reenqueues, cap rejections have no repeat limit. A
malfunctioning scheduler can keep re-inserting a task to a cid it lacks caps
on, cycling the task through reject and reenqueue. This was assumed safe
because a task that never runs trips the stall watchdog. However, the
reenqueue irq_work re-arms itself and outranks the timer vector, blocking
everything else on the CPU including stall detection and recovery, until the
NMI hardlockup detector fires.

Local reenqueues already have a repeat cap, SCX_REENQ_LOCAL_MAX_REPEAT,
which needs generalizing to cover all reenqueues. It also has an attribution
problem. Counted per-cpu on root, it tears down the whole hierarchy even
when a sub-scheduler caused the repeated reenqueues.

Generalize by bounding every reenqueue with one per-task counter. reenq_cnt
is bumped in scx_do_enqueue_task() on each SCX_ENQ_REENQ, the single path
every reenqueue producer passes through, and cleared in clr_task_runnable()
when the task is picked to run and in scx_disable_task() when it leaves the
scheduler's control. Past SCX_REENQ_MAX_REPEAT the task's owning scheduler
is ejected with a new SCX_EXIT_ERROR_REENQ and the task is left stranded to
be picked up during sched exit.

The SCX_EV_REENQ_LOCAL_REPEAT event becomes SCX_EV_REENQ_REPEAT, counting
repeat reenqueues from all sources.

v2: Count SCX_EV_REENQ_REPEAT only when a reenqueue leads to another
    reenqueue, not on every reenqueue.

v3: - Also clear reenq_cnt in scx_disable_task() so that the count doesn't
      carry over to the next owner across sched class switches, scheduler
      replacement or sub-scheduler rehoming (Andrea Righi).

    - Update the stale SCX_EV_REENQ_LOCAL_REPEAT references in sched-ext.rst
      (Andrea Righi).

Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-26 11:12:19 -10:00
Shawn Guo
4d5282c06c scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
Qualcomm UFS controller found on SoCs SA8255P/SA8797P has a MCQ I/O address
space. It should be defined in the bindings even though Linux driver
currently doesn't utilize it. Fix the binding before it gets adopted by
DTS.

Fixes: e2725ed2a7 ("scsi: ufs: dt-bindings: Document bindings for SA8255P UFS Host Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260720023552.2667237-1-shengchao.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26 15:35:33 -04:00
Linus Torvalds
72841e8e83 spi: Fixes for v7.2
Just a couple of small bits for the SpacemiT driver - one small fix, and
 a new compatible in the DT binding.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmL3sACgkQJNaLcl1U
 h9CDnwgAggPOeUHMrQWYES7f74oTVl/kt0B1TBV6g91r8a4p0yyy7Kn6C1njBQ7n
 N5bgSL2EkpQRjj2d5akh42Apwb5EQZMdqICo68XElWnk0AxH6Y1PdRkfcruU9PnS
 t7KJEeBxdsZAJhx5ZEWZrIwjY/rbEvI+rfePgdm8kVeUUVs4ur6Zg1DNk/LgolOP
 xr60E5DWHIczjJ3Ae+svL5mmJ8FICFOThAYjMzGyRACB4c3znMBhzKVoNrUR6sl5
 7qSf1x3WBXIYwd0RRs9YhTF6vQhlnfKfu8rPfb2S6v8rE7JmmokLr3kVFzgpph1K
 o893VMecWe5al0ZuE2qdf44w2Ohv0Q==
 =2PTr
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "Just a couple of small bits for the SpacemiT driver - one small fix,
  and a new compatible in the DT binding"

* tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: spacemit: add K3 SPI compatible
  spi: spacemit: Correct TX FIFO slot calculation
2026-07-26 12:13:42 -07:00
Eduard Zingerman
4748a67f71 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc5
Cross-merge BPF and other fixes after downstream PR.

Conflicts:
	net/core/filter.c

Changes [2] in bpf-next conflict with a recent fix [1]
from the 'net' tree. Resolved by using [1] as a base and
applying same flags handling logic as in [2] in the
bpf_redirect_peer() helper.

[1] https://lore.kernel.org/all/20260706185609.330006-2-daniel@iogearbox.net/
[2] https://lore.kernel.org/all/20260618182035.43811-2-jordan@jrife.io/

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-24 21:54:42 -07:00
Maciej Fijalkowski
72f2b4516f xsk: reclaim invalid Tx descriptors in ZC batch path
The zero-copy Tx batch parser stops when it encounters an invalid
descriptor. If this happens after one or more continuation descriptors,
the Tx consumer can be advanced past fragments that are neither submitted
to the driver nor returned to userspace through the completion ring.

A similar problem occurs when a packet exceeds xdp_zc_max_segs. The
descriptors consumed up to the limit are released without completion, and
the remaining continuation descriptors can subsequently be interpreted
as the beginning of another packet.

Parse Tx batches in packet units and distinguish descriptors belonging to
complete valid packets from descriptors consumed while draining an
invalid or oversized packet. Return the former to the driver and append
the latter to the CQ address area so userspace can reclaim their UMEM
frames.

Treat a standalone invalid descriptor as a one-descriptor reclaim-only
packet. Advancing the Tx-ring consumer releases the ring slot, but does
not by itself return ownership of the referenced UMEM frame to userspace.

Once draining starts, continue until the packet's end-of-packet
descriptor is consumed. Preserve the drain state on the socket when EOP
has not yet been supplied, so draining can continue during a later call.
Leave incomplete but otherwise valid packets on the Tx ring.

Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing.
Walk their Tx sockets one packet at a time, preserving the existing
per-socket fairness scheme, instead of using the legacy one-descriptor
fallback. Keep that fallback for shared pools that do not use
multi-buffer Tx. Since the drain state is maintained per socket and both
the singular and shared paths can resume an interrupted drain, changing
the socket list from singular to shared requires no special bind-time
transition.

CQ entries are positional, and drivers may complete only part of the Tx
work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only
entries cannot be published immediately when earlier driver-visible
descriptors are still outstanding.

Track the number of driver-visible CQ entries preceding the reclaim
entries. Let xsk_tx_completed() publish partial hardware Tx completions,
and publish the reclaim entries only after every earlier Tx descriptor
has completed. Complete a reclaim-only batch immediately when there is no
driver-visible work in front of it, and prevent another Tx batch from
being appended while reclaim entries remain pending.

Also cap batch processing by the size of the pool's temporary descriptor
array, as Tx rings belonging to sockets sharing a UMEM may have different
sizes.

This ensures that every invalid Tx descriptor consumed by the ZC batch
path is either submitted to the driver as part of a valid packet or
returned to userspace without violating CQ completion ordering.

Reviewed-by: Jason Xing <kernelxing@tencent.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Fixes: cf24f5a5fe ("xsk: add support for AF_XDP multi-buffer on Tx path")
Link: https://patch.msgid.link/20260719135609.147823-5-maciej.fijalkowski@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24 15:12:14 -07:00
Linus Torvalds
d326f83e81 Lots of fixes, double the count even for the "new normal".
Largely due to my time off followed by a networking conference
 which distracted most maintainers (less so the AI generators).
 
 Including fixes from Bluetooth and WiFi.
 
 Current release - regressions:
 
  - wifi: mt76: fix MAC address for non OF pcie cards
 
 Current release - new code bugs:
 
  - mptcp: fix BUILD_BUG_ON on legacy ARM config
 
  - wifi: cfg80211: guard optional PMSR nominal time
 
 Previous releases - regressions:
 
  - qrtr: ns: raise node count limit to 512, we arbitrarily picked
    256 as a limit, turns out it was too low for real world deployments
 
  - vhost-net: fix TX stall when vhost owns virtio-net header
 
  - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
 
  - wifi: ath12k: fix low MLO RX throughput on WCN7850
 
 Previous releases - always broken:
 
  - number of random AI fixes for SCTP, RDS and TIPC protocols
 
  - more AI-looking fixes for WiFi drivers
 
  - number of fixes for missing pointer reloading after skb pull
 
  - reject BPF redirect use from qdisc qevent block
 
  - tcp: initialize standalone TCP-AO response padding
 
  - vsock/virtio: collapse receive queue under memory pressure to avoid
    client OOMing the host with tiny messages
 
  - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
    make sure the ICMP response routing follows the routing policy
 
  - gro: fix double aggregation of flush-marked skbs
 
  - ovpn: fix various refcount bugs
 
  - tls: device: push pending open record on splice EOF
 
  - eth: mlx5:
   - use sender devcom for MPV master-up
   - fix MCIA register buffer overflow on 32 dword reads
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmpiX68ACgkQMUZtbf5S
 IrvYsRAAkuMhUpz0Ss9aF7rBY8iTp4SofSvFeVe06ywraUfqPuflGlak07t1Lz/i
 G4MuKXN0q8m+B0EZddfMeYw6rCGd0SCtFAkxUI3dd+pu4hssgioaCPL193drSsfC
 /lYeacjVL45jNrQvAWwKsRaAs3xdwzxWf0ddIXWvVWbdDsVfIf/mYahSS3TvniWw
 MQtEbWPnFwPvOrHzb+1ChLELCtig/yvK+3xS9JrwOkjUF4BczOUgqrYlG5MWerXP
 f/JDLsegPcoZaTycW5F5fshY05umeRQza/zCFqMKQNcQux49fjREnYxBuyTacVCo
 0cxhsNbKOhvBpBFNsHA6TjUbDxuiyL8L/g3e7VOlQFxI4hX3IMsnsP+UrSdE2zyG
 lgFAQ6HIcelgFnzFcwp9YEGsiZ5nDoJKe5aBcgftzTFPx3Plh1UeCrNjYtJawcjk
 1POovopI+G6eszwluVOoucUdDD3wf0jPgDqvdOcI9P9FVTsFmvRESsfen7NbdjG0
 v5mk9+sasWL1dns6mre6nt5is4QWSg7PDjufQUhuPKSSEnld+csEgmyxmUm0/FgL
 krUZLHdx0Yj9yIOAIYAvz8QoW9jHIyK05Mr7CoL4a/9RJ4rtxjb+3CT9qebeyd49
 jK5uzYX6tPHvILFK4CgZwcE/z9S+DoxCAuDEp6LhfstKsJW4KIM=
 =DIF8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Lots of fixes, double the count even for the 'new normal'. Largely due
  to my time off followed by a networking conference which distracted
  most maintainers (less so the AI generators).

  Including fixes from Bluetooth and WiFi.

  Current release - regressions:

   - wifi: mt76: fix MAC address for non OF pcie cards

  Current release - new code bugs:

   - mptcp: fix BUILD_BUG_ON on legacy ARM config

   - wifi: cfg80211: guard optional PMSR nominal time

  Previous releases - regressions:

   - qrtr: ns: raise node count limit to 512, we arbitrarily picked
     256 as a limit, turns out it was too low for real world deployments

   - vhost-net: fix TX stall when vhost owns virtio-net header

   - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

   - wifi: ath12k: fix low MLO RX throughput on WCN7850

  Previous releases - always broken:

   - number of random AI fixes for SCTP, RDS and TIPC protocols

   - more AI-looking fixes for WiFi drivers

   - number of fixes for missing pointer reloading after skb pull

   - reject BPF redirect use from qdisc qevent block

   - tcp: initialize standalone TCP-AO response padding

   - vsock/virtio: collapse receive queue under memory pressure to avoid
     client OOMing the host with tiny messages

   - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
     make sure the ICMP response routing follows the routing policy

   - gro: fix double aggregation of flush-marked skbs

   - ovpn: fix various refcount bugs

   - tls: device: push pending open record on splice EOF

   - eth: mlx5:
      - use sender devcom for MPV master-up
      - fix MCIA register buffer overflow on 32 dword reads"

* tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)
  drop_monitor: perform u64_stats updates under IRQ-disabled section
  drop_monitor: fix size calculations for 64-bit attributes
  net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  mptcp: fix BUILD_BUG_ON on legacy ARM config
  selftests: mptcp: userspace_pm: fix undefined variable port
  mptcp: fix stale skb->sk reference on subflow close
  mptcp: pm: userspace: fix use-after-free in get_local_id
  mptcp: decrement subflows counter on failed passive join
  mac802154: hold an interface reference across the scan worker
  sctp: don't free the ASCONF's own transport in DEL-IP processing
  phonet: check register_netdevice_notifier() error in phonet_device_init()
  phonet: pep: fix use-after-free in pep_get_sb()
  bnge/bng_re: fix ring ID widths
  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  mctp: check register_netdevice_notifier() error in mctp_device_init()
  ptp: netc: explicitly clear TMR_OFF during initialization
  rds: tcp: unregister sysctl before tearing down listen socket
  ipv6: Change allocation flags to match rcu_read_lock section requirements
  net: slip: serialize receive against buffer reallocation
  ...
2026-07-23 12:58:08 -07:00
Alexandru Elisei
679d7201c1 KVM: arm64: Reject guest_memfd memslots when the VM has MTE
The user cannot use MTE on VMAs created by mapping a guest_memfd file,
as arch_calc_vm_flag_bits() does not set VM_MTE_ALLOWED.

When creating a guest_memfd backed memslot,
kvm_arch_prepare_memory_region() rejects the memslot if MTE is enabled for
the VM and if guest_memfd has been mapped in a VMA that intersects the
memslot.

However, the documentation for KVM_SET_USER_MEMORY_REGION2 explicitly
states that the only condition for userspace_addr is for it to be a legal
userspace address, but the mapping is not required to be valid nor
populated at memslot creation.

If userspace sets userspace_addr to an address that hasn't been mapped, or
if userspace_addr belongs to a VMA that isn't backed by the guest_memfd
file, or if the VMA doesn't intersect the memslot, memslot creation is
successful and KVM ends up with a VM with MTE and guest_memfd-backed
memslots.

The same happens if the order is reversed: when userspace enables MTE, KVM
does not check if memslots backed by guest_memfd are already present.

Fix both issues by rejecting guest_memfd-backed memslots when MTE is
enabled, and by rejecting MTE when guest_memfd-backed memslots are already
present.

Fixes: 32e200bd6e ("KVM: arm64: Enable support for guest_memfd backed memory")
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Link: https://patch.msgid.link/20260722090354.94245-1-alexandru.elisei@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-07-23 09:57:06 +01:00
Linus Torvalds
08de7d9d24 watchdog fixes for v7.2-rc5
Notable fixes:
 
 - airoha: Prevent division by zero when clock frequency is zero
 
 - core: pretimeout: Fix UAF in watchdog_unregister_governor()
 
 - ni903x_wdt: Check ACPI_COMPANION() against NULL
 
 - s32g_wdt: remove incorrect options in watchdog_info struct
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmpg9jQACgkQyx8mb86f
 mYECGw//fpjigslXk+hj7G/qZ+ng2Cct34tbXPCf5z9mxnmWwu678vGFs1/V3vJp
 0Ix0CbsXIAmlzgaenFFqHU0WFWbd8VrQTw0tAOwoEpMpyZ+Z2pYiZ7TY1Y3lHPhR
 bMj5Wsts2Vtni1o2/iOi3dUiqMPwQ6gpYgmCoQSPweA7CUpjvcYEjBcLSiz59eCz
 z1HiyMdOUt+elo1UUazJuLJZR5E6BfeGYmiAJ04N+yjuKcytV1I8dTLHtnQUt8Tu
 CG+DRJEGBfM0TeLQfUGtQqvCXNwhuEKgEwj+gL030fuIjyIV70nmO/jjRmitAQsu
 rpgcl9HWH0Y8ZMpYzG/ZXC1pg861aJSumPR2mqT1hHKqXqxhv4qk8hoSKH3TSBbF
 Glbzdjtd0A2LR43Z2+tCdZmCf2Q7iFgr6CyZnq/1mmGLT90HbytSYTMiZpumKuN1
 FwWUyEgMDk81L9bxzdmaGhg0XyuwzXhL8bk3tzBPKOqnmtNfIFHQVN8NKAuPzPgR
 W38R3cq7H+GsEVjVBZWkqP6Ij6HKfj186bjeeOMEWnPkicwBNi201mZTS+7arAE5
 oxlfNOLAjtsd9ml7130ddVz2zZ2Ez2zhNvf23Bu/uIHaVjSr5FId0Gnbeywf/JLh
 whflQmaMPXs4a5kzppk23PAZVwYJ8PN7QYhPoDgfJzLJSJwEqJY=
 =12+G
 -----END PGP SIGNATURE-----

Merge tag 'watchdog-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull watchdog fixes from Guenter Roeck:

 - airoha: Prevent division by zero when clock frequency is zero

 - core: pretimeout: Fix UAF in watchdog_unregister_governor()

 - ni903x_wdt: Check ACPI_COMPANION() against NULL

 - s32g_wdt: remove incorrect options in watchdog_info struct

* tag 'watchdog-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  watchdog: airoha: Prevent division by zero when clock frequency is zero
  watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
  docs: watchdog: Fix brackets
  watchdog: ni903x_wdt: Check ACPI_COMPANION() against NULL
  watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
2026-07-22 11:15:49 -07:00
Zhengyu He
6389eaf11d
spi: dt-bindings: spacemit: add K3 SPI compatible
The K3 SPI controller is compatible with K1, so allow K3 device trees to
use "spacemit,k1-spi" as fallback.

Signed-off-by: Cody Kang <cody.kang.hk@outlook.com>
Signed-off-by: Zhengyu He <hezhy472013@gmail.com>
Link: https://patch.msgid.link/20260717-k3-com260-spi-v7-2-rc2-b4-preview-20260716-v1-2-969a1b0f783f@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21 22:39:30 +01:00
D Scott Phillips
8a570b19b4 KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
In the nested state, the physical interrupt has already been
deactivated through the HW bit in the LR. The extra deactivation
would be harmless but can hit an errata case on AmpereOne, so
avoid it here.

On AmpereOne, deactivating a physical interrupt through
ICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not
active, but is the highest priority pending interrupt causes the
cpu to lose the interrupt pending state and also prevents the
delivery of future interrupts.

Fixes: 6dd333c894 ("KVM: arm64: GICv3: nv: Plug L1 LR sync into deactivation primitive")
Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-arm-kernel/20260710222128.416581-1-scott@os.amperecomputing.com/
Link: https://patch.msgid.link/20260714231158.496808-1-scott@os.amperecomputing.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-07-21 11:19:00 +01:00
Danielle Ratson
f6e3b21608 netlink: specs: rt-link: convert bridge port flag attributes to u8
A number of IFLA_BRPORT_* attributes are documented in the rt-link spec
as having the "flag" type, i.e. a payload-less NLA_FLAG attribute whose
meaning is presence-only. This does not match the kernel, which emits
these attributes with nla_put_u8() and validates them as NLA_U8 in
br_port_policy[]. The values are not mere presence flags but carry a u8
payload (0/1).

Convert these bridge port attributes from "flag" to "u8" so the spec
reflects the actual wire format.

Fixes: 077b6022d2 ("doc/netlink/specs: Add sub-message type to rt_link family")
Reviewed-by: Petr Machata <petrm@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Link: https://patch.msgid.link/a57cdfcfc4a6dcb92106c25b4dde5059fde2bd44.1783236731.git.danieller@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-20 18:14:42 -07:00
Randy Dunlap
b056f21a38 power: supply: bd71828: add a terminating table border
Fix a documentation build error by adding a bottom table border:

Documentation/ABI/testing/sysfs-class-power-bd71828:1: ERROR: Malformed table.
No bottom table border found.
============  ===========================================
1             automatic adjustment of input current limit
0             no adjustment of input current limit. This
              helps for more unusual power sources like
              solar modules. [docutils]

Fixes: e92786dd86 ("power: supply: bd71828: sysfs for auto input current limitation")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Matti Vaittinen <mazziesaccount@gmail.com>
Link: https://patch.msgid.link/20260620011821.3568674-1-rdunlap@infradead.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21 00:01:51 +02:00
Linus Torvalds
b95f03f04d 12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues or
aren't considered appropriate for backporting.  10 are for MM.
 
 All are singletons - please see the relevant changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCal5rBQAKCRDdBJ7gKXxA
 jtgtAQCuWNUTCR7u+MzAuO3Nh46DxHXeb27OTHZL8JcazQTEQgD+NZfwqVYnNNX/
 4CVqqZvrXJQDg0aiWtIP4VdLirNh/Ac=
 =Gslp
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues
  or aren't considered appropriate for backporting. 10 are for MM.

  All are singletons - please see the relevant changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/memory-failure: trace: change memory_failure_event to ras subsystem
  mm: page_reporting: allow driver to set batch capacity
  mm/kmemleak: fix checksum computation for per-cpu objects
  mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  MAINTAINERS: add Usama as a THP reviewer
  fat: avoid stack overflow warning
  mm/damon/core: validate ranges in damon_set_regions()
  m68k: avoid -Wunused-but-set-parameter in clear_user_page()
  mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  mm/page_vma_mapped: fix device-private PMD handling
  MAINTAINERS: s/SeongJae/SJ/
  userfaultfd: prevent registration of special VMAs
2026-07-20 13:04:47 -07:00
Kumar Kartikeya Dwivedi
ecf11bc5f5
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc4
Cross-merge BPF and other fixes after downstream PR.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17 23:22:46 +02:00
Linus Torvalds
0dde292a4c Crypto library fixes for v7.2-rc4
- Fix a build error in certain configurations
 
 - Clarify some parts of the documentation
 
 - Remove unused code that I forgot to remove in commit cf52058dcd
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCalpR7hQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK0FsAP4g1ERoX/xslpz++c9GQPK3QhXGjug5
 B1nGMnqDJPQmewD/eAloShBc5VYxnCeDDN24txP2RZeRK9XSG/mGTsdv2wk=
 =Dtak
 -----END PGP SIGNATURE-----

Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull crypto library fixes from Eric Biggers:

 - Fix a build error in certain configurations

 - Clarify some parts of the documentation

 - Remove unused code that I forgot to remove in commit cf52058dcd
   ("lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code")

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  crypto: aes - Fix conditions for selecting MAC dependencies
  lib/crypto: docs: Improve introduction sentence
  lib/crypto: docs: Fix some sentence fragments
  lib/crypto: md5: Remove support for md5_mod_init_arch()
2026-07-17 10:53:57 -07:00
Linus Torvalds
45419d06c9 MMC core:
- Fix RPMB device unregister ordering
  - Fix __counted_by handling in mmc_test
 
 MMC host:
  - mtk-sd: Document missing clocks for MT8189
  - sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO
  - sdhci-of-dwcmshc: Fix error handling for clock prepare/enable
  - vub300: Fix lockdep issue for the cmd_mutex
  - vub300: Fix use-after-free on probe failure
 
 MEMSTICK:
  - Reject a card that reports too many blocks
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmpaF4YQHHVsZmhAa2Vy
 bmVsLm9yZwAKCRD+JoQlc1iMKQsXEAC4Y3DuRvuYUi3MVeAI8IqXZKW1qZ2Wg7pD
 tvjbS0h1ZLVBPXeWIhjL2N9Y2GWIzbq5Yb0zAyqwl4d99IsNL5j0ul6rQbVWHY6Z
 48IJ8idboGeUXZ9foUif8t+gZOVUd6Mecf8GxWkJcwlJ70pt36TCGWPvp3/MkQmP
 w6srlDXfIZgQyauQIz+cHYcocD0L7vp6apAcT/QQRLadY4PBpzNfjjgbqr5ogejF
 ovRkTUBp2D/ufTV0p8V0ykQ9onac7aV1HrX1ubSjs/2rkxNMOBGRYTeds8YYm4Of
 Jljdivx0EeLA638sJ7XO6QGbxT7pwwffRzS+q6VE+NilKghwF3/GE1LPv8NSV+mA
 woeSxPCgVxfqF+THGQE9J8NQXtIV6UF7gNHVSp+Vq/aKuykSwnRslUbu7mncgDZC
 nv2cwcmlVU98IKDNVFNNMCkMbaEyifWzaxR6gX2Xlo+Qo6n3A/Qz6bSjw5LTkIyg
 sAx0jmSKWbgpRZl4eYO16DKDwOkGW5zDEhjxQqtRBcyxv7Yndgl+lcP/fPR0oVCT
 /gyZOEsFg3ItfUCW5nMnTRWZ6u8D7tSXXVXaqs8b4HB8Nj7jX2WHfkrmT0+i8oMu
 eGXITNNOWp827RZHX1uxzoBMQXfHVIZq8FVECAcrCxnzQz4E5zpP3JKTzz9ydpe6
 VG49Xs+JsA==
 =IHdC
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix RPMB device unregister ordering
   - Fix __counted_by handling in mmc_test

  MMC host:
   - mtk-sd: Document missing clocks for MT8189
   - sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO
   - sdhci-of-dwcmshc: Fix error handling for clock prepare/enable
   - vub300:
       - Fix lockdep issue for the cmd_mutex
       - Fix use-after-free on probe failure

  MEMSTICK:
   - Reject a card that reports too many blocks"

* tag 'mmc-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-esdhc-imx: fix resume error handling
  mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
  mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
  mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
  mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
  mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
  mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
  mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
  mmc: block: fix RPMB device unregister ordering
  memstick: ms_block: reject a card that reports too many blocks
  dt-bindings: mmc: mtk-sd: Document extra clocks for MT8189
  mmc: vub300: defer reset until cmd_mutex is unlocked
  mmc: vub300: fix use-after-free on probe failure
  mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
  mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
2026-07-17 09:27:02 -07:00
Linus Torvalds
58717b2a13 A collection of small fixes. All are device-specific fixes (including
regression fixes) or quirks accumulated since the last update.
 Some highlights:
 
 * USB-audio:
 - Fix per-channel volume imbalance regression for sticky mixers
 - Validate input packet length in caiaq driver
 - Quirks for iBasso DC-Elite, Musical Fidelity M6s DAC, and Redragon
   H510-PRO Wireless headset
 
 * HD-audio:
 - Fix a long-standing bug of cached processing coefficient verbs
 - Make cs35l56 driver failing with missing firmware
 - Fix cirrus codec Kconfig dependency, update MAINTAINERS
 - Remove unneeded mic bias threshold override on Conexant
 - Realtek codec quirks for ASUS ROG Ally X (headphone & mic), Dell
   QCM1255, Legion Pro 7, HP/Victus laptops, Framework, and TongFang
   laptops
 
 * ASoC:
 - Add Eliza audio support on Qualcomm sc8280xp/sm8250 SoCs
 - Fix SDCA linker error with ACP on AMD
 - A few fixes for AMD ACP PCI driver
 - Add TAS2783 support on AMD ACP 7.0 platforms
 - Reset RT712-SDCA codec to fix silent headphone issue
 - Soft reset S/PDIF datapath on Meson AIU FIFO
 - Jack report fix for cs42l43
 - TAS2562 shutdown GPIO clearing fix
 - Sidecar amps quirk for Lenovo laptop in SOF SDW driver
 
 * Misc:
 - Drop redundant mod_devicetable.h includes from FireWire drivers
 - Fix memory leak and format mismatch in mixer kselftest
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmpVCXAOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+hYg//SNZJcg5CL0aMEFfBce7+7t1Y8BIQ5A7omXDS
 xqJbJeeWEaHXqfwwD32WLDuc19aOtsRzK6t8Pz7PM+8g7OPM59Az7eHOy84Bx/12
 083xxXLFNMdffV9VdG8WxhicFqbBQfXaoW+bn3JTrZ32fYllml+ar8bmQXFkrIvR
 7o/wbXdvKPF8OmBYUWXLPRmdhmtcEu4ITQYZYI7LmGU2dhzy2uQM+yWROq61Cl0N
 dz4Uad29h4Wap90d07wYHKMh3bcT6iRqorQeCETqM+tAke2PdKh/ko69xTQ4Blyn
 ErmW9APd0s2QBEyiTrYHd16pzCDuDEMw/MHN/dAPmKEjDcU5LRDfC/3PT/dKiGTD
 kZUB7PEpa5mHEiDKIkrr5rPaL8qf4hxhJz/E8DA/FmtjlzHsdeZeN7bbEbFiEsQe
 0oC9o6s/tEuwNgBB7BYf2g8TWOYCkWTiIVZ8kiVSl802mgIiCJCLsnNA+F7kBZzq
 D0U6oQ1DLONgTLeroBOwFMUtaJ+2X+k1+81L00+8sMlMWJtfZN0wVo4k7Nn7pE5j
 /8gG2XWaXr9rPkboq96ukoC7skVFu1AHSbVd0z1IodNiaangfeE6NgOXKGreGFe2
 boPhWF1U0IgSghn0+lNcqdnKYbT5O18RbPlv0DXE14G7/716LCJEMD0MctqEaqzR
 XkUJLns=
 =3e+T
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes. All are device-specific fixes (including
  regression fixes) or quirks accumulated since the last update. Some
  highlights:

  USB-audio:
   - Fix per-channel volume imbalance regression for sticky mixers
   - Validate input packet length in caiaq driver
   - Quirks for iBasso DC-Elite, Musical Fidelity M6s DAC, and Redragon
     H510-PRO Wireless headset

  HD-audio:
   - Fix a long-standing bug of cached processing coefficient verbs
   - Make cs35l56 driver failing with missing firmware
   - Fix cirrus codec Kconfig dependency, update MAINTAINERS
   - Remove unneeded mic bias threshold override on Conexant
   - Realtek codec quirks for ASUS ROG Ally X (headphone & mic), Dell
     QCM1255, Legion Pro 7, HP/Victus laptops, Framework, and TongFang
     laptops

  ASoC:
   - Add Eliza audio support on Qualcomm sc8280xp/sm8250 SoCs
   - Fix SDCA linker error with ACP on AMD
   - A few fixes for AMD ACP PCI driver
   - Add TAS2783 support on AMD ACP 7.0 platforms
   - Reset RT712-SDCA codec to fix silent headphone issue
   - Soft reset S/PDIF datapath on Meson AIU FIFO
   - Jack report fix for cs42l43
   - TAS2562 shutdown GPIO clearing fix
   - Sidecar amps quirk for Lenovo laptop in SOF SDW driver

  Misc:
   - Drop redundant mod_devicetable.h includes from FireWire drivers
   - Fix memory leak and format mismatch in mixer kselftest"

* tag 'sound-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (36 commits)
  ALSA: usb-audio: Add delay quirk for iBasso DC-Elite
  ALSA: hda: conexant: Remove mic bias threshold override
  ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7
  ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
  ALSA: hda: cs35l56: Fail if wmfw file is missing
  ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
  ALSA: hda: MAINTAINERS: Fix missing cirrus* file reference
  ALSA: hda/cirrus_scodec: Make Kconfig visible if KUNIT
  ALSA: hda/realtek: Add quirk for TongFang X6xx45xU
  ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255
  ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
  ASoC: cs42l43: Correct report for forced microphone jack
  ASoC: qcom: sc8280xp: Add support for Eliza
  ASoC: dt-bindings: qcom,sm8250: Add Eliza sound card
  ASoC: dt-bindings: qcom: Add Eliza LPASS macro codecs
  ALSA: hda/realtek: Add mic mute LED quirk for HP Laptop 15-fd0xxx
  ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)
  ALSA: usb-audio: Add quirk for Redragon H510-PRO Wireless headset
  ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
  ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
  ...
2026-07-14 09:18:19 -07:00
Linus Torvalds
3b029c035b cgroup: Fixes for v7.2-rc3
- A cpuset that never set its memory nodes could divide by zero when a
   task's mempolicy rebinds on CPU hotplug. Rebind against the effective
   nodes, which are always populated.
 
 - Documentation fixes for memory.stat, io.stat, and the misc and v1 RDMA
   controllers.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCalVWkg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGet9AQD3/qE93E+PctxXa+rmRfSSjIzqqv9NUZa4THjs
 YOUqSAEApVSLPkhg3xHF61q9l+FuocLLY378Uf6LYGWet1SghAQ=
 =1Gp+
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.2-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:

 - A cpuset that never set its memory nodes could divide by zero when a
   task's mempolicy rebinds on CPU hotplug. Rebind against the effective
   nodes, which are always populated

 - Documentation fixes for memory.stat, io.stat, and the misc and v1
   RDMA controllers

* tag 'cgroup-for-7.2-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  Docs/admin-guide/cgroup-v2: note blkcg_debug_stats gates io.latency stats
  Docs/admin-guide/cgroup-v1: document rdma.peak, rdma.events and rdma.events.local
  Docs/admin-guide/cgroup-v2: drop stale misc interface file count
  cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
  Docs/admin-guide/cgroup-v2: fix memory.stat doc details
2026-07-13 16:14:06 -07:00
Linus Torvalds
f7574d3f90 sched_ext: Fixes for v7.2-rc3
- Lifecycle fixes for the new sub-scheduler support: two use-after-frees
   and an enable-failure path that left a half-initialized sub-scheduler
   linked.
 
 - Two dispatch-path locking bugs: a spurious scheduler abort from a
   migration race, and a lockdep splat from stale runqueue-lock tracking.
 
 - Callback and task-state fixes: stale scheduler-owned state on a task
   leaving SCX, a weight callback running after disable, and a bogus
   warning on core-scheduling forced idle.
 
 - On nohz_full, finite-slice tasks could miss the tick that expires their
   slice. Enable it when such a task is picked, with a selftest.
 
 - Smaller fixes: userspace CPU-mask helpers, ratelimited deprecation
   warnings, docs and a sparse annotation.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCalVWgw4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGTmUAP0QHX7Ae/g7yMPEB4slURpnSj/wE7hRCI5jTmay
 2iIEJgD/RAhpwUUAp4Abozt0mjQMWh9UyEVjOxPCVNKaNh1XfwU=
 =EBCm
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.2-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:

 - Lifecycle fixes for the new sub-scheduler support: two
   use-after-frees and an enable-failure path that left a
   half-initialized sub-scheduler linked.

 - Two dispatch-path locking bugs: a spurious scheduler abort from a
   migration race, and a lockdep splat from stale runqueue-lock
   tracking.

 - Callback and task-state fixes: stale scheduler-owned state on a task
   leaving SCX, a weight callback running after disable, and a bogus
   warning on core-scheduling forced idle.

 - On nohz_full, finite-slice tasks could miss the tick that expires
   their slice. Enable it when such a task is picked, with a selftest.

 - Smaller fixes: userspace CPU-mask helpers, ratelimited deprecation
   warnings, docs and a sparse annotation.

* tag 'sched_ext-for-7.2-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Skip ops.set_weight() for disabled tasks
  tools/sched_ext: scx - Fix cmask_subset(), cmask_equal() and cmask_weight()
  sched_ext: Fix premature ops->priv publication in scx_alloc_and_add_sched()
  sched_ext: Record an error on errno-only sub-enable failure
  selftests/sched_ext: Verify nohz_full tick behavior
  sched_ext: Enable tick for finite slices on nohz_full
  sched_ext: Preserve rq tracking across local DSQ dispatch
  sched_ext: Documentation: Fix ops table header reference
  sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
  sched_ext: Pin parent scx_sched across a child sub-scheduler's lifetime
  sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
  sched_ext: Check remote rq eligibility under task's rq lock
  sched_ext: Reset dsq_vtime and slice when a task leaves SCX
  sched_ext: Avoid flooding the log with deprecation warnings
2026-07-13 15:55:17 -07:00
Linus Torvalds
534f8f051e USB fixes for 7.2-rc3
Here are a number of small USB driver fixes for many reported issues.
 Included in here are:
   - usb serial driver corruption and use-after-free fixes
   - usb gadget rndis bugfixes for malicious/buggy host connections
   - typec driver fixes for a load of different tiny reported issues
   - typec mux driver revert for a broken patch in -rc1
   - usb gadget driver fixes for many different reported problems
   - new usb device quirks added
   - usbip tool fixes and some core usbip fixes as well
   - dwc3 driver fixes for minor issues
   - xhci driver fixes for reported problems
   - lots of other tiny usb driver fixes for many tiny issues
 
 All of these have been in linux-next with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNSkw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynUlACgtUhZOR/MsYMcNbKJe9vk0iG35+AAnjrhznd4
 OJqmb+1vVQ7xDm2fq+gz
 =Ky4T
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are a number of small USB driver fixes for many reported issues.
  Included in here are:

   - usb serial driver corruption and use-after-free fixes

   - usb gadget rndis bugfixes for malicious/buggy host connections

   - typec driver fixes for a load of different tiny reported issues

   - typec mux driver revert for a broken patch in -rc1

   - usb gadget driver fixes for many different reported problems

   - new usb device quirks added

   - usbip tool fixes and some core usbip fixes as well

   - dwc3 driver fixes for minor issues

   - xhci driver fixes for reported problems

   - lots of other tiny usb driver fixes for many tiny issues

  All of these have been in linux-next with no reported issues"

* tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits)
  USB: core: ratelimit cabling message
  usb: misc: usbio: fix disconnect UAF in client teardown
  Revert "usb: typec: mux: avoid duplicated mux switches"
  USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
  usb: ucsi: huawei_gaokun: move typec_altmode off stack
  usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
  usb: typec: tcpm: Fix VDM type for Enter Mode commands
  usb: typec: ucsi: cancel pending work on system suspend
  usb: typec: class: drop PD lookup reference
  usb: typec: ps883x: Fix DP+USB3 configuration
  usb: xhci: Fix sleep in atomic context in xhci_free_streams()
  xhci: sideband: fix ring sg table pages leak
  usb: gadget: udc: Fix use-after-free in gadget_match_driver
  usb: dwc3: run gadget disconnect from sleepable suspend context
  usb: sl811-hcd: disable controller wakeup on remove
  usb: typec: anx7411: use devm_pm_runtime_enable()
  usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
  USB: misc: uss720: unregister parport on probe failure
  usb: gadget: function: rndis: add length check for header
  usb: gadget: function: rndis: add length check to response query
  ...
2026-07-12 12:12:41 -07:00
Linus Torvalds
2f9eb0c54a RISC-V updates for v7.2-rc3
- Avoid a null pointer deference in machine_kexec_prepare() that the
   IMA subsystem can trigger
 
 - Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid
   noise from child atfork handlers that libc might run
 
 - Include Kconfig support for UltraRISC SoCs, already referenced by
   some device drivers; and enable it in our defconfig
 
 - Fix the build of the rseq kselftest for RISC-V by borrowing a
   technique from the KVM and S390 kselftests that includes
   arch-specific header files from tools/arch/<arch>/include
 
 - Fix some memory leaks in the RISC-V vector ptrace kselftests
 
 - Clean up some DT bindings and hwprobe documentation
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpRj9YACgkQx4+xDQu9
 KktUEQ/8Cvup7jqUkHj3JBI/gjLLUyiOsa0q7KC3F2A+CznCFlrjwezGUZSeIiKq
 lmVIeBFejOK+8VKNg+SeDTbfw10YlZOpUtBozJmRtFx17K0m5R6eGn6Qjy5IwMSI
 wJmDylHtnLqrydYqESRt1iLDgETnZkmYdSlFDow2LKTa2g9BYPno+avB9uuzV2nj
 /JCAC7kWSABRmROfNDBtZikT6Qcx1hGAxSQnkHmgvjYEInNggMefIfU7+/wgqksm
 CEBCsoIZ3kqIVEkrGrYwlxoyj81wA8uOcg802xJs5ByffrdPc7xy43WZ9J41dKIb
 EDXXbXH9tudhLmGfXDI8xt0gJz03L+t05pmYTaNN8o6/CWKQ7Dj5xvqfM1WllUDD
 Q71Q6H0Smd7UmQkQ0/olyhG7yFEaewR+yJFvIEhISfQpIKUVWvVEVkEyJQdv66R4
 ei2Oc2mUjQd+drCVD8d59whctUPMKDlg0JaesSE7rwNbx03NnOsLtg2JFHQxEVdn
 GeUlKqAYLhTjPXrUvoWm3ebnU0DCvchKhY8So00aXWbdJnn2u9Qg81887czT0hQn
 lsTLAt1n7/RCsuGo1zdw9lEMXmPJI9uX/HsyfatGYR9CVxj4M4tbVYjEz+wOFu+F
 m7JKMnLFrvWF1+gRmmTXwcHCmi1qJnsqsILO4YvB+P/2vLs1FtU=
 =P9QE
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V fixes from Paul Walmsley:
 "The most notable change involves the rseq kselftest common Makefile
  (as it is not RISC-V-specific). The basic approach in the patch
  appears similar to one used in the KVM and S390 selftests (grep for
  LINUX_TOOL_ARCH_INCLUDE and SUBARCH), and the rseq kselftests pass a
  quick build test on x86 after this.

   - Avoid a null pointer deference in machine_kexec_prepare() that the
     IMA subsystem can trigger

   - Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid
     noise from child atfork handlers that libc might run

   - Include Kconfig support for UltraRISC SoCs, already referenced by
     some device drivers; and enable it in our defconfig

   - Fix the build of the rseq kselftest for RISC-V by borrowing a
     technique from the KVM and S390 kselftests that includes
     arch-specific header files from tools/arch/<arch>/include

   - Fix some memory leaks in the RISC-V vector ptrace kselftests

   - Clean up some DT bindings and hwprobe documentation"

* tag 'riscv-for-linus-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests
  selftests/rseq: Fix a building error for riscv arch
  riscv: defconfig: enable ARCH_ULTRARISC
  riscv: add UltraRISC SoC family Kconfig support
  riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP
  riscv: hwprobe.rst: Make indentation consistent
  dt-bindings: riscv: sort multi-letter Z extensions alphanumerically
  selftests: riscv: Bypass libc in inactive vector ptrace test
  riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
2026-07-12 11:25:40 -07:00
Linus Torvalds
d96fcfe1b7 arm64 fixes for -rc3
- Fix crash when using SMT hotplug on ACPI systems in conjunction with
   maxcpus=.
 
 - Fix 30% kswapd performance regression introduced by C1-Pro SME erratum
   workaround.
 
 - Fix TLB over-invalidation regression during memory hotplug.
 
 - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE.
 
 - Typo fixes in the arm64 selftests.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmpQ3FkQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNB5/B/9L6cQyMiFFdHiPdyZs1zzx2U5pTtKZQuLZ
 KQsJNhEuk0x50zSHJry+Be2FPkbqJzGiEl+cIyMjWt5hbDnTuj1MylLPX1HgpblG
 oXCsBOq3ahPBCmngLTq9jmQWGqBsc/9x9IscIhICY3hbjyc1esl7OAfRCxZeDjMW
 +ybpv6pYsheMvNm8NAN3RmpSWgxgiiP50HBdOHkSNNsF8NfVr3SwW7fv2sdaLWEo
 jdPvpP8k+misIZoXw/tdXhpUlTrseWnuhuV8R08mloJF4J6fMoYgwJNpkOttTphT
 EomGhwYI7pCqh7otX1GPvcZtzL4OB2zVBCJwmRNmdlOegMnFoWtK
 =J2Ug
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:

 - Fix crash when using SMT hotplug on ACPI systems in conjunction with
   maxcpus=

 - Fix 30% kswapd performance regression introduced by C1-Pro SME
   erratum workaround

 - Fix TLB over-invalidation regression during memory hotplug

 - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE

 - Typo fixes in the arm64 selftests

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  selftests/arm64: fix spelling errors in comments
  arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
  arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
  arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum
  cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
  arm64: smp: Fix hot-unplug tearing by forcing unregistration
2026-07-10 09:59:55 -07:00
SJ Park
14afcf67dc MAINTAINERS: s/SeongJae/SJ/
My legal and preferred first names are SeongJae and SJ, respectively.  I
was using the legal name for commits and tags, while using the preferred
name for conversations.  It sometimes confuses people including myself. 
Consistently use the preferred name.

Together remove copyright notes on files.  Those are only confusing for
people who are not familiar with the law.  Meanwhile, we can infer the
information in a better way from git logs and public information.

Link: https://lore.kernel.org/20260630013820.143366-1-sj@kernel.org
Signed-off-by: SJ Park <sj@kernel.org>
Acked-by: Lorenzo Stoakes <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-09 15:48:53 -07:00
Eric Biggers
9665e22579 lib/crypto: docs: Improve introduction sentence
Make it clear that lib/crypto/ is a kernel-internal library.  It's easy
for people to come across this page, especially the HTML version online,
without that context.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://patch.msgid.link/20260709022747.44635-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-09 11:06:05 -04:00
Eric Biggers
8008d6b59a lib/crypto: docs: Fix some sentence fragments
Currently, the section about the library API for each algorithm begins
with a noun phrase that was intended to serve as an elaboration on the
title.  It's better to use complete sentences.

Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://patch.msgid.link/20260709022651.44216-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-09 11:05:54 -04:00
Daniel Borkmann
84c42f515f
Documentation/bpf: Add BPF signing and enforcement doc
Describe the BPF signing design end to end: why a trusted loader is
needed, the signature(insns || metadata) contract, load-time
verification via fd_array (exclusive + frozen maps), the binary
BPF_SIG_{UNSIGNED,VERIFIED} verdict, and how [BPF] LSMs can enforce
policy on it.

This writes down the contract on the discussion points with the LSM /
integrity folks [0][1]: by the time security_bpf_prog_load() is
called, signature verification has fully completed and covers the
instructions plus the frozen contents of every bound exclusive map;
there is no intermediate "loader verified, payload pending" state
to reason about; and what BPF_SIG_VERIFIED means at each hook is
spelled out explicitly.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/bc823ddbaf63e0e177eb46d1cc15076e4e2e689d.camel@HansenPartnership.com [0]
Link: https://lore.kernel.org/bpf/CAHC9VhSDkwGgPfrBUh7EgBKEJj_JjnY68c0YAmuuLT_i--GskQ@mail.gmail.com [1]
Link: https://lore.kernel.org/bpf/20260708075343.358712-9-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-08 20:05:16 +02:00