github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,368,315 Commits 1 Branch 940 Tags 24 GiB
d32e907d15
Commit Graph

1368315 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds
d32e907d15 xfs: Fixes for 6.16-rc5 
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaGKExAAKCRBcsMJ8RxYu
 Y4fTAXoCMZGmJKwTbcBk/9u2nD1ehULBDBQB+jDEjxQUile2fMvSMndxqAw0Dgt5
 RAg055kBfiwXnK92j2dgayVabNDY3HAxcmGe4B3OBC58/7rNINtgdujfj/gtHZLG
 M0Cko5OICA==
 =QrM0
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-6.16-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:

 - Fix umount hang with unflushable inodes (and add new tracepoint used
   for debugging this)

 - Fix ABBA deadlock in xfs_reclaim_inode() vs xfs_ifree_cluster()

 - Fix dquot buffer pin deadlock

* tag 'xfs-fixes-6.16-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: add FALLOC_FL_ALLOCATE_RANGE to supported flags mask
  xfs: fix unmount hang with unflushable inodes stuck in the AIL
  xfs: factor out stale buffer item completion
  xfs: rearrange code in xfs_buf_item.c
  xfs: add tracepoints for stale pinned inode state debug
  xfs: avoid dquot buffer pin deadlock
  xfs: catch stale AGF/AGF metadata
  xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
  xfs: actually use the xfs_growfs_check_rtgeom tracepoint
  xfs: Improve error handling in xfs_mru_cache_create()
  xfs: move xfs_submit_zoned_bio a bit
  xfs: use xfs_readonly_buftarg in xfs_remount_rw
  xfs: remove NULL pointer checks in xfs_mru_cache_insert
  xfs: check for shutdown before going to sleep in xfs_select_zone
 2025-07-03 09:00:04 -07:00
Linus Torvalds
b4911fb0b0 MMC core: 
- Apply BROKEN_SD_DISCARD quirk earlier during init
  - Silence some confusing error messages for SD UHS-II cards
 
 MMC host:
  - mtk-sd: Prevent memory corruption from DMA map failure
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  - sdhci: Revert "Disable SD card clock before changing parameters"
  - sdhci-of-k1: Fix error code in probe()
  - sdhci-uhs2: Silence some confusing error messages for SD UHS-II cards
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmhlREcXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCmBkw//RPCYvrt8wSGm8rJpCBBAKwx/
 VdT/VuCOtRriDTyitr7X+HTlkCGyTiYgWA7o33DzBUnHyt314s42SmU5nnC9ZTJ0
 t7mElYzmjJoju75wAeTwHXF3YKCUHEBNbHRmCtU41tayHQ9hu/iUoJtqYCN41Sr1
 tdo95MUwKTuK6tKs4lQvRBfJUzNVf2t52fIvVq/6FRqOelrvg8qgQvi84iPimd+E
 8zdR71MpalhIpBhTF7ds2gn37khe8vHPm2z3y8uPxZAPG8AgET4g/u7zBAqIqXNa
 sJel+kaCfmNaQfJzVZNOL1xRBxnpF7cAABXANpmNYMe+VmAF2Ftt4UMQ8LJwhF1R
 Tzoq4N5FGPF6qNsZrC2H+68jq/NkUob1f7DsfvYHaFxOfzEH9IaB4r0w0wdy5mj5
 0xcb/mHoYB049XXs7ms9crP7bl+HatEfeC8obeCO6Hd1KP25yWFOoMUjRdZEUb/E
 ILTshX/wYxS6b0HP3YUzUoi6tu+7SR8Kd974EPfD5xsMXWFK7+kghfOKxkMEmOtM
 7JyW4WTRc8ldyyYDUDvmyBFy9vt7FHbJ4tJ+RLOYHxa7w0Q0CFFKwsZCPRnXl89w
 s9aeVNjvk5jnysknPtkSTZ1ucPLXIQEIF/CHYgYYINjZT9iMs2lZbH3oWDsukjhZ
 9mXAXleVSySD9uZdpA8=
 =X3ZX
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Apply BROKEN_SD_DISCARD quirk earlier during init
   - Silence some confusing error messages for SD UHS-II cards

  MMC host:
   - mtk-sd:
       - Prevent memory corruption from DMA map failure
       - Fix a pagefault in dma_unmap_sg() for not prepared data
   - sdhci: Revert "Disable SD card clock before changing parameters"
   - sdhci-of-k1: Fix error code in probe()
   - sdhci-uhs2: Silence some confusing error messages for SD UHS-II cards"

* tag 'mmc-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mtk-sd: reset host->mrq on prepare_data() error
  Revert "mmc: sdhci: Disable SD card clock before changing parameters"
  mmc: sdhci-uhs2: Adjust some error messages and register dump for SD UHS-II card
  mmc: sdhci: Add a helper function for dump register in dynamic debug mode
  mmc: core: Adjust some error messages for SD UHS-II cards
  mtk-sd: Prevent memory corruption from DMA map failure
  mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  mmc: sdhci-of-k1: Fix error code in probe()
  mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
 2025-07-02 09:34:57 -07:00
Linus Torvalds
ba6a2f25d3 s390 fixes for 6.16-rc5 
- Fix PCI error recovery and bring it in line with AER/EEH
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCaGU3EBccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8BoVAP4+t6zSnkV8nSDTX6yISaI9o8Dx
 v4feTwMOkizuFbQbxQEA/QiQsN4bOymNDWwNgkzLDEBjirVLsYVzlvS2ttFfjAE=
 =oStU
 -----END PGP SIGNATURE-----

Merge tag 's390-6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Alexander Gordeev:

 - Fix PCI error recovery and bring it in line with AER/EEH

* tag 's390-6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/pci: Allow automatic recovery with minimal driver support
  s390/pci: Do not try re-enabling load/store if device is disabled
  s390/pci: Fix stale function handles in error handling
 2025-07-02 09:27:57 -07:00
Linus Torvalds
3c894cb29b iommufd 6.16 first rc pull 
Some changes to the userspace selftest framework cause the iommufd tests
 to start failing. This turned out to be bugs in the iommufd side that were
 just getting uncovered.
 
 - Deal with MAP_HUGETLB mmaping more than requested even when in MAP_FIXED
   mode
 
 - Fixup missing error flow cleanup in the test
 
 - Check that the memory allocations suceeded
 
 - Suppress some bogus gcc 'may be used uninitialized' warnings
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaGU5zgAKCRCFwuHvBreF
 YWsUAP9tLIwPDojp5bovlHRn6D9EbeJo96DSaG7ZRKLeBMJzSAEAtob6On8QNTUY
 paSxWftGWC0Xyy5BXrAg/HTEM394PAg=
 =UXkc
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd fixes from Jason Gunthorpe:
 "Some changes to the userspace selftest framework cause the iommufd
  tests to start failing. This turned out to be bugs in the iommufd side
  that were just getting uncovered.

   - Deal with MAP_HUGETLB mmaping more than requested even when in
     MAP_FIXED mode

   - Fixup missing error flow cleanup in the test

   - Check that the memory allocations suceeded

   - Suppress some bogus gcc 'may be used uninitialized' warnings"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd/selftest: Fix build warnings due to uninitialized mfd
  iommufd/selftest: Add asserts testing global mfd
  iommufd/selftest: Add missing close(mfd) in memfd_mmap()
  iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
 2025-07-02 09:23:56 -07:00
Linus Torvalds
7e4a6b57dd RDMA v6.16 first rc pull request 
Several mlx5 bugs, crashers, and reports
 
 - Limit stack usage
 
 - Fix mis-use of __xa_store/erase() without holding the lock to a locked
   version
 
 - Rate limit prints in the gid cache error cases
 
 - Fully initialize the event object before making it globally visible in
   an xarray
 
 - Fix deadlock inside the ODP code if the MMU notifier was called from a
   reclaim context
 
 - Include missed counters for some switchdev configurations and mulit-port MPV
   mode
 
 - Fix loopback packet support when in mulit-port MPV mode
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaGVC1AAKCRCFwuHvBreF
 YeaCAP4opgkgFIqpAcpYVZbNjeh4XGbH04mLlP+sKU07U+U+6AD/WubEZZdttP4m
 vODiddGUIdw3ZvrFDoqWlZ7A/8/SdgI=
 =vc41
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
 "Several mlx5 bugs, crashers, and reports:

   - Limit stack usage

   - Fix mis-use of __xa_store/erase() without holding the lock to a
     locked version

   - Rate limit prints in the gid cache error cases

   - Fully initialize the event object before making it globally visible
     in an xarray

   - Fix deadlock inside the ODP code if the MMU notifier was called
     from a reclaim context

   - Include missed counters for some switchdev configurations and
     mulit-port MPV mode

   - Fix loopback packet support when in mulit-port MPV mode"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/mlx5: Fix vport loopback for MPV device
  RDMA/mlx5: Fix CC counters query for MPV
  RDMA/mlx5: Fix HW counters query for non-representor devices
  IB/core: Annotate umem_mutex acquisition under fs_reclaim for lockdep
  IB/mlx5: Fix potential deadlock in MR deregistration
  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  RDMA/core: Rate limit GID cache warning messages
  RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
  RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup
 2025-07-02 09:17:40 -07:00
Linus Torvalds
65c1736c8e MFD Fixes for v6.16 
- Fix some -Werror=unused-variable build errors
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmhj47gACgkQUa+KL4f8
 d2G9Qw/+KxOL6kHPLRYJObnrKPeDn4bQqs5vzfsg8o8kJigIH5xVAk8GnvZ2MxoB
 ijuIxDe2pTP5IM/zSCtQpC63YwPeFpOpQgMyWbknYlraiea9JZNHS1VzXmWGe+QV
 gjeqZG1kRAKXSct4KK+jLbOjQrUun7eIim2D9alSKUrx6nxaVxKX/R1dLAPnEhRR
 Mu5gDzRKnpot66nO/p9919ufmJqST368YvkIeKgvJ5wAMzoTtKVdovuwjLK5vLwD
 86XDZhoyEk7kdzSI8tkzr1gTbCs0TnVfrap5OtBNy7R3m1UHJQrI/82jT899NGxY
 41zkLsAxc5uSVAJhIdWSv2KfWdKa7WiKVmInVvJKC/Fd5CKDoFy9Dh+z/VwCdb3U
 iNlLMaRqjFJAdM6VNS8Dr40eF9pjOPe/YdQxPh9KwrGym5r0zixeD6QvuGNXT3oj
 pV/lkKfy85oT2G4vSGnaba4k615Ophvv69NoDngZBhsBkyFTtmLsgUzuQKcJwSgc
 Kjthowk2TMlDl6owwbYGMpGBNod56poNVp72Y6U8GsnCatHByvgupeNrPZu4LS7F
 Uxrhpe4E4tDf1yvA7WuSOWULZkMewUWi8CXr+KmymYk2BJjoDbXfpmPf+GYDyNGj
 ZsSFD/7EuIOf2r+VOaI458FnUvjTsKcmIDSeeaoOWBk5DP6n1d4=
 =q4ed
 -----END PGP SIGNATURE-----

Merge tag 'mfd-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

Pull MFD fix from Lee Jones:

 - Fix some -Werror=unused-variable build errors

* tag 'mfd-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:
  mfd: Fix building without CONFIG_OF
 2025-07-01 13:50:21 -07:00
Linus Torvalds
ce95858aee NFS Client Bugfixes for Linux 6.16 
* Fix loop in GSS sequence number cache
 * Clean up /proc/net/rpc/nfs if nfs_fs_proc_net_init() fails
 * Fix a race to wake on NFS_LAYOUT_DRAIN
 * Fix handling of NFS level errors in I/O
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEnZ5MQTpR7cLU7KEp18tUv7ClQOsFAmhkRaUACgkQ18tUv7Cl
 QOskFxAAiyf6OIZ6M1mBfmbDDb+O5Gl6zofn0+OW2V9puJT/0U7pgNzepK9gFtO8
 o3Bq0/GU3I2oxO7wEFrWFQXl3hkPvMqCN7ai1Vb2DjRGWhu97E0Mk3DWltSmuDFQ
 IaofuURjJdhgvjLb03mI6ReQNxONbMU3qD0JgK4/WIfvm44574Fah6jTnod32G23
 EHj8cBw+iIvGh8MmPb4g01XivMGM36bA08NP4qkU/wgeLnkJzFYb5XZf16v821T6
 ZxwwruclX2fbpLtsQsHfJpOgW/TFRJTyjBcZw581H8fpkgh1PlJ96OFwrbOU7RCp
 gVzDw3hvWoKFaMjVlkKk3wSWzwtMWLnB8a7TmgssuNU+DqmN3qMzkaRqrOxWSYMc
 t7SycQ+PReaR2gQdlJNrN5/Q75OLpqplwPi6O5cqOMQXC2aMK+nhXVW9QiC1SPFI
 ZcymKk4anzdgIgH+8TR3JpFVmPoEuuIeLV24+DQ0rlh7+4SI3TooTygfsl3/DErb
 6Ic6nXgeSBWBPvuemnPbsq9DuAqGFbLrbdutVu4LUx/9XoGd8AfA9dVLMIb/0hgm
 C3Lwt1xeata8dz1v2jHHS1Tzs8ZphXnUCU7gzcf4TDs3UQUGzKnnNfdfb1r2cvxU
 LVz2guJ9xH4r3TsVNn2GQijbccxwPVFxszzPm0JobxiQYOna0Ss=
 =F4+b
 -----END PGP SIGNATURE-----

Merge tag 'nfs-for-6.16-2' of git://git.linux-nfs.org/projects/anna/linux-nfs

Pull NFS client fixes from Anna Schumaker:

 - Fix loop in GSS sequence number cache

 - Clean up /proc/net/rpc/nfs if nfs_fs_proc_net_init() fails

 - Fix a race to wake on NFS_LAYOUT_DRAIN

 - Fix handling of NFS level errors in I/O

* tag 'nfs-for-6.16-2' of git://git.linux-nfs.org/projects/anna/linux-nfs:
  NFSv4/flexfiles: Fix handling of NFS level errors in I/O
  NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  sunrpc: fix loop in gss seqno cache
 2025-07-01 13:42:30 -07:00
Linus Torvalds
66701750d5 io_uring-6.16-20250630 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmhi/gwQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpq3FEACU0f8KTDoKE/kacZq0feu0869ycNU8RGLo
 h3ehaQn0yqieoFjmLyh2y2u6SYdyacPHFDtfXmfkdy1NZ5ORzLmDJHvuqrFgBdFj
 G+azBmi55nmSX+GwrMaX+6KwpFqtAFeHhf/2XrvTTgBprhif/3eYrtHPaQGx9Lcl
 +sMG0tUTfyL6yOAaDabcY3KoN6Yy6CBvDLknnigLBuWPFoJk7p+srywuyJat8YQv
 TOk572L1Uq11+rrQOhb9I9+sGKR3PmWyaGhmLnNa//FCO8oiONX/ncB0L222+yH6
 xpwvHLlP8esoE4dZxrveub0lVg7N3hAjjehwxZBPVTFyKXRoe10wbaEAlySskMHu
 I2MZVo82BWaN/k9IoLA9SwvpAztLJFaU30AZ8UMdIYNjR5ZFZOyXRhbCLBQua9Fd
 k9+nPD0WPWMCvRgbvInyYRdJyMNktA0fPrhspSDdv/QPKI8O3pdmNw0zd9dXE2ZD
 CeG+P5K2Mftaq1Fky1ZgtldT3vqdLgh676MH0RTcfHKDraBDojN7RhLngzrGDalp
 Z6P4EeO7km3OiSUMyDc6nrzcgv939wqi+Zg5+6SjBxhx+gAj6HJHPatkKU5OCjsW
 UOBxFp4wUPTdFnHE5Tsan3pwBxU22ZE4WEeD6QwnxfuICJVWlsEmftk/2AoCusXW
 aLfjD6KRXA==
 =F1L2
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.16-20250630' of git://git.kernel.dk/linux

Pull io_uring fix from Jens Axboe:
 "Now that anonymous inodes set S_IFREG, this breaks the io_uring
  read/write retries for short reads/writes. As things like timerfd and
  eventfd are anon inodes, applications that previously did:

    unsigned long event_data[2];

    io_uring_prep_read(sqe, evfd, event_data, sizeof(event_data), 0);

  and just got a short read when 1 event was posted, will now wait for
  the full amount before posting a completion.

  This caused issues for the ghostty application, making it basically
  unusable due to excessive buffering"

* tag 'io_uring-6.16-20250630' of git://git.kernel.dk/linux:
  io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well
 2025-06-30 16:32:43 -07:00
Linus Torvalds
4b424a3f7d RTC fixes for 6.16 
Drivers:
  - cmos: use spin_lock_irqsave in cmos_interrupt
  - pcf2127: fix SPI command byte for PCF2131
  - s5m: add S2MPG10 support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmhhucMACgkQY6TcMGxw
 OjIjdw/+Iw2XCn6E0tmopC06IesmnxwnCRJlyneHeJ9rxfo+2mHQPHBjNs3LVK2Z
 J70a1nd8aLNLiLUkOm+mJIy3T7lMVAaHF+xCgMJgfU/siXr02YODJNgyaZtFOC1m
 dtW1ze/evsbT19tN3vdJ2aqDl7Cy7JcHV2VPF/aySZ0XuhwxsuY6qMPyUXTw8JV0
 PLh/Yx/CgAvf8SrBi91I0iCwssnrGrLkc7MCeeUTteiTc02pSzM8o1gMo6n2OgQO
 mIbQK0RaDqfIs4eyRGpgNGxA/x7G/KoPjsbKvrT7w5+tKIhx993FEscOaKwGKDD0
 Crj05k43StqlYOtPyifNauR9fqr+75V1yvqNASvKBmXnLIvS2G6Pc+0pKEiSvZrO
 uccJBPRfUGLuvRrhS3u5GF/HVdJwurjOF28GvhGQjfoJKRLxBKEQfqbo9jdqKhk/
 ZXYtZRg4nEWduHtlVkfDBVcy+wr7J0WSxCM9cu3GvI8X/6IIQHXT2zyH73IiBP9M
 XZRfXFvFdxqpHjSqnVy5nxBfajFfz0aP5a110+8BG+Pm5GVbTI/o2eS9hPsYExPs
 WsT4V4u22yT2E2g0VHGLfEp7Wv3ig4dcfp2VeYuTItnX9NppDB/wCh9PqIgpRU30
 gNpgDB9rZeDQJ8gYTE08USTja/mGT+46oT2ReOsExBvpaZAlpbQ=
 =p1Mo
 -----END PGP SIGNATURE-----

Merge tag 'rtc-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

Pull RTC fixes from Alexandre Belloni:
 "Some fixes for 6.16. The cmos one is important for PREEMPT_RT. I've
  also added the s5m changes as they had a dependency on the MFD pull
  request that was included in 6.16-rc1 and we didn't synchronize before
  the merge window and they won't hurt.

   - cmos: use spin_lock_irqsave in cmos_interrupt

   - pcf2127: fix SPI command byte for PCF2131

   - s5m: add S2MPG10 support"

* tag 'rtc-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
  rtc: pcf2127: add missing semicolon after statement
  rtc: pcf2127: fix SPI command byte for PCF2131
  rtc: cmos: use spin_lock_irqsave in cmos_interrupt
  rtc: s5m: replace open-coded read/modify/write registers with regmap helpers
  rtc: s5m: replace regmap_update_bits with regmap_clear/set_bits
  rtc: s5m: switch to devm_device_init_wakeup
  rtc: s5m: fix a typo: peding -> pending
  rtc: s5m: add support for S2MPG10 RTC
  rtc: s5m: prepare for external regmap
  rtc: s5m: cache device type during probe
 2025-06-30 08:27:38 -07:00
Youling Tang
9e9b46672b xfs: add FALLOC_FL_ALLOCATE_RANGE to supported flags mask 
Add FALLOC_FL_ALLOCATE_RANGE to the set of supported fallocate flags in
XFS_FALLOC_FL_SUPPORTED. This change improves code clarity and maintains
by explicitly showing this flag in the supported flags mask.

Note that since FALLOC_FL_ALLOCATE_RANGE is defined as 0x00, this addition
has no functional modifications.

Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Youling Tang <tangyouling@kylinos.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-30 14:16:13 +02:00
Jens Axboe
6f11adcc6f io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well 
io_uring marks a request as dealing with a regular file on S_ISREG. This
drives things like retries on short reads or writes, which is generally
not expected on a regular file (or bdev). Applications tend to not
expect that, so io_uring tries hard to ensure it doesn't deliver short
IO on regular files.

However, a recent commit added S_IFREG to anonymous inodes. When
io_uring is used to read from various things that are backed by anon
inodes, like eventfd, timerfd, etc, then it'll now all of a sudden wait
for more data when rather than deliver what was read or written in a
single operation. This breaks applications that issue reads on anon
inodes, if they ask for more data than a single read delivers.

Add a check for !S_ANON_INODE as well before setting REQ_F_ISREG to
prevent that.

Cc: Christian Brauner <brauner@kernel.org>
Cc: stable@vger.kernel.org
Link: https://github.com/ghostty-org/ghostty/discussions/7720
Fixes: cfd86ef7e8 ("anon_inode: use a proper mode internally")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 2025-06-29 16:52:34 -06:00
Linus Torvalds
d0b3b7b22d Linux 6.16-rc4 2025-06-29 13:09:04 -07:00
Linus Torvalds
afa9a6f4f5 Staging driver fix for 6.16-rc4 
Here is a single staging driver fix for 6.16-rc4.  It resolves a build
 error in the rtl8723bs driver for some versions of clang on arm64 when
 checking the frame size with -Wframe-larger-than.
 
 It has been in linux-next for a while now with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaGEwLA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yl1CACglnFMp3D+vkjNwDiDvYY4KhJCejkAoMwLpSdr
 lDh2mnQSJ/5aY7pHe9CZ
 =8Brn
 -----END PGP SIGNATURE-----

Merge tag 'staging-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fix from Greg KH:
 "Here is a single staging driver fix for 6.16-rc4. It resolves a build
  error in the rtl8723bs driver for some versions of clang on arm64 when
  checking the frame size with -Wframe-larger-than.

  It has been in linux-next for a while now with no reported issues"

* tag 'staging-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
 2025-06-29 09:25:55 -07:00
Linus Torvalds
798804b69f TTY/Serial driver fixes for 6.16-rc4 
Here are 5 small serial and tty and vt fixes for 6.16-rc4.  Included in
 here are:
   - kerneldoc fixes for vt recent changes
   - imx serial driver fix
   - of_node sysfs fix for a regression
   - vt missing notification fix
   - 8250 dt bindings fix
 
 All of these have been in linux-next for a while with no reported issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaGExmw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yntSQCZAc5lq73ZU4Fchhl6pzYPkqDjUboAoIQwQN6a
 WsV/qlgO+vAL4edKai3t
 =7xRK
 -----END PGP SIGNATURE-----

Merge tag 'tty-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial driver fixes from Greg KH:
 "Here are five small serial and tty and vt fixes for 6.16-rc4. Included
  in here are:

   - kerneldoc fixes for recent vt changes

   - imx serial driver fix

   - of_node sysfs fix for a regression

   - vt missing notification fix

   - 8250 dt bindings fix

  All of these have been in linux-next for a while with no reported issues"

* tag 'tty-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
  serial: imx: Restore original RXTL for console to fix data loss
  serial: core: restore of_node information in sysfs
  vt: fix kernel-doc warnings in ucs_get_fallback()
  vt: add missing notification when switching back to text mode
 2025-06-29 09:21:27 -07:00
Linus Torvalds
3b1890e4b2 - Consider secondary address mask registers in amd64_edac in order to 
get the correct total memory size of the system
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmhg+mIACgkQEsHwGGHe
 VUq4wQ//a8BsgU2zPe1pUP4EX6AsvNRbkmnlzOPwVPsKbKE9hRLJlI3AbwsbcF/a
 1eU7LMaHgNRymO/AV5FpOEMJYKV1H+YnoBb4/Xam0dJoq82KAhSUXbATKsApbWo3
 shO+t+jLA5w3eSOWbRSut1cfI+LWyotGPdpt6bfxYLFuA4zIAox8i75UPzj3MP0O
 dqJKOXTEmfZTxvJw/R6iJ9iFIl5QpmeqxlZKQtKwWuK+jkIDNk6jpB0o3qVGFdWj
 otzZq/d9LWeCvLLh/OuWSKVDG8ILvWSfro+pgiAYLPKCXeoT0J0mudPbYUhvVdK2
 Gh95NKH4IbuZh1AUT27XwFMdrNZb1OlRQm4o2uJwCs9IFOoVcXUzAWw1wWqOfry1
 tVpLsQtHmGOQSGEXbVZL8zbvnSi5k+7zx8V4xOHRIGkKapxNH3bXO4XvsMLPEDf5
 gahGl/d0c+LVH7frIYD+ZGEEpRp7FALtyXt+wKtm/9B58L8LFwQXjZh3mKlDM/fd
 ciNcNa869dXM8J7D/qnuF0A6bFz2+oSYSAZYX+Zy/bHxkBEYeCwLBe6cCcaAOZF1
 IC+WdyrxDmmIveFTAtu/X32NA6OLUYHW562mRVE3WMKLm5djYiLHAGEjHIJNcsmK
 Mfj3IMas6HX1MQFSwJ0Q5j2SVPpPSr8SwCi+YxLbmtyAV1Snyf8=
 =K5/s
 -----END PGP SIGNATURE-----

Merge tag 'edac_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras

Pull EDAC fix from Borislav Petkov:

 - Consider secondary address mask registers in amd64_edac in order to
   get the correct total memory size of the system

* tag 'edac_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
 2025-06-29 08:43:54 -07:00
Linus Torvalds
cc69ac7a65 - Make sure DR6 and DR7 are initialized to their architectural values and not 
accidentally cleared, leading to misconfigurations
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmhg/UQACgkQEsHwGGHe
 VUrmXBAAtOrpEtR4geeBeZtCEaUxE4DE8Zvj36dr+sAScHTXNTzYK94mAy/AHU22
 V3rF12/kuyyZSrwROXLBD6PgkHEn8u0WLztSeqP/SisnoLjMTV9H9TuGYBUoz1NS
 clkoElQ6DJP5BVzmYpZlJrcofqNjkS/mAxfMRoIAq+LzKkb3iL/Lge+Ox/IDUg8z
 L9wRlKh/IaJ5EETWlqh0gkFeS/M9DXYmfkasDQeVkUxnKFeXBdyUGc2jFzBGX5RA
 rsdnz+C3x3ow2U9N+ZMVr+n06yTZvh+fAiU8emeBQm0q5fZBBHWDbnZZtWf+KG6s
 43tlWyVqic5yzyQbUpRC2sttOkIAtOCMx36XexbGm1eKRNNc6fTz9IlgO/97HkuE
 lYBNq0zd/p5Kb53lXb3uwBVy4sjIEZUyD/K5DO4YfTgamcwXl8BP5xnKtNPqImI5
 aaF3xKKLOUDOTL1CcK5YG0joaU1k+I0F0KO7HYqkDi8Uf5naWZSUNil8nPQn8RX7
 3f3LJx0e3j2o0f60AHI4mjUAUJHsxExmpaTl079k03wt8YVE3ucNaUN6se6nidVz
 H5q0JU4q3C3DCu0I3Ub4wa5QXGA+TOHKuqhJCapKAVAAQDlbV2z8GxA/3B2YbRM+
 eZ6/RVyk++VrRXIyfmfwLPu0CLVoSNhaUhu/hFrYbjA3NX+85qw=
 =fjgT
 -----END PGP SIGNATURE-----

Merge tag 'x86_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Borislav Petkov:

 - Make sure DR6 and DR7 are initialized to their architectural values
   and not accidentally cleared, leading to misconfigurations

* tag 'x86_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/traps: Initialize DR7 by writing its architectural reset value
  x86/traps: Initialize DR6 by writing its architectural reset value
 2025-06-29 08:28:24 -07:00
Linus Torvalds
2fc18d0b89 - Make sure an AUX perf event is really disabled when it overruns 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmhg/fMACgkQEsHwGGHe
 VUpi5BAAwBTf3vpsGZvVQNhZhTM9uy9EG0ZmNzPihhJ+e2Ko4BMlWmnBfB0olYgN
 SUBypUQQwkneh5qnUnNe7MEsFof2NONRK4EBwr2l2GWcO8YhEKe6DH+ow+wT+fB0
 B5ifBiEGua1Cv+G276c54WJr35Tkc7XqyfRorvT5LdmynbawU7raS1JK7lQRmKFD
 TzBcTqb8OSTq3tJ+G3eXB5rA9XbYd/TeVCDWYXGOl+BhCt1hnHph+p1xEz/o5PAV
 orCbR8tgv0+tBCvsnSDGQ3TEfAqdPnGYOzIyXte5r9/FaXPhyL8K8x3ixVx1zjnE
 8i+HCUvK7aQs0jFuQ6rfIGnKwNURmM8qVjL65MsFglTJenfXwa7WBYti7dlKUai3
 riaW0FQaEmRt5UhadB3OZJFMzQXKw3ZsxUHjTeYKlx8csangdb03pzwVvMz2o0VO
 xAhJ1i0jgRXaMOFOORtzU7FOZFUuhV8pDKergSObMpimmMG69reNU3MAZPJToYaO
 0Dxx2R/yWsnZMUctVWkcQPL5Qb2e63ecTcYOBUsMfOBuj2WNNLSnh9z6VmHPcT22
 n5nmeAwcGFD33C7CqyT76ruY2687pQi6DxvWxF3ED8vNOkXnP/URkHjpMcRA9fr0
 rUvglIeAxZSXus79ScMy+9Yu985AMljn6ZuMKlGapMWw4+BQAVQ=
 =yQqt
 -----END PGP SIGNATURE-----

Merge tag 'perf_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf fix from Borislav Petkov:

 - Make sure an AUX perf event is really disabled when it overruns

* tag 'perf_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/aux: Fix pending disable flow when the AUX ring buffer overruns
 2025-06-29 08:16:02 -07:00
Linus Torvalds
753a0f61b9 - Make sure the new futex phash is not copied during fork in order to 
avoid a double-free
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmhg/MYACgkQEsHwGGHe
 VUrwpA//V/4ZuZ+avjabOAb3W7C/QgQwmXg+RlTWhmw21lTIIzxC20pkwYXDUWQE
 JQgS6Y7128otps01IwnTXR/kXZHkGYGt2Isudqyv9ngK/XrxyxXFxkU7vhPeIFY7
 mibLBscVj8x1EgNBMhfF4/xvmACPhO/QPditdo3pxPTuSEiScJG+1GwiIIBQyjw7
 pfoZid6EC1YOhCCr7HwdywNm9Vaz2UahXY3NZX/wMQT9NG3eCDFCjRCPxVphnp8M
 dh6IgRa+91VMKpV0PLvIVWnoWQyItPUarAuFudVBRGKnlPFECMEpLMbLOidNx1Q6
 HHO/x9hu1JFWHTfoVJ0C1pSzOhMAYJpl5qanQKznfaYewYmchilGobXE8F/n/6If
 TqTG0ayRifZdeTnvRa4khOh1TNM01H6SYYUzDihsMv9HQnhMpD9lbMDZpULfzpcc
 qpt9ubmbu3xpOCwHvtDpIOO2puyUUVcoHMAY1TFQCvxB+VwwqZT2QXC20PbE8uwt
 44KWtWeJJDjkTbbPHj/Q3IuhQ3NZJyPlAyn53mroMtZAOfRfXQEHhsnsQUYBW/zi
 srs1FzqM/qkU+bwK98go635x79ztm95AUerzy4nnT4H3lksOpvgWhTK+OBSS0Cto
 mrgFQVdDOFkceNC1UZBwV0E6oysL327sWrYLzrGpXkOobQvP8HU=
 =ZynV
 -----END PGP SIGNATURE-----

Merge tag 'locking_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fix from Borislav Petkov:

 - Make sure the new futex phash is not copied during fork in order to
   avoid a double-free

* tag 'locking_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Initialize futex_phash_new during fork().
 2025-06-29 08:09:13 -07:00
Linus Torvalds
dfba48a70c i2c-for-6.16-rc4 
- imx: fix SMBus protocol compliance during block read
 - omap: fix error handling path in probe
 - robotfuzz, tiny-usb: prevent zero-length reads
 - x86, designware, amdisp: fix build error when modules are
   disabled (agreed to go in via i2c)
 - scx200_acb: fix build error because of missing HAS_IOPORT
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmhgO5sACgkQFA3kzBSg
 Kbb/zA/9FeV35eBjQI58FzJ+aCnYKKIIXFJpPMFsRZofSB5AJ8m8DUljQOrLZEYl
 1fKwIbvnHMlgKvly+laRFoli0eSzpM+v85/ZG9CAssRUh6oUGs7jMb/dO1q2k5+e
 bw7Bjy8lHtZbDvw+F7HVO4xIau9X1MUVmMlJAB8HnvKSLQDzPKKiNmZdTp2ONurC
 W0HMrLzswmxDHi2G2DBooufXP/OCF745G5FaRjDrQE7un0CD1cADFQxlJLy3I1br
 as/tht++N3UN4trL0G0GkKhFOUnKFKA3UYBI9zfXKtOxBtJywHRWgbUBQwVmu6yH
 nDLbOx7eVVgO7f5AIxXDAYXOE8uLDp9OWtuXsg0H2APG4cCKwK+f7Qn2xYF+f4yS
 tymDMMvzxmW0Ojkb66EVlexsTcgQKiMpQRnuflPEl3hUOdiJ8fWLE2/Mss6nZwYE
 Vpobk+kmggrRUA97OLCb+xMEeCWSpu4jyiKMeByAwHDf4Ji1jH7wwwhJ4rPWQZvZ
 tfHqimYbNg1vFQGMgHAHWiZNoublm/BqdPi5O16JZjADuNx/cob5xIirMH8Eea5Y
 bhjw7O+lw4gEnbe6g8NLU1pkz9w1tEiQUOiLNarxwJgmumyWpFJDkd32LsIPgWTx
 mOGBcJZwbWDzuQL+SP3iVcjYbWcfdltDyzOGWVaox8Btf6/JYd4=
 =WgQ5
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:

 - imx: fix SMBus protocol compliance during block read

 - omap: fix error handling path in probe

 - robotfuzz, tiny-usb: prevent zero-length reads

 - x86, designware, amdisp: fix build error when modules are disabled
   (agreed to go in via i2c)

 - scx200_acb: fix build error because of missing HAS_IOPORT

* tag 'i2c-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: scx200_acb: depends on HAS_IOPORT
  i2c: omap: Fix an error handling path in omap_i2c_probe()
  platform/x86: Use i2c adapter name to fix build errors
  i2c: amd-isp: Initialize unique adapter name
  i2c: designware: Initialize adapter name only when not set
  i2c: tiny-usb: disable zero-length read messages
  i2c: robotfuzz-osif: disable zero-length read messages
  i2c: imx: fix emulated smbus block read
 2025-06-28 15:23:17 -07:00
Linus Torvalds
ded779017a tracing fixes for v6.16: 
- Fix possible UAF on error path in filter_free_subsystem_filters()
 
   When freeing a subsystem filter, the filter for the subsystem is passed in
   to be freed and all the events within the subsystem will have their filter
   freed too. In order to free without waiting for RCU synchronization, list
   items are allocated to hold what is going to be freed to free it via a
   call_rcu(). If the allocation of these items fails, it will call the
   synchronization directly and free after that (causing a bit of delay for
   the user).
 
   The subsystem filter is first added to this list and then the filters for
   all the events under the subsystem. The bug is if one of the allocations
   of the list items for the event filters fail to allocate, it jumps to the
   "free_now" label which will free the subsystem filter, then all the items
   on the allocated list, and then the event filters that were not added to
   the list yet. But because the subsystem filter was added first, it gets
   freed twice.
 
   The solution is to add the subsystem filter after the events, and then if
   any of the allocations fail it will not try to free any of them twice
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaF/yIRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qpoNAP9AuI6SzS+E14UFbA7lEPVtQAgaj6rv
 xURhlmZdsGJ2AQEA3ZTv6Lf3DbnSHzPDOUnK9ItQZE7UHPh4Yed0QrriEAM=
 =hFZ1
 -----END PGP SIGNATURE-----

Merge tag 'trace-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fix from Steven Rostedt:

 - Fix possible UAF on error path in filter_free_subsystem_filters()

   When freeing a subsystem filter, the filter for the subsystem is
   passed in to be freed and all the events within the subsystem will
   have their filter freed too. In order to free without waiting for RCU
   synchronization, list items are allocated to hold what is going to be
   freed to free it via a call_rcu(). If the allocation of these items
   fails, it will call the synchronization directly and free after that
   (causing a bit of delay for the user).

   The subsystem filter is first added to this list and then the filters
   for all the events under the subsystem. The bug is if one of the
   allocations of the list items for the event filters fail to allocate,
   it jumps to the "free_now" label which will free the subsystem
   filter, then all the items on the allocated list, and then the event
   filters that were not added to the list yet. But because the
   subsystem filter was added first, it gets freed twice.

   The solution is to add the subsystem filter after the events, and
   then if any of the allocations fail it will not try to free any of
   them twice

* tag 'trace-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: Fix filter logic error
 2025-06-28 11:39:24 -07:00
Linus Torvalds
3a3de75a68 LoongArch fixes for v6.16-rc4 
-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmhecpMWHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImeuXAEACmM0dpvqSCnCMoDPy7h1vHUERa
 tA4un0egBEmFzgxHqzhAkirnRgOXtz2gAlQMdw1qWkbVVcBYMoSxuJ7U5QZykt6Q
 idP2ZglbnaNtb5PhRPQ6sUKrvr3sMOiYXdVA8GQdJu2CPVdQhdrusW6i5cZNykYt
 8Gwjzx9Z9MlLRNCx6nrzEWFy5B4ANR5l4Vh7VnS+zsL7xOiJF0j7W4nz5qhClFVf
 KRobF9lyvrQhEoFHFRzFVN/EUrU5EtPkhmi54XpF0Q1a1yy0sQFDiFln9fPBNlvy
 P/jcxddN09bzsiIiABBAOfh7AsSeUSjvN2CJJFIvPera2pZEL+u0aYmw5+kLDJmn
 Hlp50EnMfVcxcjf+PgqXKXLZSBdl8k7ytpK9GOkmKr59sqGW82KnWqmCXRyy2Qsl
 8dj0eIHB0rLhZT26ztkB/Ec2IBiZoZCZw696bTi9sQYPKayZOYhgoa8OrOgJUb91
 N9wsK2kEErgHvruAhz7Lpxqx6cQd5/ZU4XSEQxdmWWZH0+DATzLz48OGav21IImw
 M/WjuHVZMHiiJtkrXKt4CiYs4FMV6vE9Kv0p5psdHZvrg1E03WE/sEWmn/r7PjJx
 foNTcNBErilMBh6GHAvcJDe5G1Fb35A/GP4y+J+qb9rH4DO4weNqoIirLb5CzhQF
 OM7AMehueYS7sVcPuQ==
 =jnb5
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-fixes-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch fixes from Huacai Chen:

 - replace __ASSEMBLY__ with __ASSEMBLER__ in headers like others

 - fix build warnings about export.h

 - reserve the EFI memory map region for kdump

 - handle __init vs inline mismatches

 - fix some KVM bugs

* tag 'loongarch-fixes-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  LoongArch: KVM: Disable updating of "num_cpu" and "feature"
  LoongArch: KVM: Check validity of "num_cpu" from user space
  LoongArch: KVM: Check interrupt route from physical CPU
  LoongArch: KVM: Fix interrupt route update with EIOINTC
  LoongArch: KVM: Add address alignment check for IOCSR emulation
  LoongArch: KVM: Avoid overflow with array index
  LoongArch: Handle KCOV __init vs inline mismatches
  LoongArch: Reserve the EFI memory map region
  LoongArch: Fix build warnings about export.h
  LoongArch: Replace __ASSEMBLY__ with __ASSEMBLER__ in headers
 2025-06-28 11:35:11 -07:00
Niklas Schnelle
62355f1f87 s390/pci: Allow automatic recovery with minimal driver support 
According to Documentation/PCI/pci-error-recovery.rst only the
error_detected() callback in the err_handler struct is mandatory for
a driver to support error recovery. So far s390's error recovery chose
a stricter approach also requiring slot_reset() and resume().

Relax this requirement and only require error_detected(). If a callback
is not implemented EEH and AER treat this as PCI_ERS_RESULT_NONE. This
return value is otherwise used by drivers abstaining from their vote
on how to proceed with recovery and currently also not supported by
s390's recovery code.

So to support missing callbacks in-line with other implementors of the
recovery flow, also handle PCI_ERS_RESULT_NONE. Since s390 only does per
PCI function recovery and does not do voting, treat PCI_ERS_RESULT_NONE
optimistically and proceed through recovery unless other failures
prevent this.

Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
 2025-06-28 18:59:00 +02:00
Niklas Schnelle
b97a7972b1 s390/pci: Do not try re-enabling load/store if device is disabled 
If a device is disabled unblocking load/store on its own is not useful
as a full re-enable of the function is necessary anyway. Note that SCLP
Write Event Data Action Qualifier 0 (Reset) leaves the device disabled
and triggers this case unless the driver already requests a reset.

Cc: stable@vger.kernel.org
Fixes: 4cdf2f4e24 ("s390/pci: implement minimal PCI error recovery")
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
 2025-06-28 18:58:59 +02:00
Niklas Schnelle
45537926dd s390/pci: Fix stale function handles in error handling 
The error event information for PCI error events contains a function
handle for the respective function. This handle is generally captured at
the time the error event was recorded. Due to delays in processing or
cascading issues, it may happen that during firmware recovery multiple
events are generated. When processing these events in order Linux may
already have recovered an affected function making the event information
stale. Fix this by doing an unconditional CLP List PCI function
retrieving the current function handle with the zdev->state_lock held
and ignoring the event if its function handle is stale.

Cc: stable@vger.kernel.org
Fixes: 4cdf2f4e24 ("s390/pci: implement minimal PCI error recovery")
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
 2025-06-28 18:58:59 +02:00
Linus Torvalds
aaf724ed69 six smb3 client fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmhfImcACgkQiiy9cAdy
 T1EMWwv+LSveqDxylD28bL12GuCudX2b894QzUhckC9DHerRDarLcWSEvRo2/dT1
 y5s//OL2NmvbfxfTnbQLSY7o+r3NOvF6XRAd8ooOSolyEQKWeRO5byBFFszb/PNC
 ajlXX+xgA4VxzZWWOXOFYAz5EIPF4avYxHmvF9BD/RhS6u2k9ZaDCvtOqzreOlfa
 t1V/eqcZwvlde7dObTEgJKgHD5Mej/+vlDRu+vQnrqOYnrLbZgWImOm05lJyKpat
 qibPrnOtejzcWChpjvv2OqF4Jsige/Bzko3W/v60ZOsFfc5eegxAHpGrdbFuI4fN
 E9vP/PA8n9gS8LZZkHTuHv7b78XOx06qhtiNcPNIpmJmlg1I2XlAwa1ifDd5F5Im
 C4sstB2ujJ28k5ReqkYnd5Q8SvVmoCcP+31bP6ibUrk+onYrXPHRJp+CvUrniYIp
 WNHkPwL2khrsRjHb2GnKwQQvdvyZa0/Vams2WtTHsK6CMOQMm14MHcJq1KNsd4oz
 UXNq2D5j
 =vWu+
 -----END PGP SIGNATURE-----

Merge tag 'v6.16-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Multichannel reconnect lock ordering deadlock fix

 - Fix for regression in handling native Windows symlinks

 - Three smbdirect fixes:
     - oops in RDMA response processing
     - smbdirect memcpy issue
     - fix smbdirect regression with large writes (smbdirect test cases
       now all passing)

 - Fix for "FAILED_TO_PARSE" warning in trace-cmd report output

* tag 'v6.16-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
  cifs: Fix the smbd_response slab to allow usercopy
  smb: client: fix potential deadlock when reconnecting channels
  smb: client: remove \t from TP_printk statements
  smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data
  smb: client: fix regression with native SMB symlinks
 2025-06-27 20:38:05 -07:00
Linus Torvalds
0fd39af24e 16 hotfixes. 6 are cc:stable and the remainder address post-6.15 issues 
or aren't considered necessary for -stable kernels.  5 are for MM.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaF8vtQAKCRDdBJ7gKXxA
 jlK9AP9Syx5isoE7MAMKjr9iI/2z+NRaCCro/VM4oQk8m2cNFgD/ZsL9YMhjZlcL
 bMIVUZ9E+yf1w9dLeHLoDba+pnF7Wwc=
 =vdkO
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2025-06-27-16-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "16 hotfixes.

  6 are cc:stable and the remainder address post-6.15 issues or aren't
  considered necessary for -stable kernels. 5 are for MM"

* tag 'mm-hotfixes-stable-2025-06-27-16-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  MAINTAINERS: add Lorenzo as THP co-maintainer
  mailmap: update Duje Mihanović's email address
  selftests/mm: fix validate_addr() helper
  crashdump: add CONFIG_KEYS dependency
  mailmap: correct name for a historical account of Zijun Hu
  mailmap: add entries for Zijun Hu
  fuse: fix runtime warning on truncate_folio_batch_exceptionals()
  scripts/gdb: fix dentry_name() lookup
  mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
  mm/alloc_tag: fix the kmemleak false positive issue in the allocation of the percpu variable tag->counters
  lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
  mm/hugetlb: remove unnecessary holding of hugetlb_lock
  MAINTAINERS: add missing files to mm page alloc section
  MAINTAINERS: add tree entry to mm init block
  mm: add OOM killer maintainer structure
  fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
 2025-06-27 20:34:10 -07:00
Linus Torvalds
867b9987a3 RISC-V Fixes for 5.16-rc4 
* .rodata is no longer linkd into PT_DYNAMIC, it was not supposed to be
   there in the first place and resultst in invalid (but unused) entries.
   This manifests as at least warnings in llvm-readelf.
 * A fix for runtime constants with all-0 upper 32-bits.  This should
   only manifest on MMU=n kernels.
 * A fix for context save/restore on systems using the T-Head vector
   extensions.
 * A fix for a conflicting "+r"/"r" register constraint in the VDSO
   getrandom syscall wrapper, which is undefined behavior in clang.
 * A fix for a missing register clobber in the RVV raid6 implementation.
   This manifests as a NULL pointer reference on some compilers, but
   could trigger in other ways.
 * Misaligned accesses from userspace at faulting addresses are now
   handled correctly.
 * A fix for an incorrect optimization that allowed access_ok() to mark
   invalid addresses as accessible, which can result in userspace
   triggering BUG()s.
 * A few fixes for build warnings, and an update to Drew's email address.
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEEKzw3R0RoQ7JKlDp6LhMZ81+7GIkFAmhe80kZHHBhbG1lcmRh
 YmJlbHRAZ29vZ2xlLmNvbQAKCRAuExnzX7sYicV6EACT/5384tdpYSQ6WQ4K2mT2
 XxPbrYTJ4jrhZMugnfe1LHBokeBGoGPRK11Dr/PyNJ71oeeDF7opv0kxAfqsiOO3
 QrwUE/4zhGgEzs7Z6D8UgYiqVDfb4aMU+oZ0qIfy+r+cB4F9M65TIejdVj99V6Hu
 V9cjJ4ABM9KfaZhD5BvoqflblYtwuSg/VYsUmZH6aolDyadzTy4rWcPk1jdFJDQt
 tIEsXjc92KNAKGSFe8DDZjjhM216Th/nUsZcxI2DLRQjjHPNEthkAgLNltQGocU9
 gJ8U3IqfazgnqcZAlrr7BXlWYlBFH/wGXVsxuBL5LPov19RcTkjl2PWH7T08yyuv
 lCGXrfkz3hSu+Sa9A40w4LptrKNWUEFJztaPkQ68gn1ZQP7KB/rsWp+82dCqhT35
 RNxmSznLyTsHFRXR2n9fZrWX/F/LwxY7vaH7cTZUDkMHI8F7WP/3tlihxPCQaUHD
 dIb+osch8puxG3YjO7H99WrpJamNNw3+L1l2lXtXTRmXdxE+x7fyatmHX98mY8IC
 7NXGOdNNIEvv4i9vzSphYQHBOT3tBVfz40z878qfSL3xYHG3ZLMIsWuynaWDMI73
 QprwAPmdFxdmJrHyIY6gIiyrscNHz5WLMjkG4K+jXlsBBmDxJMAY5zzNdFoeUVDz
 tjnDY4DYc4fCnteKSA/hpw==
 =42TO
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-5.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V Fixes for 5.16-rc4

 - .rodata is no longer linkd into PT_DYNAMIC.

   It was not supposed to be there in the first place and resulted in
   invalid (but unused) entries. This manifests as at least warnings in
   llvm-readelf

 - A fix for runtime constants with all-0 upper 32-bits. This should
   only manifest on MMU=n kernels

 - A fix for context save/restore on systems using the T-Head vector
   extensions

 - A fix for a conflicting "+r"/"r" register constraint in the VDSO
   getrandom syscall wrapper, which is undefined behavior in clang

 - A fix for a missing register clobber in the RVV raid6 implementation.

   This manifests as a NULL pointer reference on some compilers, but
   could trigger in other ways

 - Misaligned accesses from userspace at faulting addresses are now
   handled correctly

 - A fix for an incorrect optimization that allowed access_ok() to mark
   invalid addresses as accessible, which can result in userspace
   triggering BUG()s

 - A few fixes for build warnings, and an update to Drew's email address

* tag 'riscv-for-linus-5.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: export boot_cpu_hartid
  Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
  riscv: Fix sparse warning in vendor_extensions/sifive.c
  Revert "riscv: misaligned: fix sleeping function called during misaligned access handling"
  MAINTAINERS: Update Drew Fustini's email address
  RISC-V: uaccess: Wrap the get_user_8 uaccess macro
  raid6: riscv: Fix NULL pointer dereference caused by a missing clobber
  RISC-V: vDSO: Correct inline assembly constraints in the getrandom syscall wrapper
  riscv: vector: Fix context save/restore with xtheadvector
  riscv: fix runtime constant support for nommu kernels
  riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
 2025-06-27 20:22:18 -07:00
Linus Torvalds
fa33adcaf8 pci-v6.16-fixes-2 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmhe910UHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vzPTg//UMXXLGtV1pcwmwrt6810n0lvPAbX
 uyzq+CzDgikkdbuhcsMYluLKiMAGCGkCp8JsDi+Rqhpjc6Qo9/OMALAF0fYOAfBS
 jffql/Zg+PSxbaKYYYmtzQbiWGqoW0+C8zK1f2MFRxfTcgQRwqXGszanfo0hBD8m
 dVRYTtdyagxWYeCF5P7SVw9+m5OvTlPusiOvzPFCjxHCJrPb05oeDVGjkESU52QP
 f7tLjY2Wv13YUFLjKIC2qLEypFjOgY7HuDV0WyJ5MRusnv7gN3b4nsH73Pr+Qblc
 lWevd0CT6diMY+q7skxW6TFjanEZI1djlNNgr8dlY7rTJjZFP/gOfImfiOebeLt2
 6PEJzMONMR6KEg5WFPDxw17bZl4/5fYmWrfwttWIeaySYM0nMs3ur+O6Q1y5iDEv
 jHeZ1pPO/+KfSaQ4+I7A1nfihfOMJxJcfrONAsSoi4bDBgZLD6+AMp8rpgb4a69i
 xZ5z1ykWoASHCkh/UVjbPslThmDPBqA78tumT7vSIm84tpcTU2nOBPyGGzWlSrxZ
 DVNEMcAGy+xwnN1AOfqiSJrGP/aZ3M/cJwpSMq7kVPZxY85uz0rGP/rpVn/Qa6UT
 QG0eJm7yk4ohwb6JfFju60IUeeMOIMk+7yXTdmW8JP/EPI3VTZbo4XB619WbDyP/
 z1RaITMzNjZ6aMM=
 =ERzL
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull PCI fix from Bjorn Helgaas:

 - Fix a PTM debugfs build error with CONFIG_DEBUG_FS=n &&
   CONFIG_PCIE_PTM=y (Manivannan Sadhasivam)

* tag 'pci-v6.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI/PTM: Build debugfs code only if CONFIG_DEBUG_FS is enabled
 2025-06-27 20:17:48 -07:00
Linus Torvalds
7abdafd234 drm fixes for 6.16-rc4 
core:
 - fix drm_writeback_connector_cleanup function signature
 - use correct HDMI audio bridge in drm_connector_hdmi_audio_init
 
 bridge:
 - SN65DSI86: fix HPD
 
 amdgpu:
 - Cleaner shader support for additional GFX9 GPUs
 - MES firmware compatibility fixes
 - Discovery error reporting fixes
 - SDMA6/7 userq fixes
 - Backlight fix
 - EDID sanity check
 
 i915:
 - Fix for SNPS PHY HDMI for 1080p@120Hz
 - Correct DP AUX DPCD probe address
 - Followup build fix for GCOV and AutoFDO enabled config
 
 xe:
 - Missing error check
 - Fix xe_hwmon_power_max_write
 - Move flushes
 - Explicitly exit CT safe mode on unwind
 - Process deferred GGTT node removals on device unwind
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmhfBuMACgkQDHTzWXnE
 hr7W8g/9Gro8VxzVjiGuPXTP8em3B7mzw6FKWyGRHq4gRSPQySoEep6vh7iySFvp
 oFZjWEzLW1y9GElxfMss2zj4ZwRWo6x8VhjCqW6B8rM3HNgIAaMyF1IMWeb2tTHd
 QU+NAsMmy63VHp2gG8XrMWAP1cigXuI2bmCVsgqEl8bP0ZAU7ndlGD6WPENbpIvm
 +EH4Dnr8kC2V9SXzbKmZ9B3Vc4EDaHUyeVkDZ9eQfvYOwjY5gh8BXH2xdN95478X
 qUzGXUsfz2Z9vFJoCYThxtMjFiEyIc6A4ZOBE6CvEXk0ZE0+VasguVsBaa9b1lyW
 X/2GB3bhM20O5Y9zKW7CRdjUV7L0H4VAXT/yZNzbgF17lWTUTxCt1Q/tOaR2E0BG
 mRabuz/LWDGQrunUbFxcA8a1SNmmcxU1RVkvg3yn9ZoVLD/i89agUBj+Ef2+PYFr
 ukpyqy33lPBSEsWiqV7kVa6KYpIDOrNPzVfmLSA4mxDT1HrU0fZcRiExEG9WmiQm
 zNtdiCBEas0QVZ60VlH+pvPLz56eYaOvMzKHc1yTQk8hdMSqg0h/DG+HGkiA6z29
 4jD/P5GXdjKiFaKNi1Z0Zc9jsLWsCdTsAOtXO34ZM+D70riyPTaBhcsCBMz0RCW5
 XHqzdslf4OW5X/dY6jrlNY6hAm+JzRO0GhK//h8Z3van4BXiGRI=
 =AAHI
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-06-28' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular weekly drm updates, nothing out of the ordinary, amdgpu, xe,
  i915 and a few misc bits. Seems about right for this time in the
  release cycle.

  core:
   - fix drm_writeback_connector_cleanup function signature
   - use correct HDMI audio bridge in drm_connector_hdmi_audio_init

  bridge:
   - SN65DSI86: fix HPD

  amdgpu:
   - Cleaner shader support for additional GFX9 GPUs
   - MES firmware compatibility fixes
   - Discovery error reporting fixes
   - SDMA6/7 userq fixes
   - Backlight fix
   - EDID sanity check

  i915:
   - Fix for SNPS PHY HDMI for 1080p@120Hz
   - Correct DP AUX DPCD probe address
   - Followup build fix for GCOV and AutoFDO enabled config

  xe:
   - Missing error check
   - Fix xe_hwmon_power_max_write
   - Move flushes
   - Explicitly exit CT safe mode on unwind
   - Process deferred GGTT node removals on device unwind"

* tag 'drm-fixes-2025-06-28' of https://gitlab.freedesktop.org/drm/kernel:
  drm/xe: Process deferred GGTT node removals on device unwind
  drm/xe/guc: Explicitly exit CT safe mode on unwind
  drm/xe: move DPT l2 flush to a more sensible place
  drm/xe: Move DSB l2 flush to a more sensible place
  drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
  drm/i915: fix build error some more
  drm/xe/hwmon: Fix xe_hwmon_power_max_write
  drm/xe/display: Add check for alloc_ordered_workqueue()
  drm/amd/display: Add sanity checks for drm_edid_raw()
  drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value
  drm/amdgpu/sdma7: add ucode version checks for userq support
  drm/amdgpu/sdma6: add ucode version checks for userq support
  drm/amd: Adjust output for discovery error handling
  drm/amdgpu/mes: add compatibility checks for set_hw_resource_1
  drm/amdgpu/gfx9: Add Cleaner Shader Support for GFX9.x GPUs
  drm/bridge-connector: Fix bridge in drm_connector_hdmi_audio_init()
  drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  drm/i915/snps_hdmi_pll: Fix 64-bit divisor truncation by using div64_u64
  drm: writeback: Fix drm_writeback_connector_cleanup signature
 2025-06-27 19:38:36 -07:00
Linus Torvalds
26fd9f7b7f cxl fixes for v6.16-rc4 
- Fix return value of cxlctl_validate_set_features()
 - Fix min_scrub_cycle of a region miscaculation and add additional documentation
 - Fix potential memory leak issues for CXL EDAC
 - Fix CPER handler device confusion for CXL RAS
 - Fix using wrong repair type to check DRAM event record
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmheuicACgkQYGjFFmlT
 OEoHlRAAl//KP13UhasDWndE7+U9XZHLoeUnnEMdX4QYoZ8S9+zbReWmkAvenmUy
 WCNOfXGa0zJfCQEtQYdox6BxwUnlFSTr+BlHY2J4xPLK7OH1LqSr5gKs7jQPecHJ
 lh5UYmGIgQtvfgvWIVc6Ia8iU6LSgDM315qHp559uCq1E2E24CMNw5yqLukQ4+l/
 Pnb75CXlrYNfVlRDWk46QJEIQ2c5m9V/zT34p1gOagZev4JkWqxhDiP7GA3m9GwB
 CGL/SHdAzTE/60cYUTBRfsx4ZrgKh1OFVTKDrOnhNO5XzPGgwYBn65jbzr1F63Fi
 C0qHU7aMmqWw2jMfPcyDmlmT+bNsOAis9v0aM6kb9R43+6eA4E+WfsR5v7o1Ccrx
 xl9x1nZs3h0CbDEsoaQG16lm4fnMJz7lMZhphmI+LH+AzsXLP3bEWXQ+ixjjudHg
 f1zQfG3Uma5+PlnnrLGAD1YNqs9ZCugPwzh2qwi2Q61YRl9fsTUZRXjI/NX06CS5
 nkl9CcxyyQQucNqADG1ajIZhbV0gPeSC/jOwQ5Zg/7lVi7y15kZqml3ZhBpU6GBO
 ZkokdncfjMf/ZBJj5yPs91V4+0QMp44XFjubdy9hk4807ugbKpErFg0x0MNz3T8h
 O9bz5zYoYC53ALKJTD92gS5hZw2gziTq/Ov5KSdxyqFqt374l5Q=
 =wps+
 -----END PGP SIGNATURE-----

Merge tag 'cxl-fixes-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl

Pull Compute Express Link (CXL) fixes from Dave Jiang:
 "These fixes address a few issues in the CXL subsystem, including
  dealing with some bugs in the CXL EDAC and RAS drivers:

   - Fix return value of cxlctl_validate_set_features()

   - Fix min_scrub_cycle of a region miscaculation and add additional
     documentation

   - Fix potential memory leak issues for CXL EDAC

   - Fix CPER handler device confusion for CXL RAS

   - Fix using wrong repair type to check DRAM event record"

* tag 'cxl-fixes-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
  cxl/edac: Fix using wrong repair type to check dram event record
  cxl/ras: Fix CPER handler device confusion
  cxl/edac: Fix potential memory leak issues
  cxl/Documentation: Add more description about min/max scrub cycle
  cxl/edac: Fix the min_scrub_cycle of a region miscalculation
  cxl: fix return value in cxlctl_validate_set_features()
 2025-06-27 17:58:32 -07:00
Linus Torvalds
5683cd63a3 Crypto library fix for v6.16-rc4 
Fix a regression where the purgatory code sometimes fails to build.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCaF7e+xQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOKwB8AP0eDd9f+Zm/vM9V/4ekdcOWh/m5Lk/g
 LmNziU123T7ZGwEA/qUqiM6/eRU1F375XW6EhLtxbNico/4KOf7A0kkxlAc=
 =xjmX
 -----END PGP SIGNATURE-----

Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull crypto library fix from Eric Biggers:
 "Fix a regression where the purgatory code sometimes fails to build"

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  lib/crypto: sha256: Mark sha256_choose_blocks as __always_inline
 2025-06-27 17:32:30 -07:00
Dave Airlie
9fbceb37c9 Merge tag 'drm-misc-fixes-2025-06-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes 
drm-misc-fixes for v6.16-rc4:
- Fix function signature of drm_writeback_connector_cleanup.
- Use correct HDMI audio bridge in drm_connector_hdmi_audio_init.
- Make HPD work on SN65DSI86.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://lore.kernel.org/r/3dd1d5e1-73b6-4b0c-a208-f7d6235cf530@linux.intel.com
 2025-06-28 06:53:00 +10:00
Edward Adam Davis
6921d1e07c tracing: Fix filter logic error 
If the processing of the tr->events loop fails, the filter that has been
added to filter_head will be released twice in free_filter_list(&head->rcu)
and __free_filter(filter).

After adding the filter of tr->events, add the filter to the filter_head
process to avoid triggering uaf.

Link: https://lore.kernel.org/tencent_4EF87A626D702F816CD0951CE956EC32CD0A@qq.com
Fixes: a9d0aab5eb ("tracing: Fix regression of filter waiting a long time on RCU synchronization")
Reported-by: syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=daba72c4af9915e9c894
Tested-by: syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
 2025-06-27 15:51:36 -04:00
Linus Torvalds
35e261cd95 ACPI fix for 6.16-rc4 
Revert a commit that attempted to fix a memory leak in an error code
 path and introduced a different issue (Zhe Qiao).
 -----BEGIN PGP SIGNATURE-----
 
 iQFFBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmhe40QSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1PtAH+Ick60JqU5I4Ff4r2ES0Ph/HQUd9agwN
 cF0wzZ0wnt55Xq6ADh7JtYcGjFCIoqFDmcp4vj6vuFjuW92lULT01fU8ELV3Ix3h
 u/zL0gwfYogy1a76AO6cSz9ltljFzwlwL4sUkhAapOapf3hq9C4f7TqYm9Zlo6n4
 UGXujN9+5yKqoR0LgyApN5zz9MuNq08rAH+/qdoizM/kzKC3ehXUinYLodEohnCF
 cs6D673538AAlSJItjLjjxZK2ZCCeR2B2C82/v+lz0AXGCqOXWY0ozhqxld79YjZ
 0KtZtgEBl0ahyDBsSG4qnsUXp90eTBLZ+18gsYZSb4eRL+wpuS9WTg==
 =PXSv
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "Revert a commit that attempted to fix a memory leak in an error code
  path and introduced a different issue (Zhe Qiao)"

* tag 'acpi-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()"
 2025-06-27 12:08:36 -07:00
Linus Torvalds
e540341508 block-6.16-20250626 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmhd4zsQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpmZgEACOk81RNf8WGNQf4/parSENzebWNj9W+fKD
 RDhWxwBAquT2VzkF8Iu6wbteVbP9A8yq4BagbD079OWrr0iV8NgWA5y1GyqdER6N
 upe2ZtBlY7RR4F1FerpSGqRBbhWYejNojSr073ea8mmx5Yl0BbHz5aKKmzWGbUYO
 lveYPgCeL4dD7kfPeINiamhicLudyAGdqqYpG+/wriefwaVhTgCe+4aQ6pEwftRT
 utqCzrpUnxrmXS4TFXiWd4u3iVNwPhzcMyUrgkK1yTM7mWIqp8QyHzfF4Acbh/T3
 RN/8d5OCfYmamlRvDUCl3FXWukkdGtBrA4m51mhUIzRJ9Np9IiSHdd2UTDgGqSeG
 2NSjLtmdDQvtVXeuqBs56os7e3DFx42LZuceqbGWaTQ4VC4QE+Xz+n2ZENx/hWFZ
 /lixcIBdxt6iqjveJuBJeXW6UqaR+Hz4hpSigZU69DMQzrKm65bSoMdOvyn5b0bU
 GtlPusSnfgpsSe/H41Lm7SLBePiGXMJvhujzlkWW5cnUUl+yRUQhTO206kQJkbV1
 XUMs8Syow15gjQaXI9KiAq+MMUuUwOvXmptMyYQ1NjFy16yzhJ8QOhJilJLWfLdT
 SqsLyXn1kG2EdcPmXHJRthIgVmQ+uORy2JB1wAomyjJj9a16wJYhgCGDjrl4mocl
 9LpjfnyMsA==
 =ln4w
 -----END PGP SIGNATURE-----

Merge tag 'block-6.16-20250626' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

 - Fixes for ublk:
      - fix C++ narrowing warnings in the uapi header
      - update/improve UBLK_F_SUPPORT_ZERO_COPY comment in uapi header
      - fix for the ublk ->queue_rqs() implementation, limiting a batch
        to just the specific task AND ring
      - ublk_get_data() error handling fix
      - sanity check more arguments in ublk_ctrl_add_dev()
      - selftest addition

 - NVMe pull request via Christoph:
      - reset delayed remove_work after reconnect
      - fix atomic write size validation

 - Fix for a warning introduced in bdev_count_inflight_rw() in this
   merge window

* tag 'block-6.16-20250626' of git://git.kernel.dk/linux:
  block: fix false warning in bdev_count_inflight_rw()
  ublk: sanity check add_dev input for underflow
  nvme: fix atomic write size validation
  nvme: refactor the atomic write unit detection
  nvme: reset delayed remove_work after reconnect
  ublk: setup ublk_io correctly in case of ublk_get_data() failure
  ublk: update UBLK_F_SUPPORT_ZERO_COPY comment in UAPI header
  ublk: fix narrowing warnings in UAPI header
  selftests: ublk: don't take same backing file for more than one ublk devices
  ublk: build batch from IOs in same io_ring_ctx and io task
 2025-06-27 09:02:33 -07:00
Linus Torvalds
0a47e02d8a io_uring-6.16-20250626 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmhd4xwQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgph6UEACRarJ4kKnkjN3EtYWZRzoYRXHAPd3U5s/9
 ySh02Gzr/C2mb6N6eMVKlYKiJ+wj1zajfGtu7ng/i3mIZ2NNF4RDAlkvFntwUiZN
 CDAnRmLIroHnGsYRPGHGbBCqVPC1/LAbWef4B/QQy/lmzvZlXKe68FsAbreXosXJ
 zyP6lH/Ce9MbZdXfnr4OSZxkc/RhF1gRgt0X2AaHnFLGRYqG/W2GXLnbby1E5clQ
 Y7JdZ2W4qdpECYr3Qe7XJXkWYSNdFw8JJA89IfRM/iK0xlexOH4HJ78Rk9Czf8k2
 WHHYBZMLDWwmaa31Zr3tsgvDfD2g8kZJp+ZTf8bB6720rzRNAqPLA7u5mW5lAwKi
 MK+iYnlVRQU4zzhGZPkpgUvgd5s6b+7lRCvIOEXTj6ETqfll6NRXWWTwusNzZDul
 Z2ffFWFHtSMgeO5A5dm4BK3t1qFbBC+odQzQyccLdH0H7DLPx34js8hqDwN6yWPL
 Z/VRFBJo2k4SrJiVbuLLDQoJ20J2NOm6VMuFWSIg5yi/V9kIxnI8ge8cbC0GoVUz
 DzsInjGb5Jjb3KKdPfhUmtu+FmNKcv4JlguUG7MyfYWyHr9kqWsGel1AkKDsWdra
 d6sqEum4F3UzdAjbCJPG71q/9avtio98IuaDXXKAAmd8gL1DCZ0QZEYV8c/A8n4M
 fXmdKG3Xqw==
 =BUYz
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.16-20250626' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:

 - Two tweaks for a recent fix: fixing a memory leak if multiple iovecs
   were initially mapped but only the first was used and hence turned
   into a UBUF rathan than an IOVEC iterator, and catching a case where
   a retry would be done even if the previous segment wasn't full

 - Small series fixing an issue making the vm unhappy if debugging is
   turned on, hitting a VM_BUG_ON_PAGE()

 - Fix a resource leak in io_import_dmabuf() in the error handling case,
   which is a regression in this merge window

 - Mark fallocate as needing to be write serialized, as is already done
   for truncate and buffered writes

* tag 'io_uring-6.16-20250626' of git://git.kernel.dk/linux:
  io_uring/kbuf: flag partial buffer mappings
  io_uring/net: mark iov as dynamically allocated even for single segments
  io_uring: fix resource leak in io_import_dmabuf()
  io_uring: don't assume uaddr alignment in io_vec_fill_bvec
  io_uring/rsrc: don't rely on user vaddr alignment
  io_uring/rsrc: fix folio unpinning
  io_uring: make fallocate be hashed work
 2025-06-27 08:55:57 -07:00
Linus Torvalds
9c7331f150 ata fix for 6.16-rc4 
- Use the correct DMI identifier for ASUSPRO-D840SA LPM quirk such that
    the quirk actually gets applied (me)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCaF5uegAKCRDJZDGjmcZN
 cix5AQC/MZLYzUOAiuXlAc1it8obVJRekQMM036sk4xPw+uQQgD/d4kq+K+a8GOx
 dvMCSjzIgMAg3r24Hp981aya1VRSHQk=
 =sjR9
 -----END PGP SIGNATURE-----

Merge tag 'ata-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fix from Niklas Cassel:

 - Use the correct DMI identifier for ASUSPRO-D840SA LPM quirk such that
   the quirk actually gets applied (me)

* tag 'ata-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
 2025-06-27 08:30:37 -07:00
Linus Torvalds
51df97f900 s390 fixes for 6.16-rc4 
- Fix incorrectly dropped dereferencing of the stack nth entry
   introduced with a previous KASAN false positive fix
 
 - Use a proper memdup_array_user() helper to prevent overflow
   in a protected key size calculation
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCaF1tnRccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8LQXAP47ZqfoOoWig2uO3j2JuEOLF7fo
 9Pvp1593fgpX1+BlowEAw6zRb1KF4hRcuOI/9rUD2AE6Xjh/xTE6qa7hR8GHHgA=
 =Q5GY
 -----END PGP SIGNATURE-----

Merge tag 's390-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Alexander Gordeev:

 - Fix incorrectly dropped dereferencing of the stack nth entry
   introduced with a previous KASAN false positive fix

 - Use a proper memdup_array_user() helper to prevent overflow in a
   protected key size calculation

* tag 's390-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth()
  s390/pkey: Prevent overflow in size calculation for memdup_user()
 2025-06-27 08:26:25 -07:00
Linus Torvalds
9c2f970518 sound fixes for 6.16-rc4 
A collection of small fixes again:
 - A regression fix for hibernation bug in ASoC SoundWire
 - Fixes for the new Qualcomm USB offload stuff
 - A potential OOB access fix in USB-audio
 - A potential memleadk fix in ASoC Intel
 - Quirks for HD-audio and ASoC AMD ACP
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmheUOQOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE9RTQ/8DKVcs3Z4HB3b3FUHtyRphxm3SR2STPgKlIzK
 vRU+T4BG4LoDl0ElrFBMXVS+XqePc9fwUlWYVfgMVCY2ZfAs2HrSZwbs/NUBORRn
 /0hQV047w7LleMs712J5X2asbtKty77TM5P8m+CiwlOgirc/FI0ah2dX5rux+giJ
 vkVGywOzTBToVk1lVJWBZ2n4scsV9hPRcMx1tQxaSpMMHyu6kmau4RWy7tL2d0LT
 mf1lVrSIlIfzcUEGDnZjFcmaPqoqxWbyY91U1gh6VN4BmMYIv3ywk+n9ZN+N//WX
 bQaRUTBkR/qHxIyz7OsDSpZG7F258Cet7XuNpF2iRbRtAWW91trtoKrNFYhBMa2j
 qzvBw9MXeP/QRxMk46lLzKoAM+dOUp7J5pHzaGm3f4WnPBB2AjulEOnKcN/nTJV8
 /kM6Sx228xZ5GKBRxhWN4KC9XyGPq5Aq5FNpE1xyyQ8wbtcaGq6M6woL+9btRja3
 fuxQhhkRMa9MpmwDuF6i5RGpr959PlG1VMfyUmKaCNIrpMEsBtxAEdeYn1LqClM9
 d4WgGjxc1Mbj2V9GSc35SLvd9M+lI8F112nlCmQEaSyx9md5jbzv1JF3v0twc4HL
 rGVevA6sjHjS1vmEEzsh17QcENVf1ifXhTjOuKavyG0SMWpcVxXRlOye6jankjEw
 Qbi0JQI=
 =Sv2/
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes again:

   - A regression fix for hibernation bug in ASoC SoundWire

   - Fixes for the new Qualcomm USB offload stuff

   - A potential OOB access fix in USB-audio

   - A potential memleadk fix in ASoC Intel

   - Quirks for HD-audio and ASoC AMD ACP"

* tag 'sound-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
  ALSA: usb: qcom: fix NULL pointer dereference in qmi_stop_session
  ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
  ASoC: rt721-sdca: fix boost gain calculation error
  ALSA: qc_audio_offload: Fix missing error code in prepare_qmi_response()
  ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
  ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
  ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 6 G1a
  ASoC: amd: ps: fix for soundwire failures during hibernation exit sequence
  ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
  ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
  ASoC: qcom: sm8250: Fix possibly undefined reference
  ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
  ALSA: hda/realtek: Add quirks for some Clevo laptops
 2025-06-27 08:21:05 -07:00
Dave Chinner
7b5f775be1 xfs: fix unmount hang with unflushable inodes stuck in the AIL 
Unmount of a shutdown filesystem can hang with stale inode cluster
buffers in the AIL like so:

[95964.140623] Call Trace:
[95964.144641]  __schedule+0x699/0xb70
[95964.154003]  schedule+0x64/0xd0
[95964.156851]  xfs_ail_push_all_sync+0x9b/0xf0
[95964.164816]  xfs_unmount_flush_inodes+0x41/0x70
[95964.168698]  xfs_unmountfs+0x7f/0x170
[95964.171846]  xfs_fs_put_super+0x3b/0x90
[95964.175216]  generic_shutdown_super+0x77/0x160
[95964.178060]  kill_block_super+0x1b/0x40
[95964.180553]  xfs_kill_sb+0x12/0x30
[95964.182796]  deactivate_locked_super+0x38/0x100
[95964.185735]  deactivate_super+0x41/0x50
[95964.188245]  cleanup_mnt+0x9f/0x160
[95964.190519]  __cleanup_mnt+0x12/0x20
[95964.192899]  task_work_run+0x89/0xb0
[95964.195221]  resume_user_mode_work+0x4f/0x60
[95964.197931]  syscall_exit_to_user_mode+0x76/0xb0
[95964.201003]  do_syscall_64+0x74/0x130

$ pstree -N mnt |grep umount
	     |-check-parallel---nsexec---run_test.sh---753---umount

It always seems to be generic/753 that triggers this, and repeating
a quick group test run triggers it every 10-15 iterations. Hence it
generally triggers once up every 30-40 minutes of test time. just
running generic/753 by itself or concurrently with a limited group
of tests doesn't reproduce this issue at all.

Tracing on a hung system shows the AIL repeating every 50ms a log
force followed by an attempt to push pinned, aborted inodes from the
AIL (trimmed for brevity):

 xfs_log_force:   lsn 0x1c caller xfsaild+0x18e
 xfs_log_force:   lsn 0x0 caller xlog_cil_flush+0xbd
 xfs_log_force:   lsn 0x1c caller xfs_log_force+0x77
 xfs_ail_pinned:  lip 0xffff88826014afa0 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED
 xfs_ail_pinned:  lip 0xffff88814000a708 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED
 xfs_ail_pinned:  lip 0xffff88810b850c80 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED
 xfs_ail_pinned:  lip 0xffff88810b850af0 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED
 xfs_ail_pinned:  lip 0xffff888165cf0a28 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED
 xfs_ail_pinned:  lip 0xffff88810b850bb8 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED
 ....

The inode log items are marked as aborted, which means that either:

a) a transaction commit has occurred, seen an error or shutdown, and
called xfs_trans_free_items() to abort the items. This should happen
before any pinning of log items occurs.

or

b) a dirty transaction has been cancelled. This should also happen
before any pinning of log items occurs.

or

c) AIL insertion at journal IO completion is marked as aborted. In
this case, the log item is pinned by the CIL until journal IO
completes and hence needs to be unpinned. This is then done after
the ->iop_committed() callback is run, so the pin count should be
balanced correctly.

Yet none of these seemed to be occurring. Further tracing indicated
this:

d) Shutdown during CIL pushing resulting in log item completion
being called from checkpoint abort processing. Items are unpinned
and released without serialisation against each other, journal IO
completion or transaction commit completion.

In this case, we may still have a transaction commit in flight that
holds a reference to a xfs_buf_log_item (BLI) after CIL insertion.
e.g. a synchronous transaction will flush the CIL before the
transaction is torn down.  The concurrent CIL push then aborts
insertion it and drops the commit/AIL reference to the BLI. This can
leave the transaction commit context with the last reference to the
BLI which is dropped here:

xfs_trans_free_items()
  ->iop_release
    xfs_buf_item_release
      xfs_buf_item_put
        if (XFS_LI_ABORTED)
	  xfs_trans_ail_delete
	xfs_buf_item_relse()

Unlike the journal completion ->iop_unpin path, this path does not
run stale buffer completion process when it drops the last
reference, hence leaving the stale inodes attached to the buffer
sitting the AIL. There are no other references to those inodes, so
there is no other mechanism to remove them from the AIL. Hence
unmount hangs.

The buffer lock context for stale buffers is passed to the last BLI
reference. This is normally the last BLI unpin on journal IO
completion. The unpin then processes the stale buffer completion and
releases the buffer lock.  However, if the final unpin from journal
IO completion (or CIL push abort) does not hold the last reference
to the BLI, there -must- still be a transaction context that
references the BLI, and so that context must perform the stale
buffer completion processing before the buffer is unlocked and the
BLI torn down.

The fix for this is to rework the xfs_buf_item_relse() path to run
stale buffer completion processing if it drops the last reference to
the BLI. We still hold the buffer locked, so the buffer owner and
lock context is the same as if we passed the BLI and buffer to the
->iop_unpin() context to finish stale process on journal commit.

However, we have to be careful here. In a shutdown state, we can be
freeing dirty BLIs from xfs_buf_item_put() via xfs_trans_brelse()
and xfs_trans_bdetach().  The existing code handles this case by
considering shutdown state as "aborted", but in doing so
largely masks the failure to clean up stale BLI state from the
xfs_buf_item_relse() path. i.e  regardless of the shutdown state and
whether the item is in the AIL, we must finish the stale buffer
cleanup if we are are dropping the last BLI reference from the
->iop_relse path in transaction commit context.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:14:37 +02:00
Dave Chinner
816c330b60 xfs: factor out stale buffer item completion 
The stale buffer item completion handling is currently only done
from BLI unpinning. We need to perform this function from where-ever
the last reference to the BLI is dropped, so first we need to
factor this code out into a helper.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:14:37 +02:00
Dave Chinner
d2fe5c4c8d xfs: rearrange code in xfs_buf_item.c 
The code to initialise, release and free items is all the way down
the bottom of the file. Upcoming fixes need to these functions
earlier in the file, so move them to the top.

There is one code change in this move - the parameter to
xfs_buf_item_relse() is changed from the xfs_buf to the
xfs_buf_log_item - the thing that the function is releasing.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:14:37 +02:00
Dave Chinner
fc48627b9c xfs: add tracepoints for stale pinned inode state debug 
I needed more insight into how stale inodes were getting stuck on
the AIL after a forced shutdown when running fsstress. These are the
tracepoints I added for that purpose.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:14:37 +02:00
Dave Chinner
d62016b1a2 xfs: avoid dquot buffer pin deadlock 
On shutdown when quotas are enabled, the shutdown can deadlock
trying to unpin the dquot buffer buf_log_item like so:

[ 3319.483590] task:kworker/20:0H   state:D stack:14360 pid:1962230 tgid:1962230 ppid:2      task_flags:0x4208060 flags:0x00004000
[ 3319.493966] Workqueue: xfs-log/dm-6 xlog_ioend_work
[ 3319.498458] Call Trace:
[ 3319.500800]  <TASK>
[ 3319.502809]  __schedule+0x699/0xb70
[ 3319.512672]  schedule+0x64/0xd0
[ 3319.515573]  schedule_timeout+0x30/0xf0
[ 3319.528125]  __down_common+0xc3/0x200
[ 3319.531488]  __down+0x1d/0x30
[ 3319.534186]  down+0x48/0x50
[ 3319.540501]  xfs_buf_lock+0x3d/0xe0
[ 3319.543609]  xfs_buf_item_unpin+0x85/0x1b0
[ 3319.547248]  xlog_cil_committed+0x289/0x570
[ 3319.571411]  xlog_cil_process_committed+0x6d/0x90
[ 3319.575590]  xlog_state_shutdown_callbacks+0x52/0x110
[ 3319.580017]  xlog_force_shutdown+0x169/0x1a0
[ 3319.583780]  xlog_ioend_work+0x7c/0xb0
[ 3319.587049]  process_scheduled_works+0x1d6/0x400
[ 3319.591127]  worker_thread+0x202/0x2e0
[ 3319.594452]  kthread+0x20c/0x240

The CIL push has seen the deadlock, so it has aborted the push and
is running CIL checkpoint completion to abort all the items in the
checkpoint. This calls ->iop_unpin(remove = true) to clean up the
log items in the checkpoint.

When a buffer log item is unpined like this, it needs to lock the
buffer to run io completion to correctly fail the buffer and run all
the required completions to fail attached log items as well. In this
case, the attempt to lock the buffer on unpin is hanging because the
buffer is already locked.

I suspected a leaked XFS_BLI_HOLD state because of XFS_BLI_STALE
handling changes I was testing, so I went looking for
pin events on HOLD buffers and unpin events on locked buffer. That
isolated this one buffer with these two events:

xfs_buf_item_pin:     dev 251:6 daddr 0xa910 bbcount 0x2 hold 2 pincount 0 lock 0 flags DONE|KMEM recur 0 refcount 1 bliflags HOLD|DIRTY|LOGGED liflags DIRTY
....
xfs_buf_item_unpin:   dev 251:6 daddr 0xa910 bbcount 0x2 hold 4 pincount 1 lock 0 flags DONE|KMEM recur 0 refcount 1 bliflags DIRTY liflags ABORTED

Firstly, bbcount = 0x2, which means it is not a single sector
structure. That rules out every xfs_trans_bhold() case except one:
dquot buffers.

Then hung task dumping gave this trace:

[ 3197.312078] task:fsync-tester    state:D stack:12080 pid:2051125 tgid:2051125 ppid:1643233 task_flags:0x400000 flags:0x00004002
[ 3197.323007] Call Trace:
[ 3197.325581]  <TASK>
[ 3197.327727]  __schedule+0x699/0xb70
[ 3197.334582]  schedule+0x64/0xd0
[ 3197.337672]  schedule_timeout+0x30/0xf0
[ 3197.350139]  wait_for_completion+0xbd/0x180
[ 3197.354235]  __flush_workqueue+0xef/0x4e0
[ 3197.362229]  xlog_cil_force_seq+0xa0/0x300
[ 3197.374447]  xfs_log_force+0x77/0x230
[ 3197.378015]  xfs_qm_dqunpin_wait+0x49/0xf0
[ 3197.382010]  xfs_qm_dqflush+0x55/0x460
[ 3197.385663]  xfs_qm_dquot_isolate+0x29e/0x4d0
[ 3197.389977]  __list_lru_walk_one+0x141/0x220
[ 3197.398867]  list_lru_walk_one+0x10/0x20
[ 3197.402713]  xfs_qm_shrink_scan+0x6a/0x100
[ 3197.406699]  do_shrink_slab+0x18a/0x350
[ 3197.410512]  shrink_slab+0xf7/0x430
[ 3197.413967]  drop_slab+0x97/0xf0
[ 3197.417121]  drop_caches_sysctl_handler+0x59/0xc0
[ 3197.421654]  proc_sys_call_handler+0x18b/0x280
[ 3197.426050]  proc_sys_write+0x13/0x20
[ 3197.429750]  vfs_write+0x2b8/0x3e0
[ 3197.438532]  ksys_write+0x7e/0xf0
[ 3197.441742]  __x64_sys_write+0x1b/0x30
[ 3197.445363]  x64_sys_call+0x2c72/0x2f60
[ 3197.449044]  do_syscall_64+0x6c/0x140
[ 3197.456341]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Yup, another test run by check-parallel is running drop_caches
concurrently and the dquot shrinker for the hung filesystem is
running. That's trying to flush a dirty dquot from reclaim context,
and it waiting on a log force to complete. xfs_qm_dqflush is called
with the dquot buffer held locked, and so we've called
xfs_log_force() with that buffer locked.

Now the log force is waiting for a workqueue flush to complete, and
that workqueue flush is waiting of CIL checkpoint processing to
finish.

The CIL checkpoint processing is aborting all the log items it has,
and that requires locking aborted buffers to cancel them.

Now, normally this isn't a problem if we are issuing a log force
to unpin an object, because the ->iop_unpin() method wakes pin
waiters first. That results in the pin waiter finishing off whatever
it was doing, dropping the lock and then xfs_buf_item_unpin() can
lock the buffer and fail it.

However, xfs_qm_dqflush() is waiting on the -dquot- unpin event, not
the dquot buffer unpin event, and so it never gets woken and so does
not drop the buffer lock.

Inodes do not have this problem, as they can only be written from
one spot (->iop_push) whilst dquots can be written from multiple
places (memory reclaim, ->iop_push, xfs_dq_dqpurge, and quotacheck).

The reason that the dquot buffer has an attached buffer log item is
that it has been recently allocated. Initialisation of the dquot
buffer logs the buffer directly, thereby pinning it in memory. We
then modify the dquot in a separate operation, and have memory
reclaim racing with a shutdown and we trigger this deadlock.

check-parallel reproduces this reliably on 1kB FSB filesystems with
quota enabled because it does all of these things concurrently
without having to explicitly write tests to exercise these corner
case conditions.

xfs_qm_dquot_logitem_push() doesn't have this deadlock because it
checks if the dquot is pinned before locking the dquot buffer and
skipping it if it is pinned. This means the xfs_qm_dqunpin_wait()
log force in xfs_qm_dqflush() never triggers and we unlock the
buffer safely allowing a concurrent shutdown to fail the buffer
appropriately.

xfs_qm_dqpurge() could have this problem as it is called from
quotacheck and we might have allocated dquot buffers when recording
the quota updates. This can be fixed by calling
xfs_qm_dqunpin_wait() before we lock the dquot buffer. Because we
hold the dquot locked, nothing will be able to add to the pin count
between the unpin_wait and the dqflush callout, so this now makes
xfs_qm_dqpurge() safe against this race.

xfs_qm_dquot_isolate() can also be fixed this same way but, quite
frankly, we shouldn't be doing IO in memory reclaim context. If the
dquot is pinned or dirty, simply rotate it and let memory reclaim
come back to it later, same as we do for inodes.

This then gets rid of the nasty issue in xfs_qm_flush_one() where
quotacheck writeback races with memory reclaim flushing the dquots.
We can lift xfs_qm_dqunpin_wait() up into this code, then get rid of
the "can't get the dqflush lock" buffer write to cycle the dqlfush
lock and enable it to be flushed again.  checking if the dquot is
pinned and returning -EAGAIN so that the dquot walk will revisit the
dquot again later.

Finally, with xfs_qm_dqunpin_wait() lifted into all the callers,
we can remove it from the xfs_qm_dqflush() code.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:14:37 +02:00
Dave Chinner
db6a227416 xfs: catch stale AGF/AGF metadata 
There is a race condition that can trigger in dmflakey fstests that
can result in asserts in xfs_ialloc_read_agi() and
xfs_alloc_read_agf() firing. The asserts look like this:

 XFS: Assertion failed: pag->pagf_freeblks == be32_to_cpu(agf->agf_freeblks), file: fs/xfs/libxfs/xfs_alloc.c, line: 3440
.....
 Call Trace:
  <TASK>
  xfs_alloc_read_agf+0x2ad/0x3a0
  xfs_alloc_fix_freelist+0x280/0x720
  xfs_alloc_vextent_prepare_ag+0x42/0x120
  xfs_alloc_vextent_iterate_ags+0x67/0x260
  xfs_alloc_vextent_start_ag+0xe4/0x1c0
  xfs_bmapi_allocate+0x6fe/0xc90
  xfs_bmapi_convert_delalloc+0x338/0x560
  xfs_map_blocks+0x354/0x580
  iomap_writepages+0x52b/0xa70
  xfs_vm_writepages+0xd7/0x100
  do_writepages+0xe1/0x2c0
  __writeback_single_inode+0x44/0x340
  writeback_sb_inodes+0x2d0/0x570
  __writeback_inodes_wb+0x9c/0xf0
  wb_writeback+0x139/0x2d0
  wb_workfn+0x23e/0x4c0
  process_scheduled_works+0x1d4/0x400
  worker_thread+0x234/0x2e0
  kthread+0x147/0x170
  ret_from_fork+0x3e/0x50
  ret_from_fork_asm+0x1a/0x30

I've seen the AGI variant from scrub running on the filesysetm
after unmount failed due to systemd interference:

 XFS: Assertion failed: pag->pagi_freecount == be32_to_cpu(agi->agi_freecount) || xfs_is_shutdown(pag->pag_mount), file: fs/xfs/libxfs/xfs_ialloc.c, line: 2804
.....
 Call Trace:
  <TASK>
  xfs_ialloc_read_agi+0xee/0x150
  xchk_perag_drain_and_lock+0x7d/0x240
  xchk_ag_init+0x34/0x90
  xchk_inode_xref+0x7b/0x220
  xchk_inode+0x14d/0x180
  xfs_scrub_metadata+0x2e2/0x510
  xfs_ioc_scrub_metadata+0x62/0xb0
  xfs_file_ioctl+0x446/0xbf0
  __se_sys_ioctl+0x6f/0xc0
  __x64_sys_ioctl+0x1d/0x30
  x64_sys_call+0x1879/0x2ee0
  do_syscall_64+0x68/0x130
  ? exc_page_fault+0x62/0xc0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Essentially, it is the same problem. When _flakey_drop_and_remount()
loads the drop-writes table, it makes all writes silently fail. Writes
are reported to the fs as completed successfully, but they are not
issued to the backing store. The filesystem sees the successful
write completion and marks the metadata buffer clean and removes it
from the AIL.

If this happens at the same time as memory pressure is occuring,
the now-clean AGF and/or AGI buffers can be reclaimed from memory.

Shortly afterwards, but before _flakey_drop_and_remount() runs
unmount, background writeback is kicked and it tries to allocate
blocks for the dirty pages in memory. This then tries to access the
AGF buffer we just turfed out of memory. It's not found, so it gets
read in from disk.

This is all fine, except for the fact that the last writeback of the
AGF did not actually reach disk. The AGF on disk is stale compared
to the in-memory state held by the perag, and so they don't match
and the assert fires.

Then other operations on that inode hang because the task was killed
whilst holding inode locks. e.g:

 Workqueue: xfs-conv/dm-12 xfs_end_io
 Call Trace:
  <TASK>
  __schedule+0x650/0xb10
  schedule+0x6d/0xf0
  schedule_preempt_disabled+0x15/0x30
  rwsem_down_write_slowpath+0x31a/0x5f0
  down_write+0x43/0x60
  xfs_ilock+0x1a8/0x210
  xfs_trans_alloc_inode+0x9c/0x240
  xfs_iomap_write_unwritten+0xe3/0x300
  xfs_end_ioend+0x90/0x130
  xfs_end_io+0xce/0x100
  process_scheduled_works+0x1d4/0x400
  worker_thread+0x234/0x2e0
  kthread+0x147/0x170
  ret_from_fork+0x3e/0x50
  ret_from_fork_asm+0x1a/0x30
  </TASK>

and it's all down hill from there.

Memory pressure is one way to trigger this, another is to run "echo
3 > /proc/sys/vm/drop_caches" randomly while tests are running.

Regardless of how it is triggered, this effectively takes down the
system once umount hangs because it's holding a sb->s_umount lock
exclusive and now every sync(1) call gets stuck on it.

Fix this by replacing the asserts with a corruption detection check
and a shutdown.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:13:34 +02:00
Dave Chinner
09234a632b xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock 
Lock order of xfs_ifree_cluster() is cluster buffer -> try ILOCK
-> IFLUSHING, except for the last inode in the cluster that is
triggering the free. In that case, the lock order is ILOCK ->
cluster buffer -> IFLUSHING.

xfs_iflush_cluster() uses cluster buffer -> try ILOCK -> IFLUSHING,
so this can safely run concurrently with xfs_ifree_cluster().

xfs_inode_item_precommit() uses ILOCK -> cluster buffer, but this
cannot race with xfs_ifree_cluster() so being in a different order
will not trigger a deadlock.

xfs_reclaim_inode() during a filesystem shutdown uses ILOCK ->
IFLUSHING -> cluster buffer via xfs_iflush_shutdown_abort(), and
this deadlocks against xfs_ifree_cluster() like so:

 sysrq: Show Blocked State
 task:kworker/10:37   state:D stack:12560 pid:276182 tgid:276182 ppid:2      flags:0x00004000
 Workqueue: xfs-inodegc/dm-3 xfs_inodegc_worker
 Call Trace:
  <TASK>
  __schedule+0x650/0xb10
  schedule+0x6d/0xf0
  schedule_timeout+0x8b/0x180
  schedule_timeout_uninterruptible+0x1e/0x30
  xfs_ifree+0x326/0x730
  xfs_inactive_ifree+0xcb/0x230
  xfs_inactive+0x2c8/0x380
  xfs_inodegc_worker+0xaa/0x180
  process_scheduled_works+0x1d4/0x400
  worker_thread+0x234/0x2e0
  kthread+0x147/0x170
  ret_from_fork+0x3e/0x50
  ret_from_fork_asm+0x1a/0x30
  </TASK>
 task:fsync-tester    state:D stack:12160 pid:2255943 tgid:2255943 ppid:3988702 flags:0x00004006
 Call Trace:
  <TASK>
  __schedule+0x650/0xb10
  schedule+0x6d/0xf0
  schedule_timeout+0x31/0x180
  __down_common+0xbe/0x1f0
  __down+0x1d/0x30
  down+0x48/0x50
  xfs_buf_lock+0x3d/0xe0
  xfs_iflush_shutdown_abort+0x51/0x1e0
  xfs_icwalk_ag+0x386/0x690
  xfs_reclaim_inodes_nr+0x114/0x160
  xfs_fs_free_cached_objects+0x19/0x20
  super_cache_scan+0x17b/0x1a0
  do_shrink_slab+0x180/0x350
  shrink_slab+0xf8/0x430
  drop_slab+0x97/0xf0
  drop_caches_sysctl_handler+0x59/0xc0
  proc_sys_call_handler+0x189/0x280
  proc_sys_write+0x13/0x20
  vfs_write+0x33d/0x3f0
  ksys_write+0x7c/0xf0
  __x64_sys_write+0x1b/0x30
  x64_sys_call+0x271d/0x2ee0
  do_syscall_64+0x68/0x130
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

We can't change the lock order of xfs_ifree_cluster() - XFS_ISTALE
and XFS_IFLUSHING are serialised through to journal IO completion
by the cluster buffer lock being held.

There's quite a few asserts in the code that check that XFS_ISTALE
does not occur out of sync with buffer locking (e.g. in
xfs_iflush_cluster). There's also a dependency on the inode log item
being removed from the buffer before XFS_IFLUSHING is cleared, also
with asserts that trigger on this.

Further, we don't have a requirement for the inode to be locked when
completing or aborting inode flushing because all the inode state
updates are serialised by holding the cluster buffer lock across the
IO to completion.

We can't check for XFS_IRECLAIM in xfs_ifree_mark_inode_stale() and
skip the inode, because there is no guarantee that the inode will be
reclaimed. Hence it *must* be marked XFS_ISTALE regardless of
whether reclaim is preparing to free that inode. Similarly, we can't
check for IFLUSHING before locking the inode because that would
result in dirty inodes not being marked with ISTALE in the event of
racing with XFS_IRECLAIM.

Hence we have to address this issue from the xfs_reclaim_inode()
side. It is clear that we cannot hold the inode locked here when
calling xfs_iflush_shutdown_abort() because it is the inode->buffer
lock order that causes the deadlock against xfs_ifree_cluster().

Hence we need to drop the ILOCK before aborting the inode in the
shutdown case. Once we've aborted the inode, we can grab the ILOCK
again and then immediately reclaim it as it is now guaranteed to be
clean.

Note that dropping the ILOCK in xfs_reclaim_inode() means that it
can now be locked by xfs_ifree_mark_inode_stale() and seen whilst in
this state. This is safe because we have left the XFS_IFLUSHING flag
on the inode and so xfs_ifree_mark_inode_stale() will simply set
XFS_ISTALE and move to the next inode. An ASSERT check in this path
needs to be tweaked to take into account this new shutdown
interaction.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 2025-06-27 14:08:39 +02:00
Johannes Berg
f40213cd93 i2c: scx200_acb: depends on HAS_IOPORT 
It already depends on X86_32, but that's also set for ARCH=um.
Recent changes made UML no longer have IO port access since
it's not needed, but this driver uses it. Build it only for
HAS_IOPORT. This is pretty much the same as depending on X86,
but on the off-chance that HAS_IOPORT will ever be optional
on x86 HAS_IOPORT is the real prerequisite.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
 2025-06-27 12:28:33 +02:00
Bibo Mao
955853cf83 LoongArch: KVM: Disable updating of "num_cpu" and "feature" 
Property "num_cpu" and "feature" are read-only once eiointc is created,
which are set with KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL attr group before
device creation.

Attr group KVM_DEV_LOONGARCH_EXTIOI_GRP_SW_STATUS is to update register
and software state for migration and reset usage, property "num_cpu" and
"feature" can not be update again if it is created already.

Here discard write operation with property "num_cpu" and "feature" in
attr group KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL.

Cc: stable@vger.kernel.org
Fixes: 1ad7efa552 ("LoongArch: KVM: Add EIOINTC user mode read and write functions")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2025-06-27 18:27:44 +08:00
Bibo Mao
cc8d5b209e LoongArch: KVM: Check validity of "num_cpu" from user space 
The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about
irqchip EIOINTC, here add validation about cpu number to avoid array
pointer overflow.

Cc: stable@vger.kernel.org
Fixes: 1ad7efa552 ("LoongArch: KVM: Add EIOINTC user mode read and write functions")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2025-06-27 18:27:44 +08:00
Bibo Mao
45515c643d LoongArch: KVM: Check interrupt route from physical CPU 
With EIOINTC interrupt controller, physical CPU ID is set for irq route.
However the function kvm_get_vcpu() is used to get destination vCPU when
delivering irq. With API kvm_get_vcpu(), the logical CPU ID is used.

With API kvm_get_vcpu_by_cpuid(), vCPU ID can be searched from physical
CPU ID.

Cc: stable@vger.kernel.org
Fixes: 3956a52bc0 ("LoongArch: KVM: Add EIOINTC read and write functions")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2025-06-27 18:27:44 +08:00