Commit Graph

1413564 Commits

Author SHA1 Message Date
Kairui Song
8a1968bd99 mm/shmem, swap: fix race of truncate and swap entry split
The helper for shmem swap freeing is not handling the order of swap
entries correctly.  It uses xa_cmpxchg_irq to erase the swap entry, but it
gets the entry order before that using xa_get_order without lock
protection, and it may get an outdated order value if the entry is split
or changed in other ways after the xa_get_order and before the
xa_cmpxchg_irq.

And besides, the order could grow and be larger than expected, and cause
truncation to erase data beyond the end border.  For example, if the
target entry and following entries are swapped in or freed, then a large
folio was added in place and swapped out, using the same entry, the
xa_cmpxchg_irq will still succeed, it's very unlikely to happen though.

To fix that, open code the Xarray cmpxchg and put the order retrieval and
value checking in the same critical section.  Also, ensure the order won't
exceed the end border, skip it if the entry goes across the border.

Skipping large swap entries crosses the end border is safe here.  Shmem
truncate iterates the range twice, in the first iteration,
find_lock_entries already filtered such entries, and shmem will swapin the
entries that cross the end border and partially truncate the folio (split
the folio or at least zero part of it).  So in the second loop here, if we
see a swap entry that crosses the end order, it must at least have its
content erased already.

I observed random swapoff hangs and kernel panics when stress testing
ZSWAP with shmem.  After applying this patch, all problems are gone.

Link: https://lkml.kernel.org/r/20260120-shmem-swap-fix-v3-1-3d33ebfbc057@tencent.com
Fixes: 809bc86517 ("mm: shmem: support large folio swap out")
Signed-off-by: Kairui Song <kasong@tencent.com>
Reviewed-by: Nhat Pham <nphamcs@gmail.com>
Acked-by: Chris Li <chrisl@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-26 19:03:45 -08:00
Linus Torvalds
6c790212c5 Devicetree fixes for v6.19, part 3:
- Fix a refcount leak in of_alias_scan()
 
 - Support decending into child nodes when populating nodes in /firmware
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmlwAPAACgkQ+vtdtY28
 YcPl+w//ZFiI8NJWbHPxRE6oDVTM7q79F5ob73fVYbkAUGGQX+sgYngZ/I148JX6
 RSn9RDeCC48QYJCcGKSScNgZeKUDxOzBllgp8FhqQ+t+hqXLXtR1ec9VPrpHazf6
 xY1OAqRvxsQgwZ4Dn77IypQ1DzufR7PvOGpBMoKwUG+HwRlLX+xsP5fpFhTlP5gV
 YpdX1Kg9YFFlk3kylMonB+PXXoLkJuvskPDHKVQuAClVKU+TYbG/C9mfnFoLuZke
 YuQcf6vDOdvZwct0jK8Nv6yyoZSfD3mNkCGYFYR8V+b4xct2sdkUBvXwe1viRFqB
 8cyg21s1n87QJOGI+BwfrNQFWaCtD9xn1yUN5Ai/sL4SodiHmcqxvIsHnJYt3UeA
 S/eNOoeyY97jc67cfoSo8O/FMMmGt0ACoHp+aS/0MgTVglsJUWzi+BqYE8s0Z7uL
 0YFjoZrI0B1n8flfM9uAyV4PsdWi73BSOjbFYNJBa2JpYjklGlKA2urCNDCQAgVR
 6pNg+w10NXGecaO0i/FHgLwMoz3rq8o7SwvpOOvUOhNM0bkAUGS/LLG3xY5YoMAB
 Q30fndgsfgrff+3UwbuoPdpXOJxMNiOT5gFy2jGA7NvEhaYOxdQ1S7xRFSaTvQ4k
 XtdVY8FHmJ19pLDaQSjgFSjysSPy48nQgwy+yCSt1oD9M9D4oMY=
 =0Vm+
 -----END PGP SIGNATURE-----

Merge tag 'devicetree-fixes-for-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull devicetree fixes from Rob Herring:

 - Fix a refcount leak in of_alias_scan()

 - Support descending into child nodes when populating nodes
   in /firmware

* tag 'devicetree-fixes-for-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  of: fix reference count leak in of_alias_scan()
  of: platform: Use default match table for /firmware
2026-01-20 15:01:15 -08:00
Linus Torvalds
c25f2fb1f4 17 hotfixes. 12 are cc:stable, 16 are for MM.
- A 4 patch series from David Hildenbrand which fixes a few things
   realted to hugetlb PMD sharing
 
 - The remainder are singletons, please see their changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaW/vEQAKCRDdBJ7gKXxA
 jtMcAQCK1tKnINRmVjY3UJCqZMAaXvOdOoUIgHDaTXD/DWKm9AD9HRwWzYB4+TNr
 k/Te8F33d418LcMBTW9CLhrplQpaIAI=
 =+d1A
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-01-20-13-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:

 - A patch series from David Hildenbrand which fixes a few things
   related to hugetlb PMD sharing

 - The remainder are singletons, please see their changelogs for details

* tag 'mm-hotfixes-stable-2026-01-20-13-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm: restore per-memcg proactive reclaim with !CONFIG_NUMA
  mm/kfence: fix potential deadlock in reboot notifier
  Docs/mm/allocation-profiling: describe sysctrl limitations in debug mode
  mm: do not copy page tables unnecessarily for VM_UFFD_WP
  mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather
  mm/rmap: fix two comments related to huge_pmd_unshare()
  mm/hugetlb: fix two comments related to huge_pmd_unshare()
  mm/hugetlb: fix hugetlb_pmd_shared()
  mm: remove unnecessary and incorrect mmap lock assert
  x86/kfence: avoid writing L1TF-vulnerable PTEs
  mm/vma: do not leak memory when .mmap_prepare swaps the file
  migrate: correct lock ordering for hugetlb file folios
  panic: only warn about deprecated panic_print on write access
  fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
  mm: take into account mm_cid size for mm_struct static definitions
  mm: rename cpu_bitmap field to flexible_array
  mm: add missing static initializer for init_mm::mm_cid.lock
2026-01-20 13:32:16 -08:00
Linus Torvalds
c03e9c42ae dma-mapping fixes for Linux 6.19
- minor fixes for the corner cases of the SWIOTLB pool management (Robin Murphy)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaW+NbgAKCRCJp1EFxbsS
 RKU3AQCIpNwIYN6evmnTXO/Y+AFRjsrb1pE1cUyHn5QTY4/o4wEA6BiSgMCrZEbv
 HTEs1ZSHgLOwBwZre1Z11icGg3BkRgY=
 =6fBC
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-6.19-2026-01-20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fixes from Marek Szyprowski:

 - minor fixes for the corner cases of the SWIOTLB pool management
   (Robin Murphy)

* tag 'dma-mapping-6.19-2026-01-20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma/pool: Avoid allocating redundant pools
  mm_zone: Generalise has_managed_dma()
  dma/pool: Improve pool lookup
2026-01-20 10:16:18 -08:00
Linus Torvalds
8f7537efbe pwm: Two fixes and a maintainer update
Included here are three changes:
 
  - pwm: Ensure ioctl() returns a negative errno on error
    This affects two ioctls on /dev/pwmchipX where the return value of
    copy_to_user() was passed to userspace. This is fixed to return
    -EFAULT now instead.
    You might argue that this is an ABI change, but I still think it's
    sensible to be fixed because a) other exit paths already return
    -EFAULT so userspace must be aware of this return value; b) the
    interface is somewhat new (commit v6.17-rc1~181^2~35 ("pwm: Add
    support for pwmchip devices for faster and easier userspace access"))
    and the only known user is libpwm which relies on the fixed
    semantics (and uses the ioctl correctly and thus doesn't trigger that
    problematic error path); and c) it's very unlikely that
    copy_to_user() fails if a moment before copy_from_user() on the same
    memory chunk succeeded.
 
  - pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops
    This fixes an oversight in commit v6.18-rc1~168^2~3^2~6 which added
    support for the max7360 driver. There is no user-visible effect
    because the .sizeof_wfhw member is just a safe guard that the memory
    provided by the core is big enough. While it currently is big enough
    and there is no reason to assume that will change, doing that
    correctly is necessary.
 
  - MAINTAINERS: Add myself as reviewer for PWM rust drivers
    "Myself" here is Michal Wilczynski who cares for the Rust parts of
    the pwm subsystem. Several of the patches sent recently for the (for
    now) only Rust pwm driver did not add Michal to Cc which resulted in
    the patches waiting for review as I thought Michal would care but he
    wasn't aware of them.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmlvR/AACgkQj4D7WH0S
 /k6KoQgAmUmnCVrIcqdzSlC1drxdzhV9kAqTaVUi317xC3AtSquuUojrfwEiGnBq
 v/p9we57m4jcRjt56Qrg6g23bt8U7F4OSiFKifXgCDrpoX5qdN/iCchOQ1SfR7fA
 o0F4KSBZHCOCHBwUgfEQmXPMkEj5VaJ20xh6yLlyrIgkTlaMQ3TMyD39+uHk68Pm
 hyaiCyYNOfu+UkYX2BbjNCCzAxTmdZim1vQ6iZsRrSY97+Fp+WDKvAErZUuPgzJQ
 aqvBleJXMCS+y0w6hcoTAuf/g8YXAeNo+kYNANfzO1UKoXsyG0+feHbohKFA46L7
 xKi/5Y1vd058EiNh12AW7MJ/u1GNwg==
 =txwU
 -----END PGP SIGNATURE-----

Merge tag 'pwm/for-6.19-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull pwm fixes and a maintainer update from Uwe Kleine-König:

 - pwm: Ensure ioctl() returns a negative errno on error

   This affects two ioctls on /dev/pwmchipX where the return value of
   copy_to_user() was passed to userspace. This is fixed to return
   -EFAULT now instead.

 - pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops

   This fixes an oversight in the original commit that added support for
   the max7360 driver (d93a75d94b79: "pwm: max7360: Add MAX7360 PWM
   support"). There is no user-visible effect because the .sizeof_wfhw
   member is just a safe guard that the memory provided by the core is
   big enough. While it currently is big enough and there is no reason
   to assume that will change, doing that correctly is necessary.

 - MAINTAINERS: Add Michal Wilczynski as reviewer for PWM rust drivers

   Michal cares for the Rust parts of the pwm subsystem. Several of the
   patches sent recently for the (for now) only Rust pwm driver did not
   add Michal to Cc which resulted in the patches waiting for review as
   I thought Michal would care but he wasn't aware of them.

* tag 'pwm/for-6.19-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  MAINTAINERS: Add myself as reviewer for PWM rust drivers
  pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops
  pwm: Ensure ioctl() returns a negative errno on error
2026-01-20 09:46:29 -08:00
Yosry Ahmed
16aca2c98a mm: restore per-memcg proactive reclaim with !CONFIG_NUMA
Commit 2b7226af73 ("mm/memcg: make memory.reclaim interface generic")
moved proactive reclaim logic from memory.reclaim handler to a generic
user_proactive_reclaim() helper to be used for per-node proactive reclaim.

However, user_proactive_reclaim() was only defined under CONFIG_NUMA, with
a stub always returning 0 otherwise.  This broke memory.reclaim on
!CONFIG_NUMA configs, causing it to report success without actually
attempting reclaim.

Move the definition of user_proactive_reclaim() outside CONFIG_NUMA, and
instead define a stub for __node_reclaim() in the !CONFIG_NUMA case. 
__node_reclaim() is only called from user_proactive_reclaim() when a write
is made to sys/devices/system/node/nodeX/reclaim, which is only defined
with CONFIG_NUMA.

Link: https://lkml.kernel.org/r/20260116205247.928004-1-yosry.ahmed@linux.dev
Fixes: 2b7226af73 ("mm/memcg: make memory.reclaim interface generic")
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Qi Zheng <zhengqi.arch@bytedance.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:27 -08:00
Breno Leitao
9bc9ccbf4c mm/kfence: fix potential deadlock in reboot notifier
The reboot notifier callback can deadlock when calling
cancel_delayed_work_sync() if toggle_allocation_gate() is blocked in
wait_event_idle() waiting for allocations, that might not happen on
shutdown path.

The issue is that cancel_delayed_work_sync() waits for the work to
complete, but the work is waiting for kfence_allocation_gate > 0 which
requires allocations to happen (each allocation is increased by 1) -
allocations that may have stopped during shutdown.

Fix this by:
1. Using cancel_delayed_work() (non-sync) to avoid blocking. Now the
   callback succeeds and return.
2. Adding wake_up() to unblock any waiting toggle_allocation_gate()
3. Adding !kfence_enabled to the wait condition so the wake succeeds

The static_branch_disable() IPI will still execute after the wake, but at
this early point in shutdown (reboot notifier runs with INT_MAX priority),
the system is still functional and CPUs can respond to IPIs.

Link: https://lkml.kernel.org/r/20260116-kfence_fix-v1-1-4165a055933f@debian.org
Fixes: ce2bba8956 ("mm/kfence: add reboot notifier to disable KFENCE on shutdown")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reported-by: Chris Mason <clm@meta.com>
Closes: https://lore.kernel.org/all/20260113140234.677117-1-clm@meta.com/
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Chris Mason <clm@meta.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
Suren Baghdasaryan
cb7d761bf5 Docs/mm/allocation-profiling: describe sysctrl limitations in debug mode
When CONFIG_MEM_ALLOC_PROFILING_DEBUG=y, /proc/sys/vm/mem_profiling is
read-only to avoid debug warnings in a scenario when an allocation is
made while profiling is disabled (allocation does not get an allocation
tag), then profiling gets enabled and allocation gets freed (warning due
to the allocation missing allocation tag).

Link: https://lkml.kernel.org/r/20260116184423.2708363-1-surenb@google.com
Fixes: ebdf9ad4ca ("memprofiling: documentation")
Reported-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: SeongJae Park <sj@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Ran Xiaokai <ran.xiaokai@zte.com.cn>
Cc: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
Lorenzo Stoakes
35e2470326 mm: do not copy page tables unnecessarily for VM_UFFD_WP
Commit ab04b530e7 ("mm: introduce copy-on-fork VMAs and make
VM_MAYBE_GUARD one") aggregates flags checks in vma_needs_copy(),
including VM_UFFD_WP.

However in doing so, it incorrectly performed this check against src_vma. 
This check was done on the assumption that all relevant flags are copied
upon fork.

However the userfaultfd logic is very innovative in that it implements
custom logic on fork in dup_userfaultfd(), including a rather well hidden
case where lacking UFFD_FEATURE_EVENT_FORK causes VM_UFFD_WP to not be
propagated to the destination VMA.

And indeed, vma_needs_copy(), prior to this patch, did check this property
on dst_vma, not src_vma.

Since all the other relevant flags are copied on fork, we can simply fix
this by checking against dst_vma.

While we're here, we fix a comment against VM_COPY_ON_FORK (noting that it
did indeed already reference dst_vma) to make it abundantly clear that we
must check against the destination VMA.

Link: https://lkml.kernel.org/r/20260114110006.1047071-1-lorenzo.stoakes@oracle.com
Fixes: ab04b530e7 ("mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one")
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reported-by: Chris Mason <clm@meta.com>
Closes: https://lore.kernel.org/all/20260113231257.3002271-1-clm@meta.com/
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Acked-by: Pedro Falcato <pfalcato@suse.de>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
David Hildenbrand (Red Hat)
8ce720d5bd mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather
As reported, ever since commit 1013af4f58 ("mm/hugetlb: fix
huge_pmd_unshare() vs GUP-fast race") we can end up in some situations
where we perform so many IPI broadcasts when unsharing hugetlb PMD page
tables that it severely regresses some workloads.

In particular, when we fork()+exit(), or when we munmap() a large
area backed by many shared PMD tables, we perform one IPI broadcast per
unshared PMD table.

There are two optimizations to be had:

(1) When we process (unshare) multiple such PMD tables, such as during
    exit(), it is sufficient to send a single IPI broadcast (as long as
    we respect locking rules) instead of one per PMD table.

    Locking prevents that any of these PMD tables could get reused before
    we drop the lock.

(2) When we are not the last sharer (> 2 users including us), there is
    no need to send the IPI broadcast. The shared PMD tables cannot
    become exclusive (fully unshared) before an IPI will be broadcasted
    by the last sharer.

    Concurrent GUP-fast could walk into a PMD table just before we
    unshared it. It could then succeed in grabbing a page from the
    shared page table even after munmap() etc succeeded (and supressed
    an IPI). But there is not difference compared to GUP-fast just
    sleeping for a while after grabbing the page and re-enabling IRQs.

    Most importantly, GUP-fast will never walk into page tables that are
    no-longer shared, because the last sharer will issue an IPI
    broadcast.

    (if ever required, checking whether the PUD changed in GUP-fast
     after grabbing the page like we do in the PTE case could handle
     this)

So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather
infrastructure so we can implement these optimizations and demystify the
code at least a bit. Extend the mmu_gather infrastructure to be able to
deal with our special hugetlb PMD table sharing implementation.

To make initialization of the mmu_gather easier when working on a single
VMA (in particular, when dealing with hugetlb), provide
tlb_gather_mmu_vma().

We'll consolidate the handling for (full) unsharing of PMD tables in
tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track
in "struct mmu_gather" whether we had (full) unsharing of PMD tables.

Because locking is very special (concurrent unsharing+reuse must be
prevented), we disallow deferring flushing to tlb_finish_mmu() and instead
require an explicit earlier call to tlb_flush_unshared_tables().

From hugetlb code, we call huge_pmd_unshare_flush() where we make sure
that the expected lock protecting us from concurrent unsharing+reuse is
still held.

Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that
tlb_flush_unshared_tables() was properly called earlier.

Document it all properly.

Notes about tlb_remove_table_sync_one() interaction with unsharing:

There are two fairly tricky things:

(1) tlb_remove_table_sync_one() is a NOP on architectures without
    CONFIG_MMU_GATHER_RCU_TABLE_FREE.

    Here, the assumption is that the previous TLB flush would send an
    IPI to all relevant CPUs. Careful: some architectures like x86 only
    send IPIs to all relevant CPUs when tlb->freed_tables is set.

    The relevant architectures should be selecting
    MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable
    kernels and it might have been problematic before this patch.

    Also, the arch flushing behavior (independent of IPIs) is different
    when tlb->freed_tables is set. Do we have to enlighten them to also
    take care of tlb->unshared_tables? So far we didn't care, so
    hopefully we are fine. Of course, we could be setting
    tlb->freed_tables as well, but that might then unnecessarily flush
    too much, because the semantics of tlb->freed_tables are a bit
    fuzzy.

    This patch changes nothing in this regard.

(2) tlb_remove_table_sync_one() is not a NOP on architectures with
    CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync.

    Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB)
    we still issue IPIs during TLB flushes and don't actually need the
    second tlb_remove_table_sync_one().

    This optimized can be implemented on top of this, by checking e.g., in
    tlb_remove_table_sync_one() whether we really need IPIs. But as
    described in (1), it really must honor tlb->freed_tables then to
    send IPIs to all relevant CPUs.

Notes on TLB flushing changes:

(1) Flushing for non-shared PMD tables

    We're converting from flush_hugetlb_tlb_range() to
    tlb_remove_huge_tlb_entry(). Given that we properly initialize the
    MMU gather in tlb_gather_mmu_vma() to be hugetlb aware, similar to
    __unmap_hugepage_range(), that should be fine.

(2) Flushing for shared PMD tables

    We're converting from various things (flush_hugetlb_tlb_range(),
    tlb_flush_pmd_range(), flush_tlb_range()) to tlb_flush_pmd_range().

    tlb_flush_pmd_range() achieves the same that
    tlb_remove_huge_tlb_entry() would achieve in these scenarios.
    Note that tlb_remove_huge_tlb_entry() also calls
    __tlb_remove_tlb_entry(), however that is only implemented on
    powerpc, which does not support PMD table sharing.

    Similar to (1), tlb_gather_mmu_vma() should make sure that TLB
    flushing keeps on working as expected.

Further, note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a
concern, as we are holding the i_mmap_lock the whole time, preventing
concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed
separately as a cleanup later.

There are plenty more cleanups to be had, but they have to wait until
this is fixed.

[david@kernel.org: fix kerneldoc]
  Link: https://lkml.kernel.org/r/f223dd74-331c-412d-93fc-69e360a5006c@kernel.org
Link: https://lkml.kernel.org/r/20251223214037.580860-5-david@kernel.org
Fixes: 1013af4f58 ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reported-by: Uschakow, Stanislav" <suschako@amazon.de>
Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/
Tested-by: Laurence Oberman <loberman@redhat.com>
Acked-by: Harry Yoo <harry.yoo@oracle.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Rik van Riel <riel@surriel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
David Hildenbrand (Red Hat)
a8682d500f mm/rmap: fix two comments related to huge_pmd_unshare()
PMD page table unsharing no longer touches the refcount of a PMD page
table.  Also, it is not about dropping the refcount of a "PMD page" but
the "PMD page table".

Let's just simplify by saying that the PMD page table was unmapped,
consequently also unmapping the folio that was mapped into this page.

This code should be deduplicated in the future.

Link: https://lkml.kernel.org/r/20251223214037.580860-4-david@kernel.org
Fixes: 59d9094df3 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: "Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
David Hildenbrand (Red Hat)
3937027cae mm/hugetlb: fix two comments related to huge_pmd_unshare()
Ever since we stopped using the page count to detect shared PMD page
tables, these comments are outdated.

The only reason we have to flush the TLB early is because once we drop the
i_mmap_rwsem, the previously shared page table could get freed (to then
get reallocated and used for other purpose).  So we really have to flush
the TLB before that could happen.

So let's simplify the comments a bit.

The "If we unshared PMDs, the TLB flush was not recorded in mmu_gather."
part introduced as in commit a4a118f2ee ("hugetlbfs: flush TLBs
correctly after huge_pmd_unshare") was confusing: sure it is recorded in
the mmu_gather, otherwise tlb_flush_mmu_tlbonly() wouldn't do anything. 
So let's drop that comment while at it as well.

We'll centralize these comments in a single helper as we rework the code
next.

Link: https://lkml.kernel.org/r/20251223214037.580860-3-david@kernel.org
Fixes: 59d9094df3 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: "Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
David Hildenbrand (Red Hat)
ca1a47cd3f mm/hugetlb: fix hugetlb_pmd_shared()
Patch series "mm/hugetlb: fixes for PMD table sharing (incl.  using
mmu_gather)", v3.

One functional fix, one performance regression fix, and two related
comment fixes.

I cleaned up my prototype I recently shared [1] for the performance fix,
deferring most of the cleanups I had in the prototype to a later point. 
While doing that I identified the other things.

The goal of this patch set is to be backported to stable trees "fairly"
easily. At least patch #1 and #4.

Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing
Patch #2 + #3 are simple comment fixes that patch #4 interacts with.
Patch #4 is a fix for the reported performance regression due to excessive
IPI broadcasts during fork()+exit().

The last patch is all about TLB flushes, IPIs and mmu_gather.
Read: complicated

There are plenty of cleanups in the future to be had + one reasonable
optimization on x86. But that's all out of scope for this series.

Runtime tested, with a focus on fixing the performance regression using
the original reproducer [2] on x86.


This patch (of 4):

We switched from (wrongly) using the page count to an independent shared
count.  Now, shared page tables have a refcount of 1 (excluding
speculative references) and instead use ptdesc->pt_share_count to identify
sharing.

We didn't convert hugetlb_pmd_shared(), so right now, we would never
detect a shared PMD table as such, because sharing/unsharing no longer
touches the refcount of a PMD table.

Page migration, like mbind() or migrate_pages() would allow for migrating
folios mapped into such shared PMD tables, even though the folios are not
exclusive.  In smaps we would account them as "private" although they are
"shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the
pagemap interface.

Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().

Link: https://lkml.kernel.org/r/20251223214037.580860-1-david@kernel.org
Link: https://lkml.kernel.org/r/20251223214037.580860-2-david@kernel.org
Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [1]
Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [2]
Fixes: 59d9094df3 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Tested-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:26 -08:00
Lorenzo Stoakes
90888b4ae1 mm: remove unnecessary and incorrect mmap lock assert
This check was introduced by commit 42fc541404 ("mmap locking API: add
mmap_assert_locked() and mmap_assert_write_locked()") which replaced a
VM_BUG_ON_VMA() over rwsem_is_locked from commit a00cc7d9dd ("mm, x86:
add support for PUD-sized transparent hugepages"), i.e.  the commit that
introduced PUD THPs.

These seem to be careful asserts introduced to ensure that locks are held
in general, however for a zap we require that VMAs are kept stable, and
this is a requirement that has held perfectly well for a long time.

These were long before VMA locks and thus there appears to be no reason to
think this is assert is there for anything other than 'stabilised VMA'.

Asserting that the VMA under examination is stable only in the case of a
THP PUD is strange and unnecessary.  If we wish to be careful and assert
such things, we should do so at the zap level.

However in any case the current situation is already simply incorrect - a
VMA lock suffices here.

Remove the assert for now as it is unnecessarily, incorrect and unhelpful,
subsequent work can introduce an assert in general for zapping if
required.

Link: https://lkml.kernel.org/r/20260114115619.1087466-1-lorenzo.stoakes@oracle.com
Fixes: 2ab7f1bbaf ("mm/madvise: allow guard page install/remove under VMA lock")
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reported-by: Chris Mason <clm@meta.com>
Closes: https://lore.kernel.org/all/20260113220856.2358195-1-clm@meta.com/
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: SeongJae Park <sj@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-20 09:34:25 -08:00
Michal Wilczynski
0a155a8a24 MAINTAINERS: Add myself as reviewer for PWM rust drivers
I would like to help with reviewing the Rust part of the PWM drivers.
While I maintain the Rust bindings, adding this separate entry ensures I
am automatically CC-ed on the driver implementations (drivers/pwm/*.rs)

Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Link: https://patch.msgid.link/20260119-maintain_rust_drivers-v1-1-88711afc559e@samsung.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-01-20 09:53:18 +01:00
Andrew Cooper
b505f19445 x86/kfence: avoid writing L1TF-vulnerable PTEs
For native, the choice of PTE is fine.  There's real memory backing the
non-present PTE.  However, for XenPV, Xen complains:

  (XEN) d1 L1TF-vulnerable L1e 8010000018200066 - Shadowing

To explain, some background on XenPV pagetables:

  Xen PV guests are control their own pagetables; they choose the new
  PTE value, and use hypercalls to make changes so Xen can audit for
  safety.

  In addition to a regular reference count, Xen also maintains a type
  reference count.  e.g.  SegDesc (referenced by vGDT/vLDT), Writable
  (referenced with _PAGE_RW) or L{1..4} (referenced by vCR3 or a lower
  pagetable level).  This is in order to prevent e.g.  a page being
  inserted into the pagetables for which the guest has a writable mapping.

  For non-present mappings, all other bits become software accessible,
  and typically contain metadata rather a real frame address.  There is
  nothing that a reference count could sensibly be tied to.  As such, even
  if Xen could recognise the address as currently safe, nothing would
  prevent that frame from changing owner to another VM in the future.

  When Xen detects a PV guest writing a L1TF-PTE, it responds by
  activating shadow paging.  This is normally only used for the live phase
  of migration, and comes with a reasonable overhead.

KFENCE only cares about getting #PF to catch wild accesses; it doesn't
care about the value for non-present mappings.  Use a fully inverted PTE,
to avoid hitting the slow path when running under Xen.

While adjusting the logic, take the opportunity to skip all actions if the
PTE is already in the right state, half the number PVOps callouts, and
skip TLB maintenance on a !P -> P transition which benefits non-Xen cases
too.

Link: https://lkml.kernel.org/r/20260106180426.710013-1-andrew.cooper3@citrix.com
Fixes: 1dc0da6e9e ("x86, kfence: enable KFENCE for x86")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Tested-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:02 -08:00
Lorenzo Stoakes
605f6586ec mm/vma: do not leak memory when .mmap_prepare swaps the file
The current implementation of mmap() is set up such that a struct file
object is obtained for the input fd in ksys_mmap_pgoff() via fget(), and
its reference count decremented at the end of the function via.  fput().

If a merge can be achieved, we are fine to simply decrement the refcount
on the file.  Otherwise, in __mmap_new_file_vma(), we increment the
reference count on the file via get_file() such that the fput() in
ksys_mmap_pgoff() does not free the now-referenced file object.

The introduction of the f_op->mmap_prepare hook changes things, as it
becomes possible for a driver to replace the file object right at the
beginning of the mmap operation.

The current implementation is buggy if this happens because it
unconditionally calls get_file() on the mapping's file whether or not it
was replaced (and thus whether or not its reference count will be
decremented at the end of ksys_mmap_pgoff()).

This results in a memory leak, and was exposed in commit ab04945f91
("mm: update mem char driver to use mmap_prepare").

This patch solves the problem by explicitly tracking whether we actually
need to call get_file() on the file or not, and only doing so if required.

Link: https://lkml.kernel.org/r/20260112155143.661284-1-lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Fixes: ab04945f91 ("mm: update mem char driver to use mmap_prepare")
Reported-by: syzbot+bf5de69ebb4bdf86f59f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6964a92b.050a0220.eaf7.008a.GAE@google.com/
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Jann Horn <jannh@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:01 -08:00
Matthew Wilcox (Oracle)
b7880cb166 migrate: correct lock ordering for hugetlb file folios
Syzbot has found a deadlock (analyzed by Lance Yang):

1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).
2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire
folio_lock.

migrate_pages()
  -> migrate_hugetlbs()
    -> unmap_and_move_huge_page()     <- Takes folio_lock!
      -> remove_migration_ptes()
        -> __rmap_walk_file()
          -> i_mmap_lock_read()       <- Waits for i_mmap_rwsem(read lock)!

hugetlbfs_fallocate()
  -> hugetlbfs_punch_hole()           <- Takes i_mmap_rwsem(write lock)!
    -> hugetlbfs_zero_partial_page()
     -> filemap_lock_hugetlb_folio()
      -> filemap_lock_folio()
        -> __filemap_get_folio        <- Waits for folio_lock!

The migration path is the one taking locks in the wrong order according to
the documentation at the top of mm/rmap.c.  So expand the scope of the
existing i_mmap_lock to cover the calls to remove_migration_ptes() too.

This is (mostly) how it used to be after commit c0d0381ade.  That was
removed by 336bf30eb7 for both file & anon hugetlb pages when it should
only have been removed for anon hugetlb pages.

Link: https://lkml.kernel.org/r/20260109041345.3863089-2-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Fixes: 336bf30eb7 ("hugetlbfs: fix anon huge page migration race")
Reported-by: syzbot+2d9c96466c978346b55f@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/68e9715a.050a0220.1186a4.000d.GAE@google.com
Debugged-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:01 -08:00
Gal Pressman
90f3c12324 panic: only warn about deprecated panic_print on write access
The panic_print_deprecated() warning is being triggered on both read and
write operations to the panic_print parameter.

This causes spurious warnings when users run 'sysctl -a' to list all
sysctl values, since that command reads /proc/sys/kernel/panic_print and
triggers the deprecation notice.

Modify the handlers to only emit the deprecation warning when the
parameter is actually being set:

 - sysctl_panic_print_handler(): check 'write' flag before warning.
 - panic_print_get(): remove the deprecation call entirely.

This way, users are only warned when they actively try to use the
deprecated parameter, not when passively querying system state.

Link: https://lkml.kernel.org/r/20260106163321.83586-1-gal@nvidia.com
Fixes: ee13240cd7 ("panic: add note that panic_print sysctl interface is deprecated")
Fixes: 2683df6539 ("panic: add note that 'panic_print' parameter is deprecated")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Cc: Feng Tang <feng.tang@linux.alibaba.com>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:01 -08:00
Joanne Koong
f9a49aa302 fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
Above the while() loop in wait_sb_inodes(), we document that we must wait
for all pages under writeback for data integrity.  Consequently, if a
mapping, like fuse, traditionally does not have data integrity semantics,
there is no need to wait at all; we can simply skip these inodes.

This restores fuse back to prior behavior where syncs are no-ops.  This
fixes a user regression where if a system is running a faulty fuse server
that does not reply to issued write requests, this causes wait_sb_inodes()
to wait forever.

Link: https://lkml.kernel.org/r/20260105211737.4105620-2-joannelkoong@gmail.com
Fixes: 0c58a97f91 ("fuse: remove tmp folio for writebacks and internal rb tree")
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Reported-by: Athul Krishna <athul.krishna.kr@protonmail.com>
Reported-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Reviewed-by: Bernd Schubert <bschubert@ddn.com>
Tested-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Bernd Schubert <bschubert@ddn.com>
Cc: Bonaccorso Salvatore <carnil@debian.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:01 -08:00
Mathieu Desnoyers
be31340a4c mm: take into account mm_cid size for mm_struct static definitions
Both init_mm and efi_mm static definitions need to make room for the 2
mm_cid cpumasks.

This fixes possible out-of-bounds accesses to init_mm and efi_mm.

Add a space between # and define for the mm_alloc_cid() definition to make
it consistent with the coding style used in the rest of this header file.

Link: https://lkml.kernel.org/r/20251224173358.647691-4-mathieu.desnoyers@efficios.com
Fixes: af7f588d8f ("sched: Introduce per-memory-map concurrency ID")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Liam R . Howlett" <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Martin Liu <liumartin@google.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: SeongJae Park <sj@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:00 -08:00
Mathieu Desnoyers
6ac433f8b2 mm: rename cpu_bitmap field to flexible_array
The cpu_bitmap flexible array now contains more than just the cpu_bitmap. 
In preparation for changing the static mm_struct definitions to cover for
the additional space required, change the cpu_bitmap type from "unsigned
long" to "char", require an unsigned long alignment of the flexible array,
and rename the field from "cpu_bitmap" to "flexible_array".

Introduce the MM_STRUCT_FLEXIBLE_ARRAY_INIT macro to statically initialize
the flexible array.  This covers the init_mm and efi_mm static
definitions.

This is a preparation step for fixing the missing mm_cid size for static
mm_struct definitions.

Link: https://lkml.kernel.org/r/20251224173358.647691-3-mathieu.desnoyers@efficios.com
Fixes: af7f588d8f ("sched: Introduce per-memory-map concurrency ID")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Liam R . Howlett" <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Martin Liu <liumartin@google.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: SeongJae Park <sj@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:00 -08:00
Mathieu Desnoyers
12a6ddfc76 mm: add missing static initializer for init_mm::mm_cid.lock
Initialize the mm_cid.lock struct member of init_mm.

Link: https://lkml.kernel.org/r/20251224173358.647691-2-mathieu.desnoyers@efficios.com
Fixes: 8cea569ca7 ("sched/mmcid: Use proper data structures")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Cc: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Liam R . Howlett" <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Martin Liu <liumartin@google.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: SeongJae Park <sj@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-01-19 12:30:00 -08:00
Linus Torvalds
73c9007d9b ata fixes for 6.19-rc7
* A set of fixes for link power management as the recent changes/fixes
    introduced regressions with ATAPI devices and with adapters that have
    DUMMY ports, preventing an adapter to fully reach a low power state
    and thus preventing the system CPU from reaching low power C-states
    (from Niklas).
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCaW6MiAAKCRDdoc3SxdoY
 dltpAP41vWWYPU4CMG4hqQTgtxk+DKCkpy7xcJuysuEEt7W2DwD7BXu9bzax9ied
 CAuy2qUuq7hYDNGRbvtxbCqv1fM+WAM=
 =bJXV
 -----END PGP SIGNATURE-----

Merge tag 'ata-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Damien Le Moal:

 - A set of fixes for link power management as the recent changes/fixes
   introduced regressions with ATAPI devices and with adapters that have
   DUMMY ports, preventing an adapter to fully reach a low power state
   and thus preventing the system CPU from reaching low power C-states
   (from Niklas)

* tag 'ata-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata: Print features also for ATAPI devices
  ata: libata: Add DIPM and HIPM to ata_dev_print_features() early return
  ata: libata: Add cpr_log to ata_dev_print_features() early return
  ata: libata-sata: Improve link_power_management_supported sysfs attribute
  ata: libata: Call ata_dev_config_lpm() for ATAPI devices
  ata: ahci: Do not read the per port area for unimplemented ports
2026-01-19 12:24:45 -08:00
Richard Genoud
63faf32666 pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops
The sizeof_wfhw field wasn't populated in max7360_pwm_ops so it was set
to 0 by default.
While this is ok for now because:
sizeof(struct max7360_pwm_waveform) < PWM_WFHWSIZE
in the future, if struct max7360_pwm_waveform grows, it could lead to
stack corruption.

Fixes: d93a75d94b ("pwm: max7360: Add MAX7360 PWM support")
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com>
Link: https://patch.msgid.link/20260113163907.368919-1-richard.genoud@bootlin.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-01-19 18:31:05 +01:00
Uwe Kleine-König
c198b7773c pwm: Ensure ioctl() returns a negative errno on error
copy_to_user() returns the number of bytes not copied, thus if there is
a problem a positive number. However the ioctl callback is supposed to
return a negative error code on error.

This error is a unfortunate as strictly speaking it became ABI with the
introduction of pwm character devices. However I never saw the issue in
real life -- I found this by code inspection -- and it only affects an
error case where readonly memory is passed to the ioctls or the address
mapping changes while the ioctl is active. Also there are already error
cases returning negative values, so the calling code must be prepared to
see such values already.

Fixes: 9c06f26ba5 ("pwm: Add support for pwmchip devices for faster and easier userspace access")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260119151325.571857-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-01-19 17:46:51 +01:00
Linus Torvalds
24d479d26b Linux 6.19-rc6 2026-01-18 15:42:45 -08:00
Linus Torvalds
90a855e75a Landlock fix for v6.19-rc6
-----BEGIN PGP SIGNATURE-----
 
 iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCaWledRAcbWljQGRpZ2lr
 b2QubmV0AAoJEOXj0OiMgvbSBowBAID4pRQB8EKRNaoqadUWnoSE/wl929Y6KY7i
 FBf8aODOAP9lOtU/CjL5jHKjt00zKW5gX3o0LIuFzSeuzCFTVx2MBA==
 =Aef0
 -----END PGP SIGNATURE-----

Merge tag 'landlock-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull landlock fixes from Mickaël Salaün:
 "This fixes TCP handling, tests, documentation, non-audit elided code,
  and minor cosmetic changes"

* tag 'landlock-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  landlock: Clarify documentation for the IOCTL access right
  selftests/landlock: Properly close a file descriptor
  landlock: Improve the comment for domain_is_scoped
  selftests/landlock: Use scoped_base_variants.h for ptrace_test
  selftests/landlock: Fix missing semicolon
  selftests/landlock: Fix typo in fs_test
  landlock: Optimize stack usage when !CONFIG_AUDIT
  landlock: Fix spelling
  landlock: Clean up hook_ptrace_access_check()
  landlock: Improve erratum documentation
  landlock: Remove useless include
  landlock: Fix wrong type usage
  selftests/landlock: NULL-terminate unix pathname addresses
  selftests/landlock: Remove invalid unix socket bind()
  selftests/landlock: Add missing connect(minimal AF_UNSPEC) test
  selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
  landlock: Fix TCP handling of short AF_UNSPEC addresses
  landlock: Fix formatting
2026-01-18 15:15:47 -08:00
Linus Torvalds
6f32aa9161 cgroup: Another fix for v6.19-rc5
- Add Chen Ridong as cpuset reviewer.
 
 - Add SPDX license identifiers to cgroup files that were missing them.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaW0ToA4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGel7AQD3eTbiR/OU0i5yJj6YZsIdVYcteqqsWBkDFnZ3
 9pZZugEA+KCwi5eQz+cryKZ7y5fU5g5O6f4OP/lfLEcSmFDpfQU=
 =QHwy
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-6.19-rc5-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:

 - Add Chen Ridong as cpuset reviewer

 - Add SPDX license identifiers to cgroup files that were missing them

* tag 'cgroup-for-6.19-rc5-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  kernel: cgroup: Add LGPL-2.1 SPDX license ID to legacy_freezer.c
  kernel: cgroup: Add SPDX-License-Identifier lines
  MAINTAINERS: Add Chen Ridong as cpuset reviewer
2026-01-18 14:30:27 -08:00
Linus Torvalds
f8907398a6 Ext4 bug fixes for 6.19:
* Fix an inconsistency in structure size on 32-bit platforms caused by padding
      differences for the new EXT4_IOC_[GS]ET_TUNE_SB_PARAM ioctls
    * Fix a buffer leak on the error path when dropping the refcount an xattr
      value stored in an inode
    * Fix missing locking on the error path for the file defragmentation ioctl
      leading to a BUG
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEK2m5VNv+CHkogTfJ8vlZVpUNgaMFAmltDvoACgkQ8vlZVpUN
 gaOe8Af/cKUtk6niuANObDZ4BKIxiTVq1dujTVfftfDQoTsi+G3R4GrZS3UeZ8FB
 9K7UdnnmMkIVgv4e6mYjyjfvNY9oUF2PI9y19E+bk+sxhEEtIJfw0DCgbTfwtIc2
 6NKUS66DDlM1vy8qTrStIM4qShmFjfP+xqiOHWQKD0Xfd9vdxbPV/otVr+Qjl/Xj
 W2kT2erpvPnD9WLB+iaRv4G8zH3RSXEBPGCx43bP6E6JqwFhMw9qzIg1tcy4bVqG
 WPROiAuctzgnE9yEVvi5gF8gG3e1naB72rXi2aP6Ush4QMeNKLOWnDHhyCDr/V+5
 0fme7qlZYyIJZ7gys2sBAW4PkTaHEA==
 =SXcS
 -----END PGP SIGNATURE-----

Merge tag 'ext4_for_linus-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

Pull ext4 fixes from Ted Ts'o:

 - Fix an inconsistency in structure size on 32-bit platforms caused by
   padding differences for the new EXT4_IOC_[GS]ET_TUNE_SB_PARAM ioctls

 - Fix a buffer leak on the error path when dropping the refcount an
   xattr value stored in an inode

 - Fix missing locking on the error path for the file defragmentation
   ioctl leading to a BUG

* tag 'ext4_for_linus-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  ext4: add missing down_write_data_sem in mext_move_extent().
  ext4: fix ext4_tune_sb_params padding
2026-01-18 14:01:20 -08:00
Linus Torvalds
e90b81e8ff dmaengine fixes for v6.19
Bunch of driver fixes for:
  - dma mask fix for mmp pdma driver
  - Xilinx regmap max register, uninitialized addr_width fix
  - device leak fix for bunch of drivers in the subsystem
  - stm32 dmamux, TI crossbar driver fixes for device & of node leak and
    route allocation cleanup
  - Tegra use afer free fix
  - Memory leak fix in Qualcomm gpi and omap-dma driver
  - compatible fix for apple driver
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmls+JYACgkQfBQHDyUj
 g0fHFQ/+OKnFEbDdPXVkPKE+6Lm6YpLkwg1eHaZ3s+mTPoj0wer1E4UQspLAmG+x
 U7P687tOEtt+9l+rNmD8JBoPeZQypX5R0FQaTnbs8DJl6lkfTFHzeUn9DWHbuw16
 K9RWwH0hyVgEQjUuMZH9RMGxNKE7kvv6Nko2vGGYA6I2WGaVJbglWAA3QlaHRvN/
 mpgVx33vRX3fvL9CCY9gEk/GgkbuaUxXCAkbhlQJ5xsBOAyuZrr5EubQgoYvQi0x
 mcDX/UPJbviI2KbvGLD7jiY9OEUdHhBX3//YOSeTsqo6IJRRgWpKDjO3zVoTCN0Y
 oQJvoGNMle/QQjF76MabtUcsH/wj/Ssq+S8Wzv4t8Tirdase0VCIEkYdDn5wyrUF
 jv312foG1IiBlLP+qNVicWBpE2EDf3sYMz7FRTeFyz8J6yZi2Dd/WIARtDlZjboa
 loBqT9ktaQTa76Kk3vTgJRYQ2YyMsEGSQje6oU1lsR7KSm5fEd4SQ1oc5y3RByxr
 U0/Ni54tbzy5LtwwGqoywecuOocjr+7zISRdKB+mAHZPZtsHZO4VnPjEQs/TOxrt
 aa93PlVksLLzW+jSQl14izqCSiJiN1EVON5yyek2+QB6YztViMBf2sy17wwwu/il
 KASyaeXduLiAYvYyEvR3+MGD9eaFakVh0K887oRRNK3rtzDTloU=
 =GvUd
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-fix-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

Pull dmaengine fixes from Vinod Koul:
 "A bunch of driver fixes for:

   - dma mask fix for mmp pdma driver

   - Xilinx regmap max register, uninitialized addr_width fix

   - device leak fix for bunch of drivers in the subsystem

   - stm32 dmamux, TI crossbar driver fixes for device & of node leak
     and route allocation cleanup

   - Tegra use afer free fix

   - Memory leak fix in Qualcomm gpi and omap-dma driver

   - compatible fix for apple driver"

* tag 'dmaengine-fix-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (25 commits)
  dmaengine: apple-admac: Add "apple,t8103-admac" compatible
  dmaengine: omap-dma: fix dma_pool resource leak in error paths
  dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
  dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
  dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
  dmaengine: tegra-adma: Fix use-after-free
  dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  dmaengine: ti: k3-udma: fix device leak on udma lookup
  dmaengine: ti: dma-crossbar: clean up dra7x route allocation error paths
  dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
  dmaengine: stm32: dmamux: clean up route allocation error labels
  dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
  dmaengine: stm32: dmamux: fix device leak on route allocation
  dmaengine: sh: rz-dmac: fix device leak on probe failure
  dmaengine: lpc32xx-dmamux: fix device leak on route allocation
  dmaengine: lpc18xx-dmamux: fix device leak on route allocation
  dmaengine: idxd: fix device leaks on compat bind and unbind
  dmaengine: dw: dmamux: fix OF node leak on route allocation failure
  ...
2026-01-18 13:38:31 -08:00
Linus Torvalds
3271b25e3d phy fixes for 6.19
Bunch of driver fixes:
  - Freescale typec orientation switch fix, clearing register fix, assertion
    of phy reset during power on
  - Qualcomm pcs register clear before using
  - stm one off fix
  - TI runtimepm error handling, regmap leak fixes
  - Rockchip gadget mode disconnection and disruption fixes
  - Tegra register level fix
  - Broadcom pointer cast warning fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmls7lsACgkQfBQHDyUj
 g0duRg/9El3c4fH6k4G+1Q7Xb69Z0I3elXQF0jQoXVfshOWF0CUnGNF96SEbKnq2
 jhEcYTxo9GQgfFMF3ZukCI/1GAdL3W3cCBuDJoX5lnMkIGwtgPj/tr62bzBW5fc1
 S3caMSjjgllVbbpLu8m9vauVMYmtcibNCZJs0kSHliYyDBYfq6u++PZhHtxmMLHT
 4OBCAK7ZeL8kGy4EyN0aceRB907YT6m1QcTxlhCgZEkq+0Nq1/vGApYtusINI5qP
 IadQh5PJH6dl4vkZd7WGCtKYPhtqPOa5Jh4CKuhq79YL3h5/JezuLimwNpOaKWS8
 GDRg1OYjIVvHcr9wEPMXco2W0y9i5JZDTkAv5yfOD7trKiopCF/5KMYQUlZz7uqR
 yW5zxZ5RFNJAtgwSvjeDiGpDesFGp582+PoL+IDix+41fYV4QaN1dPGL90vKtghO
 rpgPc85JdG+fW4CbpMA54n67tsWDU+jt4IX1XlK/LSY0x5PXvZ2vQHrxlcYa1Sr1
 NTmMiaL6wEMkAOIxvGerojVw7JBwcVQOOaI6YlId/Uwa3ejhw+8DMu5vfpASoQAa
 S4GcjheW8/2AJIMzDE9iN314gV65LtizTHitdxld2o0ooUyQx+/JAxthEvuCJ93b
 NOSrJWTd/vMRJlEFrR0aOGU0bInazGdmKxpciFd9MCbN0iNLZrg=
 =eupL
 -----END PGP SIGNATURE-----

Merge tag 'phy-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy fixes from Vinod Koul:
 "A bunch of driver fixes:

   - Freescale typec orientation switch fix, clearing register fix,
     assertion of phy reset during power on

   - Qualcomm pcs register clear before using

   - stm one off fix

   - TI runtimepm error handling, regmap leak fixes

   - Rockchip gadget mode disconnection and disruption fixes

   - Tegra register level fix

   - Broadcom pointer cast warning fix"

* tag 'phy-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: freescale: imx8m-pcie: assert phy reset during power on
  phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
  phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
  phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
  phy: rockchip: inno-usb2: fix communication disruption in gadget mode
  phy: rockchip: inno-usb2: fix disconnection in gadget mode
  phy: ti: gmii-sel: fix regmap leak on probe failure
  phy: sparx5-serdes: make it selectable for ARCH_LAN969X
  phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors
  phy: stm32-usphyc: Fix off by one in probe()
  phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
  phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
  dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings for qcs8300
  phy: fsl-imx8mq-usb: fix typec orientation switch when built as module
2026-01-18 13:18:40 -08:00
Linus Torvalds
56bc8a18aa soundwire fix for 6.19
- Single off-by-one fix for allocating slave id
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmls4ocACgkQfBQHDyUj
 g0c61BAApv/Q6wiYFNw+NL+KYn0Qlg9Bq1uXBy/FuiKitMDqjw3+ssRpeOpgEaK8
 slAHajjKJHUPmeuX9sc7o61ne7QDdsFSleaZVBEstL0nknrPa+LfN+yJ0GNKtEMJ
 vy1GrZjhsBFzGfGCps9xcgx8SCubQZKhdg0sclu0AUmPK6EmpyKOD4qx3O1JRCoW
 SvdUltTg7wUH2u/Rs3dv5tcklW4i23rusDQ7O4BQySoewynx/zoWQ197T7jK+/jp
 F5fKm3fb2BQLgekWT8pmSqyQFrkogGpl4dKfjWARrwAgCavjxLX07KlNZWPlEEUp
 XM5fPqkmGOSg4sOLgVr6Cb1KC6bcZUBOdmeQjrcJQd/TX9fDSYKTVpAfAlkL2g3t
 4Gnz6Aos4B9aMFvzg17N+ojfMf+BhRge0mB2B1GIn2eopDEf/4OMNgW12d7H80vF
 5WNI8lEBL/jJeIPAE38Y625ODoI4xJig1Ao7I4X3ZmbKSbu9QTt1M3mYNiymEO8z
 03dZJ0KYBKzBqcRuhDPnxrh0kzzLFvYULAAEPBFBlslyAUQVONhLs6vDE8pnmM4V
 pV3lWBHKXHdefXeynRKJgvpBlXcXRH0BdN4llHZHFYf2jsmQ0Hi56R6Gp5yytIhS
 njrqx8SPz4SFdd4vrVZHTL4fPAI8ZBL9+IfrmLK/0g94ps7kVmg=
 =ejFF
 -----END PGP SIGNATURE-----

Merge tag 'soundwire-6.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

Pull soundwire fix from Vinod Koul:

 - Single off-by-one fix for allocating slave id

* tag 'soundwire-6.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: bus: fix off-by-one when allocating slave IDs
2026-01-18 12:29:12 -08:00
Linus Torvalds
27983960f0 USB fixes for 6.19-rc6
Here are some small USB fixes and new device ids for 6.19-rc6
 
 Included in here are:
   - new usb-serial device ids
   - dwc3-apple driver fixes to get things working properly on that
     hardware platform
   - ohci/uhci platfrom driver module soft-deps with ehci to remove a
     runtime warning that sometimes shows up on some platforms.
   - quirk for broken devices that can not handle reading the BOS
     descriptor from them without going crazy.
   - usb-serial driver fixes
   - xhci driver fixes
   - usb gadget driver fixes
 
 All of these except for the last xhci fix has been in linux-next for a
 while.  The xhci fix has been reported by others to solve the issue for
 them, so should be ok.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaWz3vg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yla9wCcD1m6pbFyOvvzQCDqL8YGB2VQxkgAmgKb/7Zl
 R5vaEmB6L41wkiWzMtsx
 =qgN6
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB fixes and new device ids for 6.19-rc6

  Included in here are:

   - new usb-serial device ids

   - dwc3-apple driver fixes to get things working properly on that
     hardware platform

   - ohci/uhci platfrom driver module soft-deps with ehci to remove a
     runtime warning that sometimes shows up on some platforms.

   - quirk for broken devices that can not handle reading the BOS
     descriptor from them without going crazy.

   - usb-serial driver fixes

   - xhci driver fixes

   - usb gadget driver fixes

  All of these except for the last xhci fix has been in linux-next for a
  while. The xhci fix has been reported by others to solve the issue for
  them, so should be ok"

* tag 'usb-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  xhci: sideband: don't dereference freed ring when removing sideband endpoint
  usb: gadget: uvc: retry vb2_reqbufs() with vb_vmalloc_memops if use_sg fail
  usb: gadget: uvc: return error from uvcg_queue_init()
  usb: gadget: uvc: fix interval_duration calculation
  usb: gadget: uvc: fix req_payload_size calculation
  usb: dwc3: apple: Ignore USB role switches to the active role
  usb: host: xhci-tegra: Use platform_get_irq_optional() for wake IRQs
  USB: OHCI/UHCI: Add soft dependencies on ehci_platform
  usb: dwc3: apple: Set USB2 PHY mode before dwc3 init
  USB: serial: f81232: fix incomplete serial port generation
  USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
  USB: serial: option: add Telit LE910 MBIM composition
  usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
  dt-bindings: usb: qcom,dwc3: Correct MSM8994 interrupts
  dt-bindings: usb: qcom,dwc3: Correct IPQ5018 interrupts
  tcpm: allow looking for role_sw device in the main node
  usb: dwc3: Check for USB4 IP_NAME
2026-01-18 12:09:13 -08:00
Linus Torvalds
5d1765a96c i2c-for-6.19-rc6
riic, imx-lpi2c: suspend/resume fixes
 qcom-geni: DMA handling fix
 iproc: correct DT binding description
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmlssnIACgkQFA3kzBSg
 KbbsDBAAkVM62lA/c2/JHjF/4qH4aDaqXSMNLdqMgy732HrVSayeltXvnRvVFR/d
 R1jdE8YAfC2xamCN31iHteHVcoynoX9blSToI2QhxRpWlcgT1rHerkRqiWnfHYFA
 3iwSsx5V/l1nL2EqkbHdpMjNFydZYf1FU6eS5y/7scVuhoGG9gcRZB7I+W7pEF17
 uDiReBPdY3hKhzYR0nu4Zlq5P7WoHcdp1vqv/J9s53RqAA/sWkCEjHIoWypwzQDX
 6K0zN+u0TTZWCIlI7UaU0OI0QLBgKhfp3PeTUIJ9JSvodcnVBm/YAfAnAt3onyV0
 3YxemVr2mC8CIl9QCVs6moXPYpwn2gibVENass6Xn23E8hrkyDMKqwHZCpmr6vn3
 oWC4uTcVtu5ezwxnwrvxULF1V6Io0bMb4j9qUw9KzpwN/QVH0LQKhBQs0GWIIbPR
 qscMnP1KuEbSBGetRlO0HRhHU/zViXHLO6ngbjv+d3/UYqfA/xr9PTzgbnsdMxLK
 MdtkG3Q9hYwasfAfCmFRrzsebJrkf307W3enLowhlpi2zkmV3y8lAQYuhvvOGJTx
 p1K4Xd+sQEkBcd6JJuW8VbBbwW+8G4y7wODYnEnW4I4aW3dAjbB8EV9cQ7fQ6ZKh
 PVUx22gQ5vOCvCzNbrH+Etd5fl/3Wp60hFkFC5wpafvZsGXdcMI=
 =o2qp
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:

 - riic, imx-lpi2c: suspend/resume fixes

 - qcom-geni: DMA handling fix

 - iproc: correct DT binding description

* tag 'i2c-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: imx-lpi2c: change to PIO mode in system-wide suspend/resume progress
  i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
  i2c: riic: Move suspend handling to NOIRQ phase
  dt-bindings: i2c: brcm,iproc-i2c: Allow 2 reg entries for brcm,iproc-nic-i2c
2026-01-18 12:00:35 -08:00
Linus Torvalds
93fc4e044a - Make sure the memory-mapped memory controller registers BAR gets unmapped
when the driver memory allocation fails. Fix that in both x38 and i3200 EDAC
   drivers as former has copied the bug from the latter, it looks like
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmlsv50ACgkQEsHwGGHe
 VUpDoQ//bQlRmb9O09RqtD13R1ivlgYhucv9qUb8beLAY7xDpXVL/9S8dE/bHnRF
 IXl9KvCKFzFMxEAlKAqOI/Xv21l51KdqgFz6JJo4QIXzPUbMBZwdXSnZd3HGf4i8
 f3tKTgJZQMY0egHuThiFxOrPdfGzxHRQ6Vv2K00b6jzn04Vzb0oGmZf1Mnvw7iXx
 zUusPIX72x5RzcA9enLj4hJvUdJTlCir9YHYulPW+8Uik6OTLNhMg+rzMPD0uhca
 JWz7XWRH7V+GA8wFTMaEe4UkGlfdsCSc2/ngsdrI+N1Om6H6r1MK+MlOowVal3LQ
 LSMacK+POMI5b/5qLti+10vQeYb/6Xf3C4hG5sEpAEqBpbiCIB16L9otvzMKzqEE
 LkMRN5qXaxGc9cd8h1JUKpdZoj2+aFKvsX0bMYzTgf3DgNIYoTTWswY4OXWYkjfN
 sHtaYiFPl0lf2Ran1ztM290vWiIeFEkYgatmWUd7rPHU/WbaLwL6KL0L2nQIGbas
 9KEnZSz+LxTqZ8WWje+EiyG/EQW+7tpN5coFQ1Xu8kk087J217jCEnZ+VDjGNkEU
 VMoNupXM3XJ7fWarEnL8LXGNX1sV1s2jdTWOToD/ipO5UkLi/Bh/v0UEVvrsx4Id
 eFiddMoB+9jVbpfiqXy7hZKZXBzbdqOOzddGze1VDii+ROG2Wqc=
 =d17O
 -----END PGP SIGNATURE-----

Merge tag 'edac_urgent_for_v6.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras

Pull EDAC fixes from Borislav Petkov:
 "Make sure the memory-mapped memory controller registers BAR gets
  unmapped when the driver memory allocation fails

  Fix that in both x38 and i3200 EDAC drivers as former has copied the
  bug from the latter, it looks like"

* tag 'edac_urgent_for_v6.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/x38: Fix a resource leak in x38_probe1()
  EDAC/i3200: Fix a resource leak in i3200_probe1()
2026-01-18 11:39:56 -08:00
Linus Torvalds
e503f539dc Misc x86 fixes:
- Fix resctrl initialization on Hygon CPUs
 
  - Fix resctrl memory bandwidth counters
    on Hygon CPUs
 
  - Fix x86 self-tests build bug
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmlssTsRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gpPBAAlLehAo2UyjalUQ03wakg0vt1hVQ71MG8
 W4xze/rk3vK8xxGwdaWbLnxZxsN7diY6mZt+3JZPfifMQh4UDhHoPSf9seanW2FU
 PndGS6w3IDDiUIAz0JBGdJraDdZyHLLfg1G7+Yp8+avHmKOBIf4NjULYdj+Og/WP
 205kXXhjZ6PaKTzzwkrzm5efZM23bDkx5jGVLxAs9plv7g9C+qRlSkbhL8tUsRSK
 twAx2L25/Sa0y1q9dHDGVoHEWDJNkCw+so36wn6BdYIovXhc9sYpLowF+HqMCpWB
 nsf6D87H7mrtJoSwF34rc3GqN2VkKUQqGM7J8kp2Yi+pB+DImaCVwjG6FNJJIDrt
 CweXSemVhegbfwLJEEflUTaVA/nOsCP/k+sYP8pvOE9TsVuT0QlUj1Ao7vbKEbZu
 TG0Ujzwgm1Y6j7vTxiSmHdQm6ff2xO+1acOt1f3wB7esA+Kpa2i5App1FU/PVFc6
 vO4qWOaYVg5EzUZWPWnpDWRX0nvfjklyx0SzBhhwKOnRjXupsYmEWwnHqpLyBbGf
 7+MfAANqtAzK2b71lZXCZ2yDfmR0jiFLOKhO8pmJueP2kuaxqe8zqisICuLsrV11
 93xw1V/YMdeMAbcQvo+Mkwe5aCfgcM9EOAJcXZHC+nVDXHCC5CiLAgQWpkPXlJGf
 mCXp1h5IEBU=
 =wTUl
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull misc x86 fixes from Ingo Molnar:

 - Fix resctrl initialization on Hygon CPUs

 - Fix resctrl memory bandwidth counters on Hygon CPUs

 - Fix x86 self-tests build bug

* tag 'x86-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  selftests/x86: Add selftests include path for kselftest.h after centralization
  x86/resctrl: Fix memory bandwidth counter width for Hygon
  x86/resctrl: Add missing resctrl initialization for Hygon
2026-01-18 11:34:11 -08:00
Linus Torvalds
b671c1dad2 Fix the update_needs_ipi() check in the hrtimer code that
may result in incorrect skipping of hrtimer IPIs.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmlsr+oRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iLPw/+OuA8hPlFY8nxrpVKASoiP7u+mGQ82Qmf
 xdf1Kimpmc5ydpGsxpRLKY19l3fLuGSJuOa2Url0Ro52JHxU+yPPOkN2ONjsPxLI
 mFMdhyXiS1PIgYt307OmNmKFadxdg5cGJTKY0wIS9JCcPFxI5Y3NFhWZ4ybPlGHK
 /bxtsjUctekUTDVahqP65lRIYMvjhO1I2LQfoPQyg/C+2n6Owy7TAX8xZovDZLHz
 a9RkkX6FPc8aR8Kj1VYm1yABNlUhGvFvTE6wfcfOMjiHHeDv2qYdwNHF2tK2eoKC
 QX609zBTCT/n0ioZlikLrKDZitj6uRgS2blBc+hodHEs4cY5gE2umWSU4IirT7HH
 GDjvG/vns/BLRr97gPdMaJ+N/sjdCSQ5tsDRrvHwCGC27VXPu3O3DYU128eH4eXW
 +KNJGQHJvR7slBKElQ4wxJaLhbLBB5rw/AqqdXa4PU8LqvMBBNcLZjHnrYlbD5Ei
 ovdX5VtRYOjrVl7pCNrXXdzFfBpXK+sOPHQMoJxnLHKXO+cdsZz8zIB7AHZEVe20
 CIOMRcfgw2nvpS+0MqaHzre0ixyq+U2XSIu7MRIlq8GZ+zdjiVMqx3pPa19QRdyr
 hA9JupeRC9eZdymlms2MiSzqIVmWSVvgcyhIFSYw9yLe55vXcGyArF27RKGtBHRA
 uF+K5aT8gqA=
 =CAdu
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Ingo Molnar:
 "Fix the update_needs_ipi() check in the hrtimer code that may result
  in incorrect skipping of hrtimer IPIs"

* tag 'timers-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  hrtimer: Fix softirq base check in update_needs_ipi()
2026-01-18 10:56:32 -08:00
Linus Torvalds
837c8180e3 Misc DL scheduler fixes, mainly for a new category of bugs that were
discovered and fixed recently:
 
  - Fix a race condition in the DL server
 
  - Fix a DL server bug which can result in incorrectly going
    idle when there's work available
 
  - Fix DL server bug which triggers a WARN() due to broken
    get_prio_dl() logic and subsequent misbehavior
 
  - Fix double update_rq_clock() calls
 
  - Fix setscheduler() assumption about static priorities
 
  - Make sure balancing callbacks are always called
 
  - Plus a handful of preparatory commits for the fixes.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmlsrfIRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hgUA/9HQi51sxF/TlhKeoj9Z0zSO/L5Fbd7d5O
 ucsr+exoU7B+X95AnYC64pV3YlTNibD5y6HR4zpPzhlmEdFw8K9hTmDeSOF2cB0T
 dPdEY2KtvNoQwVwytPYKMsXtBTcJtZZqOec9BgGBzSIpjPm6Zhxr1J2/lKFy/udA
 00aqNuJwfQW94dxvyPf+jPXbm0JW9HHZGNuuOXkkmZpkH+HIzBDrTWcAjHUaZt9H
 doPyEfO08dg3Uu4OxNBtxx94X7bQsn5RU1plSEc+xF7zynqwEIwDbelFftpHiM+z
 UqfFgkzCV8A8o/72BfZVhQgaspMZ+M4XSsaGBbouOTg3Rgx8gRKC23s8/xhDJSpy
 ayMWhuR5bsI04GD1xZVOwLvUi8oDIgAFIAKRI6gcW5eQELlejii0bAvs9Jw9/OjI
 QhhrX54sJCPPKMZpKO2n+AzQvv9a6+/p7ikiA2U5dR4wBEERFUw8ffRguHwSm+BU
 U1M+t+2tw+UiC7yML0zvIC3HdyfBhj33ZeW7PWyvFU0vjGm78U6NjqliAxbqW21l
 GdtQUpi9aXCtijXqHhLFvBtWGmqowj9UQiHroC0+nq1BsTpBDe575vwJNYF2K9he
 ht0hZqreUIf7xTsJHXlLFbtFxPQw0xAKzWJWUswaaqO8eS2JcWJbmHUAsHQuxmJB
 MbkJAlU7j/w=
 =DgiW
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:
 "Misc deadline scheduler fixes, mainly for a new category of bugs that
  were discovered and fixed recently:

   - Fix a race condition in the DL server

   - Fix a DL server bug which can result in incorrectly going idle when
     there's work available

   - Fix DL server bug which triggers a WARN() due to broken
     get_prio_dl() logic and subsequent misbehavior

   - Fix double update_rq_clock() calls

   - Fix setscheduler() assumption about static priorities

   - Make sure balancing callbacks are always called

   - Plus a handful of preparatory commits for the fixes"

* tag 'sched-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/deadline: Use ENQUEUE_MOVE to allow priority change
  sched: Deadline has dynamic priority
  sched: Audit MOVE vs balance_callbacks
  sched: Fold rq-pin swizzle into __balance_callbacks()
  sched/deadline: Avoid double update_rq_clock()
  sched/deadline: Ensure get_prio_dl() is up-to-date
  sched/deadline: Fix server stopping with runnable tasks
  sched: Provide idle_rq() helper
  sched/deadline: Fix potential race in dl_add_task_root_domain()
  sched/deadline: Remove unnecessary comment in dl_add_task_root_domain()
2026-01-18 10:17:40 -08:00
Linus Torvalds
cee4757965 Fix two objtool build failures that trigger in uncommon build
environments.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmlsqxkRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1irfg/8Ct/Z+OftNDHe18+gwO2+rBaJNn0vuQfK
 2uFur9ag5kkfXq9l6FOSZKH+xEDO07w7tqfeXqJIXaqUJq4DtrkSk1MSdDcmjHZl
 fXnnpUfEcZPlTD1CfLXIkBLaILLwL/ZZKAWWNFXLZPqznCf2mQzOHcpIsL7TO4V+
 UQdnyWTXMATDRi9tbmbc177GVm2uoEzns/LkxTww9bjvBk85yAnR/gDl7nCByJTb
 s6C73tEHFcOWvGQiU8JwWYMdeTXILrZCCowGNBbSsYATMlsSBv0Gq/95oDcYbRRv
 mF9nWoNkTjVpKJK5ckH9iKSdhomn6JbknKE++wFx+3AMq6MaJ70GtisZDrRE7ZkG
 DiEymmJTCBEIvBlrt+8jpRxaCL6V++Du8+c5VP2VsLwGxt607MNEuuUfBQGSsgR/
 77VxWV+ueP/5Pfx1HzqBTpXqU4weXASpzCbM6T1RLpV3DPDprf6nWRZ4em5L2eFJ
 YZdfptIOH71esgl/z60wgyzpaF0f70d/Mox5IM4XDZg3tlN9Gv64WvdZamRGbg3X
 nHnjt5Lq3rgR6wVMXE83my+IdqX95dDsEvCcreAKLhbmm81xVCDlYgyLSnYj1Dfx
 m20JLxPjAeCfo3tWgJ3XlFNGgWnDJ8ipe/BNKXocV7yafPC3p/eJUxGCqOzGHlVx
 kvlF96NgNA4=
 =yYJ3
 -----END PGP SIGNATURE-----

Merge tag 'objtool-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull objtool fixes from Ingo Molnar:
 "Fix two objtool build failures that trigger in uncommon build
  environments"

* tag 'objtool-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  objtool: fix build failure due to missing libopcodes check
  objtool: fix compilation failure with the x32 toolchain
2026-01-18 09:09:32 -08:00
Linus Torvalds
8562711ac0 Fix a riscv-imsic irqchip driver regression.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmlsqi4RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gfBA//Rt89kvdu3CG4BbYN4AN9aGlanB43z5Ih
 2lC7tog7+Esr6hjIKHm+7J47dnABzSInyqcgxr7yhR2OhzjNvLhccDwKkWROxcAO
 ML+hw+hvpdkSFdVOIIhGTSeGrGw8xndpISFOkAZGP5BZVZ/v3AUA+kjwdzYzHY1I
 wHQ/yf1dvXoUde7Rq0axgx9GZc7Z8HgY8gzH0hAIFpmfKDJRf5R8pjvsg+foV39J
 29fn/8NzHgsVfi2BjKAtoFOgDUwTYVZ2e3thkOmPUjs07NSQZ4U7u1S9KIhFjxLM
 wMi+udCKzcJe4pBCw/2cPZOVCPBpX3T33zlKMlyNQVZbSec3gitPO3jUXPz0AYYN
 34FUNvhjInSnsbksu+cT8u3MiuWEaSxXfQgaeB3e99K1XC9ckjmE5YtxTMoE4Dxx
 2HOdAdesNw0cgAcXRWWnAC1ZtocmkdDLZF652Y1iKx8bK3qc9cORYNV1+tZqnOzJ
 qIzmYIJh2LKLUY6xMUbGlU2sIEWEzqb0mDHI7Sfn7OMLvXmrZ1lsLgXDiiKczckn
 FwHVxDRpYmBBq5JOFj0YwyVKgmeIrxuVHe/99CPuueU0j0yFq5wZZiScrfx6zLuD
 TUZGGMMn8ZPEA75SPxpPwSDe4rtvQ1KMTluYMFYu7LA6eOkmicd7VK7SiYM2S92F
 sQBacoQzUAo=
 =O16d
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fix from Ingo Molnar:
 "Fix a riscv-imsic irqchip driver regression"

* tag 'irq-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/riscv-imsic: Revert "Remove redundant irq_data lookups"
2026-01-18 09:08:27 -08:00
Yang Erkun
d250bdf531 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
The error branch for ext4_xattr_inode_update_ref forget to release the
refcount for iloc.bh. Find this when review code.

Fixes: 57295e8354 ("ext4: guard against EA inode refcount underflow in xattr update")
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
2026-01-18 11:23:10 -05:00
Julian Sun
0ef7ef4227 ext4: add missing down_write_data_sem in mext_move_extent().
Commit 962e8a01ea ("ext4: introduce mext_move_extent()") attempts to
call ext4_swap_extents() on the failure path to recover the swapped
extents, but fails to acquire locks for the two inode->i_data_sem,
triggering the BUG_ON statement in ext4_swap_extents().

This issue can be fixed by calling ext4_double_down_write_data_sem()
before ext4_swap_extents().

Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Reported-by: syzbot+4ea6bd8737669b423aae@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69368649.a70a0220.38f243.0093.GAE@google.com/
Fixes: 962e8a01ea ("ext4: introduce mext_move_extent()")
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://patch.msgid.link/20251208123713.1971068-1-sunjunchao@bytedance.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2026-01-18 11:23:10 -05:00
Arnd Bergmann
cd16edba1c ext4: fix ext4_tune_sb_params padding
The padding at the end of struct ext4_tune_sb_params is architecture
specific and in particular is different between x86-32 and x86-64,
since the __u64 member only enforces struct alignment on the latter.

This shows up as a new warning when test-building the headers with
-Wpadded:

include/linux/ext4.h:144:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded]

All members inside the structure are naturally aligned, so the only
difference here is the amount of padding at the end. Make the padding
explicit, to have a consistent sizeof(struct ext4_tune_sb_params) of
232 on all architectures and avoid adding compat ioctl handling for
EXT4_IOC_GET_TUNE_SB_PARAM/EXT4_IOC_SET_TUNE_SB_PARAM.

This is an ABI break on x86-32 but hopefully this can go into 6.18.y early
enough as a fixup so no actual users will be affected.  Alternatively, the
kernel could handle the ioctl commands for both sizes (232 and 228 bytes)
on all architectures.

Fixes: 04a91570ac ("ext4: implemet new ioctls to set and get superblock parameters")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20251204101914.1037148-1-arnd@kernel.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
2026-01-18 11:22:53 -05:00
Linus Torvalds
e84d960149 for-6.19-rc5-tag
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmlsRSEACgkQxWXV+ddt
 WDtXqg/+IGNYVrdRU6Ds/m1T7RO7uAYTTk9X4+21u7cYfVtZzC2gkBVfRwjv3gkD
 JVVCjXrKmdcQl1QMazeALauF0NBjLtA46SH4mm6tF9ZJu2TNxOmumCYpqjMtGjRG
 npAJW3LrdNxyClm9AbtJrvGcEQ78XuaGoctIHIvJH5NakA7pgOjEGMTGuCcKMMGH
 e/cQ6rEriOIAl9hPVJRx4odI1zd7AY0MMiLsSLKJdad1/TcJxFT36lg7SNc2Eqvz
 bBUlRqb6KOWLItU1c+KBx3yMuFpGYe7OLLqOtZo1Xdb0jDF0cU54eM0OgSkgMhRJ
 pFGFnGjfGtmpwDuthjNObnLTUzfsR2Yj7Yc56e0Ah7KAbhvWr7npAkN7bid+bagP
 1MnnRNrb4zqGNbzZ5EwX2MYcHV5EiwlzSZx9H0MIP0umCNVa4vubQ9S4UCHk4Twj
 BbAK7No3pgicwXvp0HI/4lYQldYBhp6ni+lh1HLgScYVReUCpmG1X2rDkf8viJ9d
 dYnKHnoyzPDIDQcVDkPOMIDnBofTGHux3aUIhE9va/ysALyNHn5uDr+idQt+eM1E
 SwnK+l8V+0kr55cHNZ0l3+e9gnDuD27pgQv0oHCDe2KKiUJCMBwaepH+P+QZjsHx
 bgCXnau6897qjxc3oDjQUZArkPPXw+8rqvkzv2aSFEMnhSOBqmI=
 =qIBc
 -----END PGP SIGNATURE-----

Merge tag 'for-6.19-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:

 - with large folios in use, fix partial incorrect update of a reflinked
   range

 - fix potential deadlock in iget when lookup fails and eviction is
   needed

 - in send, validate inline extent type while detecting file holes

 - fix memory leak after an error when creating a space info

 - remove zone statistics from sysfs again, the output size limitations
   make it unusable, we'll do it in another way in another release

 - test fixes:
     - return proper error codes from block remapping tests
     - fix tree root leaks in qgroup tests after errors

* tag 'for-6.19-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: remove zoned statistics from sysfs
  btrfs: fix memory leaks in create_space_info() error paths
  btrfs: invalidate pages instead of truncate after reflinking
  btrfs: update the Kconfig string for CONFIG_BTRFS_EXPERIMENTAL
  btrfs: send: check for inline extents in range_is_hole_in_parent()
  btrfs: tests: fix return 0 on rmap test failure
  btrfs: tests: fix root tree leak in btrfs_test_qgroups()
  btrfs: release path before iget_failed() in btrfs_read_locked_inode()
2026-01-17 19:29:32 -08:00
Linus Torvalds
47622aa8b6 LoongArch fixes for v6.19-rc6
-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmlq+z4WHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImeuiPEACvL76/lHI+5aww1PfokzjCdQYk
 /ked1m/3BmLhufqFvLDhraLTA/6rFF7j2KdHm2RESIS6bk/YaN7RMh9iAGpN+APu
 /pF0ppPMPuvpJGdWuWSPvTdwCMuA5ksvMl+CPRthSYqsQ42d1h5alirWOkbtLTW7
 EMmgnMZAL6VHnyiWHjMn86BCkvC/2DHyvtC7WsMh1LNa6Cqlcu/sxaMC73sBf9qZ
 FbB5dziLXjpkJp7QIJH0KbrRhtw8CzCbW4xuwJO2u/dR+9Xl3LT9HD8/aYa11aXE
 Q9QW3M7d1h8+cJIbdrTjLqSCV49hwPC4YpA5d4ElFcJJF68gpMfBs+ZLzLc5OkK3
 mapw0dMWlXbkOEAC0dq0NIf3jpIgVdlaZQcC6jFNNiAgWnQv+qqfvvtw7A/bK3K+
 xwM+wcSpMe0zEmxFKz4xhDJ3PdMvgyrSBkcItgcdiEd107fLskYHuMUzHPMwh6oA
 uGJ+4u0sCXLFubhjhkQGgTyUbk/cgOBcCAnqv0gTQfcTdF0fCLuSFcpUjtunq9wu
 AqKxr3kA4YkMW7uG2pliCJyUL1/jV2kIMhekxJN2Q8WQPhZ6antSUQhJZDOl8xj2
 QRaoprMZ/uUmH2vMmGMiO+7TTglDH8DrkVWdqo4kxZjvnIcXzkBs0bAvFdzo3mlS
 Mozpbd+D8LdURSMjhA==
 =0h8y
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch fixes from Huacai Chen:
 "Remove redundant code in head.S, fix PMU counter allocation for mixed-
  type event groups, fix a lot of dts build warnings, and fix kvm_device
  memory leaks"

* tag 'loongarch-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()
  LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()
  LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
  LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
  LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells
  LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells
  LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells
  LoongArch: dts: Describe PCI sideband IRQ through interrupt-extended
  LoongArch: Fix PMU counter allocation for mixed-type event groups
  LoongArch: Remove redundant code in head.S
2026-01-17 19:24:48 -08:00
Linus Torvalds
d12453c7e2 arm64/mpam fix to use non-atomic bitops on struct mmap_props member
(atomicity not required). For kunit testing, the structure is packed to
 avoid memcmp() errors but this affects atomic bitops as they have strict
 alignment requirements.
 
 Also remove a duplicate include in the mpam driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmlrlm0ACgkQa9axLQDI
 XvHAXg/9Fk91bQjJzqSY3oPdDyY+H9VC49iS89OIiJb5Bw+2p+0/vJw10ujhCQ3I
 A0GJs4DvjBJbqBqYhZ0lIZtKrKCfNsa3Ej3RqlZfRh6BtQK+EfcE7IxyYXevuDOc
 wLUqrVQJpx2T6fzus2XMRFLGn8kRGnq+eCysEFCjRxqCQcxcLaokWrX2tYAbgBtb
 E3EjA2mQkpQQgkBUbCODUa4aHZggGPO7oiWGi6KfyuYbJ/GnKRDWdLg2WsqnI1E6
 DnVuonfkXIc+8glnTkqh8T3M4NEQxYxBBpraeyuWdzIhzK0oNp5uChCNeG+oPAOd
 FAQ0oN/2W+KpAdX16eYoZcc4AhXaOoNuVPtcw1M18VhCIVhQ8l8GlXVjKX8HPtzs
 DWk/pG1hgmTtmww8BS2Vjx5hxJXcsQGACQ4KZ61VkPUJpMIARDxlB/+hXGTO34bM
 E5SheukLH46kLRzU5hJmC6BChHBLcSUj4fo0MKsM/4iiagrRi/G/Sbll33HYFEO9
 ksIayBMX0lLylMeCg00+QovA+7MiNnMEAgdvKhnIoJo2bdXG7z+mt2S1LXjuGY9J
 czsfSCuDgb413REAi+VKv7Ow+fOwUSUWjiFgoi70Jy/hIoiGdyPlWiuu6ayb/qsP
 ghe6deDdNx7Hx5+iYLTFAIiV8yT8EOTsbEmGdJi6vSVYiOcclJw=
 =lmDb
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:
 "An arm64/mpam fix to use non-atomic bitops on struct mmap_props member
  (atomicity not required).

  For kunit testing, the structure is packed to avoid memcmp() errors
  but this affects atomic bitops as they have strict alignment
  requirements.

  Also remove a duplicate include in the mpam driver"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm_mpam: Use non-atomic bitops when modifying feature bitmap
  arm_mpam: Remove duplicate linux/srcu.h header
2026-01-17 08:52:45 -08:00
Weigang He
81122fba08 of: fix reference count leak in of_alias_scan()
of_find_node_by_path() returns a device_node with its refcount
incremented. When kstrtoint() fails or dt_alloc() fails, the function
continues to the next iteration without calling of_node_put(), causing
a reference count leak.

Add of_node_put(np) before continue on both error paths to properly
release the device_node reference.

Fixes: 611cad7201 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Link: https://patch.msgid.link/20260117091238.481243-1-geoffreyhe2@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-01-17 10:20:43 -06:00
Bala-Vignesh-Reddy
d9b40d7262 selftests/x86: Add selftests include path for kselftest.h after centralization
The previous change centralizing kselftest.h include path in lib.mk caused x86
selftests to fail, as x86 Makefile overwrites CFLAGS using ":=", dropping the
include path added in lib.mk. Therefore, helpers.h could not find kselftest.h
during compilation.

Fix this by adding the tools/testing/sefltest to CFLAGS in x86 Makefile.

  [ bp: Correct commit ID in Fixes: ]

Fixes: e6fbd1759c ("selftests: complete kselftest include centralization")
Closes: https://lore.kernel.org/lkml/CA+G9fYvKjQcCBMfXA-z2YuL2L+3Qd-pJjEUDX8PDdz2-EEQd=Q@mail.gmail.com/T/#m83fd330231287fc9d6c921155bee16c591db7360
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Tested-by: Brendan Jackman <jackmanb@google.com>
Link: https://patch.msgid.link/20251022062948.162852-1-reddybalavignesh9979@gmail.com
2026-01-17 12:22:27 +01:00
Linus Torvalds
d3eeb99bbc block-6.19-20260116
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlrBfMQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphVYEADD88/MTkm0x/Ydwq5WjoJ1yfYsJXFpO+ZW
 UZpsKGhPbmnu1d+541vlzMJS7OkIE3OsCHn8sXTagrKP862aDDZ7r71cG1OPF49U
 7ICK660OPr0s1E0sVEC0O3tB1C1jJf+cKgPmpDiz9Lyj43J23mGhXfuWyX4hpx3W
 3HVJBFb5KBaTV4hiFKGwNnPGNgRyWMt2tj5hSKGTZ8UU4jhi+CtWju64HUOqL8X6
 gPFKoqHx+qWwrnT7frd+B3ldVgrVUVY5hosrmqa9qKapEoxy+mZ897UZrV8mJc9X
 gbp+403kNMilMKOI1sE0ekU7aCpz7iAyWAX7+h5HTH19fmwlRVGrNZpqRINY06xR
 Wc9XdLgIrPwLdpngfO9YXFik6rLa5uhiXVYaIIaKwl0riORCxzKGpL3bROjYJKfh
 N0nLkvt55mO2BA4dxJd1h3Mz5Bwxme+B21nsNJf2pBSKBBfpW86t+Euqzm5xZwYW
 UYMbIfLnTGd7swLXhAzX67pz7dkkVTPd6cx6lOXtSq+WUS+Lng7c1tTTryuF2o/X
 LmHDTvsaWBkli4s8DKbxdoJQen8g9YE0jqvwJIgFecIlrhOl/6OjvI4VbKd18i56
 bkL/0RBtoNRfw8KyuXabZOX4h/NVSsO/7l1nPbqdiBXXuWTYUZFqvcuPD1Z76slt
 abUDIP8OQw==
 =8QRq
 -----END PGP SIGNATURE-----

Merge tag 'block-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - NVMe pull request via Keith:
     - Device quirk to disable faulty temperature (Ilikara)
     - TCP target null pointer fix from bad host protocol usage (Shivam)
     - Add apple,t8103-nvme-ans2 as a compatible apple controller
       (Janne)
     - FC tagset leak fix (Chaitanya)
     - TCP socket deadlock fix (Hannes)
     - Target name buffer overrun fix (Shin'ichiro)

 - Fix for an underflow for rnbd during device unmap

 - Zero the non-PI part of the auto integrity buffer

 - Fix for a configfs memory leak in the null block driver

* tag 'block-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  rnbd-clt: fix refcount underflow in device unmap path
  nvme: fix PCIe subsystem reset controller state transition
  nvmet: do not copy beyond sybsysnqn string length
  nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  null_blk: fix kmemleak by releasing references to fault configfs items
  block: zero non-PI portion of auto integrity buffer
  nvme-fc: release admin tagset if init fails
  nvme-apple: add "apple,t8103-nvme-ans2" as compatible
  nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  nvme-pci: disable secondary temp for Wodposit WPBSNM8
2026-01-16 20:59:46 -08:00