Toolchain and infrastructure:
- Update vendored 'zerocopy' crate to v0.8.62 (released 2026-10-08).
This update advances 8 releases, with 3 of them carrying most of the
changes. It contains new features as well as fixes. However, almost
nothing has changed that requires updates on our side (a move of our
non-ASCII change and the addition of an SPDX license identifier).
- Generate Rust KUnit test suites for doctests reusing the
'#[kunit_tests]' and '#[test]' attributes instead of C FFI
functions, which allows to remove the generated C glue file.
Relatedly, simplify 'kunit_assert!' by using 'file!()' and 'line!()'
inside (which doctests override as needed), which allows to remove
the 'file' helper and 'CONFIG_RUSTC_HAS_SPAN_FILE'.
- Trim the function names in doctests generated by 'rustdoc' < 1.95.0
when building with 'O=', which were not reproducible.
- Fix the 'VM_MAYSHARE' value in the generated bindings and its
blocklist entry, due to typos.
- Build 'core' with '--cfg no_io_statics' to ensure 'core' does not
introduce any use of 'core::sync::atomic' into the kernel image
since upstream Rust is moving 'std::io::Error' into 'core', which
uses a global atomic pointer.
Upstream Rust merged a PR to add a test checking that builds of
'core' are warning-free with that 'cfg' enabled.
- Enable the unstable 'proc_macro_span' feature in 'proc-macro2',
which provides 'Span::join' and thus improves the quality of the
diagnostics of all our procedural macros, notably 'pin-init'. This
is only used for producing diagnostics, thus there is no hard
reliance on the feature.
- Globally allow 'clippy::comparison_chain', since its suggestions are
not always ideal and upstream downgraded it to 'pedantic' too.
'kernel' crate:
- New 'mem' module: add the 'Align<N>' zero-sized type so that
alignment can be specified via const generics ('repr(align(...))'
only works with integer literals), e.g.:
const N: usize = 128;
struct S {
_align: Align<N>,
}
assert_eq!(align_of::<S>(), N);
- New 'ratelimit' module: add the 'Ratelimit' abstraction for 'struct
ratelimit_state' and, based on it, the 'pr_*_ratelimited!' printing
macros, which can be used for printing that may be triggered by
userspace.
In addition, convert Rust Binder to use them.
- 'sync' module: to construct a global 'struct ratelimit_state', add a
'const' constructor for 'raw_spinlock_t'.
In addition, move the lockdep types into a new 'sync::lockdep'
submodule, since there were starting to be too many of them.
- 'num' module: add the 'cv!' macro to create constant values ("cv")
from an integer constant expression, with validity checked at
compile time, inferring the target type from the context. It works
for any type that implements the new 'FromConst' trait, e.g.:
let a: Alignment = cv!(4096);
let b: Bounded<u32, 4> = cv!(15);
// Any integer constant expression works, not only literals.
let m: NonZero<usize> = cv!(usize::MAX);
// Checked narrowing, including in `const` items.
const SMALL: u8 = cv!(200u32);
// The target type can be given explicitly.
let e = cv!(200u32 => u8);
// With an explicit primitive target, the expression can use
// generic parameters.
const fn as_u64<const KEY: u16>() -> u64 {
cv!(KEY => u64)
}
This avoids the verbose turbofish syntax which disincentivized using
these types at interface boundaries (e.g. 'Alignment:🆕:<8>()').
- 'alloc' module:
- Allow different error types in 'KBox::pin_slice()', enabling use
of infallible initializers.
- Add 'NumaNode::id()' accessor to retrieve the underlying NUMA
node identifier.
- 'time' module:
- Add 'Delta::to_jiffies_timeout()' for use in timeout arguments.
- Add 'Delta::as_jiffies_unsigned()'.
- Make 'Delta::ZERO' generic over the time unit.
- Warn and assert when passing out-of-range inputs to 'fsleep' and
'udelay'.
- Rename 'ClockSource' to 'ClockId' to better align with naming
conventions in C kernel.
- Make 'CONFIG_HZ' value available as 'bindings::HZ'.
- Add implementation detail documentation for 'HrTimer'.
- 'bitmap' module:
- Add contiguous area operations ('next_zero_area{,_off}', 'set'
and 'clear'), with extra checks compared to the underlying C
code, plus additional ones under 'CONFIG_RUST_BITMAP_HARDENED'.
It includes tests demonstrating the edge cases.
- Restrict bitmap length to at most 'i32::MAX', matching
'BitmapVec::MAX_LEN' and simplifying a few things. This also
fixes 'u32' casts truncating in 'copy_and_extend', which could
otherwise lead to OOB writes.
- 'bug' module:
- Fix 'warn_on!' on UML which called 'warn_slowpath_fmt()' with
the wrong arguments; and fix its '// SAFETY:' comment too.
- Add a KUnit test for 'warn_on!'.
- 'id_pool' module: add contiguous ID reservation via the new
'reserve_ids' and 'release_ids' methods, built on top of the new
bitmap area operations.
- 'sizes' module: add the sub-1K size constants ('SZ_1' to 'SZ_512')
and implement 'SizeConstants' for 'Alignment', so that one can write
e.g. 'Alignment::SZ_8'.
'macros' crate:
- Add '#[optional]' attribute for optional methods in '#[vtable]' to
replace the 'build_error!(VTABLE_DEFAULT_ERROR)' boilerplate, e.g.:
#[vtable]
pub trait Operations: Sized {
#[optional]
fn f(&self) -> Result;
}
In addition, apply it to miscdevice and hide generated 'HAS_'
constants for required methods.
- Allow non-ASCII characters in the 'authors' field of the 'module!'
macro, which was unintentionally restricted when multiple authors
support was introduced.
'pin-init' crate:
[ Extra context from Gary's pull request:
"This is a cycle packed with feature updates. Two of the most
anticipated features, tuple struct support and safe self
reference creation, has been included in this pull request.
Safe self reference is a big one and is pushed a bit late in the
cycle. The initial plan was to include a minimum subset for this
cycle because I was worried about potential soundness issues;
however during Plumbers it was agreed that the features should be
upstreamed at once. This is because the initial users (Nova,
JobQueue) would all need the advanced features, so it is better
to ensure that the feature get put into use for real, and it can
iterate with users, rather than being fully designed on paper.
The existing safety checks are already very comprehensive, and
Benno and I are confident that if new ones are discovered, it
wouldn't affect the overall design.
That said, the the usage of the advanced features (invariance,
existential lifetime) shall be limited to the pre-agreed users
only, so even in case where the feature needs to be reworked, the
blast radius is limited.
Another theme in this cycle is to improve the developer
experience when things are used wrongly. A lot of work has been
done to use proper spans from user-provided tokens so error
message point to things that cause them. Many common misuse
scenarios also gain additional custom diagnostics." ]
- User visible changes:
- Support tuple structs.
- Allow safe creation of self references.
- Vastly improve diagnostics for common misuse scenarios.
- Other changes:
- Use 'mixed_site' hygiene consistently.
'MAINTAINERS':
- Add 'RUST [BUG]' entry for the Rust 'bug' module (i.e. 'warn_on!'),
which will be maintained by FUJITA Tomonori -- thank you!
- Add Alice Ryhl as co-maintainer for 'Rust [ALLOC]'.
And some other fixes, cleanups and improvements.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmrU9HoACgkQGXyLc2ht
IW2t/A/8CWBNGMU1HlM23gKmG9z3UuOp9RdebQMQxcjKcW5+odHHLtLn5ytuKfds
TwGHoPXBlm9iyVBTCbklJfRmVqXwGgg/Dr5PyUpFSMLPKfeTDANnseJmFzcnNtkr
3ChqB4D1J91OWZuUbS2YqNyXYuQQHhPCfu4idi/HjqdDPDZr8bAG3RdYhydTHITu
ahlbeisR6fyFO2ctWkxCFbbsAJ6nX37TVDF8lTKu5vxbJp5b7r4u9u2cQ2OEWrNc
sh/n3tv7JZSoIWapOAlsDpRXX00MsPFqiO1Ytuf8JOb3kwoVDDT0Ww3dDbmkiVKN
NEcEkYUcFRkAltscPHSos8MuElVqXQyY+ZrjCykXrFsxwKWeGXHYwBS9HBVPs49Q
AYzdbNe+hsUfqNJo4lP/9R8U9SQTv4/0T0cvgg9W1sdYJCePuzOwuTgaFDPs6zUL
vz/RZ6tIA0UbRQVnLnjoD8xWne+kpfDaZVinTCGqHpOBmEvPSxWwsHKj9Q5qJsC8
1UakcpFQ3gsvXn4Od7VAL2ODrc/gxSHEG7J1Zj0625CbrSd81Ga0fvE3VxtjxpRH
AQF9W/fnZ17pV4xBlqYZP2TR0/QNCHH8b/JCevOg1Rkafe3eqf2FjarfbrhVyOTT
wrm9gdDVwv40j0K1tVVnOAo+ey3wjlh+Q5jqVrnu15FpMsfzxlE=
=nyUg
-----END PGP SIGNATURE-----
Merge tag 'rust-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust updates from Miguel Ojeda:
"Toolchain and infrastructure:
- Update vendored 'zerocopy' crate to v0.8.62 (released 2026-10-08).
This update advances 8 releases, with 3 of them carrying most of
the changes. It contains new features as well as fixes. However,
almost nothing has changed that requires updates on our side (a
move of our non-ASCII change and the addition of an SPDX license
identifier).
- Generate Rust KUnit test suites for doctests reusing the
'#[kunit_tests]' and '#[test]' attributes instead of C FFI
functions, which allows to remove the generated C glue file.
Relatedly, simplify 'kunit_assert!' by using 'file!()' and
'line!()' inside (which doctests override as needed), which allows
to remove the 'file' helper and 'CONFIG_RUSTC_HAS_SPAN_FILE'.
- Trim the function names in doctests generated by 'rustdoc' < 1.95.0
when building with 'O=', which were not reproducible.
- Fix the 'VM_MAYSHARE' value in the generated bindings and its
blocklist entry, due to typos.
- Build 'core' with '--cfg no_io_statics' to ensure 'core' does not
introduce any use of 'core::sync::atomic' into the kernel image
since upstream Rust is moving 'std::io::Error' into 'core', which
uses a global atomic pointer.
Upstream Rust merged a PR to add a test checking that builds of
'core' are warning-free with that 'cfg' enabled.
- Enable the unstable 'proc_macro_span' feature in 'proc-macro2',
which provides 'Span::join' and thus improves the quality of the
diagnostics of all our procedural macros, notably 'pin-init'. This
is only used for producing diagnostics, thus there is no hard
reliance on the feature.
- Globally allow 'clippy::comparison_chain', since its suggestions
are not always ideal and upstream downgraded it to 'pedantic' too.
'kernel' crate:
- New 'mem' module: add the 'Align<N>' zero-sized type so that
alignment can be specified via const generics ('repr(align(...))'
only works with integer literals), e.g.:
const N: usize = 128;
struct S {
_align: Align<N>,
}
assert_eq!(align_of::<S>(), N);
- New 'ratelimit' module: add the 'Ratelimit' abstraction for 'struct
ratelimit_state' and, based on it, the 'pr_*_ratelimited!' printing
macros, which can be used for printing that may be triggered by
userspace.
In addition, convert Rust Binder to use them.
- 'sync' module: to construct a global 'struct ratelimit_state', add
a 'const' constructor for 'raw_spinlock_t'.
In addition, move the lockdep types into a new 'sync::lockdep'
submodule, since there were starting to be too many of them.
- 'num' module: add the 'cv!' macro to create constant values ("cv")
from an integer constant expression, with validity checked at
compile time, inferring the target type from the context. It works
for any type that implements the new 'FromConst' trait, e.g.:
let a: Alignment = cv!(4096);
let b: Bounded<u32, 4> = cv!(15);
// Any integer constant expression works, not only literals.
let m: NonZero<usize> = cv!(usize::MAX);
// Checked narrowing, including in `const` items.
const SMALL: u8 = cv!(200u32);
// The target type can be given explicitly.
let e = cv!(200u32 => u8);
// With an explicit primitive target, the expression can use
// generic parameters.
const fn as_u64<const KEY: u16>() -> u64 {
cv!(KEY => u64)
}
This avoids the verbose turbofish syntax which disincentivized
using these types at interface boundaries (e.g.
'Alignment:🆕:<8>()').
- 'alloc' module:
- Allow different error types in 'KBox::pin_slice()', enabling use
of infallible initializers.
- Add 'NumaNode::id()' accessor to retrieve the underlying NUMA
node identifier.
- 'time' module:
- Add 'Delta::to_jiffies_timeout()' for use in timeout arguments.
- Add 'Delta::as_jiffies_unsigned()'.
- Make 'Delta::ZERO' generic over the time unit.
- Warn and assert when passing out-of-range inputs to 'fsleep' and
'udelay'.
- Rename 'ClockSource' to 'ClockId' to better align with naming
conventions in C kernel.
- Make 'CONFIG_HZ' value available as 'bindings::HZ'.
- Add implementation detail documentation for 'HrTimer'.
- 'bitmap' module:
- Add contiguous area operations ('next_zero_area{,_off}', 'set'
and 'clear'), with extra checks compared to the underlying C
code, plus additional ones under 'CONFIG_RUST_BITMAP_HARDENED'.
It includes tests demonstrating the edge cases.
- Restrict bitmap length to at most 'i32::MAX', matching
'BitmapVec::MAX_LEN' and simplifying a few things. This also
fixes 'u32' casts truncating in 'copy_and_extend', which could
otherwise lead to OOB writes.
- 'bug' module:
- Fix 'warn_on!' on UML which called 'warn_slowpath_fmt()' with
the wrong arguments; and fix its '// SAFETY:' comment too.
- Add a KUnit test for 'warn_on!'.
- 'id_pool' module: add contiguous ID reservation via the new
'reserve_ids' and 'release_ids' methods, built on top of the new
bitmap area operations.
- 'sizes' module: add the sub-1K size constants ('SZ_1' to 'SZ_512')
and implement 'SizeConstants' for 'Alignment', so that one can
write e.g. 'Alignment::SZ_8'.
'macros' crate:
- Add '#[optional]' attribute for optional methods in '#[vtable]' to
replace the 'build_error!(VTABLE_DEFAULT_ERROR)' boilerplate, e.g.:
#[vtable]
pub trait Operations: Sized {
#[optional]
fn f(&self) -> Result;
}
In addition, apply it to miscdevice and hide generated 'HAS_'
constants for required methods.
- Allow non-ASCII characters in the 'authors' field of the 'module!'
macro, which was unintentionally restricted when multiple authors
support was introduced.
'pin-init' crate:
[ Extra context from Gary's pull request:
"This is a cycle packed with feature updates. Two of the most
anticipated features, tuple struct support and safe self
reference creation, has been included in this pull request.
Safe self reference is a big one and is pushed a bit late in the
cycle. The initial plan was to include a minimum subset for this
cycle because I was worried about potential soundness issues;
however during Plumbers it was agreed that the features should be
upstreamed at once. This is because the initial users (Nova,
JobQueue) would all need the advanced features, so it is better
to ensure that the feature get put into use for real, and it can
iterate with users, rather than being fully designed on paper.
The existing safety checks are already very comprehensive, and
Benno and I are confident that if new ones are discovered, it
wouldn't affect the overall design.
That said, the the usage of the advanced features (invariance,
existential lifetime) shall be limited to the pre-agreed users
only, so even in case where the feature needs to be reworked, the
blast radius is limited.
Another theme in this cycle is to improve the developer
experience when things are used wrongly. A lot of work has been
done to use proper spans from user-provided tokens so error
message point to things that cause them. Many common misuse
scenarios also gain additional custom diagnostics." ]
- User visible changes:
- Support tuple structs.
- Allow safe creation of self references.
- Vastly improve diagnostics for common misuse scenarios.
- Other changes:
- Use 'mixed_site' hygiene consistently.
'MAINTAINERS':
- Add 'RUST [BUG]' entry for the Rust 'bug' module (i.e. 'warn_on!'),
which will be maintained by FUJITA Tomonori -- thank you!
- Add Alice Ryhl as co-maintainer for 'Rust [ALLOC]'.
And some other fixes, cleanups and improvements.
* tag 'rust-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (91 commits)
rust: zerocopy: update to v0.8.62
rust: zerocopy: fix link to upstream `README.md`
rust: id_pool: add contiguous ID reservation
rust: bitmap: add contiguous area operations
rust: sizes: implement SizeConstants for Alignment
rust: sizes: add sub-1K size constants
rust: bitmap: restrict bitmap length to at most i32::MAX
rust: bitmap: use function-level cfg on kunit test
rust: num: add cv! macro to create values from constant expressions
rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
rust: time: add Delta::as_jiffies_unsigned()
rust: time: make Delta::ZERO generic over the time unit
rust_binder: use pr_*_ratelimited! for printing
rust: add pr_*_ratelimited! macros for printing
rust: sync: add const constructor for raw_spinlock_t
rust: sync: move lockdep types to rust/kernel/sync/lockdep.rs
rust: pin-init: internal: suppress `explicit_outlives_requirements`
MAINTAINERS: add entry for the Rust `bug` module
rust: pin-init: internal: pin_data: support existential lifetimes
rust: pin-init: internal: pin_data: support shared projection
...
- __MAKE_OP() removal (Yury, Mark);
- bitmap parsing fixes (Shashank);
- Rust docs updates (Georgios).
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEEi8GdvG6xMhdgpu/4sUSA/TofvsgFAmrVbSMACgkQsUSA/Tof
vshlsQv+NeRJp2focN/6QYq9ec2tp8uwdY1Ur9tiHdonE3Oq04EMNjbsVOLxn9u2
eFfTzb7UyjCjKGab8h0ZzZxg34rBCvIYCwW66FcEeXzpPiTJVKPHYx6Mp+Gg1UiF
QSIRXJsXiI5zj7ltORBb+FYHVVwGN80EGle1fjAN3cTA5OmiVcwLVml8jCfTzUJJ
lEsJm57MDyH3XVnrBTm4HE8yMQZkDYhh8KUFQClZJsl7D9VcymtNIqkz33lm1Zqh
ItoYq4nJD0t4emTVRvH+KcfJnnv1my68rErbDNv7T0gjKY/razPkN+EFeB6e6NFv
J6lFW2OHTeAmpbMSxUCHuqx5m/wRxPdlkN1o3CoAd+pUbjs/Dz59PnffTlGLw6yD
AMg3m+6/4B+Ucmb6+WWpEHEuixUXm1Vnjl63EHaHPJNHFRzQGKnEtMJblKphwE7k
v0sq75ev4rvZ6SACICydZa0l88M8Z/q3Rj0W6SmuQHRZObsHLPprzqn5KIeEfTjO
7iv6Vkry
=5Jv7
-----END PGP SIGNATURE-----
Merge tag 'bitmap-for-v7.4-rc1' of https://github.com/norov/linux
Pull bitmap updates from Yury Norov:
"This includes __MAKE_OP() macro removal from me with the follow-up
from Mark, cleanups for bitmaps parser from Shashank and a couple Rust
docs fixes from Georgios"
* tag 'bitmap-for-v7.4-rc1' of https://github.com/norov/linux:
rust: bitmap: document panics in `next_bit` and `next_zero_bit`
rust: id_pool: document panics in `find_unused_id` and `release_id`
bitmap: test bitmap_parselist() with a group size close to UINT_MAX
bitmap: bitmap_parselist(): don't wrap around on a huge group size
bitmap: test bitmap_parselist() with text after the group size
bitmap: bitmap_parselist(): reject trailing characters after group size
bitmap: test bitmap_parse() with an illegal character before 8 hex digits
bitmap: bitmap_parse(): reject non-hex character before 8 digits
bitfield: Restore be16_replace_bits()
bitfield: get rid of __MAKE_OP machinery
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmrSkXAUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXOXTQ/+LcghZOG72DOeZwDkXIzdD+Ex5Xkf
kV3EiZ+l6LCy2sGePC5PdHJaX1wQE5N0bHCHh8TMIsfE5b0nbdKJsDiFJVkayTJz
CE4SpAm8Tup+CBDkwMJ1x3aGYgh4RxbgTR9klsrH2zsehI80sGLE3SYp9+lO3BFp
Eyf+INgF2GrcBNH3ozQBtME5b0086UC/uWif1vQ3HK4RU6QxWlQg5VB68+XJv9GY
/wZyJ4bIet8QQ1S2boMQN/RGQHih1qYs8hOeuL+R0Inh6pk59ucgM3qfj9OILWbD
x4u9ptO7ICvoKlkrzWIfvt+ydM5q9mHozN1qi2i+dy4IiDyBicZ75YCFWIeSOld+
UGL73NB08g/KT1fOo7WE3lfm/ZAMoR8F0IUScDvMeVLv06NU/rCccPKl+z8bYBuo
vSbctpHsnSPxpZew1U1FiTavwTUZVTHgPnuGrM28wfV1qsj+y9jebM35GNETolDi
6fcsVh6Fw/8qCG/V1TVQzahqI0xuA2/BDQE7vFKO87Mmu7EJqNr1J3lgFdmMk7tD
cZqHhHhSF7MgQz8qkuCB8t2edukXV1Fyzm8tUmA9MeurfQHrhLkwZuRPzKmEz0RB
HssTyKhmo9cwgLgRFzspnoDIOXcSYqxUNSmz4BOVb9yUMi/d5bRhiZ6JFym19rRr
9IjSU2ud7x3fXqw=
=7Dpp
-----END PGP SIGNATURE-----
Merge tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm updates from Paul Moore:
- Add LSM hooks, object blobs, and audit records for namespaces
Add the necessary bits to enable LSMs to enforce access controls on
the management of various kernel namespaces. While this pull request
does not contain any in-tree users of these hooks, the Landlock pull
request for Linux v7.4 will include Landlock support and the next
merge window will likely include SELinux support as well. Considering
the development behind these hooks, I expect that BPF LSM developers
will also be making use of the namespace hooks, if they haven't
already.
- Update the inode LSM hooks to include mount idmaps
This allows LSMs to incorporate the mount ID mapping into their
access control decisions. While there are no current in-tree users of
this, it was requested by those developing BPF LSM programs and this
pull request includes a BPF LSM selftest.
- Preserve the full 32-bit ioctl command in LSM audit records
Previously only the low 16 bits were logged, ignoring the direction
and size information in the upper 16 bits. The pull request also
includes a Landlock based selftest to verify the full 32-bit ioctl
value.
- Ensure we don't call security_backing_file_free() multiple times
Thankfully we don't have a problem with the current code base, but we
want to fix this behavior now before it becomes a problem.
- Clarify that only the current task may access current->cred
The current code is a bit misleading around safely accessing the cred
field in a task struct. Through comment and code corrections, this
pull request clarifies that only the task itself may access its cred
field.
- Add SLAB_NO_MERGE to the credential object cache
Harden the credential cache by ensuring credential objects live on
dedicated slab pages.
- Make use of safe memory zero'ing in the LSM Rust bindings
- Update the docs for the current behavior of /sys/kernel/security/lsm
- Update the docs for CONFIG_LSM and the "lsm=" command line option
- Remove unnecessary code
* tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
lsm: remove redundant NULL check in security_init()
selftests/landlock: Check full ioctl commands in audit records
lsm: Preserve full ioctl commands in audit records
doc: fix LSM ordering description for /sys/kernel/security/lsm
doc: describe CONFIG_LSM and lsm= as the selection mechanism
selftests/bpf: verify mount idmaps reach inode hooks
lsm: expose mount idmaps to inode hooks
rust: lsm: replace `core::mem::zeroed` with `pin_init::zeroed`
cred: prevent slab cache merging for cred_jar
lsm: don't call security_backing_file_free() multiple times
lsm: delete duplicate assignment in lsm_prepare()
lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()
lsm: add LSM_AUDIT_DATA_NS for namespace audit records
lsm: add LSM blob and hooks for namespaces
ns: Free anonymous mount namespaces via ns_common_free()
cred: clarify that task_struct::cred is only for the current task
Manual merge fixup in ns_common_types.h:ns_common to work around a conflict
with the nsfs RCU grace period fix.
* lsm/dev:
lsm: remove redundant NULL check in security_init()
selftests/landlock: Check full ioctl commands in audit records
lsm: Preserve full ioctl commands in audit records
doc: fix LSM ordering description for /sys/kernel/security/lsm
doc: describe CONFIG_LSM and lsm= as the selection mechanism
selftests/bpf: verify mount idmaps reach inode hooks
lsm: expose mount idmaps to inode hooks
rust: lsm: replace `core::mem::zeroed` with `pin_init::zeroed`
cred: prevent slab cache merging for cred_jar
lsm: don't call security_backing_file_free() multiple times
lsm: delete duplicate assignment in lsm_prepare()
lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()
lsm: add LSM_AUDIT_DATA_NS for namespace audit records
lsm: add LSM blob and hooks for namespaces
ns: Free anonymous mount namespaces via ns_common_free()
cred: clarify that task_struct::cred is only for the current task
Three changes for the Rust configfs bindings. One typo fix for a safety comment and two bug fixes.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEEV4rZyNlmdiYqwGqG+lApCKrFvdAFAmrGURoWHGEuaGluZGJv
cmdAa2VybmVsLm9yZwAKCRD6UCkIqsW90CvkD/wLBRiEaAbavO414YzZgn34Gnfc
G0YfJ66bk9NFjLHf/ckpFZwFOEPw/3gFs2vtjAgLxs3Dmv7YIh8ZWJ8QBEcRLodT
hv6cc2bxOQ4consnfZRtdkPk94zhEqXRA22Yddt2lO2EEoZ4o1gk1FEpBYRszEQf
IvOynDRIdqQBwlez051Gk1/OcKqaTJSe2EnYri6G79Tzc56Dw+wASOCTn0IkpCQJ
v16Vp3bBfaDHBXcXdN1S1xNR8fpX3Gz+GjtgXZnx3Z1+7qNyX/8Fjgragk9MuP48
mWVJjQ43tNNV3ebIlwW2KTo3m+3EODtn1gYnRi9Qfn41BFdcdbDB3xmx6fC7w+NI
33MR/t12aZuLA+JkPiII7HAfmBL9+2ERXDilZAWSF22H0TdLRBYDL10u+Bp+bMl8
GF08MQrERJbts/olHGliz3yfO5YqqCHorbCNbInK8vUAg0bLPLduv1ufsYxl0cGC
gWJ3rcbhmGvUHT/UhdIEN5lqK9ptZRHZjpQBc6jVAHDofy31UBGAtshiMZIuCDKV
39xYzL3MTEFAQjCNTicAnFd4ihzMAyKo6ASM+FrSX4D2MLPk+gkQdLNIgk1lWmdn
CjkCQnxTp2SGhtMW9RFOjycLGjCCgX+omkcPaYt1chjglih6TDISf/7ABNE6QylW
+i993IjHjc+NDMrW6g==
=AtTm
-----END PGP SIGNATURE-----
Merge tag 'rust-configfs-for-v7.4-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux into updates-v7.4
Rust configfs changes for v7.4-rc1
Three changes for the Rust configfs bindings. One typo fix for a safety comment and two bug fixes.
* tag 'rust-configfs-for-v7.4-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux:
rust: configfs: fix data offset calculation for subsystem callbacks
rust: configfs: require thread-safe callback data
rust: configfs: fix release safety documentation
The attribute structure defined in driver code never need to be
modified. Allow them to be marked as const.
As there are many drivers which use these attributes, prepare for a
phased transition by using a union of const and non-const attributes.
After all drivers have been migrated to the const variant, the non-const
one can be replaced by the const one and the transition machinery will
be removed again.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260716-configfs-const-base-v1-5-c545a4053cb5@weissschuh.net
Signed-off-by: Breno Leitao <leitao@debian.org>
The configfs_bin_attribute structures defined by driver are never
modified. Make them const.
As there are only two users of these attributes, adapt them in the same
commit to avoid a phased transition.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260716-configfs-const-base-v1-4-c545a4053cb5@weissschuh.net
Signed-off-by: Breno Leitao <leitao@debian.org>
Add `IdPool::reserve_ids` which allocates a contiguous range with the
given offset, count, and alignment.
Reviewed-by: Burak Emir <burak.emir@gmail.com>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Reviewed-by: Yury Norov <ynorov@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-7-0d6cca376cff@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Add bindings for area operations on bitmaps. Each one is
made safe by adding some extra checks compared to the underlying C code
(for example, checking bounds) and with additional checks to catch
likely erroneous usage if `CONFIG_RUST_BITMAP_HARDENED` is on.
Add tests demonstrating the edge cases.
Reviewed-by: Burak Emir <burak.emir@gmail.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Reviewed-by: Yury Norov <yury.norov@gmail.com>
Link: https://patch.msgid.link/20260930-chid-v9-6-0d6cca376cff@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Currently, constructing an alignment is quite verbose [1]:
Alignment:🆕:<8>()
It's unfortunate because it disincentivizes using it at interface
boundaries. Implement `SizeConstants` for `Alignment` so we can write
e.g. `Alignment::SZ_8` instead.
Link: https://lore.kernel.org/an4xDp29VX8Am0uR@yury [1]
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-4-0d6cca376cff@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Add some more size constants, mirroring include/linux/sizes.h. This is
useful for making `Alignment` implement `SizeConstants` in a following
patch, because these are more common alignment values.
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-3-0d6cca376cff@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
It is currently possible to construct a non-`BitmapVec` backed `Bitmap`
using `Bitmap::from_raw` that is larger than `i32::MAX`, and it is not
part of the unsafe requirements. Restricting all bitmaps (even
non-`BitmapVec` backed ones) to a maximum size of `i32::MAX` simplifies
a few things and matches `BitmapVec::MAX_LEN`. For example,
`copy_and_extend` truncates `len` to u32, which is wrong for > u32::MAX
size. `__bitmap_set` and `__bitmap_clear` need i32 for `size` and u32
for `start` - so they can't be run on a `Bitmap` with a > i32::MAX size.
Rather than adding runtime checks to account for the case of a non
`BitmapVec` backed `Bitmap`, just include that in the requirements for
`Bitmap`.
Add that requirement to the unsafe requirements on `Bitmap::from_raw`
and `Bitmap::from_raw_mut`, and to the invariants on `Bitmap`.
This also fixes u32 casts truncating in `copy_and_extend`, which could
otherwise lead to OOB writes.
Fixes: 11eca92a2c ("rust: add bitmap API.")
Link: https://lore.kernel.org/DKG0U8RLO7LZ.2I1AIH0S38PAP@nvidia.com
Reviewed-by: Yury Norov <ynorov@nvidia.com>
Reviewed-by: Burak Emir <burak.emir@gmail.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-2-0d6cca376cff@nvidia.com
Cc: stable@vger.kernel.org
[ Added a few intra-doc links. Added backticks to C types. Capitalize
tagged comments. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Since commit c652dc4419 ("rust: kunit: allow `cfg` on `test`s"),
we no longer need this workaround.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Yury Norov <ynorov@nvidia.com>
Reviewed-by: Burak Emir <burak.emir@gmail.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-1-0d6cca376cff@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Currently, using NonZero/Bounded constants is quite verbose. It's
unfortunate because it disincentivizes using it in interface boundaries.
Introduce a macro to make it nicer to use. The macro `cv!` (for constant
value) takes a const integer expression and widens it to i128 (at build
time only) before passing it as a const generic value to a new trait
`FromConst`. The value is then converted and appears in the
associated constant `FromConst::VALUE`. The trait is implemented by
NonZero, Bounded, and Alignment and lets values of each be constructed
from constants without a verbose turbofish syntax.
For example, `const { NonZero::new(1).unwrap() }` can be written as
`cv!(1)`.
Add the `cv!` macro to the prelude so it doesn't need to be imported
explicitly to use it.
Suggested-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20261013-cv-v5-1-113a538dfaef@nvidia.com
[ Added a few intra-doc links. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
The SAFETY comment says that it is always safe to call
`warn_slowpath_fmt()` with a valid null-terminated string. This is not
true. The taint argument must also be a valid taint number.
Commit 951d09ca45 ("rust: bug: pass TAINT_WARN to warn_slowpath_fmt()
on UML") fixed a bug where it was not.
List each condition that the call meets: the file name, the taint
number, and the null `fmt`.
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20261002104550.2877930-1-tomo@flapping.org
Cc: stable@vger.kernel.org
Fixes: dff64b0727 ("rust: Add warn_on macro")
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Delta<Jiffy> is signed, but some C functions, such as
queue_delayed_work_on(), take a span in jiffies as unsigned long. So
each caller has to clamp a negative value to zero and cast it before
it passes the value to C. Add a helper that does both.
Suggested-by: Gary Guo <gary@garyguo.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20261002050428.2746277-3-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Delta::ZERO is defined only for Delta<Nsec>, so code that needs a zero
Delta<Jiffy> has to write Delta::from_jiffies(0).
Define ZERO for every Delta<U> instead. An integer literal cannot be
used for a generic U::Repr, so add ZERO to TimeUnit.
Suggested-by: Markus Probst <markus.probst@posteo.de>
Suggested-by: Gary Guo <gary@garyguo.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20261002050428.2746277-2-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Printing can be very expensive if it occurs often, so printing that can
be triggered by userspace should be rate limited. For this purpose, add
a Rust wrapper around `struct ratelimit_state` and use it in the new
macros.
The new files will fall under the catch-all RUST maintainers entry.
Tested-by: Alvin Sun <alvin.sun@linux.dev>
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Link: https://github.com/Rust-for-Linux/linux/issues/122
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20261007-pr-ratelimited-v6-3-f14accd4ea3b@google.com
[ Removed unused link reference definitions. On the `static`, allowed
the `non_upper_case_globals` lint so that `kernel` users (and users
providing their own name) do not warn. Reworded title for typo.
- Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
The abstractions for pr_*_ratelimited! need to construct a global
`struct ratelimit_state`, which contains a `raw_spinlock_t` field. Thus,
add a const constructor for the `raw_spinlock_t` type.
The SPINLOCK_OWNER_INIT constant isn't mirrored via a const helper
because bindgen generates a 'static mut' instead of a constant from the
pointer constant.,
The __ARCH_SPIN_LOCK_UNLOCKED constant cannot be translated by bindgen
because it's a define for a struct without type annotations, so it's
explicitly declared in Rust.
Reviewed-by: Boqun Feng <boqun@kernel.org>
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20261007-pr-ratelimited-v6-2-f14accd4ea3b@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
The lockdep types are currently stored directly in rust/kernel/sync.rs,
but there are starting to be too many of them to keep them in that file.
Thus, move them to a submodule. The new module is listed under LOCKING
PRIMITIVES in the MAINTAINERS file.
For commonly used lockdep logic it's useful to keep re-exports in
kernel::sync, and this also avoids the need to update any users.
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Boqun Feng <boqun@kernel.org>
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20261007-pr-ratelimited-v6-1-f14accd4ea3b@google.com
[ Used the "kernel vertical" imports style. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
This time we have a few assorted changes:
- Warnings when passing out-of-range inputs to `fsleep` and `udelay`.
- Rename `ClockSource` to `ClockId` to better align with naming conventions in C kernel.
- Make `CONFIG_HZ` value available as `bindings::HZ`.
- Add a conversion method to convert `Delta` to `jiffies` for use in timeout arguments.
- Add implementation detail documentation for `HrTimer`.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEEV4rZyNlmdiYqwGqG+lApCKrFvdAFAmrGSTgWHGEuaGluZGJv
cmdAa2VybmVsLm9yZwAKCRD6UCkIqsW90D0vEACXEA9m3GSSzZiZg5Fl9p/6d85I
cRuoZOJpiYX5AlI/Xj380qYcPC8vvCf+1UeXk6YKQTAw4kFiRvq+rC2+8tDlUqU9
4EeKXe/9ERSIWJmatcsSi3lASfTEGayTvcO6OPYIodxeSZ8uD7hJ6ccNukLX1xzd
/ZXwHJ7PnPU8w9iv6mWlIl12NyUG8DuuJTD6mQHNIVC9ay2nm1aSkJqnXDKdsjs0
8I/iUaE1jUKSiMDtegix/DmiciBgonSb/CAUPfLFtQsA0M+xK4yFvGAUfUn2IMwP
SUMutztFcjHh5S/AKKp5t9JsTv9Q+VGlsCfbTxvtTZRiI0L8FwfvSxMRckvX+W+p
okzKjiZ2wYq8wBUzjI1z5YfoUrHSH5qBR15ezUYdQgm4G8d5D0bPvx6aa68aS1JN
7MqezMzJ/pHCzKe3BGL4e2G7fqLMAQMdhvgfVsgDUrJ2dna3EpdTg0UAVBjldPhM
/LwPX0OX+KKpmonqw4QH2T673NZc+rP2nxpYKC9dQzNpcW1U3DHEI+ayWLWdRHwY
8ZpWWI4lLWi19Nbiuwc3CEwS4g9JvpReZ7W86kO3p3y2F3wLscdQQ9VbxyImLrum
hJjoFoM1Sk+rSZqAjd7VNWgW74PbeKixGGRnKFFesymtvLRbHXc9POqzofYAF1CN
oYVw5shj4qI8y3ypQA==
=AXU9
-----END PGP SIGNATURE-----
Merge tag 'rust-timekeeping-for-v7.4-rc1' of https://github.com/Rust-for-Linux/linux into rust-next
Pull timekeeping updates from Andreas Hindborg:
- Warn and assert when passing out-of-range inputs to 'fsleep' and
'udelay'.
- Rename 'ClockSource' to 'ClockId' to better align with naming
conventions in C kernel.
- Make 'CONFIG_HZ' value available as 'bindings::HZ'.
- Add a conversion method to convert 'Delta' to 'jiffies' for use in
timeout arguments.
- Add implementation detail documentation for 'HrTimer'.
* tag 'rust-timekeeping-for-v7.4-rc1' of https://github.com/Rust-for-Linux/linux:
rust: hrtimer: document handle based design rationale
rust: time: add Delta::to_jiffies_timeout() for timeout conversion
rust: bindings: set HZ to CONFIG_HZ
rust: time: rename ClockSource trait to ClockId
rust: time: warn and assert out-of-range input in fsleep() and udelay()
- Add Alice Ryhl as co-maintainer for Rust [ALLOC]
- Allow different error types in KBox::pin_slice(), enabling use of
infallible initializers
- Add NumaNode::id() accessor to retrieve the underlying NUMA node
identifier
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaso6SAAKCRBFlHeO1qrK
LiA9AQCOElh67wE67s3xFqNcyOSYgc+xq0APKRxALX3EFQNRMwD/bngREM6SlSdz
WcrCyIXR7MDcji1MU0C9RkOXKKvHfgU=
=AnZl
-----END PGP SIGNATURE-----
Merge tag 'alloc-7.4-rc1' of https://github.com/Rust-for-Linux/linux into rust-next
Pull alloc updates from Danilo Krummrich:
- Add Alice Ryhl as co-maintainer for Rust [ALLOC]
- Allow different error types in KBox::pin_slice(), enabling use of
infallible initializers
- Add NumaNode::id() accessor to retrieve the underlying NUMA node
identifier
* tag 'alloc-7.4-rc1' of https://github.com/Rust-for-Linux/linux:
rust: alloc: add `NumaNode::id()` accessor
rust: alloc: allow different error types in `KBox::pin_slice`
MAINTAINERS: add Alice Ryhl as co-maintainer for Rust [ALLOC]
`next_bit()` and `next_zero_bit()` use `bitmap_assert!()` to check
that `start` is less than `self.len()`, which panics when
`CONFIG_RUST_BITMAP_HARDENED` is enabled. However, neither function
has a `# Panics` section, and both document that `None` is returned
for exactly the input that triggers the panic.
Update the documentation of `next_bit()` and `next_zero_bit()` to add
the missing `# Panics` sections, add the missing blank doc comment line
before `Returns` in `next_zero_bit()`, and simplify the wording.
Fixes: 11eca92a2c ("rust: add bitmap API.")
Closes: https://github.com/Rust-for-Linux/linux/issues/1252
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Georgios Androutsopoulos <georgeandrout13@gmail.com>
Signed-off-by: Yury Norov <ynorov@nvidia.com>
`find_unused_id()` calls `Bitmap::next_zero_bit()` and `release_id()`
calls `Bitmap::clear_bit()`, both of which panic when
`CONFIG_RUST_BITMAP_HARDENED` is enabled and the index is out of
bounds. Neither `IdPool` method documents this.
Add the missing `# Panics` sections and state the bounds requirement
on `offset` and `id`.
Fixes: 2cdae413cd ("rust: add dynamic ID pool abstraction for bitmap")
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Georgios Androutsopoulos <georgeandrout13@gmail.com>
Signed-off-by: Yury Norov <ynorov@nvidia.com>
The `diff` parameter is needed currently because doctests want to override
the line number. Simplify it by changing it to use `line!()`. Have doctests
override `line!()` macro to achieve the current behavior.
An existing doctest requires `line!()` to expand to a literal; so update
it to use `::core::line!()` instead.
Reviewed-by: David Gow <david@davidgow.net>
Signed-off-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260902-kunit-v2-2-eda3ed6c00c5@garyguo.net
[ Removed spurious `///`-to-`//` change and adjusted `line!` to match.
Added a comment to match `file!`'s. Made `NOTE:` more precise. Reworded
to say it is only one doctest being updated. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
This parameter is needed currently because doctests want to override the
file. Simplify it by changing it to use `file!()`. Have doctests override
`file!()` macro to achieve the current behavior.
This allows us to remove the `file` helper and associated Kconfig options.
Reviewed-by: David Gow <david@davidgow.net>
Signed-off-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260902-kunit-v2-1-eda3ed6c00c5@garyguo.net
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Replace the `build_error!(VTABLE_DEFAULT_ERROR)` boilerplate with the
`#[optional]` attribute.
Signed-off-by: Gary Guo <gary@garyguo.net>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260811-vtable_macro-v1-3-50c5aab3c211@garyguo.net
[ Reworded title for prefix. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Rust's `repr(align())` only works with integers. Add an `Align` type so it
can also be specified via const generics.
Signed-off-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260610-const-align-v2-1-ccd12f0aedb7@garyguo.net
[ Adjusted the title of the new module to match the one used in patch
"rust: mem: add `transmute` with deferred size check" (landing via
driver-core), which is also closer to the upstream standard library
title. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
The `#[allow(non_camel_case_types)]` was there because register names can
be commonly SCREAMING_CASE and thus not CamelCase. However, when a bitfield
type is created by itself, this justification does not apply. Thus, remove
it.
Users that want to use non-standard styles can add the `#[allow]`
themselves. For example, the invocation of `bitfield!` inside `register!`
macro carry this annotation.
Signed-off-by: Gary Guo <gary@garyguo.net>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260910170542.92010-1-gary@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
The test runs warn_on!(false) and warn_on!(true) inside a KUnit warning
suppression block, then checks that one warning was counted. The counter
is incremented by the kernel warning path, not by warn_on! itself, so a
count of one means the warning was really reported.
warn_flags! has a different definition per architecture. The test does not
look at any of them, so it runs on every architecture that supports Rust.
The new CONFIG_RUST_BUG_KUNIT_TEST depends on BUG. With CONFIG_BUG=n,
warn_on! does nothing and no warning is counted.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20260916140952.3290924-1-tomo@flapping.org
[ Added newlines for clarity. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
On UML, `warn_flags!` calls `warn_slowpath_fmt()` directly. Its third
argument is a taint number, but `warn_on!` passes its bug flags there.
As a result, `add_taint()` gets 2304 instead of 9 (`TAINT_WARN`). The
warning is not recorded: `/proc/sys/kernel/tainted` stays 0 after
`warn_on!` fires, where it should be 512. It also causes an
out-of-bounds write in `add_taint()`.
Pass `TAINT_WARN` directly, as C does on UML.
Cc: stable@vger.kernel.org
Fixes: dff64b0727 ("rust: Add warn_on macro")
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20261001123103.2198104-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
`NumaNode` wraps an `i32` but offers no way to read it back. Add a
trivial `id()` getter so callers that need to pass the node id to a
C binding can recover the underlying `c_int` without reaching into
the private field.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260929-numa-node-id-v2-1-fdd2c0a49412@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Previously, `KBox::pin_slice` required the initializer error type to match
the return error type via `E: From<AllocError>`. This prevented using
infallible initializers like `new_mutex!` inside `pin_slice`, because
`Infallible` does not implement `From<AllocError>`.
Introduce a separate type parameter `E2` for the initializer error type
and require `E: From<AllocError>` and `E: From<E2>` instead. This allows
the initializer to return a different error type that can be converted
into the final error type, enabling use of infallible pin initializers
in fallible allocation contexts.
Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/.E2.9C.94.20Constructing.20Mutex.20from.20PinInit.3CT.2C.20Error.3E
Co-developed-by: Benno Lossin <lossin@kernel.org>
Signed-off-by: Benno Lossin <lossin@kernel.org>
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260605-pin-slice-init-v2-1-b197e84040ba@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.
This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.
Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.
Fixes: 5eaa5fbb6e ("rust: netlink: add raw netlink abstraction")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Sagar Taunk <sagartaunk@proton.me>
Link: https://patch.msgid.link/20260925085449.22553-1-sagartaunk@proton.me
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
`get_group_data()` chooses between `Group::<Parent>::container_of()` and
`Subsystem::<Parent>::container_of()` based on whether `this` represents
the root group of a configfs subsystem. It detects this by checking
`(*this).cg_subsys.is_null()`, but `link_group()` in `fs/configfs/dir.c`
unconditionally sets `cg_subsys` for every `config_group` attached anywhere
in a registered subsystem, including the subsystem's own `su_group`. The
only `config_group` with a NULL `cg_subsys` is the configfs root, on which
userspace cannot trigger callbacks. The check is therefore always false at
runtime, and the `Subsystem` branch is dead. Subsystem-level callbacks
reach the `Group` branch and may read `data` at the wrong offset.
Thus change the `is_root` check to correctly identify whether a group is a
root group by comparing `this` to `subsys.su_group`.
Cc: stable@vger.kernel.org
Fixes: 446cafc295 ("rust: configfs: introduce rust support for configfs")
Link: https://msgid.link/20260608-configfs-fix-offset-v1-1-7f01b8fb9e5f@kernel.org
[ Andreas: Fix clippy warning on 1.85.0 by moving safety comment. ]
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
The boundaries of __msecs_to_jiffies() and nsecs_to_jiffies64() depend
on which HZ branch is compiled. With CONFIG_HZ_300
nsecs_to_jiffies64() overflows after 64.99 years, which is less than
the 292 years a Delta can hold. With HZ=1000 a jiffy is a millisecond,
so __msecs_to_jiffies() returns its argument unchanged and never caps
it at MAX_JIFFY_OFFSET.
Compute the conversion in Rust with mul_u64_add_u64_div_u64() instead. It
returns (a * b + c) / d, computing a * b internally in 128 bits, so
ceil(nanos * HZ / NSEC_PER_SEC) needs no input clamp and rounds once. The
bound then follows from the arithmetic: with HZ <= NSEC_PER_SEC, which a
static_assert() checks, the result is at most the nanosecond count.
Unless the result saturates, the value is rounded up, so the timeout is
never shorter than the requested span. It saturates at zero jiffies for a
negative span, i.e. an immediate timeout, and at MAX_JIFFY_OFFSET, the
upper bound the kernel uses for a jiffies span. Since MAX_JIFFY_OFFSET is
derived from long, only 32 bit can reach it, and a saturated timeout there
is finite, so it can be shorter than the requested span.
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://msgid.link/20260924232530.446588-3-tomo@flapping.org
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
The Rust configfs abstractions do not fully constrain callback data for
cross-thread use. Add the missing `Send` and `Sync` requirements.
Specifically, make the following changes:
1. Require `Data: Send` when implementing `Send` for `Subsystem<Data>`,
since the subsystem stores its data by value.
2. Make `GroupOperations` a `Sync` supertrait because `make_group` and
`drop_item` receive `&self` from foreign threads. Require `Child: Send`
because configfs may release child groups on an arbitrary thread.
3. Require `AttributeOperations::Data: Sync` because its callbacks receive
`&Data` from foreign threads.
4. Update the safety comments in FFI callbacks that call `get_group_data`
to cite these bounds as justification for sharing the returned
references with the callback thread.
5. Remove redundant `Child: 'static` bounds from `GroupOperationsVTable`
and `new_with_child_ctor`.
Fixes: 446cafc295 ("rust: configfs: introduce rust support for configfs")
Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/Should.20add.20Data.3A.20Send.2FSync.20bounds.20in.20configfs.3A.3ASubsystem.3F/with/623719979
Assisted-by: Gpt-5.6 Sol
Signed-off-by: Yilin Chen <1479826151@qq.com>
Link: https://msgid.link/tencent_5449081195EDDF5726C709CF648DD4044A08@qq.com
[ Andreas: Add Send/Sync bounds for `Group<Data>`, add `Send` bounds to
`GroupOperationsVTable`, `ItemOperationsVTable` and `ItemType` macro
implementation. ]
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
The `ClockSource` trait has nothing to do with the C `struct clocksource`
in `include/linux/clocksource.h`, which abstracts the hardware counter
used as a source of time for the majority of the clockids. The trait
instead carries a `clockid_t` `ID`, i.e. one of the IDs of "the various
system clocks (for POSIX.1b interval timers)" as described in
include/uapi/linux/time.h (CLOCK_MONOTONIC, CLOCK_REALTIME, ...). It thus
plays the role of a `clockid_t`, and the `ClockSource` name overlaps
confusingly with the C `clocksource` concept when reading across C and
Rust code.
Rename the trait to `ClockId` to reflect that it represents a
`clockid_t`. This is a pure rename; there is no functional change.
Suggested-by: John Stultz <jstultz@google.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://lore.kernel.org/rust-for-linux/CANDhNCrKMdHCmL76LWCROVF2Ly-9NxmfmQ2T+P=iv34aVkO2uQ@mail.gmail.com/
Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://msgid.link/20260722001050.4115708-1-tomo@flapping.org
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
ItemOperationsVTable<Group<Data>, Data>::release() receives a pointer
to a config_item, not a config_group.
The old Safety docs described the pointer as a config_group embedded in
Group<Parent>. Update them to state that the pointer must be the cg_item
field of a config_group embedded in a valid Group<Data>.
Assisted-by: Codex:GPT-5
Signed-off-by: Yilin Chen <1479826151@qq.com>
Link: https://msgid.link/tencent_9FAFC60382D724C608F0F6BFABFC63BB6707@qq.com
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
fsleep() documents out-of-range input as a bug but does not check
it, unlike udelay(). Add `debug_assert!` calls to catch it in
debug builds.
Also add `pr_warn_once!` calls in both fsleep() and udelay() so
the clamped path is observable at runtime.
Reviewed-by: Onur Özkan <work@onurozkan.dev>
Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://msgid.link/20260621105909.4055210-1-ekffu200098@gmail.com
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Previous releases - regressions:
- netfilter: hold reference on ct until flow is released
- bridge:
- move switchdev call outside rcu
- vlan: fix bugs caused by switchdev deletion errors
- wifi:
- mac80211: reset state when starting AP fails
- cfg80211: don't free driver-owned scan requests
- tcp: don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
- mptcp: return sk_wait_data() errors from recvmsg()
- xfrm: serialize state GC with device state flush
- drop_monitor: synchronize tracepoint unregistration on error path
- bluetooth:
- eir: validate service data length before reading UUID
- hci_sync: serialize local codec list cleanup
- RFCOMM: avoid socket lock inversion in listener cleanup
- eth: lan743x: fix RX checksum use-after-free
- eth: mvpp2: prevent buffer overflow in page_pool allocation
Previous releases - always broken:
- core: lock the socket in sock_gettstamp()
- neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
- sched: codel: bound the dropping loop per dequeue call
- wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic
- psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
- xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()
- bluetooth: hci_qca: do not write to the serial port after it is closed
- dsa: mxl862xx: disable the stats poll on teardown
- eth: stmmac: fix TSO header length truncation
- eth: ip_tunnel: initialize `options_len` before referencing options
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmqsEOsWHHBhb2xvLmFi
ZW5pQGdtYWlsLmNvbQAKCRApJHmNzI8TpKMnD/4vxx/YloxnyDssUB95WcTfiHau
XD+YDfTTf4Qy3DwKnMiesZ4w2547FXG+LwJZGpAGWpRSE99OawFHvx5gyn3Vf4IU
HEsOuZEYMwhSeeMJxGdCg8K6McNEQx+aAD7D8gLoisnJr/DCKBJtxFgKVEjaKUfP
aCG+FmbBqdS7hwBVbYREwmqwQSMnNzRWLd7/10/oYMcLfvgEsIkZisRErAW2BgZj
mzGw/IcG+QRldDPGDwLwLzfEG9o1a2JctSRrQ3uLHZ3VOdmpnSkmf25s2IaEFAn6
xfIhGPMgYIBDrakn/Ci4fAF0L98FtBq4Sa21HlvPMBst7rcce5x49ddSlIUWxRVZ
Fbvs/0IMN0cEpYGbVJxE8iF3yo+t8XvsMdGS1JXd/ycaL9lpF+9gCzNvChSxba3N
ik7BGAmlg76rqMuzeeMbWqMCmOcCBhQsb7iZXjNStJoiVY+UT2QfgvJ1TqF8Qrar
Eu/xFkaqk8i/7jrx4ujceg9XpRt1Y3Y3Pq0sgdzlzTm162AV/kg1fvwHc6ORIML7
71XpBSGvjyTHoh95ob/w3/5fec/ekzvWlCBL/cYIwBJ4R6n7Vk5e0Y1yZDffPSo3
xQR0r4YdLewkjQdtnGEih6FSyWsu6nYpVSuwHbof1bQSzvlIM6TAabJmtJckFTld
1bR2C9UVw5mQYMy8PA==
=Gw4S
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Netfilter, Bluetooth, IPSec and WiFi.
Previous releases - regressions:
- netfilter: hold reference on ct until flow is released
- bridge:
- move switchdev call outside rcu
- vlan: fix bugs caused by switchdev deletion errors
- wifi:
- mac80211: reset state when starting AP fails
- cfg80211: don't free driver-owned scan requests
- tcp: don't call skb_clone_and_charge_r() for close()d listener in
tcp_v6_do_rcv()
- mptcp: return sk_wait_data() errors from recvmsg()
- xfrm: serialize state GC with device state flush
- drop_monitor: synchronize tracepoint unregistration on error path
- bluetooth:
- eir: validate service data length before reading UUID
- hci_sync: serialize local codec list cleanup
- RFCOMM: avoid socket lock inversion in listener cleanup
- eth:
- lan743x: fix RX checksum use-after-free
- mvpp2: prevent buffer overflow in page_pool allocation
Previous releases - always broken:
- core: lock the socket in sock_gettstamp()
- neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
- sched: codel: bound the dropping loop per dequeue call
- wifi: mac80211: include TIM bitmap control for buffered S1G mcast
traffic
- psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
- xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()
- bluetooth: hci_qca: do not write to the serial port after it is
closed
- dsa: mxl862xx: disable the stats poll on teardown
- eth:
- stmmac: fix TSO header length truncation
- ip_tunnel: initialize `options_len` before referencing options"
* tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (159 commits)
mptcp: fix bad accounting in __mptcp_subflow_push_pending()
mptcp: close race between scheduler and state change
mptcp: avoid unneeded actions on subflow reset
net: skbuff: do not leave stale header offsets after pskb_carve()
selftests: net: packetdrill: test exclusion of old ACK from TCP fast path
tcp: exclude old ACKs from tcp fast path
dpll: reject a reference sync pin which is not on the pin's dpll
net: mvpp2: prevent buffer overflow in page_pool allocation
net: macb: fix ordering around PTP timestamp read
selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion
net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
net: stmmac: preserve real_num_tx_queues on mqprio setup failure
net: stmmac: propagate FPE preemption-class mapping errors
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
net: ethernet: cortina: Ack RX overrun interrupt correctly
net: lock the socket in sock_gettstamp()
eth: fbnic: ring the doorbell if a burst ends in a drop
net: netsec: fix device_node reference leak on phy_np
...
The hand-written bitfield offsets in is_link_up(), is_autoneg_enabled()
and is_autoneg_completed() were correct when the abstraction was
merged: at that time autoneg, link, and autoneg_complete were at bits
13, 14, and 15 of struct phy_device's first bitfield unit. Commit
2796ff1e3d ("net: phy: add flag is_genphy_driven to struct phy_device")
later inserted is_genphy_driven just before autoneg, shifting the three
fields up by one, so the accessors now read:
is_link_up() reads bit 14 = autoneg
is_autoneg_enabled() reads bit 13 = is_genphy_driven
is_autoneg_completed() reads bit 15 = link
The official ax88796b Rust driver uses all three accessors in its
read_status() implementation, so it inherits the bug.
phy_attach_direct() sets is_genphy_driven only when it falls back to
the generic driver, and ax88796b has a real driver, so
is_genphy_driven stays 0. The broken is_autoneg_enabled() therefore
reads bit 13 as 0, compares it against AUTONEG_ENABLE (1), and always
returns false, so read_status() never reaches the
resolve_aneg_linkmode() call.
The ordinary bindgen accessors take &self. Calling them through
(*phydev).link() would create a shared reference to the complete
bindings::phy_device, which is not appropriate for an object wrapped in
Opaque.
Use the bindgen-generated raw accessors (link_raw(), autoneg_raw(),
and autoneg_complete_raw()) instead. They retain the bit positions and
endianness handling generated from the C layout without creating a Rust
reference to the complete phy_device. Drop the hand-written numbers
together with the TODO comment that marked them as a stopgap.
The raw accessors are only emitted by bindgen 0.71 and later, and were
added at the Rust-for-Linux project's request, so this fix can only be
backported to stable branches whose minimum bindgen version is at least
that, hence the scope on the Cc: stable line below.
Found by a static equivalence audit (C2RustDrv, a C-to-Rust driver
migration tool) that compares hand-written bitfield offsets against
the bindgen layout of struct phy_device. Verified by building the
bindings and checking the generated accessors; no runtime testing was
possible without PHY hardware.
Fixes: 2796ff1e3d ("net: phy: add flag is_genphy_driven to struct phy_device")
Cc: stable@vger.kernel.org # Only 7.1.y and later (requires bindgen's raw pointer accessors).
Link: https://github.com/rust-lang/rust-bindgen/issues/2674
Signed-off-by: Chunfeng Song <springbreeze@stu.pku.edu.cn>
Reviewed-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20260910055110.167110-1-springbreeze@stu.pku.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Toolchain and infrastructure:
- Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute
for 'unnecessary_transmutes', which is unknown in older compilers.
- Clean 'clippy::as_underscore' lints in generated code by the new
'bindgen' 0.73.0+ releases.
- Clean new 'clippy::needless_range_loop' lint for the upcoming Rust
1.100.0 (expected 2026-11-12).
'kernel' crate:
- 'num' module: fix soundness issue in 'Bounded' by sealing the
'Integer' trait.
'pin-init' crate:
- Fix unreachable warning for the upcoming Rust 1.100.0 (expected
2026-11-12) due to 'Infallible' becoming an alias of '!'.
Samples:
- Add missing newlines in 'pr_*!'s macro calls.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqmuA8ACgkQGXyLc2ht
IW0ZVRAAk75N61v8xzY5dsQjA0O0ivCxDBqrPnFYYOq9jWWwKR4XF8zfX7dxPzFG
48NHlQ9s3XEOSfmoVdaab9DMz8l2gCLMcCUOqmEGZtf1ORlFqCn7m0OMXfsidgx9
YIWYSAySpjaQ27bg8+uvbBlBmD2KaE6zBlrAKbvdC9dJBOMfLjEnT3wtzkRkROzo
WJMyx+OjIk0kmFNMUPBV/J+VWyxP5IAl8C5xK/hl3L+tf0VeQWkn82f7zzoGfwRV
xLuIybzlxF2QK6D8OSf+SpxIqgl1fCDxh2rzWyNBJKbdGn1fMTTY7Ci6rM2DK853
PjmQWtlkrYIOnO7k2qdCebOOv8wOBKE1hNpK+23mkEUbsZjWPNgSHVuf6X098NuH
GEk5okH6+1e2w80dSRfUjKPY2omYhNoq4/4KEC+0IcV3xV+9FLq1uo9K/eOEr0Cf
z430H31YnollXCWUx56QJZ7p3r0dITwhKHPE9pfKB53yWZelTEboRuD1zRKYEO4E
0f+bDuLOAJeCzSX66YteZ+DiWphNB4OX49TGKRJpo9gWKn6+29TKIbJjAuk/oAu9
FVkE5//WAu8El5++1W0YE4AM5eVvhrarH4vo6q44o6bd3acNHHJDzwUR8fu3FSYA
skFb9vcRAq6vUPlzotlQMbuCP1PfBuFIhJdfqDcsVzGJO8oQPuk=
=/75K
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute
for 'unnecessary_transmutes', which is unknown in older compilers
- Clean 'clippy::as_underscore' lints in generated code by the new
'bindgen' 0.73.0+ releases
- Clean new 'clippy::needless_range_loop' lint for the upcoming Rust
1.100.0 (expected 2026-11-12)
'kernel' crate:
- 'num' module: fix soundness issue in 'Bounded' by sealing the
'Integer' trait
'pin-init' crate:
- Fix unreachable warning for the upcoming Rust 1.100.0 (expected
2026-11-12) due to 'Infallible' becoming an alias of '!'
Samples:
- Add missing newlines in 'pr_*!'s macro calls"
* tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: allow `unknown_lints` in generated bindings for Rust < 1.88
rust: allow `clippy::as_underscore` in the generated bindings
rust: num: seal Integer
drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
rust: samples: add missing newlines in rust_print_main
rust: pin-init: use irrefutable pattern for `stack_pin_init`
All types in `bindings` implement `Zeroable` if they can, so use
`pin_init::zeroed` instead of relying on `unsafe` code.
If this ends up not compiling in the future, something in bindgen or on
the C side changed and is most likely incorrect.
Link: https://lore.kernel.org/r/20250814093046.2071971-8-lossin@kernel.org
Link: https://github.com/Rust-for-Linux/linux/issues/1189
Signed-off-by: Benno Lossin <lossin@kernel.org>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Nils Lehnen <nils.lehnen@proton.me>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Miguel Ojeda <ojeda@kernel.org>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Bounded relies on Integer implementations to describe primitive integer
semantics correctly. In particular, it uses Integer::BITS and Signedness
to justify unchecked operations.
Integer is currently safe and externally implementable, so an
implementation can violate those assumptions and make safe Bounded
operations reach undefined behavior.
For example, an Integer implementation for a u8 wrapper can report
BITS = 16. Safe code can then cast a Bounded<u16, 9> containing 256
to that wrapper. Its TryFrom<u16> implementation returns Err, and
Bounded::cast() calls unwrap_unchecked() on it, causing undefined
behavior.
Seal Integer so only the primitive implementations provided by the
kernel crate can satisfy it.
Fixes: 01e345e82e ("rust: num: add Bounded integer wrapping type")
Reported-by: Miguel Ojeda <ojeda@kernel.org>
Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/
Cc: stable@vger.kernel.org
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Younes Akhouayri <git@younes.io>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260905-feature-rust-num-seal-integer-v2-1-f1311ffbe6e7@younes.io
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
IrqVectorRegistration::index() accepts a usize, but pci_irq_vector()
takes an unsigned int. On 64-bit architectures, casting an index larger
than u32::MAX wraps it before the PCI core can validate it. In
particular, u32::MAX + 1 becomes zero and can resolve to the first
allocated vector.
Use a checked conversion and return EINVAL when the index cannot be
represented by the C API.
Fixes: 2fb7755b0a ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")
Signed-off-by: Sophon Zhang <aiqubits@hotmail.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260901-fix-pci-irq-vector-index-truncation-v4-1-f94aa6932fd9@hotmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures when
'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqT+BIACgkQGXyLc2ht
IW0vRRAAmR1E04gT5HFDH+iNJgLlyticVsHs0rH46ICYgQWs+gpGGiJsPpnNBJxM
M5+VGauMPch5kIBKYwD/XrUe6cDDNqIfY8Eq+BnJiTxDe6U68K4cSnmPe478wZIn
15AIteCHN2x9vf49KpfI3fH/xoriS5XVEC915bQ9APXOYJv7iXZCFDzxw9dXnYu/
TE3YleA32oJ9COBT3s8ovtzNpEOtZPKhWFd2lOCaGbxBLWygu5X/PSEZs6ikmqgR
BqHrbhzSco8aYKCrbFbQrdgtwFPr3PQ8pRn44TPU6/siZNVBk83IpcxdtXrQ2gRi
wOwZfMsH2K/cEZWMXPz16hp+4onWUr1bgkfLUAzPtyqUX6rOEaBrliSXGs+yCl40
KNx5BefrhzH6UL+/pbLGVXzC5q1VLTsgS6u66piUyvhf52Wmvzc7AExGml/BWA/q
jomwnxpgLiBjO61cH4dnfrm3AtXHAWGzG/dd0BnVcpT+8HEr2W4WWRSydmPtkB+f
hXXmwAOF3sgVueJ2nxlPVcqt3LdsinCwBrQQmO8J+TtPyNW9sh72OfFSOkF/wybw
o5tcqFG7ZSNGR7pli5pYsnG4Gfv3vIraLwhiVciGXZ+es+FkKtOpaOMunUcQwKP6
+uFpdMqXVQmH4l3Adc0rG1lq6zRHnGvZ96R5PlmPhl6RVDZuv0E=
=EBLX
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures
when 'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment"
* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
rust: num: restrict bool conversion to unsigned Bounded
kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
kbuild: rust: preserve unreachable traps with inline helpers
rust: cfi: disable function merging if CFI is enabled
rust: jump_label: skip arch-specific asm in `testlib` builds
objtool/rust: add one more `noreturn` Rust function
rust: kernel: list: fix incorrect pop_back example comment
Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
- new device ids
- other minor USB driver updates and fixes
All of these have been in linux-next for a while with no reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2lJA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynK3QCeLQdHatZ2d5sJdvssiLKREZeND4EAnj+V1K1O
PcVJzKAiC4dgSZ5SOwn1
=OJea
-----END PGP SIGNATURE-----
Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt updates from Greg KH:
"Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
- new device ids
- other minor USB driver updates and fixes
All of these have been in linux-next for a while with no reported issues"
* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
usb: typec: hd3ss3220: fix VBUS regulator error message
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
usb: gadget: f_tcm: keep port count until LUN teardown completes
usb: usbtest: disable dynamic ID support
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
usb: gadget: midi2: remove default configfs groups on teardown
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
usb: typec: thunderbolt: Disable work before freeing tbt on remove
usb: xhci: Handle bogus TRB pointers in Missed Service Error events
...
