github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 11:06:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,479,908 Commits 1 Branch 949 Tags 16 GiB
7bb6284aa7
Commit Graph

1479908 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds
7bb6284aa7 Arm: 
* Add support for 'slot' based PMU events, paired with new UAPI that
   compels the user to select a specific PMU implementation
 
 * Lazy save/restore of vCPU state for pKVM, along with various fixes
   and cleanups to the management of vCPU state between the untrusted
   host and pKVM hypervisor
 
 * Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
   is present, guaranteeing that EL2-specific register bits are stateful
   in the EL1 counterpart
 
 * Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
   of those instructions remains 'in host' (i.e. L1 kernel/userspace)
 
 * Pile of fixes for the management of the VNCR pseudo-TLB, such as
   under-invalidations and races with concurrent TLBIs on other vCPUs
 
 * Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
   runtime-patched constant, allowing the same data to be shared with
   pKVM prior to dropping host privileges
 
 * Considerable pile of LLM-assisted fixes around the shop but mostly in
   the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
 
 LoongArch:
 
 * Advertise already-supported capabilities.
 
 * Some bug fixes about timer and MMIO.
 
 * Some hardening about interrupt injection.
 
 * Replace kvm_err() with kvm_pr_unimpl().
 
 * Add FPU/LSX/LASX test cases for selftests.
 
 RISC-V:
 
 * Svadu/Zicfiss/Zicfilp FWFT support for Guest
 
 * Use try_cmpxchg for IMSIC MRIF RMW
 
 * More arch-specific tracepoints in KVM RISC-V
 
 * Eager page splitting when enabling dirty logging
 
 * Optimize hfence request handling for SMP Guests
 
 * Improve dirty log clearing by skipping zero bits in mask
 
 * Guard HFENCE range loops against overflow
 
 * CPU PM notifiers in KVM RISC-V for non-retentive idle states
 
 * Fix kernel-mode vector context save/restore for Guest
 
 s390:
 
 * Fixes for vfio-ap
 
 * Fixes for the gmap rework
 
 * Fixes for vsie
 
 * AI triggered fixes all over
 
 * diag9c tracing
 
 * code move preparation for the additional arm64 support
 
 * enable CONTEXT_ANALYSIS
 
 x86:
 
 * Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
   (the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
   relevant code out of x86.c.
 
 * Split kvm_mmu in three parts, respectively to describe the format of page
   tables, walking the guest page tables and building the page tables.  Always
   use the same page table walker kvm->arch.gva_walk as the entry point to
   convert a guest's virtual address, where the previous code used two
   different kvm_mmu structs depending on whether the walk included nested
   EPT/NPT or not.  Make page fault vmexits reuse the permission checking
   machinery that is used for guest page faults.  This is both a cleanup
   and a baby step towards supporting XS/XU memory permissions.
 
 * Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
   on x86.
 
 * Remove a defunct masterclock update from kvm_xen_shared_info_init().  It
   could result in incorrect kvmclock due to triggering an unnecessary
   switch to/from masterclock mode.
 
 * Skip Xen runstate time updates if time has effectively gone backwards, so
   that the guest doesn't report 100% steal time for a very, very long time.
 
 * Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
   updating the wrong sub-leaf, and upstream KVM will soon provide all the
   information needed by userspace to populate the CPUID field itself.
 
 * Fix a bug where KVM would walk a newly created rmap without holding the rmap
   lock (or mmu_lock) during aging.
 
 * Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
 
 * Fix a variety of #DB priority bugs.
 
 * Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.
 
 * Use static calls for nested virtualization ops.
 
 * Move more KVM-internal code out of x86's kvm_host.h.
 
 * Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.
 
 * Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
 
 * Harden kvm_vcpu_map() against double-mapping and thus leaking references.
 
 * Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
 
 x86 (Intel):
 
 * Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
   virtualization when the vCPU is freed, to fix a use-after-free where hardware
   will write to a freed vCPU's PID.
 
 * Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
   could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
 
 * Cap the maximum value shoved into the VMX Preemption Timer to workaround an
   erratum that affects all existing Intel CPUs that support CPUID 0x15.
 
 * Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
 
 * Harden the TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.
 
 x86 (AMD):
 
 * Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
   zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
   Change request.
 
 * Remove a dying VM from the GA Log notifier list before the VM is actually
   destroyed, to fix a potential use-after-free.
 
 * While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
   FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
   get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
   So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
   pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
   introduced by KVM's (correct) usage of long-term pins.
 
   (This was reviewed by mm maintainers; for more information, see commit
   ee1a586dd1).
 
 * Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to
   fix a data corruption issue due to the PSP driver assigning to-be-written
   pages to firmware (as required by the SNP specs).
 
 * Unconditionally intercept ICBEP so that KVM generates the correct guest RIP
   when handling an ICEBP-induced TASK_SWITCH #VMEXIT.
 
 * Harden the SNP "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.
 
 Generic:
 
 * Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
 
 * Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
   which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
   before calling into arch code.  This allows arch code to consume vcpu_id
   without having to worry about cross-vCPU clobbering (at least s390 and x86
   have had related bugs).
 
 * Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare
   for in-place private<=>shared conversion, and clean up a few warts along the
   way.
 
 Selftests:
 
 * Automatically allocate a full page for L2 guest stacks on x86 instead of
   requiring test-specific L1 guest code to carve out a portion of the L1
   stack for L2 usage, and to ensure the L2 stack also adheres to the x86-64
   calling convention ABI.
 
 * Add a selftest to verify {Guest,Host}-Only behavior in x86's mediated PMU.
 
 * Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
   functionality for nested VMX, and drop the ucall hack that was fudging
   around the lack of GPR switching on nVMX.
 
 * Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
   across save/restore, including when L2 is active.
 
 * Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
   KVM_CAP_VM_TYPES.
 
 * Misc selftests fixes and cleanups
 
 * Fix several issues with seeding the pRNG, and rework the pRNG APIs to that
   the pRNG can be sanely used in host code, not just guest code.
 
 * Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
   KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
   via writes to an assigned VFIO device.
 
 * Add syscall wrappers to assert success on a variety of pthreads and CPU
   affinity APIs.
 
 * Set vCPU pthread affinity as early as possible to reduce contention issues
   that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
   minute on large hosts, versus the expected ~5 seconds.
 
 * Rework the PMU counters test to run each testcase using a single VM with
   many vCPUs for each sub-testcase, instead of using a unique VM for each
   sub-testcase.  This cuts the runtime by ~20x.
 
 Miscellaneous:
 
 * MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86.  Mostly representing
   the status quo more accurately, but also... welcome David Hildenbrand
   as guest_memfd reviewer!
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmqMgosUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroP8bwf+ORImBMDM3QEmybZM3I+N2+xqSuHP
 QHttbmqGbsFK/RUeH96/X/+P9waqaz3uVeUQ6Qp2r0ryqwKtLt8YvIxKDp+M0vVJ
 n+iukk1xulBEc28aGdKHn9G4wayAwDA/9f7CvJ23hojaJfLScbF3OlFkDd7y5DpO
 x15Rtg9folYUjjop3LDML4N9/9Qmk4KRvVZ4ZVv6IB4uGJJ72fLd5dbBMyDk+BLl
 Lz9N1xVTXcnJXJmrjMB4/QNt/HiQJdun8LcokJZyykta7Xx6aY7OGZv+VmCeq47K
 e9Hk8mD4AyAdVbVvIntROSeBJOrlsgWJXAPHea6wEdRQnS3XVEBuZC0yDA==
 =rfLh
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "ARM64:

   - Add support for 'slot' based PMU events, paired with new UAPI that
     compels the user to select a specific PMU implementation

   - Lazy save/restore of vCPU state for pKVM, along with various fixes
     and cleanups to the management of vCPU state between the untrusted
     host and pKVM hypervisor

   - Disable traps of EL1 registers for nested hypervisors when
     FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
     are stateful in the EL1 counterpart

   - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
     scope of those instructions remains 'in host' (i.e. L1
     kernel/userspace)

   - Pile of fixes for the management of the VNCR pseudo-TLB, such as
     under-invalidations and races with concurrent TLBIs on other vCPUs

   - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
     runtime-patched constant, allowing the same data to be shared with
     pKVM prior to dropping host privileges

   - Considerable pile of LLM-assisted fixes around the shop but mostly
     in the VGIC, our in-kernel generator of bugs (and sometimes
     interrupts)

  LoongArch:

   - Advertise already-supported capabilities

   - Some bug fixes about timer and MMIO

   - Some hardening about interrupt injection

   - Replace kvm_err() with kvm_pr_unimpl()

   - Add FPU/LSX/LASX test cases for selftests

  RISC-V:

   - Svadu/Zicfiss/Zicfilp FWFT support for Guest

   - Use try_cmpxchg for IMSIC MRIF RMW

   - More arch-specific tracepoints in KVM RISC-V

   - Eager page splitting when enabling dirty logging

   - Optimize hfence request handling for SMP Guests

   - Improve dirty log clearing by skipping zero bits in mask

   - Guard HFENCE range loops against overflow

   - CPU PM notifiers in KVM RISC-V for non-retentive idle states

   - Fix kernel-mode vector context save/restore for Guest

  s390:

   - Fixes for vfio-ap

   - Fixes for the gmap rework

   - Fixes for vsie

   - AI triggered fixes all over

   - diag9c tracing

   - code move preparation for the additional arm64 support

   - enable CONTEXT_ANALYSIS

  x86:

   - Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
     regs.c (the kvm_cache_regs.h => regs.h is already applied) and
     msrs.{c,h}, and moving relevant code out of x86.c

   - Split kvm_mmu in three parts, respectively to describe the format
     of page tables, walking the guest page tables and building the page
     tables. Always use the same page table walker kvm->arch.gva_walk as
     the entry point to convert a guest's virtual address, where the
     previous code used two different kvm_mmu structs depending on
     whether the walk included nested EPT/NPT or not. Make page fault
     vmexits reuse the permission checking machinery that is used for
     guest page faults. This is both a cleanup and a baby step towards
     supporting XS/XU memory permissions

   - Document some of the "fun" gotchas with the APIC base when creating
     IRQCHIPs on x86

   - Remove a defunct masterclock update from kvm_xen_shared_info_init().
     It could result in incorrect kvmclock due to triggering an
     unnecessary switch to/from masterclock mode

   - Skip Xen runstate time updates if time has effectively gone
     backwards, so that the guest doesn't report 100% steal time for
     a very, very long time

   - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
     was updating the wrong sub-leaf, and upstream KVM will soon provide
     all the information needed by userspace to populate the CPUID field
     itself

   - Fix a bug where KVM would walk a newly created rmap without holding
     the rmap lock (or mmu_lock) during aging

   - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs

   - Fix a variety of #DB priority bugs

   - Fix a class of races related to enabling Hyper-V emulation on a
     vCPU after the vCPU is visible to the rest of KVM

   - Use static calls for nested virtualization ops

   - Move more KVM-internal code out of x86's kvm_host.h

   - Enumerate support for a variety of Zhaoxin instructions that don't
     require explicit virtualization

   - Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
     path

   - Harden kvm_vcpu_map() against double-mapping and thus leaking
     references

   - Misc fixes and cleanups, e.g. for largely benign syzkaller splats

  x86 (Intel):

   - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
     for IPI virtualization when the vCPU is freed, to fix a
     use-after-free where hardware will write to a freed vCPU's PID

   - Service local TLB flushes on a failed nested VM-Enter to fix a bug
     where KVM could miss a TLB on a future, successful VM-Enter with
     the same L2 VPID

   - Cap the maximum value shoved into the VMX Preemption Timer to
     workaround an erratum that affects all existing Intel CPUs that
     support CPUID 0x15

   - Fix VPID virtualization bugs where KVM would fail to flush hardware
     TLBs

   - Harden the TDX "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  x86 (AMD):

   - Forcefully invalidate SNP VMSA pages if their backing guest_memfd
     page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
     a Page-State Change request

   - Remove a dying VM from the GA Log notifier list before the VM is
     actually destroyed, to fix a potential use-after-free

   - While FOLL_WRITE was needed in the past to trigger CoW unsharing,
     nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
     and in fact, get_user_pages() actually disallows FOLL_WRITE
     together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
     registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
     guest memory, to fix a regression with file-backed memory
     introduced by KVM's (correct) usage of long-term pins

     (This was reviewed by mm maintainers; for more information, see
     commit ee1a586dd1 "KVM: SEV: Drop FOLL_WRITE for encrypted region
     registration")

   - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
     hosts to fix a data corruption issue due to the PSP driver
     assigning to-be-written pages to firmware (as required by the SNP
     specs)

   - Unconditionally intercept ICBEP so that KVM generates the correct
     guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT

   - Harden the SNP "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  Generic:

   - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
     debugfs

   - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
     for which the vCPU isn't yet online, and use the bitmap to reject
     duplicate IDs before calling into arch code. This allows arch code
     to consume vcpu_id without having to worry about cross-vCPU
     clobbering (at least s390 and x86 have had related bugs)

   - Rework the so called "prepare" and "invalidate" guest_memfd hooks
     to prepare for in-place private<=>shared conversion, and clean up a
     few warts along the way

  Selftests:

   - Automatically allocate a full page for L2 guest stacks on x86
     instead of requiring test-specific L1 guest code to carve out a
     portion of the L1 stack for L2 usage, and to ensure the L2 stack
     also adheres to the x86-64 calling convention ABI

   - Add a selftest to verify {Guest,Host}-Only behavior in x86's
     mediated PMU

   - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
     reuse the functionality for nested VMX, and drop the ucall hack
     that was fudging around the lack of GPR switching on nVMX

   - Add a stress test to verify KVM doesn't clobber/drop #PF state,
     e.g. CR2, across save/restore, including when L2 is active

   - Add a test to verify KVM_CREATE_VM accepts exactly what is reported
     by KVM_CAP_VM_TYPES

   - Misc selftests fixes and cleanups

   - Fix several issues with seeding the pRNG, and rework the pRNG APIs
     to that the pRNG can be sanely used in host code, not just guest
     code

   - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
     via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
     triggering IRQs via writes to an assigned VFIO device

   - Add syscall wrappers to assert success on a variety of pthreads and
     CPU affinity APIs

   - Set vCPU pthread affinity as early as possible to reduce contention
     issues that were surfaced by PREEMPT_LAZY, which result in runtimes
     of over a minute on large hosts, versus the expected ~5 seconds

   - Rework the PMU counters test to run each testcase using a single VM
     with many vCPUs for each sub-testcase, instead of using a unique VM
     for each sub-testcase. This cuts the runtime by ~20x

  Miscellaneous:

   - MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
     representing the status quo more accurately, but also... welcome
     David Hildenbrand as guest_memfd reviewer!"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
  KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
  KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
  KVM: arm64: vgic: Prevent speculative SPI array underflow
  KVM: arm64: vgic: Free gic_kvm_info on initialization failure
  KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
  s390/vfio-ap: Fix NULL deref in status_show() during queue probe
  s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
  s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
  s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
  s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
  s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
  s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
  RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
  riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
  riscv: vector: refactor riscv_v_start_kernel_context
  KVM: s390: gmap: Make prefix handling optional
  KVM: s390: gmap: Make CMMA optional
  KVM: s390: gmap: Make storage keys optional
  KVM: s390: Prepare gmap for a second KVM implementation
  ...
 2026-08-25 11:48:04 -07:00
Linus Torvalds
70f5376dbd TTY / Serial driver updates for 7.3-rc1 
Here is the "big" set of tty and serial driver updates for 7.3-rc1.  Not
 really all that much happened this development cycle for this subsystem,
 changes in here are:
   - removal of the ipwireless driver as it's no longer used or needed
   - new 8250_mxpcie driver added
   - qcom serial driver updates and additions
   - vt mode validation addition
   - lots of other small serial driver updates and additions
 
 All of these have been in linux-next for weeks with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2mTw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yk34ACdFfyDYJ0n1JcdskTxdNMBSPRkj7UAoJtMC/2y
 jxCfyfkM18YIuwZD6CvO
 =MlfE
 -----END PGP SIGNATURE-----

Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull TTY / serial driver updates from Greg KH:
 "Here is the "big" set of tty and serial driver updates for 7.3-rc1.

  Not really all that much happened this development cycle for this
  subsystem, changes in here are:

   - removal of the ipwireless driver as it's no longer used or needed

   - new 8250_mxpcie driver added

   - qcom serial driver updates and additions

   - vt mode validation addition

   - lots of other small serial driver updates and additions

  All of these have been in linux-next for weeks with no reported issues"

* tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits)
  serial: imx: serialize imx_uart_ports[] lifetime
  tty: clear cdev pointer after cdev_add() failure
  tty: skip cdev_del() when no cdev is registered
  serial: core: clear freed pointers on uart_register_driver() failure
  serial: core: do fallible allocations before the console can be registered
  serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL
  serial: 8250_mxpcie: introduce per-port private data structure
  serial: 8250: allow UART drivers to override rx_trig_bytes handling
  serial: 8250_mxpcie: add break support for RS485 using MUEx50 features
  serial: 8250: allow low-level drivers to override break control
  serial: 8250_mxpcie: support serial interface mode switching
  serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window
  serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window
  serial: 8250_mxpcie: add custom handle_irq callback
  serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware
  serial: 8250_mxpcie: enable automatic RTS/CTS flow control
  serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels
  serial: 8250: add Moxa MUEx50 UART port type
  serial: 8250: split Moxa PCIe serial board support out of 8250_pci
  serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level
  ...
 2026-08-25 10:59:12 -07:00
Linus Torvalds
f4d50813c0 USB / Thunderbolt changes for 7.3-rc1 
Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
 
 Lots of driver work for new devices and systems, and many other minor
 fixes and updates.  Included in here are:
   - Thunderbolt subsystem driver updates and additions
   - typec driver updates and additions
   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason
   - xhci driver updates and fixes based on lots of reports
   - usb-serial driver updates and additions
   - new device ids
   - other minor USB driver updates and fixes
 
 All of these have been in linux-next for a while with no reported issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2lJA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynK3QCeLQdHatZ2d5sJdvssiLKREZeND4EAnj+V1K1O
 PcVJzKAiC4dgSZ5SOwn1
 =OJea
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.

  Lots of driver work for new devices and systems, and many other minor
  fixes and updates. Included in here are:

   - Thunderbolt subsystem driver updates and additions

   - typec driver updates and additions

   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason

   - xhci driver updates and fixes based on lots of reports

   - usb-serial driver updates and additions

   - new device ids

   - other minor USB driver updates and fixes

  All of these have been in linux-next for a while with no reported issues"

* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
  usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
  usb: typec: hd3ss3220: fix VBUS regulator error message
  usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  usb: gadget: u_audio: Fix use-after-free on sound card disconnect
  usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
  usb: gadget: f_tcm: keep port count until LUN teardown completes
  usb: usbtest: disable dynamic ID support
  usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
  USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
  usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
  usb: gadget: snps_udc_plat: clean up PHY on probe deferral
  usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
  usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
  usb: gadget: f_fs: Fix Use-After-Free in AIO error path
  usb: gadget: f_fs: Prevent deadlock during ep0 read loop
  usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
  usb: gadget: midi2: remove default configfs groups on teardown
  usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
  usb: typec: thunderbolt: Disable work before freeing tbt on remove
  usb: xhci: Handle bogus TRB pointers in Missed Service Error events
  ...
 2026-08-25 10:44:46 -07:00
Linus Torvalds
29b0977977 Staging driver updates for 7.3-rc1 
Here is the big set of drivers/staging/ updates for 7.3-rc1.
 
 Nothing major in here at all, just lots of tiny coding style cleanups,
 refactoring, and minor "fixes" as found by some tools.  Included in here
   - loads of coding style and refactoring in the rtl8723bs wireless
     driver
   - minor greybus driver cleanups
   - minor sm750fb driver cleanups
   - other even smaller driver cleanups
 
 All of these have been in linux-next for a weeks with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2kLQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ym5DgCfcNXDT1NW9BrzpktehBbt+2xhtdsAoL/oRN9n
 6npdA+zvLcvV6hE3kdta
 =3AGF
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver updates from Greg KH:
 "Here is the big set of drivers/staging/ updates for 7.3-rc1.

  Nothing major in here at all, just lots of tiny coding style cleanups,
  refactoring, and minor "fixes" as found by some tools. Included in
  here

   - loads of coding style and refactoring in the rtl8723bs wireless
     driver

   - minor greybus driver cleanups

   - minor sm750fb driver cleanups

   - other even smaller driver cleanups

  All of these have been in linux-next for a weeks with no reported
  issues"

* tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (186 commits)
  staging: rtl8723bs: add blank line after declaration
  staging: rtl8723bs: remove unused enumerations
  staging: rtl8723bs: use !psta instead of comparison to NULL
  staging: rtl8723bs: Replace custom RotR1 macro with ror16
  staging: rtl8723bs: Remove multiple assignments
  staging: rtl8723bs: fix several line spaces in wifi.h
  staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe()
  staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCase
  staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCase
  staging: rtl8723bs: wrap line over 100 characters
  staging: rtl8723bs: remove unnecessary whitespace
  staging: rtl8723bs: remove extra blank lines in rtw_qos.h
  staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapper
  staging: rtl8723bs: remove debug fields from hal_com_data
  staging: rtl8723bs: remove 'rf_chip' from struct hal_com_data
  staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock'
  staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_data
  staging: rtl8723bs: hal: remove unused readings from the chip
  staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_data
  staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_data
  ...
 2026-08-25 10:16:19 -07:00
Linus Torvalds
93e4b3076b Char/Misc/IIO/etc driver update for 7.3-rc1 
Here is the big set of char, misc, iio, counter, fpga, and other small
 driver subsystems for 7.3-rc1.
 
 Overall, due to some driver removals we only added a bit more code than
 removed, which was a nice change.  Highlights in this merge request are:
   - Loads of IIO driver updates and additions
   - binder driver updates (more on that below...)
   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall
   - Removal of the obsolete ibmasm driver as it's not being used anymore
   - Coresight driver updates and additions
   - Mei driver udpates
   - Counter driver updates
   - FPGA driver updates
   - ICC driver updates
   - lots and lots of other tiny driver updates to resolve reported
     issues
 
 All of these have been in linux-next for a while, with the only reported
 issues being some major merge conflicts.  Miguel pointed out some of
 these with the Rust tree merge, which is the majority of them.  I'll
 follow up with a diffstat of the merge resolution I made against your
 most recent tree, which works for me.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao143A8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymtUgCeKB62gT1JfA86cg3NDB1opp+10N0An3oBBegQ
 IJLqJgK45dTNtMGBwGFV
 =68af
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
 2026-08-25 09:38:50 -07:00
Linus Torvalds
5f5ef9c407 Bootconfig updates for v7.3: 
- bootconfig: Support build-time command line rendering for embedded bootconfig
   . bootconfig: render descendant keys when xbc_snprint_cmdline() root has a
     value. Fix xbc_snprint_cmdline() to render descendant keys when the root
     has both a value and subkeys, and treats empty subtrees correctly.
   . bootconfig: render embedded bootconfig as a kernel cmdline at build time.
     Add build-time pipeline using tools/bootconfig -C to render the embedded
     bootconfig "kernel" subtree into .init.rodata as a cmdline string.
   . bootconfig: clean build-time tools/bootconfig from make clean.
   . bootconfig: add xbc_prepend_embedded_cmdline() helper.
     Add helper to prepend embedded bootconfig cmdline into boot_command_line
     early before parse_early_param().
   . x86/setup: prepend embedded bootconfig cmdline before parse_early_param.
     Wire early prepend helper in x86 setup_arch() so early_param handlers see
     values from the embedded bootconfig. (So this feature is currently x86 only)
   . bootconfig: skip runtime kernel.* render once prepended early.
     Avoid duplicating "kernel" keys in setup_boot_config().
   . init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in.
     Refactor setup_boot_config() to share bootconfig_cmdline_requested().
   . Documentation: bootconfig: document build-time cmdline rendering.
     Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and precedence.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqNQwAbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bcLcH/1GHYfxZHrl1aA112j60
 YqBgn98hnCiH+Q1wMhqgDIF7ks1qePT9pq0zC2vJawVa1BM6OM5RpnC4BW+YSpCa
 7tRf209Hrr5sd2i0vmsnYpmd9SV9JWKsuyz6VJjFjPsfEFtI9Nj7d3jm7WfGypUc
 aNEAjf3sntEaFB44MoKekHlLzTXDFrgBaUaAcdw3aGjUU1CE9ltdT+QooQGv6CHe
 7Z+UlmGhg+jkQa1tNNpRnKZErD5OBLnTkoMU5ca3M7PQLlPjIcOTf62SInm47Ma/
 viOyzkSYIXC/yq2U4Je4qKcZaKhNIL61jtQGFI8EbbZ0x1BzVbPjbr0DB3iq2YW4
 4Xk=
 =8++3
 -----END PGP SIGNATURE-----

Merge tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull bootconfig updates from Masami Hiramatsu:

 - Support build-time command line building for embedded bootconfig

 - Fix xbc_snprint_cmdline() to render descendant keys when the root has
   both a value and subkeys, and treats empty subtrees correctly.

 - Add build-time pipeline using tools/bootconfig -C to render the
   embedded bootconfig "kernel" subtree into .init.rodata as a cmdline
   string.

 - Clean build-time tools/bootconfig from make clean

 - Add helper to prepend embedded bootconfig cmdline into
   boot_command_line early before parse_early_param()

 - Wire early prepend helper in x86 setup_arch() so early_param handlers
   see values from the embedded bootconfig (currently x86 only)

 - Avoid duplicating "kernel" keys in setup_boot_config()

 - Refactor setup_boot_config() to share bootconfig_cmdline_requested()

 - Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and
   precedence

* tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in
  bootconfig: skip runtime kernel.* render once prepended early
  x86/setup: prepend embedded bootconfig cmdline before parse_early_param
  Documentation: bootconfig: document build-time cmdline rendering
  bootconfig: add xbc_prepend_embedded_cmdline() helper
  bootconfig: clean build-time tools/bootconfig from make clean
  bootconfig: render embedded bootconfig as a kernel cmdline at build time
  bootconfig: render descendant keys when xbc_snprint_cmdline() root has a value
 2026-08-25 08:59:09 -07:00
Linus Torvalds
7f22f3a193 This contains 52 commits with improvements to compression support, 
metadata handling, error propagation, and filesystem robustness.
 
 New feature:
 
  - Add optional read support for Windows System Compression (WOF).
    Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading WOF-compressed
    files through the NTFS page-read path. This includes parsing
    REPARSE_TAG_WOF, handling resident and non-resident WOF metadata and
    compressed chunks, and adding kernel-side XPRESS 4K/8K/16K and LZX 32K
    decompressors. The codecs use a common transparent compression interface
    shared with LZNT1. WOF support is read-only and disabled unless
    explicitly enabled.
 
 Other changes:
 
  - Harden malformed filesystem handling and error paths.
    Add bounds and consistency checks for mapping pairs, run lengths, MFT
    locations, update-sequence offsets, non-resident attributes, compressed
    attributes, index roots, and bitmap scans. Prevent out-of-bounds accesses
    in decompression, MFT allocation, and index conversion paths, clean up MFT
    mappings and attribute search contexts on failure, and propagate attribute
    and inode initialization errors correctly.
 
  - Improve compressed-file I/O path.
    Fix compressed writes on large-page and highmem systems, reuse compression
    contexts and output workspaces, avoid unnecessary reads for full-unit
    overwrites, and submit one bio per compressed write unit. Write replacement
    data before publishing the new mapping, correctly handle zero-filled
    compressed blocks, and fix initialized-size and folio state updates after
    compressed writes.
 
  - Synchronize resident reads with MFT record updates.
 
  - Validate the final EA stream size before modifying existing data, rewrite
    the stream safely when replacing entries, restore the previous state when
    metadata updates fail, and remove the EA attribute pair when the last
    entry is deleted.
 
  - Apply Windows filename restrictions only when windows_names is enabled.
 
  - Allow index roots to relocate to extent MFT records when the base record
    lacks sufficient space.
 
  - Move non-resident attribute payload data before shrinking its record.
 
  - Correct resident-to-non-resident conversion when compression or sparse
    flags are enabled.
 
  - Prepare file allocation and initialized-size updates before buffered or
    direct I/O submission, and use pagecache_isize_extended() when extending
    the file size.
 
  - Fix highmem and page/folio access in compressed I/O paths by using the
    correct local mappings and page helpers.
 
  - Apply per-file $LXMOD permissions instead of mount masks when available,
    and prevent unprivileged writes to reserved $LX* attributes.
 
  - Update the NTFS maintainer mailing list.
 
  - Four small cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmqNZO8WHGxpbmtpbmpl
 b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCOOoD/9wqck6nOvUaCTRvcKbTEw2yVrR
 C+S15hC/OuwqlxFHQQucav2NvCqwzuL/T/OBHycWi0NOycq+xYQQExs5wTms77R8
 0a+lS5QS+evc8XM1IFOywiaetJQCpn6ivDimRKzZiuMJGPwdAVYY6dRX90WW1afl
 fk9uxQHcy1Tvv7L1zvNbkr8vaycOH7LEWDukEe2XAXeZbQpumF8N0TETjH3oiNUK
 NinDliRDisn0Z00qkV+DcGLQCYdVYgyJc9jW0lWT2Q2dd/o/NxfwZCrGXOSkzn1Y
 6OXtMB36cQAxrW/lINwX0hSPj+YcMYQIi32nH3qyVC6+CcJ01OD5VU1aPtSsOqIX
 viehEDBca7WJJq2AUBBUeAhK+Mq/exqNmm0UbMZKYikckkDrGDoYrnGMK4QAtkP5
 EEduZRVy57VsRDV9gO/oNCMO3+VoAJ+iU27XFcHBxzpbsR0vmJWAjivSoRJducg0
 nwZwUXfDxe6g4qFMVdd255y133uAsZ5G/lqPVFXEDiYfK/uCnKMH8O20HkzhYA75
 b7sDbboRYhiXJhMKz08fKMgov4LvewgnC2wk0Farrvb719H6ELdcHooaIfBF4pkc
 o1UStWnh/a6Sd4L5FCnVn4IBfiVkz9eDQzL0DKfhLfzVKcxyNmGStxrGSyUCZd6K
 k1pRdpLI9Z2h6ALfhQ==
 =pHcD
 -----END PGP SIGNATURE-----

Merge tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

Pull ntfs updates from Namjae Jeon:
 "This contains improvements to compression support, metadata handling,
  error propagation, and filesystem robustness.

  New feature:

   - Add optional read support for Windows System Compression (WOF)

     Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading
     WOF-compressed files through the NTFS page-read path. This includes
     parsing REPARSE_TAG_WOF, handling resident and non-resident WOF
     metadata and compressed chunks, and adding kernel-side XPRESS
     4K/8K/16K and LZX 32K decompressors. The codecs use a common
     transparent compression interface shared with LZNT1.

     WOF support is read-only and disabled unless explicitly enabled.

  Other changes:

   - Harden malformed filesystem handling and error paths.

     Add bounds and consistency checks for mapping pairs, run lengths,
     MFT locations, update-sequence offsets, non-resident attributes,
     compressed attributes, index roots, and bitmap scans. Prevent
     out-of-bounds accesses in decompression, MFT allocation, and index
     conversion paths, clean up MFT mappings and attribute search
     contexts on failure, and propagate attribute and inode
     initialization errors correctly.

   - Improve compressed-file I/O path.

     Fix compressed writes on large-page and highmem systems, reuse
     compression contexts and output workspaces, avoid unnecessary reads
     for full-unit overwrites, and submit one bio per compressed write
     unit. Write replacement data before publishing the new mapping,
     correctly handle zero-filled compressed blocks, and fix
     initialized-size and folio state updates after compressed writes.

   - Synchronize resident reads with MFT record updates.

   - Validate the final EA stream size before modifying existing data,
     rewrite the stream safely when replacing entries, restore the
     previous state when metadata updates fail, and remove the EA
     attribute pair when the last entry is deleted.

   - Apply Windows filename restrictions only when windows_names is
     enabled.

   - Allow index roots to relocate to extent MFT records when the base
     record lacks sufficient space.

   - Move non-resident attribute payload data before shrinking its
     record.

   - Correct resident-to-non-resident conversion when compression or
     sparse flags are enabled.

   - Prepare file allocation and initialized-size updates before
     buffered or direct I/O submission, and use
     pagecache_isize_extended() when extending the file size.

   - Fix highmem and page/folio access in compressed I/O paths by using
     the correct local mappings and page helpers.

   - Apply per-file $LXMOD permissions instead of mount masks when
     available, and prevent unprivileged writes to reserved $LX*
     attributes

   - Update the NTFS maintainer mailing list

   - Small cleanups"

* tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (52 commits)
  ntfs: support resident WOF decompression
  ntfs: add non-resident WOF decompression
  ntfs: implement codec ops for LZX and XPRESS
  ntfs: port lzx/xpress decompressors from ntfs-3g-system-compression
  ntfs: return errors from inode initialization
  ntfs: parse REPARSE_TAG_WOF
  ntfs: return errors from ntfs_attr_readall
  ntfs: add WOF compression config option
  ntfs: define LZNT1 codec ops under transparent codec interface
  ntfs: introduce transparent compression codec interface
  ntfs: reject invalid empty mapping pairs
  ntfs: fix resource leak in ntfs_new_attr_flags
  ntfs: validate usa_ofs before preserving the update sequence number
  ntfs: fix off-by-one page overflow in ntfs_decompress()
  ntfs: do not update ctime when setxattr fails
  ntfs: reject invalid MFT LCNs from boot sector
  ntfs: serialize resident iomap reads with mrec_lock
  ntfs: verify run length exceeding volume boundary
  ntfs: allow index root relocation
  ntfs: validate non-resident attribute offsets
  ...
 2026-08-25 08:33:43 -07:00
Linus Torvalds
9cebfe6504 fuse update for 7.3 
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSQHSd0lITzzeNWNm3h3BK/laaZPAUCao1RzQAKCRDh3BK/laaZ
 PJ2EAP9dfslni4sFYqtXv/43Wk2iVwwdGRRSy5Tfoq8nCeNXpQEAygIv9BuJYpl6
 DL861AOn/NfDBXpeU0vX4WQpTgtFIgc=
 =Av0t
 -----END PGP SIGNATURE-----

Merge tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse updates from Miklos Szeredi:

 - Improve performance of the io-uring transport by introducing buffer
   pools and zero-copy (Joanne)

 - Fix lots of bugs (Baokun Li)

 - Fix io-uring initialization issues (Joanne, Bernd)

 - More prep work for large folios (Joanne)

 - Don't limit buffered read to 128k (Jim Harris)

 - Fix zeroing of page end (dirtied with mmap) on file size extension
   (Jimmy Zuber)

 - Improve performance in certain cases with wake_up_sync() when queuing
   request (Xuewen Yan)

 - Misc fixes and cleanups (Xuewen Yan)

* tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (35 commits)
  fuse: zero the partial EOF page when extending a file
  io_uring: Add missing include for ITER_SOURCE and ITER_DEST
  fuse: Fix the condition to enable over-io-uring
  fuse: invalidate the correct range after O_APPEND direct write
  selftests/fuse: test post-EOF page zeroing when a file is extended
  fuse: wake one waiter per freed slot when raising max_background
  fuse: use min_not_zero() in fuse_init_server_timeout()
  fuse: copy request headers via a stack buffer for io-uring
  fuse: give wakeup hints to the scheduler for synchronous requests
  fuse: check for NULL root inode in fuse_fill_super_submount
  fuse: reject a duplicate fd= mount option
  cuse: wait for pending RCU callbacks on module exit
  fuse: fix invalidate lock leak on open O_TRUNC DAX failure
  fuse: fix invalidate lock leak on setattr writeback failure
  fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
  fuse: make dentry_tree_work static
  docs: fuse: document io-uring buffer pool and zero-copy uapi
  fuse: add zero-copy over io-uring
  fuse: support registered buffer pools in io-uring
  fuse: add io-uring buffer pools
  ...
 2026-08-25 07:59:44 -07:00
Linus Torvalds
ce14fe4cd7 There are thirty-three client fixes: 
- five sensitive data leak fixes (clear stack and heap cryptographic
   keys/hashes)
 - six file size and cache synchronization fixes (fscache cookie
   serialization and truncation handling)
 - seven protocol validation and buffer safety fixes (prevent OOB
   access and loff_t underflow)
 - six metadata and POSIX attribute fixes (proper hard-link counts and
   setuid/setgid stripping)
 - three DFS cache and unmount fixes (prevent target-hint UAF and
   unmount hangs)
 - six general client improvements (fix read request leaks, stats
   loops, handle servers that don't support O_TMPFILE)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTcqRusfSdYROJQwGkpVtNKoQNdYwUCaoy9dgAKCRApVtNKoQNd
 Y5zrAP9HRp0z9rLmezHzGoTnF+0WYnkE9xK9pqRDoIjflXPyDAD+IDYzBXTWJpoq
 O1+3OiuNGvoF+X46i8xE9voAbnCTDgM=
 =ETzr
 -----END PGP SIGNATURE-----

Merge tag 'cifs-fixes-7.3-rc1' of https://git.manguebit.org/linux

Pull smb client updates from Paulo Alcantara:

 - clear sensitive data after use (stack and heap cryptographic
   keys/hashes)

 - file size and cache synchronization fixes (fscache cookie
   serialization and truncation handling)

 - protocol validation and buffer safety fixes (prevent OOB access and
   loff_t underflow)

 - metadata and POSIX attribute fixes (proper hard-link counts and
   setuid/setgid stripping)

 - DFS cache and unmount fixes (prevent target-hint UAF and unmount
   hangs)

 - general client improvements (fix read request leaks, stats loops,
   handle servers that don't support O_TMPFILE)

* tag 'cifs-fixes-7.3-rc1' of https://git.manguebit.org/linux: (33 commits)
  cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
  smb: client: reject a tree connect response whose byte count is too small
  cifs: call pagecache_isize_extended() in cifs_setsize() when extending
  smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
  smb: client: remove redundant NULL check before kfree()
  smb: client: restore the data_offset bound in is_valid_oplock_break()
  cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
  smb: client: Avoid leaking sensitive data to the heap in connect.c
  smb: client: Clear sensitive stack data in smb1encrypt.c
  smb: client: Clear sensitive stack data in cifsencrypt.c
  smb: client: Clear sensitive stack and heap data in smb2ops.c
  smb: client: Clear sensitive stack data in smb2transport.c
  Revert "cifs: remove all cifs files before kill super"
  smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
  smb: client: fix ALIGN() overflow in symlink_data() error context loop
  smb: client: simplify __build_path_from_dentry_optional_prefix()
  smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
  smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
  smb/client: decode reparse metadata using its payload type
  smb/client: preserve open info type across compound queries
  ...
 2026-08-24 18:11:49 -07:00
Frank Sorenson
6c322f5cf7 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 
With len == 0 (clone to EOF), the effective length is computed as:

    len = src_inode->i_size - off;

If off > i_size, this is a negative loff_t, corrupting the ByteCount
in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range
in filemap_write_and_wait_range().  The existing off >= i_size check
fires only after the ioctl has already been sent.

Snapshot i_size_read() once for both the bounds check and the length
calculation, eliminating the TOCTOU and 32-bit torn-read risk.  Reject
off > src_size with -EINVAL.  Treat off == src_size as a no-op,
consistent with __generic_remap_file_range_prep().

Fixes: 04b38d6012 ("vfs: pull btrfs clone API to vfs layer")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Bryam Vargas
65deb18359 smb: client: reject a tree connect response whose byte count is too small 
CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t.  The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.

Reject a byte area too small for what the parser consumes.  Two bytes is
the least it can consume, and no conformant response carries fewer.  The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.

Fixes: cc20c031bb ("cifs: convert CIFSTCon to use new unicode helper functions")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
c510edb973 cifs: call pagecache_isize_extended() in cifs_setsize() when extending 
cifs_setsize() calls truncate_pagecache() but skips
pagecache_isize_extended() on extension.  truncate_setsize() shows
the correct pattern:

  i_size_write(inode, newsize);
  if (newsize > oldsize)
      pagecache_isize_extended(inode, oldsize, newsize);
  truncate_pagecache(inode, newsize);

pagecache_isize_extended() zeroes the tail of the page straddling old
EOF.  Without it, dirty bytes in that region can be written back to
the server, exposing stale data in the newly extended range.

Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
5d14030b46 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV 
The LXDEV block in cifs_query_path_info() uses SMB2_WSL_XATTR_MODE_SIZE
(4) instead of SMB2_WSL_XATTR_DEV_SIZE (8), undercounting eas_len by 4
bytes per $LXDEV EA.

eas_len is used only as a zero/non-zero presence flag so there is no
current functional impact, but the value is incorrect and misleading.

Fixes: 97db41604555 ("smb: client: parse uid, gid, mode and dev from WSL reparse points")
Cc: stable@vger.kernel.org
Cc: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Mohammad Shahid
019716ca26 smb: client: remove redundant NULL check before kfree() 
kfree() safely handles NULL pointers, so the explicit NULL check
before calling kfree() is unnecessary.

This issue was reported by ifnullfree.cocci.

Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Bryam Vargas
ba22f575de smb: client: restore the data_offset bound in is_valid_oplock_break() 
Commit 83bfbd0bb9 ("cifs: Remove the RFC1002 header from smb_hdr")
changed the quantity this bound is measured against.  It used to be
srv->total_read minus the 4-byte RFC1002 preamble that total_read then
included, so it was the SMB message length.  The same commit stopped
counting the preamble, and the mechanical substitution to
srv->total_read - srv->pdu_size left an expression that is identically
zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly
pdu_length - MID_HEADER_SIZE() more, adding both to total_read.

len is therefore 0, the subtraction below it wraps, and no __u32
DataOffset can exceed the result, so the check from commit 097f5863b1
("cifs: read overflow in is_valid_oplock_break()") no longer rejects
anything.  Use total_read, which is now the message length on its own.

Fixes: 83bfbd0bb9 ("cifs: Remove the RFC1002 header from smb_hdr")
Cc: stable@kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
b96db32fed cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() 
When the else branch of cifs_file_set_size() finds a writable file handle
via find_writable_file(), it borrows tcon and server from the handle's
tlink, attempts the handle-based set_file_size() RPC, and then releases
the handle with cifsFileInfo_put().

If set_file_size() fails, execution falls through to the path-based
fallback, which reuses the borrowed tcon and server under the
"if (tcon == NULL)" guard.  Since tcon is not NULL at that point, the
guard is skipped.  If cifsFileInfo_put() dropped the last reference on a
tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE
cleared, as happens during reconnection or session teardown),
cifs_put_tlink() will have freed tcon; the subsequent set_path_size()
call is then a use-after-free.

Setting tcon = NULL after cifsFileInfo_put() causes the existing guard
to take the cifs_sb_tlink() path, which acquires a fresh reference for
the path-based operation or fails cleanly if the session is gone.

Fixes: 110fee6b9b ("smb: client: fix missing timestamp updates with O_TRUNC")
Cc: stable@vger.kernel.org
Cc: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Thomas Huth
111a2b8717 smb: client: Avoid leaking sensitive data to the heap in connect.c 
TCP_Server_Info contains a preauth_sha_hash[] and a cryptkey[] array
that might contain sensitive data. Thus free its memory with
kfree_sensitive() to avoid that we are leaking this information to
the heap.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Thomas Huth
2f9af06e30 smb: client: Clear sensitive stack data in smb1encrypt.c 
Make sure to not leak signature data via the stack, clear it
with memzero_explicit() before leaving the function.

To avoid that we have to introduce "goto"-cleanup here, we re-arrange
the code a little bit (and drop the commented cifs_dump_mem debug
code that looks like a leftover from very early days).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Thomas Huth
1a6bd74a27 smb: client: Clear sensitive stack data in cifsencrypt.c 
Make sure to not leak hash data via the stack, clear it
with memzero_explicit() before leaving the function.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Thomas Huth
55a1ad8413 smb: client: Clear sensitive stack and heap data in smb2ops.c 
Make sure to not leak key-related data via the heap or the stack
by using kfree_sensitive() or memzero_explicit() here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Thomas Huth
3d93986f68 smb: client: Clear sensitive stack data in smb2transport.c 
Sensitive data like keys that are stored in stack-local arrays could
be leaked via the stack to the calling functions. There is no known
vulnerability for this right now, but it's good security style to
explicitly zeroize this sensitive material as soon as possible to
avoid that it could be exploited together with other bugs later.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Zizhi Wo
ce31ec06d3 Revert "cifs: remove all cifs files before kill super" 
This reverts commit 6d9a4aaaa8.

First, directly flushing fileinfo_put_wq in that commit cannot guarantee
that all in-flight I/O has run its cleanup_work on system_dfl_wq and
subsequently called queue_work(fileinfo_put_wq, ...). Flushing only the
latter workqueue may therefore miss puts that have not yet been queued, so
the fix is not reliable in the first place. Moreover, this fix flushes
inside cifs_umount(), which means the busy-dentry warning can still be
triggered when umount_check() is called inside kill_anon_super(), because
kill_anon_super() is executed before cifs_umount().

Second, commit 75f5c412fa ("smb: client: fix busy dentry warning on
unmount after DIO") already drains both serverclose_wq and fileinfo_put_wq
in cifs_kill_sb(), before kill_anon_super(). By adding a per-superblock
outstanding-rreq counter, it guarantees that all cleanup_work for this sb
have run, and thus all relevant cfile puts are queued on fileinfo_put_wq
or serverclose_wq.

Third, no path between those drains and cifs_umount() can queue new work
onto either workqueue. In the "cifs_sb->root == NULL" path there are no
file-related workers either, so that case is safe as well.

Therefore the busy-dentry and null-ptr-deref problems cannot arise, and
the flush added by commit 6d9a4aaaa8 ("cifs: remove all cifs files before
kill super") is redundant and can be removed.

Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
05f78e6cf3 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() 
reparse_buf_ptr() reads buf->ReparseDataLength before checking that
count covers the full fixed header:

    buf = (struct reparse_data_buffer *)((u8 *)io + off);
    len = sizeof(*buf);                          /* 8 bytes */
    rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */

    if (count < len || count < rdlen + len)      /* check comes after */

struct reparse_data_buffer has ReparseDataLength at offset 4.  If a
server returns OutputCount < 6, the read at offset 4-5 reaches past
the end of the received data.  The off+count bounds against iov_len
were already validated, but that does not protect against count being
smaller than sizeof(*buf).

Split the check: verify count >= sizeof(*buf) before reading
ReparseDataLength, then verify count covers the data region.

Fixes: a158bb66b137 ("smb: client: optimise reparse point querying")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
62656b024e smb: client: fix ALIGN() overflow in symlink_data() error context loop 
The check added by commit 7d9a7f1f96 ("smb/client: fix possible
infinite loop and oob read in symlink_data()") compared the post-ALIGN
length against the remaining buffer, but ALIGN() itself can overflow:
for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8)
wraps to 0, so the subsequent bounds check passes, and the loop
advances by zero bytes leaving 'p' pointing into stale data.

Fix by checking the raw ErrorDataLength against the remaining space
before applying ALIGN(), then checking again after.  Since raw_len is
bounded by the buffer, raw_len + 7 cannot overflow, so the second check
is an exact post-alignment bounds guard.

Fixes: 76894f3e2f ("cifs: improve symlink handling for smb2+")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Dmitry Antipov
3fffaa8a64 smb: client: simplify __build_path_from_dentry_optional_prefix() 
Use the convenient 'strreplace()' to simplify
'__build_path_from_dentry_optional_prefix()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
730d0bb195 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 
When a valid primary TRANSACT2 response has been received (mid->resp_buf
set, mid->multiRsp true) and a subsequent secondary response causes
cifs_check_trans2() to return false -- either because the SMB header is
invalid (malformed != 0) or because check2ndT2() rejects the PDU --
handle_mid() overwrites mid->resp_buf with the new buffer (leaking the
primary buffer) and, because mid->multiRsp is set, skips the
server->smallbuf/bigbuf NULL-out.  When the user thread frees
mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the
demux thread reuses it for the next packet, resulting in a use-after-free.

Combine both early-exit conditions and, when mid->multiRsp is already
set, abort the pending transaction inline: set multiEnd, call
dequeue_mid() with malformed=true, and return true so handle_mid() exits
without touching mid->resp_buf or the server buffer pointers.

Fixes: 316cf94a91 ("CIFS: Move trans2 processing to ops struct")
Cc: stable@vger.kernel.org # cifs_check_trans2() is in smb1ops.c on kernels < 7.0
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Frank Sorenson
6343c1da56 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() 
coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:

  data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
                     get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
  data_area_of_src = (char *)&pSMBs->hdr.Protocol +
                     get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
  data_area_of_tgt += total_in_tgt;
  ...
  memcpy(data_area_of_tgt, data_area_of_src, total_in_src);

A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.

The "validate target area" comment present since the function was
first written in 2005 was a placeholder that was never implemented.

Add lower- and upper-bound checks for both data pointers before the
memcpy, and before any target header fields are modified.

Fixes: e4eb295d38 ("[PATCH] cifs: Handle multiple response transact2 part 1 of 2")
Cc: stable@vger.kernel.org
Reported-by: Shen Yongchao <grayhat@foxmail.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Ze Tan
43549eb842 smb/client: decode reparse metadata using its payload type 
cifs_open_info_data stores FILE_ALL_INFORMATION and SMB3 POSIX query
information in a union. reparse_info_to_fattr() selects a union member
from the mount mode, while several directory checks always read
fi.Attributes.

The metadata can instead come from an SMB2 CREATE response on a POSIX
mount, or from a POSIX query while processing a reparse point. In those
cases the mount mode and hard-coded fi accesses select the wrong union
member.

See the procedures below:

  cifs_nt_open
    smb2_open_file
      SMB2_open
        data->fi = SMB2 CREATE response
        data->contains_posix_file_info = false
    cifs_get_inode_info
      reparse_info_to_fattr
        if (tcon->posix_extensions) // true
          smb311_posix_info_to_fattr
            data->posix_fi // wrong union member

  smb311_posix_get_fattr
    smb2_query_path_info
      smb2_compound_op
        data->posix_fi = SMB3 POSIX query response
        data->contains_posix_file_info = true
    reparse_info_to_fattr
      data->fi.Attributes // wrong union member

Add a common DOS attribute accessor and use contains_posix_file_info
both for attribute reads and for the final fattr conversion.

Signed-off-by: Ze Tan <tanze@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:53 -03:00
Ze Tan
9437f2113b smb/client: preserve open info type across compound queries 
contains_posix_file_info describes the metadata stored in the
fi/posix_fi union. GET_REPARSE and QUERY_WSL_EA do not update that
union, so clearing the flag while processing those responses can make
POSIX metadata look like FILE_ALL_INFORMATION.

Set the flag when CREATE or a validated query response actually
populates the union, and leave it unchanged for auxiliary compound
operations. This also avoids changing the type when a query fails
before copying any metadata.

The issue can be reproduced against a Samba server with SMB3 UNIX
extensions enabled:

  mount -t cifs //<server>/<share> /mnt/cifs \
        -o vers=3.1.1,posix,reparse=nfs,actimeo=0
  mkfifo /mnt/cifs/test-fifo
  umount /mnt/cifs
  mount -t cifs //<server>/<share> /mnt/cifs \
        -o vers=3.1.1,posix,reparse=nfs,actimeo=0
  stat -c '%F %s' /mnt/cifs/test-fifo

Before this change, stat reports "fifo 1024" although the server-side
EOF is zero. After this change, it reports "fifo 0".

Fixes: 9df23801c8 ("smb311: failure to open files of length 1040 when mounting with SMB3.1.1 POSIX extensions")
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:52 -03:00
Ze Tan
ebdc1afb1e smb/client: mark missing nlink values as unknown 
Several SMB1 fallback and open responses do not provide the hard link
count. The SMB2 create-only query fallback has the same limitation.
These paths currently leave a zero link count or synthesize a value of
one and then expose it as authoritative metadata.

Mark those results with unknown_nlink so existing inodes keep their
cached link count and new inodes receive the usual sane default.

This was tested against Samba with "server min protocol = NT1". Mount
the share using SMB1 with Unix extensions disabled:

  mount -t cifs //<server>/<share> /mnt/cifs \
        -o username=<user>,vers=1.0,nounix

Create three names for the same inode and cache its real link count:

  TESTDIR=/mnt/cifs/nlink-repro-$$
  mkdir "$TESTDIR"
  touch "$TESTDIR/file1"
  ln "$TESTDIR/file1" "$TESTDIR/file2"
  ln "$TESTDIR/file1" "$TESTDIR/file3"
  stat -c 'before open: %h' "$TESTDIR/file1"

Open the file and read the link count through the open descriptor:

  exec 3<"$TESTDIR/file1"
  stat -Lc 'after open: %h' /proc/$$/fd/3
  exec 3<&-

Clean up the test files:

  rm -f "$TESTDIR/file1" "$TESTDIR/file2" "$TESTDIR/file3"
  rmdir "$TESTDIR"

Before this change, the two stat commands report 3 and 1 because the
SMB1 open response overwrites the known link count. With this change,
both commands report 3.

Signed-off-by: Ze Tan <tanze@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:52 -03:00
Frank Sorenson
48cab1fd57 cifs: fix clearing stats for fastest execution of each smb2 command 
The code to clear the 'fastest_cmd' statistics has a typo that
repeatedly clears the stat for cmd 0, rather than iterating
through each cmd.  Fix the typo (0->i).

Fixes: 433b8dd767 ("SMB3: Track total time spent on roundtrips for each SMB3 command")
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
 2026-08-24 17:08:52 -03:00
Linus Torvalds
66498c75b4 dmaengine updates for v7.3 
Core:
   - New API to combine configuration and preparation and users
 
  New Support:
   - Mediatek MT8189 SoC uart dma support
 
  Updates:
   - Designware dma driver flatten desc structures and simplify code,
     interrupt-path groundwork changes, first part of PCI EP DMA support
   - Updates to zynqmp_dma with runtime PM and device removal improvments
   - Xilinx dma optimizations for AXIDMA and MCDMA channel management
 -----BEGIN PGP SIGNATURE-----
 
 iQIyBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMgZEACgkQfBQHDyUj
 g0e82w/4oLwj2QUjUO3QEO2l4E/RVS2/7UyCYKoJDAh66aM8Z3QjQ+lUvy+4wHHE
 H8AtTpRzGEPpqqU+BckHEySf8mNhlA4ULhX17aPc+NKqYNlW8p2L63kPFYggI1ja
 Z6/zVFrJDLwWTI0bSxAyJ6OoaObSXY0P6qpMcXKcqoHc981+EHMGrt/iVJM4Et/c
 Q6nFMxIMgxYPI1VCMSrJqOBA4ZvymyWBisJPZf6SK0iH3PnaBnGWWWilpT8eUJxm
 /MbVf2aUMetdK1+QVx1nNQUdb1eyAw50zFgbeDFDTXQ85Mfbvwh8XxxuT4wXJS5b
 8MFwIEUq6iRgyjZYlykmFYBXw1A3SZWuWMUuMic4l13lw7dxk92wR31j99pIRaV3
 g2iykz+gzQNQ5RNPuo/9j0s26FAmMNxbFW1RPAMnoVc33vZakV4ueaYtIy7s7mMJ
 eDrE6YNDW24DWfWrSxkQGCW1qFGBUY20dXZ0sBmhUxpTLB0ubPZrWLvKKZe/qTUJ
 wmrGNtTBLAYJMsGBm5VMybXwrQXa2Hvqa6KKFR2TdjpdcJwyWVHzRPpR+sJ7GfxZ
 Lz59ODW3x1MnukRQS/T+RXGT42Tzk+qQQ+xK/yCrXq0VkxE3010n7SglTEEygGYP
 Zk2eos4fARpXOUNqAxoKTVRyvQBxrIrHuJuQjAys2RhLHARuCQ==
 =lUcr
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

Pull dmaengine updates from Vinod Koul:
 "Core:

   - New API to combine configuration and preparation and users

  New hardware support:

   - Mediatek MT8189 SoC uart dma support

  Updates:

   - Designware dma driver flatten desc structures and simplify code,
     interrupt-path groundwork changes, first part of PCI EP DMA support

   - Updates to zynqmp_dma with runtime PM and device removal
     improvments

   - Xilinx dma optimizations for AXIDMA and MCDMA channel management"

* tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (73 commits)
  dmaengine: dw-edma: Mark emulated IRQ as level-triggered
  dmaengine: idxd: assign all engines to group 0 in IAA defaults
  dmaengine: qcom_hidma: remove conditional return with no effect
  dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
  dmaengine: fsl-edma: tracing: no ptr dereference during log output
  dmaengine: dw-edma: Program endpoint function numbers
  dmaengine: dw-edma-pcie: Add chip flags to match data
  dmaengine: dw-edma-pcie: Handle optional data blocks
  dmaengine: dw-edma-pcie: Factor out descriptor block address lookup
  dmaengine: dw-edma-pcie: Add register offset match flag
  dmaengine: dw-edma-pcie: Add platform ops to match data
  dmaengine: dw-edma-pcie: Rename vsec_data to dma_data
  dmaengine: dw-edma-pcie: Add capability match data
  dmaengine: dw-edma-pcie: Track non-LL mode in DMA data
  dmaengine: dw-edma: Add partial channel ownership mode
  dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
  dmaengine: dw-edma: Add core quiesce operations
  dmaengine: dw-edma: Add per-channel interrupt routing control
  dmaengine: dw-edma: Factor out HDMA interrupt setup helper
  dmaengine: dw-edma: Defer channel IRQ handling to workqueue
  ...
 2026-08-24 12:21:15 -07:00
Linus Torvalds
16e6a1a3cb phy updates for 7.3 
As usual bunch of new device and driver support and updates to existing
 drivers and addition of Manivannan to help with reviews.
 
  - New Support
   - Mediatek MT8196 DSI PHY support
   - Renesas RZ/G3L usb2 support
   - Qualcomm SM8475 QMP USB PHY and PCIe phy, IPQ9650 QMP PCIe PHY, QUSB2
     Phy for Shikra SoC,  Hawi support for QMP PCIe phy and UFS PHY. Glymur
     QMP PCIe Multi-PHY driver and multiple link-mode support, ipq5210 PCIe
     phy support
   - Spacemit USB3/PCIe comb PHY driver
 
 - Updates
   - Samsung hdptx driver improvements for modernizing the register
     access and code cleanup
   - Qualcomm drop duplicate v8 DP headers, improved runtime handling for qmp
     drivers
   - Rockchip clock lane phase tuning and 2500 Mbps support and TMDS rate
     handling
   - Freescale imx8mq improvements for runtime pm, pd handling.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMf1YACgkQfBQHDyUj
 g0cx8g/+M2Thg88JXJ1HIbcCD/Dh6gtsZHmnfW71EUxIE//QKV950PE1Oqu/Va7i
 Z9YRonkGjzyuYFJZixW/C8OzL5lqy1vp62t/qbUa1Q4UKawhI+ALEUBrWXkozxyR
 LKM9OSoNTxUa40vJrb54MkiouTrwGOhOPhf0LB6QaIDkQqae5/10uux5TsGdvU57
 pVDC2SIAZaYg4a3xcv0sFVORDuMhPMSGZyjDR2CDSaAdR3H4kau5mfY7+98w8T6u
 dt7wEWThUSFXTSPbHER3zj2JEHlaG/EcOzAmwy44ttqTdqP7X12O4nnJeDE08ymb
 /sib42WwQvL3OwXgzBOKOIF7P6g6691I15lMLIMtGj9j2wyimDchO7YGRcNxtJTt
 3x96YbWABmDbrQblWXZcKro/PG13i0tMxmm4W0HYcCtK5sCvhWpHjwV3n46y6Kuv
 cxgQpsrRwYNGWgMOai9X0ft5tXn5uqFyaGiolPBo7IlOLtbsTuG6Q2H8QbxJKokf
 KjiYofA0EXrp/DtBnSlA1x7S5ODTRi25soHTIvrlJlljls4vRrqV4ZU33peicDY5
 XbXlIX4XOu7pxNtDSpQYoWXnIIDo9/QfpJy4YUlVdGZTtLDcLW98Aqwxre/FWWUj
 c8FeNDGSj0vPaL7Pm8XF4PXmKTW6xjf2MToFcUlAcJsEFsfm1XM=
 =Hg5e
 -----END PGP SIGNATURE-----

Merge tag 'phy-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy updates from Vinod Koul:
 "As usual bunch of new device and driver support and updates to
  existing drivers and addition of Manivannan to help with reviews.

  New Support:
   - Mediatek MT8196 DSI PHY support
   - Renesas RZ/G3L usb2 support
   - Qualcomm SM8475 QMP USB PHY and PCIe phy, IPQ9650 QMP PCIe PHY,
     QUSB2 Phy for Shikra SoC, Hawi support for QMP PCIe phy and UFS
     PHY. Glymur QMP PCIe Multi-PHY driver and multiple link-mode
     support, ipq5210 PCIe phy support
   - Spacemit USB3/PCIe comb PHY driver

  Updates:
   - Samsung hdptx driver improvements for modernizing the register
     access and code cleanup
   - Qualcomm drop duplicate v8 DP headers, improved runtime handling
     for qmp drivers
   - Rockchip clock lane phase tuning and 2500 Mbps support and TMDS
     rate handling
   - Freescale imx8mq improvements for runtime pm, pd handling"

* tag 'phy-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (76 commits)
  MAINTAINERS: Add Manivannan Sadhasivam as the Reviewer for Generic PHY Framework
  phy: rockchip-samsung-dcphy: fix out-of-range max_register
  phy: qcom: qmp-pcie: Add QMP PCIe Multi-PHY driver
  dt-bindings: phy: qcom: Add Glymur QMP PCIe multiple link-mode PHY
  phy: rockchip: samsung-hdptx: Consistently use bitfield macros
  phy: rockchip: samsung-hdptx: Simplify GRF access with FIELD_PREP_WM16()
  phy: rockchip: samsung-hdptx: Drop restrict_rate_change handling
  phy: rockchip: samsung-hdptx: Consolidate consumer_put on error path
  phy: rockchip: samsung-hdptx: Drop TMDS rate setup workaround
  phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes
  phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL
  phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow
  phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate
  phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc
  phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
  phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
  phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
  phy: qcom: qmp-pcie: Add support for SM8475 Gen3x1 PCIe0 port
  phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
  dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Add SM8475 QMP PHY
  ...
 2026-08-24 12:19:23 -07:00
Linus Torvalds
ab9b9b51ba soundwire updates for 7.3 
- Bunch of Intel dmi quirks ghost list handling for Asus Zenbook Duo, Asus
    ROG Zephyrus Duo and Asus Expertbook. Intel Peripheral
    bra_block_alignment handling
  - Cadence library BRA_NumBytes[8] support
  - Qualcomm SCP address paging, bus mclk_freq support. Increase of data
    ports to 17 and driver improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMd8kACgkQfBQHDyUj
 g0dBjg/+Po6cyEfCuBH88IMxUBrcpjODyRdKDMNdM3MxBxYTJQiJmQPO60OwLOR/
 EGDPDUTqrzDt5HwmalgnyM+gEl7aLknwMAmJoK0gCw9BiO/1RfcXPEmLdoIJtrzG
 r2GnDuGzQBpxP//af7/b3N89eTCI3HKBLCHpYapyqFrhbniKHO9uDYsnBTzgz4NI
 GK6WJU5hqx7n92zvruQZIkHYijhYgkRru566eOBx8sDhO+w9lELHDTm7TmW8Qrwo
 XV1jMlPep9edClwYT9MwfEXe8ICwh0gShM3kWrhdi/i1OeEsT0VCa1NzNh14OOuV
 h4LlT0byLDGvx1zzCeDPEG5ZRqO8wdNwe7/1HeR5VD9Sn0pcEZKDWbzFVsiWTnqG
 /QKGjbylbenKZHfaL5EvnyiWhEXLv2t0qiiSWGbT+qEGa2Jk+IL6vps3Kr6dhNcg
 7KZHs5KAag3DTNAtF/W6n7/Ut9rfz6GI4f7acDSfsHz3gRenLqPQmZeAQLX1rtMR
 /A24EMNWkan2ffxMIGgBigQ6WiAVyuUDQFLr1yefhjIGN3+WTTtE/gGaAn+8xbdd
 o1CBUneoRQ3WtdRCljhBIAfM4HdS1i4GxIdvqrcDu1jmIYLsxs2HJIs24uZOC6Mk
 KgnoJbHsiriJ5CvoM5s6eKBI9jsx6XdT/KsLyHwLvVvSnzczIRM=
 =rjmH
 -----END PGP SIGNATURE-----

Merge tag 'soundwire-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

Pull soundwire updates from Vinod Koul:

 - Intel dmi quirks ghost list handling for Asus Zenbook Duo,
   Asus ROG Zephyrus Duo and Asus Expertbook. Intel Peripheral
   bra_block_alignment handling

 - Cadence library BRA_NumBytes[8] support

 - Qualcomm SCP address paging, bus mclk_freq support. Increase of
   data ports to 17 and driver improvements

* tag 'soundwire-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus Duo
  soundwire: stream: validate slave port properties
  soundwire: honor clock_reg_supported in the clock scaling check
  soundwire: qcom: set the bus mclk_freq property
  soundwire: dmi-quirks: Disable ghost Realtek on Asus Zenbook Duo
  soundwire: intel_ace2x: handle the max_data_per_frame property
  soundwire: get mipi-sdw-bra-mode-max-data-per-frame property
  soundwire: intel: handle Peripheral bra_block_alignment
  soundwire: Add bra_block_alignment property support
  soundwire: cadence_master: add BRA_NumBytes[8] support
  soundwire: bus.h: repair kernel-doc comments
  soundwire: intel_auxdevice: Add cs42l44 to wake_capable_list
  soundwire: qcom: add SCP address paging support
  soundwire: dmi-quirks: add a global ghost list
  soundwire: dmi-quirks: Disable ghost Realtek on Asus Expertbook
  soundwire: qcom: Allocate sruntime array dynamically
  soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
  dt-bindings: soundwire: qcom: Increase max data ports to 17
 2026-08-24 12:16:16 -07:00
Linus Torvalds
2f43193b88 dma-mapping updates for Linux 7.3: 
- swiotlb: added new configuration option for the default pool size
 (Jagadeesh Pagadala) and reduced overhead for high watermark tracking
 (chenhuguanshen)
 
 - minor code cleanups and improvements (Vova Sharaienko, Honglei Huang
 and Marek Szyprowski)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaoxGQgAKCRCJp1EFxbsS
 RFPEAP0eo9usjFcvh0YKTPh6/mXgqxRuTNQZ7i+2lRGEczKcJQEA7mwkgwpiOaKn
 f++mMVOmsPvl2Y7r/5XqBWywwhyygA0=
 =X8pY
 -----END PGP SIGNATURE-----
mergetag object 04a19b35dc
 type commit
 tag dma-mapping-7.3-2026-08-24-2
 tagger Marek Szyprowski <m.szyprowski@samsung.com> 1787582472 +0200
 
 second dma-mapping update for Linux 7.3:
 
 - important dma-mapping update for confidential-computing, which adds
 proper tracking of the shared DMA state through direct, pool and swiotlb
 paths (Aneesh Kumar K.V)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaoxYzgAKCRCJp1EFxbsS
 RM9bAP4mJuHHzj2DqsKV7QX19uhyzmsHIg+ecjBNRaOdUAgelQD9FsaG/fwrZnRT
 y89H0QUErqLsdmkDqV0zsXfaGzWY4gk=
 =dKjS
 -----END PGP SIGNATURE-----

Merge tags 'dma-mapping-7.3-2026-08-24' and 'dma-mapping-7.3-2026-08-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping updates from Marek Szyprowski:

 - swiotlb:
     - new configuration option for the default pool size
       (Jagadeesh Pagadala)
     - reduce overhead for high watermark tracking (chenhuguanshen)

 - minor code cleanups and improvements (Vova Sharaienko, Honglei Huang
   and Marek Szyprowski)

 - add proper tracking of the shared DMA state through direct, pool and
   swiotlb paths (Aneesh Kumar K.V)

   This is important for confidential-computing

* tag 'dma-mapping-7.3-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma/swiotlb: decouple high watermark tracking from CONFIG_DEBUG_FS
  MAINTAINERS: update tree for DMA MAPPING HELPERS
  dma/swiotlb: introduce Kconfig option for compile-time default pool size
  dma-direct: Improve readability of the dma_direct_map_sg() for P2PDMA case
  iommu/dma: simplify dma_iova_destroy() and drop the free_iova helper
  dma-coherent: use KiB in DMA allocation logs
  dma-coherent: fix spacing coding style issue

* tag 'dma-mapping-7.3-2026-08-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (23 commits)
  swiotlb: remove unused SWIOTLB_FORCE flag
  dma: swiotlb: handle set_memory_decrypted() failures
  dma: swiotlb: free dynamic pools from process context
  dma-direct: rename ret to cpu_addr in alloc helpers
  dma-direct: select DMA address encoding from __DMA_ATTR_ALLOC_CC_SHARED
  dma-direct: set decrypted flag for remapped DMA allocations
  dma-direct: make dma_direct_map_phys() honor DMA_ATTR_CC_SHARED
  dma-direct: Move dma_direct_map_phys() to dma/direct.c
  dma-direct: pass attrs to dma_capable() for DMA_ATTR_CC_SHARED checks
  dma-mapping: make dma_pgprot() honor __DMA_ATTR_ALLOC_CC_SHARED
  dma: swiotlb: track pool encryption state and honor DMA_ATTR_CC_SHARED
  dma: swiotlb: pass mapping attributes by reference
  dma-pool: track decrypted atomic pools and select them via attrs
  dma-direct: use __DMA_ATTR_ALLOC_CC_SHARED in alloc/free paths
  dma-mapping: Add internal shared allocation attribute
  coco: arm64: s390: powerpc: Mark secure guests with CC_ATTR_GUEST_MEM_ENCRYPT
  dma-direct: swiotlb: handle swiotlb alloc/free outside __dma_direct_alloc_pages
  s390: Expose protected virtualization through cc_platform_has()
  swiotlb: Preserve allocation virtual address for dynamic pools
  dma: free atomic pool pages by physical address
  ...
 2026-08-24 11:35:46 -07:00
Linus Torvalds
918e25291c slab changes for 7.3 
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmqMSHQbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYiaC8EH/ihctMRDnqbUxyc3cSIZ
 cuy3ocSSu8UnHzSNarylY8sVYIYflgY6owV7UvaUKmXGYHiHIDdI5NMDzpjola7X
 Ct7mpIuobFHpFhTQMqvYkeEQ3EytS7NPHKs3jd6t2HSOYJdY4lghjRZcxOlo7+GA
 5EJa468TSHswWbT34e3NY7gpoHCXTucR6FBqoVtluLOliQWNMkWbeDQ9hEnMoyNy
 hEdooWDxt8vBuSqVRCZxrgJRK2nauf1P/CHZm4HcNttOQp0iwr8Q7GER7dBpW0jR
 1b1zM9YPH4g6CSll5V6sWSMUNAaDx3Akx3ZyKhd3G2kyP3HkPXKSag/fS8xxCFLN
 hh0=
 =6lTR
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab updates from Vlastimil Babka:

 - Add kfree_rcu_nolock() that can be used from contexts where spinning
   on a lock might be unsafe, such as a BPF program attached to an
   arbitrary function, or in NMI context. This complements the existing
   kfree_nolock() support (Harry Yoo)

 - Runtime instead of compile-time slabobj_ext sizing.

   Avoid wasting memory when memory allocation profiling is compiled but
   not enabled, with initial partial support to also avoid wasting
   memory for objcg pointers when those are not needed, while profiling
   is enabled (Vlastimil Babka)

 - Various non-urgent fixes, cleanups and optimizations (Hao Li,
   Hongling Zeng, Li RongQing, Li Xiasong, Seongjun Hong, Shengming Hu)

* tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (31 commits)
  mm/slab, kfence, memcg: completely remove obj_ext for kfence objects
  mm/slab: stop allocating objcg pointers when unnecessary
  mm/slab: add cache_ and slab_needs_objcg() helpers
  mm/slab: stop exporting kvfree_rcu_barrier[_on_cache]()
  slub_kunit: extend the test for kfree_rcu_nolock()
  mm/slab: introduce kfree_rcu_nolock()
  mm/slab: introduce struct kvfree_rcu_head for kvfree_rcu batching
  mm/slab: reduce slabobj_ext memory with allocation profiling disabled
  mm/slab: introduce slab_obj_ext_has_codetag()
  mm/slab: allow kfree_rcu_sheaf() on PREEMPT_RT
  mm/slab: extend deferred free mechanism to handle rcu sheaves
  mm/slab: use call_rcu() in unknown context if irqs are enabled
  mm/slab: handle the !allow_spin case in kfree_rcu_sheaf()
  mm/slab: change struct slabobj_ext to a union
  mm/slab: replace slab.stride with obj_exts_in_object
  mm/slab: abstract slabobj_ext.ref access
  mm/slab: abstract slabobj_ext.objcg access
  mm/slab: make slab_obj_ext() determine object index
  mm: move struct slabobj_ext to mm/slab.h
  mm/slab: remove objs_per_slab()
  ...
 2026-08-24 10:58:57 -07:00
Linus Torvalds
a0300e8cf0 configfs changes for v7.3-rc1 
-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEEV4rZyNlmdiYqwGqG+lApCKrFvdAFAmqMG1kWHGEuaGluZGJv
 cmdAa2VybmVsLm9yZwAKCRD6UCkIqsW90MdID/wOtlQoSX0AgF0P8caePJ460pag
 hny+JQsywMqR3nnFzbNW8mchGtKg643rS5ub3GexiJdj1ZS1++5haqAgVh0G3XSn
 kT9CZ9ndMWAzKC+QFfO7F34VLXYx5klZkjF5FJx/NGrNlxaH/gkVMYPbDsJX+FJu
 4YYqu/E7HQ6wPyA4jdnErRW/fBKSHJ9DosJ7L19u/xbXrStk1oRMQC2xHY3gnEuX
 3MEJOjm62mB3d2Syr42gjggL47hy0JDm38wI8akky7EvK7uOzhNE9Wk+cTpoUz7w
 zTTTr+N03jRPkrbFL3nHlGj38sUh3y7b1Ce650YvkRVIebo/2xKMhK+sZUnfmz/v
 aUEN0MrEzT05uYxZGtv96TtXm+980LVsJuARbvfrQAIeApGnkqm+x+AVSk2SaHXN
 kGtGUvOd+0XCPA1ZYxMkBcUOIDv5rLnlQrYAdWDq6OK4hjbL0I+qC0gbFZqtYKr8
 yn/0PNjNoz52qimdtxft280tKQT3jC0no3IOUOcEhgUl4ibpHOK5R0nAKdtHUMCE
 mo7XK2tsR/EfZkJRLhNaYIK2kF+kVmmY5LECZgbZeBaqQk+0f14bNhwwUANTE9DJ
 vsxEdsYDSSW+FKPxnrqnLvprJg1WOnjYORDhjkIArNJNawaPR1uaoJpQkanwUdnW
 j/SHjUoloWAAr35LAg==
 =fzXE
 -----END PGP SIGNATURE-----

Merge tag 'configfs-for-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux

Pull configfs update from Andreas Hindborg:
 "Update configfs MAINTAINERS entry.

  Breno Leitao will maintain configfs C code going forward. I will
  continue maintaining configfs Rust parts"

* tag 'configfs-for-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux:
  MAINTAINERS: configfs: split configfs entry in C and Rust parts
 2026-08-24 10:51:49 -07:00
Linus Torvalds
5b05bb3f6c platform-drivers-x86 for v7.3-1 
Highlights:
 
 - amd/halo: Add Halo RGB LED driver
 
 - amd/hsmp:
   - Properly serialize probe, remove, and data paths
   - Add support for protocol v7 used by Family 1AH Model 80H
   - Fix error checking corner cases (largely from AI review)
   - Reject negative power cap
 
 - amd/pmc:
   - Improve behavior on platforms that do not support STB
   - Add T14 Gen2 AMD (20XL) to s2idle quirk list
 
 - amd/pmf:
   - Add ioctl interface to retrieve device metrics
   - Add support for new metrics tables used by Family 1AH Model 80H
 
 - arm64: qcom-hamoa-ec: Reject short responses
 
 - asus-nb-wmi: Support ProArt key on ASUS ProArt PX13
 
 - asus-armoury:
   - Gate PPT writes behind active fan curve
   - Add power limits for more models
 
 - dell-wmi-base: Fix handling of ultra performance key
 
 - dell-wmi-sysman: Don't hex dump attribute security buffer
 
 - hp-bioscfg:
   - Various fixes
   - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)
 
 - lg-laptop:
   - Fix LED resource handling
   - Add support for events used in newer models
   - Fix keyboard backlight support on LG Gram 16T90SP
 
 - hp-wmi:
   - Generalize thermal params to board params
   - Manage CPU and GPU PWM independently
   - Add GPU MUX switch support
   - Add Victus 15-fb0xxx support
   - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
     16-wf0xxx, and OMEN board ID 8D88 support
   - Add OMEN Transcend 16-u0xxx support
 
 - huawei: Add support for Fn-lock ACPI interface found on newer Huawei
           laptops such as MateBook 14 2024
 
 - ISST:
   - Improve input validation (many fixes)
   - Disallow SST-CP (core-power) feature if perf profile add fails
 
 - lenovo/yb9-kbdock: Add driver for Yoga Book 9 14IAH10
 
 - lenovo/ymc:
   - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
   - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
     nodes
 
 - msi-ec: Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support
 
 - msi-wmi: Add MSI Claw M-Center keys support
 
 - oxpec: Add support for OneXPlayer X2 Mini Pro
 
 - redmi-wmi: Report kbd backlight cycle, OEM preset power mode, and FnLock
              toggle events to userspace
 
 - samsung-galaxybook: Add Samsung Galaxy Book6 Pro support
 
 - thinkpad_acpi: Add USB-C Security support
 
 - uniwill-laptop:
   - Add keyboard backlight, AC auto boot, and USB powershare support
   - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
   - Make lightbar max brightness configurable and add support for
     LAPQC71A/B
 
 - Major refactoring efforts:
   - Stop setting acpi_device_name/class() and pnp.device_class to
     faciliate their eventual removal
 
 - Many rollback/remove path fixes (presumably mostly found by AI)
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  reject missing gaming WMI results
 
 amd/hsmp:
  -  ACPI HSMP refcounted sockets and coordinated release
  -  Add HSMP messages for Family 1Ah, Model 50h-5Fh
  -  Add IOCTL_GET_TELEMETRY_DATA for metric table reads
  -  Clear mdev.this_device on deregister
  -  Enable protocol version 7 metric tables on the ACPI driver
  -  Gate the data plane on a fully initialized socket
  -  Map the metric table with ioremap() and unmap it explicitly
  -  Pass struct device explicitly to ACPI mailbox parsers
  -  Reject negative power cap writes in hwmon
  -  Serialize ACPI HSMP probe and remove with an rwsem
  -  Serialize per-socket metric table reads with a mutex
  -  Serialize the data plane against socket teardown
  -  Source metric-table size from firmware
  -  Unify response_sz validation to an upper-bound check
  -  Validate ACPI UID before parsing socket index
  -  Validate _DSD mailbox sub-package element count
 
 amd:
  -  Introduce Halo Box RGB LED driver
 
 amd/pmc:
  -  Add T14 Gen2 AMD (20XL) to s2idle quirk list
  -  Do not fail probe when STB init fails
  -  Fix LPS0 and debugfs leaks when STB init fails
  -  Fix msg_port restoration in amd_stb_debugfs_open_v2()
  -  Only expose stb_read after telemetry buffer is mapped
  -  Propagate SMU errors and validate S2D address
  -  Restore msg_port on amd_stb_s2d_init() error paths
 
 amd/pmf:
  -  Add 1AH_M80H device IDs and extended SMU mailbox registers
  -  Add 1AH_M80H metrics table and NPU metrics support
  -  Add missing newline in dev_err message
  -  Add util layer and userspace character device interface
  -  Implement util layer ioctl handler
  -  Introduce AMD PMF testing tool for driver metrics and features
  -  Move debug helper functions to UAPI header
  -  Move metrics code to dedicated file
  -  Refactor NPU metrics for platform extensibility
  -  store BIOS output values for user-space metrics via util IOCTL
  -  Store commonly used enums in the header file
  -  Use per-SoC smu_regs struct for SMU mailbox registers
  -  Use upper/lower_32_bits() in amd_pmf_set_dram_addr()
 
 arm64: qcom-hamoa-ec:
  -  reject incomplete responses
 
 asus-armoury:
  -  Add power limits for ROG Strix SCAR 16 (G635LX)
  -  Add power limits quirk for FA401KM
  -  Add power limits quirk for FA608WV
  -  add support for FX517ZR
  -  add support for HN7306EA and HN7306EAC
  -  fix Use-After-Free and memory leak in driver init
  -  gate PPT writes behind active fan curve
  -  use cleanup.h to manage tunables
 
 asus-laptop:
  -  Stop setting acpi_device_name/class()
 
 asus-nb-wmi:
  -  map ProArt key (0x8b) to KEY_PROG3
 
 asus-wireless:
  -  Fail probe when there is no ACPI match
 
 asus-wmi:
  -  fix resource leaks on probe failure
 
 dell-ddv:
  -  Use no_free_ptr() to simplify error handling
 
 dell-privacy:
  -  Fix race condition
 
 dell-smbios:
  -  Pass device to callbacks
 
 dell-smbios-wmi:
  -  Fix chardev resource management
  -  Replace global list with single item
 
 dell-wmi-base:
  -  Fix handling of ultra performance key
  -  Fix resource leak on module load failure
 
 dell-wmi-sysman:
  -  Don't hex dump attribute security buffer
  -  Fix instance ID bounds
 
 Documentation/ABI:
  -  add testing entry for AMD PMF character device interface
 
 eeepc-laptop:
  -  Stop setting acpi_device_name/class()
 
 fujitsu-laptop:
  -  Stop setting acpi_device_name/class()
 
 fujitsu-tablet:
  -  Stop setting acpi_device_name/class()
 
 hp-bioscfg:
  -  accept reduced ACPI packages from older HP BIOS
  -  advance elem past consumed array elements
  -  bound ordered-list parsing by the package count
  -  fix heap OOB read in sk_store() and kek_store()
  -  fix heap OOB read on empty password write
  -  fix new_password_store() overwriting current_password
  -  fix off-by-one write in hp_get_string_from_buffer()
  -  fix ORD_LIST_ELEMENTS never being parsed
  -  fix password encoding bounds check
  -  pass validated element count to package parsers
  -  warn on element type mismatch instead of failing
 
 hp-wmi:
  -  Add dual-channel PWM fan control
  -  Add GPU MUX switch support
  -  Add OMEN board 8A43 thermal profile support
  -  Add OMEN board 8BA9 thermal profile support
  -  Add OMEN board 8BAA thermal profile support
  -  Add OMEN board 8D88 thermal profile support
  -  Add OMEN Transcend 16 8BB3 support
  -  Add support for OMEN MAX 16-ak0xxx (8DD6)
  -  Add Victus 15-fb0xxx support
  -  Drive fan control from board data
  -  Introduce board-specific feature data
 
 huawei-wmi:
  -  add ACPI fallback for Fn-lock on newer models
 
 ideapad-laptop:
  -  Fix driver unregistration order
 
 int1092:
  -  Fix info leak in parse_package()
  -  Fix potential memory leak in sar_probe()
 
 intel/pmc:
  -  initialize empty PMT read result
 
 ishtp_eclite:
  -  Fix ACPI device reference leak in probe error path
 
 ISST:
  -  Add a NULL check for sst_inst[]
  -  Just allow 2 bits for SST feature enable
  -  Return error during profile addition
  -  Use PP level enable mask
  -  Validate level in perf mask ioctls
  -  Validate logical CPU id and clos id
  -  Validate max level for set feature
  -  Validate parameter for core power state
  -  Validate parameter for frequency and priority
  -  Validate socket ID in clos_assoc ioctl
 
 lenovo:
  -  Add Yoga Book 9 keyboard dock detection driver
 
 lenovo: lenovo-ymc:
  -  Suppress probe on Yoga Book 9 14IAH10
 
 lenovo/ymc:
  -  Only match lower byte in WMI lid switch query response
 
 lg-laptop:
  -  Add support for additional events
  -  Add support for native ACPI events
  -  Fix keyboard backlight support on LG Gram 16T90SP
  -  Fix LED resource handling
  -  Improve WMAB control method support
 
 MAINTAINERS:
  -  update Intel PMC Core maintainer contact
 
 mlxbf-bootctl:
  -  fix the build error with FIELD_PREP()
 
 mlxbf-pmc:
  -  Check ACPI_COMPANION() against NULL
 
 msi-ec:
  -  Add MSI Katana GF76 11UEK EC firmware
  -  Add MSI Raider A18 HX A9WJG EC firmware
 
 msi-wmi:
  -  Add MSI Claw M-Center keys
  -  Reformat msi_wmi_notify()
 
 oxpec:
  -  Add support for OneXPlayer X2 Mini Pro
 
 panasonic-laptop:
  -  Fix sentinel write past pcc->sinf[]
  -  Stop setting acpi_device_name/class()
 
 power: supply: surface_{battery,charger}:
  -  Consistently define ssam_device_ids using named initializers
 
 redmi-wmi:
  -  report EC state change events
 
 samsung-galaxybook:
  -  Add SAMB430 device ID
 
 sony-laptop:
  -  Stop setting acpi_device_class()
 
 sonypi:
  -  Stop setting acpi_device_name/class()
 
 surface: acpi-notify:
  -  Check ACPI companion before use
 
 surface: aggregator:
  -  Consistently define ssam_device_ids using named initializers
 
 surface: surfacepro3_button:
  -  Stop setting acpi_device_name()
 
 think-lmi:
  -  Fix certificate thumbprint sysfs output
  -  Fix current password length check
  -  Free system certificate signatures
 
 thinkpad_acpi:
  -  Add USB-C Security (USCS) support
  -  Fix fan speed reporting on Edge E330
  -  Fix USB-C Security probe failure on unsupported platforms
  -  Stop setting acpi_device_class()
 
 topstar-laptop:
  -  Stop setting acpi_device_name/class()
 
 toshiba_acpi:
  -  Do not use uninitialized device_class
 
 toshiba_bluetooth:
  -  Use more common error handling code in toshiba_bt_rfkill_probe()
 
 toshiba_haps:
  -  Do not use uninitialized device_class
 
 uniwill-laptop:
  -  Add 2 new feature defines for TUXEDO devices
  -  Add AC auto boot support
  -  Add Avell A60 MUV support
  -  Add keyboard backlight support
  -  Add lightbar support for LAPQC71A/B
  -  Add support for the AiStone X4SP4NAL
  -  Add support for the MACHENIKE L16 Pro
  -  Add support for USB powershare
  -  Handle screen-related events
  -  Remove single color keyboard detection
  -  Split uniwill_kbd_led_init()
 
 x86/platform/olpc: xo15:
  -  Stop setting acpi_device_name/class()
 
 xo15-ebook:
  -  Stop setting acpi_device_name/class()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaow0EgAKCRBZrE9hU+XO
 MRvYAP412gjYokIoj6ncE2OD897gX2d5BwUVKkraQHoevxLm8wEAikY+iYbdOv3a
 fqhPeCDZSRBn6yEBHewY7cdotNDn2go=
 =d/Uf
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen
 "Highlights:

  Major refactoring effort: stop setting acpi_device_name/class() and
  pnp.device_class to facilitate their eventual removal

  Many rollback/remove path fixes (presumably mostly found by AI)

  Miscellaneous cleanups / refactoring / improvements

  amd/halo:
   - Add Halo RGB LED driver

  amd/hsmp:
   - Properly serialize probe, remove, and data paths
   - Add support for protocol v7 used by Family 1AH Model 80H
   - Fix error checking corner cases (largely from AI review)
   - Reject negative power cap

  amd/pmc:
   - Improve behavior on platforms that do not support STB
   - Add T14 Gen2 AMD (20XL) to s2idle quirk list

  amd/pmf:
   - Add ioctl interface to retrieve device metrics
   - Add support for new metrics tables used by Family 1AH Model 80H

  qcom-hamoa-ec (arm64):
   - Reject short responses

  asus-nb-wmi:
   - Support ProArt key on ASUS ProArt PX13

  asus-armoury:
   - Gate PPT writes behind active fan curve
   - Add power limits for more models

  dell-wmi-base:
   - Fix handling of ultra performance key

  dell-wmi-sysman:
   - Don't hex dump attribute security buffer

  hp-bioscfg:
   - Various fixes
   - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)

  lg-laptop:
   - Fix LED resource handling
   - Add support for events used in newer models
   - Fix keyboard backlight support on LG Gram 16T90SP

  hp-wmi:
   - Generalize thermal params to board params
   - Manage CPU and GPU PWM independently
   - Add GPU MUX switch support
   - Add Victus 15-fb0xxx support
   - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
     16-wf0xxx, and OMEN board ID 8D88 support
   - Add OMEN Transcend 16-u0xxx support

  huawei:
   - Add support for Fn-lock ACPI interface found on newer Huawei
     laptops such as MateBook 14 2024

  ISST:
   - Improve input validation (many fixes)
   - Disallow SST-CP (core-power) feature if perf profile add fails

  lenovo/yb9-kbdock:
   - Add driver for Yoga Book 9 14IAH10

  lenovo/ymc:
   - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
   - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
    nodes

  msi-ec:
   - Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support

  msi-wmi:
   - Add MSI Claw M-Center keys support

  oxpec:
   - Add support for OneXPlayer X2 Mini Pro

  redmi-wmi:
   - Report kbd backlight cycle, OEM preset power mode, and FnLock
     toggle events to userspace

  samsung-galaxybook:
   - Add Samsung Galaxy Book6 Pro support

  thinkpad_acpi:
   - Add USB-C Security support

  uniwill-laptop:
   - Add keyboard backlight, AC auto boot, and USB powershare support
   - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
   - Make lightbar max brightness configurable and add support for
     LAPQC71A/B"

* tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (152 commits)
  platform/x86: think-lmi: Fix current password length check
  platform/x86: redmi-wmi: report EC state change events
  MAINTAINERS: update Intel PMC Core maintainer contact
  platform/x86: oxpec: Add support for OneXPlayer X2 Mini Pro
  platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330
  platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware
  platform/x86: think-lmi: Fix certificate thumbprint sysfs output
  mlxbf-bootctl: fix the build error with FIELD_PREP()
  platform/x86: think-lmi: Free system certificate signatures
  platform/x86: ISST: Add a NULL check for sst_inst[]
  platform/x86: ISST: Return error during profile addition
  platform/x86: ISST: Just allow 2 bits for SST feature enable
  platform/x86: ISST: Use PP level enable mask
  platform/x86: ISST: Validate parameter for frequency and priority
  platform/x86: ISST: Validate parameter for core power state
  platform/x86: ISST: Validate max level for set feature
  platform/x86: ISST: Validate logical CPU id and clos id
  platform/x86: ISST: Validate level in perf mask ioctls
  platform/x86: ISST: Validate socket ID in clos_assoc ioctl
  platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
  ...
 2026-08-24 10:16:35 -07:00
Linus Torvalds
8bfab832ad mailbox: updates for v7.3 
- mhuv2: convert channel translation to fw_xlate() and use generic device
           property APIs
  - axiado: add AX3005 mailbox controller driver and DT bindings
  - bcm2835: use platform_get_irq() and simplify probe error handling
  - cix: fix DT property string typo and use dev_err_probe()
  - exynos: add Exynos850 mailbox driver support and DT bindings
  - microchip: add null check for devm_kasprintf()
  - pcc: fix missed-interrupt command timeout, verify shared memory signature,
        and notify clients on polled completion
  - qcom: fix CPUCP PREEMPT_RT deadlock and NULL data crash, fix IPCC duplicate
         channel allocation across holes, and add IPQ5210 APCS and Nord IPCC bindings
  - riscv: validate RPMI notification buffer lengths and event payload bounds
  - rockchip: manage peripheral clock with devm helper and drop unused struct field
  - ti-msgmgr: convert bindings to DT schema
  - misc: remove redundant dev_err()/dev_err_probe() on IRQ request failures
         across drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6EwehDt/SOnwFyTyf9lkf8eYP5UFAmqLoQ8ACgkQf9lkf8eY
 P5X5Yg//fV6vjCgnuCPSfL0z8RbGrE8WlY9XWmQnp5boKa7rjNVKedwkiPxNFMAw
 ro/ERpyfxLSQziws/nonAr7bJ5yxrz6wHFU6++5rT9w5m4e0Y7meoKT6GEj+1bEy
 1kQ/4xmaZSLkUUTJkndU6wGBWxt0GJHObUNzVJxx28E0f1OAQa4MojT96gcgx8tm
 uPzaL6acBigsLRtlCUYgtTR5/CLi9ArJmzRYrWVNG07fxr4sSKuMWTp5Fu+te5/w
 jLJXyEgdzIzbjKrysyQPt0Di3iR2raTlw/86bFQtqdk4GNBMjPcQQtc7qWhUsst8
 XhjXm0OB8yHtJ0cn59yLeChWZ/2Cc+nPqWtYdtadWghuqnTGfdpjkS2sngPsNVRy
 txEvyqgzszQcpAqemKVnVlKHBgq0D3VwMR3KQ/tUIWLgpxw5YcG4oczum/Cf+YOR
 i3VVbxFKkzHjopzh8Gh7pgAuwY4uJnVEgOtFnQLGe6goLcs6nNmBAMe6wi2Ge5mQ
 0ZxoAj1z7pylQPiAQViPYM1uJcgRWJx+B6dzfBJKKBSTsHmHPhjXVYqbs/5/RrU+
 0iHNFVs2dQuKkyjgOQ/qX7Oas3uasc87nuTM7yyHfhFjgt3G+7XaDPETgVuBK/BX
 /3vlpkQEjQFL5CJVcxCZ0/ZSQnwhx0Kr84qXEttq2LMl1Qlzq5w=
 =rp2p
 -----END PGP SIGNATURE-----

Merge tag 'mailbox-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox

Pull mailbox updates from Jassi Brar:

 - mhuv2:
     - convert channel translation to fw_xlate()
     - use generic device property APIs

 - axiado:
     - add AX3005 mailbox controller driver and DT bindings

 - bcm2835:
     - use platform_get_irq()
     - simplify probe error handling

 - cix:
     - fix DT property string typo
     - use dev_err_probe()

 - exynos:
     - add Exynos850 mailbox driver support and DT bindings

 - microchip:
     - add null check for devm_kasprintf()

 - pcc:
     - fix missed-interrupt command timeout
     - verify shared memory signature
     - notify clients on polled completion

 - qcom:
     - fix CPUCP PREEMPT_RT deadlock and NULL data crash
     - fix IPCC duplicate channel allocation across holes
     - add IPQ5210 APCS and Nord IPCC bindings

 - riscv:
     - validate RPMI notification buffer lengths and event payload bounds

 - rockchip:
     - manage peripheral clock with devm helper
     - drop unused struct field

 - ti-msgmgr:
     - convert bindings to DT schema

 - remove redundant dev_err()/dev_err_probe() on IRQ request failures
   across drivers

* tag 'mailbox-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: (22 commits)
  mailbox: add Axiado AX3005 mailbox driver
  dt-bindings: mailbox: add Axiado AX3005 mailbox
  dt-bindings: mailbox: Convert TI Message Manager to DT schema
  mailbox: cix: fix DT property name string typo and use dev_err_probe()
  mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
  mailbox: bcm2835: use platform_get_irq and simplify probe
  mailbox: qcom-ipcc: fix duplicate channel allocation across holes
  mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
  mailbox: Remove redundant dev_err()/dev_err_probe()
  dt-bindings: mailbox: qcom: Add IPQ5210 APCS compatible
  dt-bindings: mailbox: qcom-ipcc: Document Nord IPCC
  mailbox: exynos: Add support for Exynos850 mailbox
  dt-bindings: mailbox: google,gs101-mbox: Add samsung,exynos850-mbox
  mailbox: pcc: Fix command timeout due to missed interrupt
  mailbox: pcc: Check shared memory signature on request
  mailbox: pcc: Notify clients on polled completion
  mailbox: rockchip: drop unneeded runtime pointer (pclk)
  mailbox: rockchip: disable pclk on probe failure and unbind
  mailbox: qcom-cpucp: handle NULL data in send_data callback
  mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
  ...
 2026-08-24 10:03:49 -07:00
Paolo Bonzini
76671054f9 KVM/arm64 changes for 7.3 
- Add support for 'slot' based PMU events, paired with new UAPI that
    compels the user to select a specific PMU implementation
 
  - Lazy save/restore of vCPU state for pKVM, along with various fixes
    and cleanups to the management of vCPU state between the untrusted
    host and pKVM hypervisor
 
  - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
    is present, guaranteeing that EL2-specific register bits are stateful
    in the EL1 counterpart
 
  - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
    of those instructions remains 'in host' (i.e. L1 kernel/userspace)
 
  - Pile of fixes for the management of the VNCR pseudo-TLB, such as
    under-invalidations and races with concurrent TLBIs on other vCPUs
 
  - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
    runtime-patched constant, allowing the same data to be shared with
    pKVM prior to dropping host privileges
 
  - Considerable pile of LLM-assisted fixes around the shop but mostly in
    the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaoZ/khccb2xpdmVyLnVw
 dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFkK7AP9zvAcDf+DVte8+mZjCMDrvNB1n
 UWsBnQkdZ1nDDYBJlwD8D1pvurK4ZV3UIl68IgpTqYKhMspCuOWDHrnBt1QyqQU=
 =2iPX
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 changes for 7.3

 - Add support for 'slot' based PMU events, paired with new UAPI that
   compels the user to select a specific PMU implementation

 - Lazy save/restore of vCPU state for pKVM, along with various fixes
   and cleanups to the management of vCPU state between the untrusted
   host and pKVM hypervisor

 - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
   is present, guaranteeing that EL2-specific register bits are stateful
   in the EL1 counterpart

 - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
   of those instructions remains 'in host' (i.e. L1 kernel/userspace)

 - Pile of fixes for the management of the VNCR pseudo-TLB, such as
   under-invalidations and races with concurrent TLBIs on other vCPUs

 - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
   runtime-patched constant, allowing the same data to be shared with
   pKVM prior to dropping host privileges

 - Considerable pile of LLM-assisted fixes around the shop but mostly in
   the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
 2026-08-24 12:42:07 -04:00
Linus Torvalds
47096fc3d0 i2c for v7.3, part 2 
Fixes and cleanups around probe error handling, resource
 management and a minor Rust cleanup.
 
 Drivers:
 - several drivers: drop duplicate IRQ error reporting
 - imx-lpi2c: improve probe initialization and error cleanup
 - mxs: fix DMA channel leak on probe failure
 - ocores: fix clock cleanup on resume failure
 - rcar: handle reset controllers without status support
 
 Muxes:
 - demux-pinctrl: fix OF node leak on allocation failure
 
 Rust:
 - mark trivial I2cAdapter reference-counting methods inline
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaowtFAAKCRDaeAVmJtMt
 btHCAQCsWbWHyIgqrfHvJqD0IhdB6jc5UB/9Uu1cArF9V4mCVwD/XLkzuBtKDw82
 QAaonKQUp9OaS7TAlZqcmGxMn+yGhg8=
 =ULkr
 -----END PGP SIGNATURE-----

Merge tag 'i2c-7.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

Pull more i2c updates from Andi Shyti:
 "Fixes and cleanups around probe error handling, resource management
  and a minor Rust cleanup.

  Drivers:
   - several drivers: drop duplicate IRQ error reporting
   - imx-lpi2c: improve probe initialization and error cleanup
   - mxs: fix DMA channel leak on probe failure
   - ocores: fix clock cleanup on resume failure
   - rcar: handle reset controllers without status support

  Muxes:
   - demux-pinctrl: fix OF node leak on allocation failure

  Rust:
   - mark trivial I2cAdapter reference-counting methods inline"

* tag 'i2c-7.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: rust: mark I2cAdapter methods as inline
  i2c: rcar: fix reset handling for Gen5
  i2c: mxs: fix DMA channel leak on probe error
  i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
  i2c: ocores: Disable clock on failed resume
  i2c: imx-lpi2c: reset controller in probe stage
  i2c: imx-lpi2c: properly unwind resources on probe failure
  i2c: busses: drop redundant dev_err_probe() around irq helpers
 2026-08-24 09:07:15 -07:00
Linus Torvalds
cf9610f911 Pin control bulk changes for kernel v7.3 
Core changes:
 
 - Use the non-blocking mux_state_try_select() in the generic
   MUX pin control back-end.
 
 - Free pin maps on pinctrl_generic_to_map() failure in the core
   helpers.
 
 New drivers:
 
 - Qualcomm Maili TLMM SoC pin control.
 
 - Qualcomm PMG1110 PMIC pin control.
 
 - Qualcomm Eliza LPASS LPI TLMM SoC pin control (this is for
   the low power audio, LPASS = Low Power Audio SubSystem
   portions).
 
 - Upboard support on top of the Intel pin controller.
 
 - Apple T6030 and T6031 support (just compatible strings).
 
 - Samsung Exynos 8855 SoC pin control.
 
 - Mediatek MT6858 SoC pin control.
 
 - Rockchip RK3308B SoC pin control.
 
 - Rockchip RV1106 SoC pin control.
 
 - Airoha EN7523 SoC pin control.
 
 - Airoha AN7563 SoC pin control.
 
 Improvements:
 
 - Qualcomm TLMM GPIOs are unconditionally marked as wakeup capable.
 
 - Qualcomm improvements on top of the Qualcomm PDC (power domain
   controller) irqchip improvements from tglx:s tree.
 
 - Qualcomm IPQ806x and IPQ9650 nonurgent pin grop fixups.
 
 - The NPCM8xx driver has been put into shape fixing many pin and
   group definitions.
 
 - Some nonurgent Tegra 264 pin assignments are fixed up.
 
 - Some nonurgent fixups to Airoha AN7581 and AN7583 registers and
   pin assignments, missing features etc.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmqMBvYACgkQQRCzN7AZ
 XXOCRw//aRnxM6R7HJkmcJt70749sE2GSbQ5Vx22zkRLRt8FA0QL4GdPQWjG+rwA
 /Q5XhMv5TpSXaBo63fFyAEHEhgbuxlgyUMijpXuMFVHB4AKIcp0P9Mn+TfTkpsIu
 QPIUktn2wqaIoFoAZj7G2KhXUyyeQnISplBSFl4wfpsJ25fjKqqeoiOMrMCVc05A
 Hfgm047beur5vkvYBIwFG0BC992l9ucSQJ4jDEm2XtkQ/NqIQBd16lYdxrb6vkJu
 Bj2qUH/GVQN3c+n2ZgfwVbkoWMum7VgBymxbnjhraJmQoGm27IQsnBtDnhD5bv6s
 bk5Y6Vyji0kNhHYU5uBFwjDWmYt5PxjXynkeFuruNuBkqnioQCyoTNlIeiJf5pZv
 kM0dBkR0eUTQVPrZX5kXbi9B2JqdbnkdhKbL2YQt1zV0uvs1m8xl3dLu+bvtHjEM
 xNghQKkSDvSHDgulbjTcKEthILSA48Q+poCaOoYre8KIOc4I7novSal6UzcHoTH7
 4D8+BnwJXbS5RRIG2snUWHRLB8aY+yuPlfAQBrAu0apuKWrnr2SjfWMMek1kDv57
 U/iXjSKvjSUQc+sYhq+cPMrD8yYqjIgfg483p4L8xsTIi0Mer6UhnHcZJ82TONTa
 K1A3iGlKOtw4jNFOeow8VAW8MyEHcnx3q70rgA2O+eH7WpT28rs=
 =sSjn
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control updates from Linus Walleij:
 "Core changes:

   - Use the non-blocking mux_state_try_select() in the generic MUX pin
     control back-end

   - Free pin maps on pinctrl_generic_to_map() failure in the core
     helpers

  New hardware pin control:

   - Qualcomm Maili TLMM SoC, PMG1110 PMIC, and Eliza LPASS LPI TLMM SoC
     (this is for the low power audio, LPASS = Low Power Audio SubSystem
     portions)

   - Upboard support on top of the Intel pin controller

   - Apple T6030 and T6031 support (just compatible strings)

   - Samsung Exynos 8855 SoC

   - Mediatek MT6858 SoC

   - Rockchip RK3308B and RV1106 SoCs

   - Airoha EN7523 and AN7563 SoCs

  Improvements:

   - Qualcomm TLMM GPIOs are unconditionally marked as wakeup capable

   - Qualcomm improvements on top of the Qualcomm PDC (power domain
     controller) irqchip improvements from tglx:s tree

   - Qualcomm IPQ806x and IPQ9650 non-urgent pin grop fixups

   - The NPCM8xx driver has been put into shape fixing many pin and
     group definitions

   - Some non-urgent Tegra 264 pin assignments are fixed up

   - Some non-urgent fixups to Airoha AN7581 and AN7583 registers and
     pin assignments, missing features etc"

* tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (130 commits)
  dt-bindings: pinctrl: Convert TI DA850 pupd to DT schema
  pinctrl: meson: sync some modify from A4
  pinctrl: meson: a4: Add input enable pin configuration
  pinctrl: realtek: rtd1625: remove unused group name spdif_sel
  pinctrl: realtek: rtd1625: fix base_bit for VE4 GPIO 13
  dt-bindings: pinctrl: microchip,pic32mzda-pinctrl: Convert to DT schema
  Revert "Merge branch 'ib-rsk7204' into devel"
  pinctrl: rockchip: Add RV1106 pinctrl support
  dt-bindings: pinctrl: rockchip: Add RV1106 compatible
  pinctrl: rockchip: Decode drive strength in the get function
  pinctrl: fix PINCTRL_GENERIC_MUX not always being selectable
  pinctrl: airoha: add support of an7563 SoC
  dt-bindings: pinctrl: airoha: add support of an7563 pin controller
  pinctrl: airoha: try to find chip scu node by phandle first
  pinctrl: airoha: add support of en7523 SoC
  dt-bindings: pinctrl: airoha: add support of en7523 pin controller
  pinctrl: airoha: an7583: add support for olt pinmux
  pinctrl: airoha: an7583: add support for pon_alt pinmux
  pinctrl: airoha: an7583: add support for npu_uart pinmux
  dt-bindings: pinctrl: airoha: an7583: add missed features
  ...
 2026-08-24 08:46:03 -07:00
Linus Torvalds
0b0e645ed2 auxdisplay for v7.3-1 
* Cancel backlight work on panel registration failure
 * Miscellaneous cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqaflIX74DDDzMJJtb7wzTHR8rCgFAmqL4y0ACgkQb7wzTHR8
 rCh9oQ/+LJ/jsPyYb43AupK1iyOVCA9BO6Vjn/eb8bM+v4cyt9BN3NdoIgLe5bQM
 HdLBqQuuB2UD5Fo5QmGNitcmqU9XGucOMzrGK9nJlgdXHsMCeNtykbt0Jpunr5t8
 1d0CQgCfsk2PF6YcPLuwZOK1jsHjyI5bmyhFENilO/+mxTFsZNj1s9s4auGDIqnH
 nhfmIWogCnL9CQQYsnHkZvj41DBY7ReM8Wt5T4gj4Bk5VHfcytOIouq5g/+j3r/D
 rAu/7oV5xPZmQBGovmD4ZHaxmF9bjpe32wsmhXKxEsQ+rvoKh71XAIvf/o+gvwBv
 V5DCJfLc3TvCLv/eoGNutNwXejX4EgoSfPBVDxj1+YhjuydGFmWRTvNwnELAGoKW
 /lhLCQ9+MzRHoDaIEcI3ae1Yzwpo95PnI6yKSCzhxaLAzJ9VgAMETnHIwHUOQ/fu
 7YjknaCTIFt/2OlXlBXuZzyRmXSAbFSv0P3S/H2IWrY7BHJQlTmO+w1G98sqDQLQ
 lXiO1kd8mVRjOtCZIDFLqGig729DXvnmX3idbjkwGF7G2KApnW7Kl55QmvM9RqEi
 bHRLxhBrtAtj1Exu47hV9dR6Xy2lLYb7zFr9SpV7+b4MnCXygayB1S2SzxozFUG8
 Br3rfwEavUDBnh5p3h+Q0itaoCaOvuj/j9O84TvIoSwp/QzhxfU=
 =GaAa
 -----END PGP SIGNATURE-----

Merge tag 'auxdisplay-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay

Pull auxdisplay updates from Andy Shevchenko:

 - Cancel backlight work on panel registration failure

 - Miscellaneous cleanups

* tag 'auxdisplay-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay:
  auxdisplay: charlcd: cancel backlight work on registration failure
  auxdisplay: panel: Remove unused callback binding code
  auxdisplay: Remove redundant dev_err()
 2026-08-24 08:15:59 -07:00
Jimmy Zuber
34b5c4a6e4 fuse: zero the partial EOF page when extending a file 
Extending a fuse file past a non-page-aligned EOF does not zero the tail of
the old last page.  When that page is cached and has been mmap-dirtied beyond
the old EOF, the now in-bounds tail is served to later reads as stale data
rather than zeros, which violates POSIX file-extension semantics.

Some file systems get this zeroing automatically at writeback time
(block_write_full_folio() / iomap_writeback_handle_eof() zero the tail of the
folio straddling i_size).  A non-writeback caching fuse file system uses neither
path, so it has to zero the tail itself from the size-extending paths, like
XFS (xfs_file_write_zero_eof()) and ext4 (ext4_block_zero_eof()) do.

Call truncate_pagecache_range() over the newly-exposed range up front from the
three paths that extend a file, before the new size is published:

  - a buffered write whose position is past the old EOF (fuse_perform_write());
  - a size-extending setattr/truncate (fuse_do_setattr());
  - a size-extending fallocate (fuse_file_fallocate()).

This unmaps the stale mappings and zeroes the partial tail of the old EOF
folio, so a later read returns zeros.  Truncating [old EOF, write start) before
a buffered write keeps the dropped range disjoint from the written data, so a
write that lands inside the old EOF folio is preserved.

writeback_cache connections are unaffected, as their writes go through
iomap_file_buffered_write(), which zeroes post-EOF folios.  The bug is
observable on a non-writeback_cache server that returns FOPEN_KEEP_CACHE on
writable files (without FOPEN_DIRECT_IO), and is caught by the new
write_extend_eof fuse selftest.

Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 2026-08-24 16:54:04 +02:00
Vlastimil Babka (SUSE)
564ed40708 Merge branch 'slab/for-7.3/kfree_rcu_nolock' into slab/for-next 
Merge series "mm/slab: introduce kfree_rcu_nolock() and improve
slub_kunit coverage" from Harry Yoo. From the cover letter [1]:

This series improves kmalloc_nolock() and kfree_nolock() coverage in
slub_kunit and introduces kfree_rcu_nolock() for unknown context as
suggested by Alexei Starovoitov.

Unknown context means the caller does not know whether spinning on a
lock is safe (e.g., a BPF program attached to an arbitrary kernel
function or in NMI context).

The slab allocator already supports unknown context via kmalloc_nolock()
and kfree_nolock(), but te slab allocator does not support freeing
objects by RCU in unknown context.

It is not ideal to have completely separate batching for unknown context
because the worst scenario where spinning on a lock would lead to
deadlock is very rare, and in most cases, it is safe to use the existing
mechanism (kfree_rcu_sheaf()).

Since most part of the slab allocator already supports unknown context
and sheaves support batching kvfree_rcu() calls for slab objects,
implement kfree_rcu_nolock() with minimal changes by teaching
kfree_rcu_sheaf() how to support unknown context and making it a little
bit harder to allocate an empty sheaf, instead of making intrusive
changes to the existing kvfree_rcu batching logic.

kfree_rcu_nolock() tries to free the object to the rcu sheaf if trylock
succeeds. Once the rcu sheaf becomes full, it is submitted to RCU via
call_rcu() if spinning is allowed or IRQs are enabled (to avoid calling
call_rcu() in the middle of call_rcu()). Otherwise, call_rcu() is
deferred via irq work.

When there is no sheaf available, kfree_rcu_sheaf() falls back to
defer_kfree_rcu(). It submits the object to kvfree_rcu batching via irq
work. To do this, patch 6 converts kvfree_rcu to use kvfree_rcu_head
without visible changes to the API for now.

Unlike kfree_rcu(), only the 2-argument variant is supported.  This is
because the last resort of the 1-arg variant is synchronize_rcu(), which
cannot be used in an unknown context.

As suggested by Alexei Starovoitov, kfree_rcu_nolock() can be used with
struct kvfree_rcu_head (8 bytes), which is smaller than struct rcu_head
(16 bytes).

Link: https://lore.kernel.org/all/20260729-kfree_rcu_nolock-v5-0-a28cdcda9673@kernel.org/ [1]
 2026-08-24 15:01:27 +02:00
Vlastimil Babka (SUSE)
160dcfe7f9 Merge branch 'slab/for-7.3/objext_split' into slab/for-next 
Merge series "mm/slab, alloc_tag: reduce obj_ext memory waste" from
myself. From the cover letter [1]:

It's been bothering me that the memory usage of struct slabobj_ext
depend only on config options and not whether the fields are actually
used. So with both CONFIG_MEMCG=y and CONFIG_MEM_ALLOC_PROFILING=y there
is always objcg field and codetag_ref field. And thus:

1) Having memory allocation profiling config-enabled but not
   boot-enabled means wasted memory on unused codetag_refs. This makes
   it less suitable for a general distro config and the page allocator
   side doesn't suffer from this, only slab and percpu.

2) Complementary, with memory allocation profiling enabled, there are
   caches/slabs that don't need the objcg field, so memory is wasted on
   those.

This series should solve the point 1) fully for slab; pcpuobj_ext
handling can be perhaps improved similarly, haven't looked into that.

For 2) it avoids allocating objcg fields for KMALLOC_NORMAL and
KMALLOC_NO_OBJ_EXT caches where we know they are not necessary because
kmalloc() with __GFP_ACCOUNT will pick a KMALLOC_CGROUP type (except
with SLUB_TINY).

The named kmem_caches are tricky. They can be created with SLAB_ACCOUNT
and then we know objcg fields are always needed. But also they can be
created without SLAB_ACCOUNT and then some allocations have
__GFP_ACCOUNT and some not and we don't know that in advance.

This series introduces a SLAB_MAY_ACCOUNT flag that's currently internal
only and is applied to all caches (unless kmem accounting is disabled)
except KMALLOC_NORMAL (unless that aliases KMALLOC_RECLAIM) and
KMALLOC_NO_OBJ_EXT.

As a followup we can make SLAB_MAY_ACCOUNT explicit and add it to to
caches where we know __GFP_ACCOUNT is used. Then we could only honour
__GFP_ACCOUNT for those, while warning for an unexpected usage
elsewhere.

To check for regressions, I forward-ported a microbenchmark hacked into
slub_kunit that was used to evaluate sheaves.

Tried 3 scenarios, MEMCG and KFENCE were always enabled:
- CONFIG_MEM_ALLOC_PROFILING=n
- CONFIG_MEM_ALLOC_PROFILING=y but _ENABLED_BY_DEFAULT=n
- same but booted with sysctl.vm.mem_profiling=1

The results are quite noisy, but no regression was apparent, except
perhaps few percents for the last case. I don't expect it will be
visible in any real workloads.

Link: https://lore.kernel.org/all/20260727-b4-objext_split-v3-0-c29ef0f1f257@kernel.org/ [1]
 2026-08-24 14:57:07 +02:00
Mark Brown
1b04ca2aca io_uring: Add missing include for ITER_SOURCE and ITER_DEST 
Fix IWYU issues:

/tmp/next/build/include/linux/io_uring_types.h:56:32: error: 'ITER_DEST'
undeclared here (not in a function)
   56 |         IO_BUF_DEST     = 1 << ITER_DEST,
      |                                ^~~~~~~~~
/tmp/next/build/include/linux/io_uring_types.h:57:32: error: 'ITER_SOURCE'
undeclared here (not in a function)
   57 |         IO_BUF_SOURCE   = 1 << ITER_SOURCE,
      |                                ^~~~~~~~~~~

Fixes: 95961b72c5 ("io_uring/rsrc: rename and export IO_IMU_DEST / IO_IMU_SOURCE")
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 2026-08-24 12:50:40 +02:00
Andreas Hindborg
41a9c2b48e MAINTAINERS: configfs: split configfs entry in C and Rust parts 
Split configfs MAINTAINERS entry in C and Rust parts. Mark Breno Leitao as
maintainer of configfs C parts. Mark Andreas Hindborg as maintainer of
configfs Rust parts.

Acked-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
 2026-08-24 12:19:13 +02:00
Bernd Schubert
1f59015e95 fuse: Fix the condition to enable over-io-uring 
The existing condition in fuse_uring_cmd() is there only to avoid
disabling io-uring for connections that already run with it, missing
was a condition to refuse any IORING_OP_URING_CMD if the
connection/channel didn't get enabled because of missing FUSE_INIT
reply flag FUSE_OVER_IO_URING. Without the reply flag the barrier in
fuse_uring_ready() doesn't work and IO could already be going on and
cause deadlock states (at a minimum one between fch->bg_lock and
queue->lock).

The change itself is trivial, but brings behavior change,
FUSE_OVER_IO_URING has to be set in the FUSE_INIT_REPLY by fuse servers
to accept any IORING_OP_URING_CMD. Libfuse does that and the only
non-libfuse implementation I found (fractal-fuse) also does it.
Qemu patches for fuse-io-uring are not merged yet, as far as I know.

Moved up is the smp_load_acquire(&fch->initialized) check, as a
fuse-server implementation might try to setup io-uring before FUSE_INIT
is processed and might have gotten -EOPNOTSUPP instead of -EAGAIN.

Also fixed is a stale comment that explains the handling of the
FUSE_OVER_IO_URING flag in early RFC versions.

If there should be a report from any library or application we
probably need to revert this commit.

Fixes: 3393ff964e ("fuse: block request allocation until io-uring init is complete")
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 2026-08-24 12:18:02 +02:00
Baokun Li
26d7e1f5c4 fuse: invalidate the correct range after O_APPEND direct write 
fuse_direct_write_iter() captures pos before generic_write_checks(),
which moves ki_pos to EOF for O_APPEND writes:

  fuse_direct_write_iter()
  {
      pos = iocb->ki_pos;           /* 0 (user-supplied)       */
      generic_write_checks();       /* ki_pos -> EOF           */
      fuse_direct_io();             /* writes at EOF, correct  */
      invalidate(pos, pos + res);   /* [0, res) -- wrong       */
  }

The post-write invalidation targets a stale range instead of the
actual written range at EOF.

This can cause data inconsistency when the file size is not
page-aligned.  The tail page straddling EOF has a valid portion
before EOF that concurrent readers can fault back in during the
DIO write window:

  Tail page (file size X not page-aligned):

    page_start         X (EOF)   page_end
    |--- valid data ----|-- stale --|

  CPU0 (O_APPEND DIO writer)    CPU1 (buffered reader)
  --------------------------    ----------------------
  invalidate [X, X+len)
    tail page evicted
  FUSE_WRITE in flight ...
                                read [page_start, X)
                                  tail page re-faulted
                                  [X, page_end) = stale
  FUSE_WRITE completes
  i_size = X + len
  invalidate [0, len)  <- WRONG
    tail page still cached
                                read [X, X+len)
                                  hits stale tail page
                                  returns old data

Fix by reading pos back from iocb->ki_pos after generic_write_checks(),
as generic_file_direct_write() does.

Also fix a typo in the comment ("may have" -> "may have competed").

Fixes: 2b0408d028 ("fuse: invalidate page cache after DIO and async DIO writes")
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Bernd Schubert <bernd@bsbernd.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 2026-08-24 12:18:02 +02:00