Commit Graph

53163 Commits

Author SHA1 Message Date
Daehyeon Ko
cdd812d068
exit: hold a reference to thread_pid across proc_flush_pid
Commit 0a36bad017 ("release_task: kill the no longer needed
get/put_pid(thread_pid)") removed the reference around proc_flush_pid().
It assumed that free_pids(post.pids) at the end of release_task() would
keep thread_pid alive until then.

That assumption is wrong.  __change_pid() only records a detached PID in
post.pids when pid_has_task() is false for every PIDTYPE.  If another task
still uses the exiting task's PID as its process group or session ID,
__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves
the PID out of post.pids.  release_task() therefore holds no reference to
it after dropping tasklist_lock.

The other task can then remove the remaining PIDTYPE links.  Its
free_pids() call schedules delayed_put_pid(), and the RCU callback can free
the PID before the first release_task() reaches proc_flush_pid().

An unprivileged reproducer races wait4(-1) against setsid() to trigger this
ordering.  Three of three fresh v7.2 KASAN boots reported:

    BUG: KASAN: slab-use-after-free in
    proc_invalidate_siblings_dcache+0x3e2/0x3f0
    Read of size 8 by task h7_pid_reaper/1921

    Call Trace:
     proc_invalidate_siblings_dcache
     release_task
     wait_consider_task
     __do_wait
     do_wait
     kernel_wait4

    Freed by task 0:
     kmem_cache_free
     put_pid
     delayed_put_pid
     rcu_core

    Last potentially related work creation:
     __call_rcu_common
     free_pids
     ksys_setsid

KASAN identified a 144-byte object from the pid cache and located the bad
read 80 bytes into the freed object, matching pid->inodes.  With an
explicit reference, three of three fresh boots completed without a KASAN
report.  The concurrent RCU callback dropped its reference while
proc_flush_pid() was protected, and the balancing put_pid() performed the
final free afterward.

Take a reference before __unhash_process() clears p->thread_pid and release
it after proc_flush_pid() completes.

A tested source reproducer is available privately on request.  No
controlled read or write, information leak, or privilege escalation is
claimed.  The mainline patch applies directly to v6.19.y and newer;
v6.16.y through v6.18.y need a context-adjusted backport.

Fixes: 0a36bad017 ("release_task: kill the no longer needed get/put_pid(thread_pid)")
Reported-by: syzbot+0aee5e8066eddbbe7397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0aee5e8066eddbbe7397
Reported-by: syzbot+e8b3520b53e78e90034e@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=e8b3520b53e78e90034e
Cc: stable@vger.kernel.org # see patch description, needs adjustments for 6.16.y-6.18.y
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260831001221.3755948-1-4ncienth@gmail.com
Acked-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-04 11:40:27 +02:00
Cen Zhang (Microsoft)
5a88f78df7
reboot: fix cad_pid use-after-free race
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().

At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.

Original KASAN crash stack:
  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

Fixes: 9ec52099e4 ("[PATCH] replace cad_pid by a struct pid")
Reported-by: AutonomousCodeSecurity@microsoft.com
Closes: https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/
Link: https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/
Link: https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/
Suggested-by: Mateusz Guzik <mjguzik@gmail.com>
Suggested-by: Bradley Morgan <include@grrlz.net>
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Suggested-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: stable@vger.kernel.org
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Link: https://patch.msgid.link/20260814040944.16561-1-blbllhy@gmail.com
Reviewed-by: Bradley Morgan <include@grrlz.net>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-31 10:25:46 +02:00
Linus Torvalds
ed3b875bea mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
 
 Total patches:       501
 Reviews/patch:       1.66
 Reviewed rate:       70%
 
 Excluding DAMON:
 
 Total patches:       356
 Reviews/patch:       2.26
 Reviewed rate:       90%
 
 Excluding DAMON and selftests:
 
 Total patches:       329
 Reviews/patch:       2.31
 Reviewed rate:       92%
 
 Excluding DAMON, selftests and maple_tree:
 
 Total patches:       328
 Reviews/patch:       2.31
 Reviewed rate:       92%
 
 Summary of patch series in this merge:
 
 - The 2 patch series "mm: drop "sub" prefix from various places" from
   Dev Jain implements some page->folio conversion and a naming cleanup.
 
 - The 2 patch series "mm/kasan: remove redundant initialization for
   kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
 
 - The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
   from Chi Zhiling provides a small speedup in the pagecaache read code.
 
 - The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
   recursion" from Kaitao Cheng improves a few things in the vmalloc code -
   mainly the avoidance of GFP_KERNEL allocations when the caller asked for
   GFP_NOFS or GFP_NOIO.
 
 - The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
   stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
   kmemleak scanning code in extreme situations.
 
 - The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
   collection of unrelated cleanups to the page_owner code.  For some
   reason lots of people have been working on the page_owner code this
   cycle.
 
 - The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
   find_vma()" from Kefeng Wang simplifies and accelerates the page walking
   library function.
 
 - The 3 patch series "mm/migrate: preparatory cleanups for batch copy
   and offload" from Shivank Garg implements cleanups in the migration
   code.
 
 - The 4 patch series "mm/page_owner: add per-fd filter infrastructure
   for print_mode and NUMA filtering" from Zhen Ni provides per-fd
   filtering to page_owner in order to reduce the sometimes vast amount of
   output it can produce.
 
 - The 19 patch series "mm: Refactor bootmem gigantic hugepage
   allocation" from Muchun Song is a "set of fixes and preparatory cleanups
   around bootmem HugeTLB handling, sparse initialization ordering, and
   related vmemmap setup".
 
 - The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
   from Wenchao Hao reduces lock contention in zs_free(), which dominates
   the unmap path under memory pressure on Android (LMK kills) and on x86
   servers running zswap-heavy workloads.  Up to 1.83x improvement in
   microbenchmarking.
 
 - The 2 patch series "move alloc_tag.c file under mm/" from Suren
   Baghdasaryan does that.
 
 - The 6 patch series "samples/damon: handle damon_{start,stop}()
   failures" from SJ Park fixes improper handling of damon_start(),
   damon_stop(), and damon_call() failures across DAMON sample modules to
   prevent potential memory leaks, operation disruptions and use-after-free
   bugs.
 
 - The 11 patch series "mm/damon/sysfs: kobject_del() directories that
   users can create/remove" from SJ Park resolves an issue where delayed
   sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
   creation failures due to duplicate directory names by adding missing
   kobject_del() calls before creating new directories.
 
 - The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
   David Hildenbrand cleans up the core pte handling code.
 
 - The 3 patch series "selftests/damon: misc fixes for test bugs" from
   Kunwu Chan fixes several bugs in the DAMON selftests.
 
 - The 2 patch series "selftests/damon: fix memcg_path staging handling"
   from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
   memcg_path setup, and adds a test case for it in sysfs.py.
 
 - The 2 patch series "selftests/damon: test kdamond refresh_ms" from
   Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
   feature by updating the test control module and verifying that scheme
   stats update automatically without manual intervention.
 
 - The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
   contains miscellaneous DAMON fixups.
 
 - The 2 patch series "mm/damon/core: detect internal variation above
   max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
   behavior when region counts exceed half the maximum budget by
   dynamically scaling down the split fraction as the limit approaches,
   preventing large regions from staying un-split, and adds corresponding
   KUnit test coverage.
 
 - The 6 patch series "mm: preparatory patches for PMD level swap
   entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
   call sites, and architecture flags to lay the groundwork for a follow-up
   series that introduces PMD page table swap entries.
 
 - The 11 patch series "mm/damon: update, optimize, and clean up doc,
   tests, and code" from SJ Park updates DAMON design and ABI
   documentation, expands unit and selftest coverage, optimizes
   damon_commit_target_regions(), and cleans up recently added sysfs
   interface code for better readability.
 
 - The 2 patch series "mm/vmpressure: reduce CPU, memory and code
   overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
   skipping unnecessary work on cgroup v2 for userspace event notifications
   and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
   memory overhead and code complexity.
 
 - The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
   error handling" from Hongfu Li refactors pkeys shared tracing and
   assertion helpers into a common file, unifies protection key selftests
   to use consistent diagnostic logging and assertions, and enforces
   standardized MAP_FAILED return checks for mmap() calls across the tests.
 
 - The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
   Park replaces the error-prone, continuously updated nr_accesses_bp field
   in damon_region with an on-demand moving sum function
   (damon_nr_accesses_mvsum()), reducing structure memory overhead and
   avoiding state corruption bugs.
 
 - The 6 patch series "Open HugeTLB allocation routine for more generic
   use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
   dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
   like guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs.
 
 - The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
   from SJ Park integrates DAMON's probe_hits attribute counter into the
   pseudo moving sum infrastructure, enabling real-time, online monitoring
   without waiting for full aggregation intervals.
 
 - The 18 patch series "mm: Some cleanups for page allocator APIs" from
   Brendan Jackman simplifies and refactors the page allocator entry points
   and flags by unifying allocation paths, adding internal alloc_flags
   arguments, and eliminating redundant __ prefixed alloc_pages variants.
 
 - The 5 patch series "Fix incorrect access of hugetlb pte entries" from
   Dev Jain enforces the consistent use of huge_ptep_get() instead of
   ptep_get() for HugeTLB entries and fixes an unaligned address issue in
   arm64's huge_ptep_get() implementation.
 
 - The 8 patch series "mm/damon: validate all parameters in the core"
   from SJ Park consolidates parameter validation into the DAMON core
   specifically within damon_start() and damon_commit_ctx() to centralize
   error checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency.
 
 - The 3 patch series "tools/mm/page_owner_sort: fix filtering and
   cleanup issues" from Yichong Chen renames is_need() to filter_record()
   for clearer return semantics, fixes per-record allocation memory leaks
   and bounds output copies in search_pattern() to address an existing
   buffer issue.
 
 - The 4 patch series "memcg: bail out reclaim when memcg is dying" from
   Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
   removed while one of its memory control files is doing synchronous
   reclaim.
 
 - The 5 patch series "mm/memory-failure: add panic option for
   unrecoverable pages" from Breno Leitao introduces an opt-in
   vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
   the kernel on unrecoverable memory errors in kernel-owned pages to
   preserve error context and prevent delayed, silent data corruption.
 
 - The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
   for simple error handling" from SJ Park refactors the DAMON core API
   functions to guarantee that all contexts are fully stopped when
   damon_start(), damon_stop(), or damon_commit() fail, eliminating the
   need for complex and error-prone caller-side cleanup code.
 
 - The 5 patch series "Keep tail page private zero at free and folio
   split" from Zi Yan adds checks to ensure tail_page->private is zero when
   freeing compound or high-order pages and when promoting tail pages
   during large folio splits.  By validating these fields at free and split
   time, it allows the removal of redundant private field clearing inside
   prep_compound_tail().
 
 - The 4 patch series "mm: drop redundant lru_add_drain in anon folio
   reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
   in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead.
 
   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads.
 
 - The 3 patch series "mm: clean up folio LRU and swap declarations" from
   Jianyue Wu reorganizes folio LRU and swap code by relocating
   page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
   and moving MM-internal reclaim declarations into mm/internal.h.
 
 - The 15 patch series "userfaultfd: working set tracking for VM guest
   memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
   working set of VM guest memory, so a VMM can identify hot pages and
   reclaim cold ones to tiered or remote storage.
 
 - The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
   2)" from David Hildenbrand removes the remaining pieces of
   CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
   freeing of reserved vmemmap pages on the way.
 
 - The 7 patch series "mm/damon: update probe hits for runtime parameter
   commits" from SJ Park ensures that DAMON's probe_hits attribute counter
   is properly updated when monitoring intervals are changed at runtime,
   matching the behavior of nr_accesses.  To achieve this, it refactors and
   renames existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.
 
 - The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
   from xu xin resolves a severe KSM reverse-mapping performance bottleneck
   where thousands of split VMAs sharing a single anon_vma cause extended
   lock contention.  By adding an interval-filtering check during the rmap
   walk, it reduces worst-case anon_vma lock hold times from over 500ms
   down to under 2ms, preventing application freezes and latency spikes
   under memory pressure.
 
 - The 3 patch series "mm: split a couple of headers from internal.h"
   from Mike Rapoport splits declarations related to mm_init, memblock,
   vmalloc and sparse into new headers.
 
 - The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
   from xu xin applies the interval tree optimization from rmap_walk_ksm()
   to collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.  It hoists loop-invariant address
   initialization and restricts the anon_vma_interval_tree_foreach walk to
   a targeted page offset range, reducing redundant checks and improving
   lookup efficiency.
 
 - The 3 patch series "selftests/mm: avoid false failures in hugetlb and
   KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
   selftest categories that can report failures when the prerequisites for
   the tests are not satisfied.
 
 - The 19 patch series "mm/damon: introduce data attributes only
   monitoring" from SJ Park introduces attribute-weighted region management
   in DAMON, allowing users to prioritize specific data attributes (such as
   page sizes or cgroups) over or instead of access monitoring.
 
   By assigning weights to attribute probes, DAMON can completely disable
   access tracking and adjust monitoring regions based on weighted
   probe-hit counters to optimize monitoring quality for attribute-focused
   workloads.
 
 - The 8 patch series "mm/hmm: Add mmap lock-drop support for
   userfaultfd-backed mappings" from Stanislav Kinsburskii extends
   hmm_range_fault() to support userfaultfd-backed regions by allowing the
   mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.
 
   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd regions
   while preserving backward compatibility for existing callers.
 
 - The 33 patch series "mm: make VMA page offset handling more
   consistent" from Lorenzo Stoakes cleans up and standardizes how
   vma->vm_pgoff is accessed and manipulated across file-backed and
   anonymous mappings in the kernel.
 
   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
   rmap interval tree helpers to better reflect their functionality.
 
   These changes establish a cleaner foundation for future work that will
   unify virtual page offset indexing for all anonymous and CoW'd folios.
 
 - The 3 patch series "mm: handle device-private PMDs in walk callbacks"
   from Usama Arif addresses kernel panics and state corruption caused by
   MM walk callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations.
 
   It ensures that functions which acquire pmd_trans_huge_lock() properly
   recognize device-private PMDs instead of assuming a present THP or a
   standard migration entry.
 
 - The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
   refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
   and anonymous-swapbacked logic into dedicated functions, laying the
   structural groundwork for batched anonymous large folio unmapping.
 
 - The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
   additions" from Song Hu fixes typos and fills in missing entries in the
   DAMON sysfs ABI document.
 
 - The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
   from Gregory Price introduces an atomic sysfs state attribute and
   supporting DAX/MM infrastructure to prevent userland races when
   offlining and removing entire memory regions.
 
   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.
 
 - The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
   from Lorenzo Stoakes continues transitioning the kernel from the
   deprecated vm_flags_t type to vma_flags_t across core memory management
   infrastructure.
 
   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.
 
 - The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
   xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
   duplicate slot deletion sequences in khugepaged and KSM.  It also adds
   code documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.
 
 - The 10 patch series "mm/damon/core: hide core-private struct fields"
   from SJ Park cleans up DAMON core structures by consistently marking
   internal-only fields with private: comment tags to prevent improper
   direct access from outer layers.
 
   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.
 
 - The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
   de-ref and races" from SJ Park addresses potential infinite loops, NULL
   dereferences, and race conditions identified in DAMON.
 
   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.
 
 - The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
   RT/UP" from Brendan Jackman fixes an NMI safety flaw in
   __free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
   kernels can bypass can_spin_trylock() checks via non-PCP or isolated
   migration paths.
 
   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.
 
 - The 4 patch series "mm/page_alloc: couple of followups for recent
   cleanups" from Brendan Jackman cleans up and updates page allocator
   nomenclature, documentation, and debug assertions.
 
   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
   assertions in allocation paths.
 
 - The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
   refactors and simplifies the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.
 
   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
   mm_struct parameters to enforce that sealing applies only to
   current->mm, and streamlines overall logic and comments with no
   functional changes intended.
 
 - The 4 patch series "mm/vmscan: fix swappiness=max and clean up
   per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
   bugs and cleans up function parameters across memory reclaim paths.
 
   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead of
   collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
   parameter from __node_reclaim().
 
 - The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
   cleans up and simplifies the mincore code.  Most importantly, it removes
   the historical special behavior that always reports VM_PFNMAP pages as
   non-resident.
 
 - The 2 patch series "mm/huge_memory: drop dead split helper variants"
   from Kiryl Shutsemau implements two trivial cleanups in the folio split
   API.
 
 - The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
   exec expectation bugs" from SJ Park resolves minor operational and
   testing bugs in DAMON identified by Sashiko.  It initializes the
   damos->last_applied field to prevent occasional efficiency degradation
   and fixes invalid memory accesses in DAMON KUnit tests during test
   failure handling.
 
 - The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
   cleans up and refactors stable_page_flags() used by /proc/kpageflags
   without altering functionality.
 
   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
 
 - The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
   extends batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
   to pte_install_uffd_wp_if_needed().
 
   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.
 
 - The 3 patch series "mm/early_ioremap: clarify and clean up
   early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
   architecture-specific usage of __late_set_fixmap() and
   __late_clear_fixmap() after early_ioremap_reset().
 
   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset calls
   in the RISC-V and ARM64 architectures.
 
 - The 4 patch series "mm: fix reclaim storms in defrag_mode" from
   Johannes Weiner addresses severe performance regressions, swap storms,
   and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
   in Meta production.
 
   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.
 
 - The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
   optimizes and fixes lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolating lock classes across multiple instances.
 
   It reduces memory overhead by replacing per-entry lockdep_map instances
   with a single map per struct zram, and assigns a dynamic lock_class_key
   to each instance to prevent false deadlock reports when different zram
   devices are backed by distinct filesystems.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
 jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
 THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
 =QTyb
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

 - "mm: drop "sub" prefix from various places" (Dev Jain)

   page->folio conversion and a naming cleanup

 - "mm/kasan: remove redundant initialization for kasan_flag_write_only"
   (Igor Putko)

   KASAN cleanup work

 - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)

   Small speedup in the pagecaache read code

 - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)

   Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
   allocations when the caller asked for GFP_NOFS or GFP_NOIO

 - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
   Leitao)

   Avoid a soft lockup watchdog trigger from the kmemleak scanning code
   in extreme situations

 - "mm/page_owner: misc cleanups" (Ye Liu)

   Cleanups to the page_owner code. For some reason lots of people have
   been working on the page_owner code this cycle.

 - "mm: convert to walk_page_range_vma() to eliminate find_vma()"
   (Kefeng Wang)

   Simplify and accelerate the page walking library function

 - "mm/migrate: preparatory cleanups for batch copy and offload"
   (Shivank Garg)

   Cleanups in the migration code

 - "mm/page_owner: add per-fd filter infrastructure for print_mode and
   NUMA filtering" (Zhen Ni)

   Per-fd filtering to page_owner in order to reduce the sometimes vast
   amount of output it can produce

 - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)

   Fixes and preparatory cleanups around bootmem HugeTLB handling,
   sparse initialization ordering, and related vmemmap setup

 - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)

   Reduce lock contention in zs_free(), which dominates the unmap path
   under memory pressure on Android (LMK kills) and on x86 servers
   running zswap-heavy workloads.

   Up to 1.83x improvement in microbenchmarking.

 - "move alloc_tag.c file under mm/" (Suren Baghdasaryan)

 - "samples/damon: handle damon_{start,stop}() failures" (SJ Park)

   Fix improper handling of damon_start(), damon_stop(), and
   damon_call() failures across DAMON sample modules to prevent
   potential memory leaks, operation disruptions and use-after-free
   bugs

 - "mm/damon/sysfs: kobject_del() directories that users can
   create/remove" (SJ Park)

   Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
   causeing creation failures due to duplicate directory names by adding
   missing kobject_del() calls before creating new directories

 - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)

   Clean up the core pte handling code

 - "selftests/damon: misc fixes for test bugs" (Kunwu Chan)

   Fix several bugs in the DAMON selftests

 - "selftests/damon: fix memcg_path staging handling" (Cheng Nie)

   Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
   add a test case for it in sysfs.py.

 - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)

   Selftest coverage for DAMON's refresh_ms sysfs feature by updating
   the test control module and verifying that scheme stats update
   automatically without manual intervention

 - "mm/damon: five misc fixups" (Akinobu Mita)

   Miscellaneous DAMON fixups.

 - "mm/damon/core: detect internal variation above max_nr_regions/2"
   (Jiayuan Chen)

   Fix DAMON's region splitting behavior when region counts exceed half
   the maximum budget by dynamically scaling down the split fraction as
   the limit approaches, preventing large regions from staying un-split,
   and add corresponding KUnit test coverage

 - "mm: preparatory patches for PMD level swap entries" (Usama Arif)

   Refactor and clean up PMD softleaf helpers, call sites, and
   architecture flags to lay the groundwork for a follow-up series that
   introduces PMD page table swap entries

 - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
   Park)

   Update DAMON design and ABI documentation, expands unit and selftest
   coverage, optimize damon_commit_target_regions(), and clean up
   recently added sysfs interface code for better readability

 - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
   (Usama Arif)

   Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
   userspace event notifications and refactor v1-only eventfd handling
   into mm/memcontrol-v1.c to reduce memory overhead and code complexity

 - "selftests/mm: refactor pkey helpers and fix mmap error handling"
   (Hongfu Li)

   Refactor pkeys shared tracing and assertion helpers into a common
   file, unify protection key selftests to use consistent diagnostic
   logging and assertions, and enforce standardized MAP_FAILED return
   checks for mmap() calls across the tests

 - "mm/damon: optimize out nr_accesses_bp" (SJ Park)

   Replace the error-prone, continuously updated nr_accesses_bp field in
   damon_region with an on-demand moving sum function, reducing
   structure memory overhead and avoiding state corruption bugs

 - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)

   Decouple HugeTLB folio allocation from VMA dependencies by
   introducing hugetlb_alloc_folio(), enabling subsystems like
   guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs

 - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)

   Integrate DAMON's probe_hits attribute counter into the pseudo moving
   sum infrastructure, enabling real-time, online monitoring without
   waiting for full aggregation intervals

 - "mm: Some cleanups for page allocator APIs" (Brendan Jackman)

   Simplify and refactor the page allocator entry points and flags by
   unifying allocation paths, adding internal alloc_flags arguments, and
   eliminating redundant __ prefixed alloc_pages variants.

 - "Fix incorrect access of hugetlb pte entries" (Dev Jain)

   Enforce the consistent use of huge_ptep_get() instead of ptep_get()
   for HugeTLB entries and fixes an unaligned address issue in arm64's
   huge_ptep_get() implementation

 - "mm/damon: validate all parameters in the core" (SJ Park)

   Consolidate parameter validation into the DAMON core specifically
   within damon_start() and damon_commit_ctx() to centralize error
   checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency

 - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
   Chen)

   Rename is_need() to filter_record() for clearer return semantics, fix
   per-record allocation memory leaks and bound output copies in
   search_pattern() to address an existing buffer issue

 - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)

   Mitigate a system-wide stall which occurs when a cgroup is removed
   while one of its memory control files is doing synchronous reclaim

 - "mm/memory-failure: add panic option for unrecoverable pages" (Breno
   Leitao)

   Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
   that immediately panics the kernel on unrecoverable memory errors in
   kernel-owned pages to preserve error context and prevent delayed,
   silent data corruption

 - "mm/damon: refactor damon_{start,stop,commit}() for simple error
   handling" (SJ Park)

   Refactor the DAMON core API functions to guarantee that all contexts
   are fully stopped when damon_start(), damon_stop(), or damon_commit()
   fail, eliminating the need for complex and error-prone caller-side
   cleanup code

 - "Keep tail page private zero at free and folio split" (Zi Yan)

   Add checks to ensure tail_page->private is zero when freeing compound
   or high-order pages and when promoting tail pages during large folio
   splits. By validating these fields at free and split time, it allows
   the removal of redundant private field clearing inside
   prep_compound_tail()

 - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
   Song)

   Eliminate redundant lru_add_drain() calls in
   wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead

   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads

 - "mm: clean up folio LRU and swap declarations" (Jianyue Wu)

   Reorganize folio LRU and swap code by relocating page-cluster state
   to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
   MM-internal reclaim declarations into mm/internal.h.

 - "userfaultfd: working set tracking for VM guest memory" (Kiryl
   Shutsemau)

   Add userfaultfd support for tracking the working set of VM guest
   memory, so a VMM can identify hot pages and reclaim cold ones to
   tiered or remote storage

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
   Hildenbrand)

   Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   performing some smaller cleanups around freeing of reserved vmemmap
   pages on the way.

 - "mm/damon: update probe hits for runtime parameter commits" (SJ Park)

   Ensure that DAMON's probe_hits attribute counter is properly updated
   when monitoring intervals are changed at runtime, matching the
   behavior of nr_accesses. To achieve this, it refactors and renames
   existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.

 - "KSM: performance optimizations for rmap_walk_ksm" (xu xin)

   Resolve a severe KSM reverse-mapping performance bottleneck where
   thousands of split VMAs sharing a single anon_vma cause extended lock
   contention.

   By adding an interval-filtering check during the rmap walk, it
   reduces worst-case anon_vma lock hold times from over 500ms down to
   under 2ms, preventing application freezes and latency spikes under
   memory pressure.

 - "mm: split a couple of headers from internal.h" (Mike Rapoport)

   Split declarations related to mm_init, memblock, vmalloc and sparse
   into new headers

 - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)

   Apply the interval tree optimization from rmap_walk_ksm() to
   collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.

   It hoists loop-invariant address initialization and restricts the
   anon_vma_interval_tree_foreach walk to a targeted page offset range,
   reducing redundant checks and improving lookup efficiency.

 - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
   Patil)

   Fix issues in the hugetlb and KSM MM selftest categories that can
   report failures when the prerequisites for the tests are not
   satisfied

 - "mm/damon: introduce data attributes only monitoring" (SJ Park)

   Introduce attribute-weighted region management in DAMON, allowing
   users to prioritize specific data attributes (such as page sizes or
   cgroups) over or instead of access monitoring.

   By assigning weights to attribute probes, DAMON can completely
   disable access tracking and adjust monitoring regions based on
   weighted probe-hit counters to optimize monitoring quality for
   attribute-focused workloads.

 - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
   (Stanislav Kinsburskii)

   Extend hmm_range_fault() to support userfaultfd-backed regions by
   allowing the mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.

   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd
   regions while preserving backward compatibility for existing callers.

 - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)

   Clean up and standardize how vma->vm_pgoff is accessed and
   manipulated across file-backed and anonymous mappings in the kernel

   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
   renaming rmap interval tree helpers to better reflect their
   functionality.

   These changes establish a cleaner foundation for future work that
   will unify virtual page offset indexing for all anonymous and CoW'd
   folios.

 - "mm: handle device-private PMDs in walk callbacks" (Usama Arif)

   Address kernel panics and state corruption caused by MM walk
   callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations

   It ensures that functions which acquire pmd_trans_huge_lock()
   properly recognize device-private PMDs instead of assuming a present
   THP or a standard migration entry.

 - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)

   Refactor try_to_unmap_one by modularizing Hugetlb,
   anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
   functions, laying the structural groundwork for batched anonymous
   large folio unmapping.

 - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)

   Fix typos and fills in missing entries in the DAMON sysfs ABI
   document

 - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)

   Introduce an atomic sysfs state attribute and supporting DAX/MM
   infrastructure to prevent userland races when offlining and removing
   entire memory regions

   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.

 - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)

   Continue transitioning the kernel from the deprecated vm_flags_t type
   to vma_flags_t across core memory management infrastructure.

   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.

 - "Two small patches to clean up mm/mm_slot.h" (xu xin)

   Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
   slot deletion sequences in khugepaged and KSM. It also adds code
   documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.

 - "mm/damon/core: hide core-private struct fields" (SJ Park)

   Clean up DAMON core structures by consistently marking internal-only
   fields with private: comment tags to prevent improper direct access
   from outer layers.

   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.

 - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
   (SJ Park)

   Address potential infinite loops, NULL dereferences, and race
   conditions identified in DAMON

   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.

 - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
   Jackman)

   Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
   on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
   via non-PCP or isolated migration paths.

   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.

 - "mm/page_alloc: couple of followups for recent cleanups" (Brendan
   Jackman)

   Clean up and update page allocator nomenclature, documentation, and
   debug assertions.

   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete
   VM_BUG_ON() assertions in allocation paths.

 - "mm/mseal: further cleanups" (Lorenzo Stoakes)

   Refactor and simplify the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.

   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
   eliminates mm_struct parameters to enforce that sealing applies only
   to current->mm, and streamlines overall logic and comments with no
   functional changes intended.

 - "mm/vmscan: fix swappiness=max and clean up per-node proactive
   reclaim" (Ridong Chen)

   Resolve reclaim behavior bugs and clean up function parameters across
   memory reclaim paths

   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead
   of collapsing all failures into -EAGAIN, and removes the obsolete
   gfp_mask parameter from __node_reclaim().

 - "mm: mincore: misc cleanups" (Kefeng Wang)

   Clean up and simplifies the mincore code. Most importantly, it
   removes the historical special behavior that always reports VM_PFNMAP
   pages as non-resident.

 - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)

   Two trivial cleanups in the folio split API

 - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
   bugs" (SJ Park)

   Resolve minor operational and testing bugs in DAMON identified by
   Sashiko. It initializes the damos->last_applied field to prevent
   occasional efficiency degradation and fixes invalid memory accesses
   in DAMON KUnit tests during test failure handling.

 - "cleanup for stable_page_flags()" (Jinjiang Tu)

   Clean up and refactor stable_page_flags() used by /proc/kpageflags
   without altering functionality.

   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.

 - "Batch unmap of uffd-wp file folios" (Dev Jain)

   Extend batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching
   capabilities to pte_install_uffd_wp_if_needed().

   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.

 - "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
   (Sang-Heon Jeon)

   Clarify and clean up the architecture-specific usage of
   __late_set_fixmap() and __late_clear_fixmap() after
   early_ioremap_reset()

   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset
   calls in the RISC-V and ARM64 architectures.

 - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)

   Address severe performance regressions, swap storms, and spurious
   OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
   production

   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.

 - "zram: lockmap tweaks" (Sebastian Siewior)

   Optimize and fix lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolate lock classes across multiple instances

   This reduces memory overhead by replacing per-entry lockdep_map
   instances with a single map per struct zram, and assigns a dynamic
   lock_class_key to each instance to prevent false deadlock reports
   when different zram devices are backed by distinct filesystems.

* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
  selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
  selftests/mm: unpoison pages in memory-failure teardown
  mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
  mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
  mm/zsmalloc: fix release order of locks in zs_page_migrate()
  Documentation: zram: remove sections numbering
  ksm: stop iterating VMAs when ksm_test_exit returns true
  mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
  mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
  zram: use a custom key for each zram object
  zram: move lockmap to be per-zram instead per table
  selftests/mm: fix gup_longterm EINVAL error message
  mm: page_alloc: fix non-movable reclaim storm in defrag_mode
  mm: page_alloc: move capture_control to the page allocator
  mm: compaction: support non-movable compaction for pageblock requests
  mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
  hugetlb: evaluate subpool free state while locked
  mm/damon: remove trailing semicolons after function definitions
  mm/damon/ops-common: prevent migration fallback to non-target nodes
  mm/damon: update outdated comment about DAMOS filter handling
  ...
2026-08-20 18:17:08 -07:00
Linus Torvalds
77ae27fd98 printk changes for 7.3
-----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmqFYyEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTyAlwP+gL59ZVbiHyzTRlVMetf
 6wYxjnM4B0Efe/BC/526sVZ0ZMvCaT8oNgRCUDYWEBmB1NWmxieQ2YEy5yg9N/3v
 nDgUenq7gdVLPzv+n3Xrb2ZqzsTssnP6iD/hi4S2uD2/1Bphu0f13K2yLHcgfsgR
 EKqj2y3bOR4b6Z2YyNWA3wcbbYHccIt1c6pM0t2IJi9L5gbncwfzqdG5qdsG/Ioi
 Vbd7CVyDTnPArrDNOMe19cvDNxuJcpogNUaAUjtCl2rWqSFFLC9w06LphrjmZ4L2
 lpS5C9VVPlsQVxAEoeYQ13v6glL1Iakj2nhKz/uDq5U0hMY5BxRKZNdh96aMEbhZ
 Yy4DtvmXOQsPBERzjYvMhIK92kTcLW/VgKyt5Ug62IL7r4P0xCtNvdFCRu28PISu
 pBzzwXcbiSPxVW5iXP/cR6NUsDrty3W3LHlkj1C1SE2RAnJk7XUQRjvpH5hgtzUM
 A5EDrAO+6MB/fUBzpC1YAwXBiNSZjrBQK9BReybfJA2yYLIrMz2C27+gz5PCAEp8
 brozPVQUN9KKL0ZY53mJ+De8x/U9KUtdr8ejVanrOjefVrWt/fzWwbii7UWrve72
 u2bfUQ3V4es9raS4BfVD1OiImkrQIBJQNNRX07o/MgWv7yrxAWBHDXQu3X1KkjpV
 4pKsBEI4s8/mTNkT/MiE6YAo
 =Uw8w
 -----END PGP SIGNATURE-----

Merge tag 'printk-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux

Pull printk updates from Petr Mladek:

 - Prevent a possible out-of-bound access and a use-after-free in rather
   theoretical situations

 - Make no_hash_pointers take effect early

 - Some fixes and clean up of the ratelimit KUnit test

* tag 'printk-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  printk: Handle pre-enabled consoles in the top-level register_console()
  printk: Fix possible console use-after-free
  lib/tests: test_ratelimit: fix stress test thread lifecycle and leak
  lib/vsprintf: Make no_hash_pointers take effect early
2026-08-20 15:34:31 -07:00
Linus Torvalds
6439079365 Probes updates for v7.3:
- probes: Advanced BTF typecasting and variable fetch enhancements
   . Typecast support across probe events: Extended BTF typecasting syntax
     (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and fprobes on
     function entry and return.
   . Nested typecasts: Added support for chaining and nesting typecasts up
     to 3 levels, including casting registers and stack variables.
   . Field specifier option: Added (STRUCT,FIELD) syntax to emulate
     container_of(), allowing retrieval of parent structures from member
     pointers.
   . $current variable support: Introduced $current special variable to
     access the running task_struct via BTF dereferencing.
   . Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr()
     fetcharg methods to trace CPU-local data safely.
   . Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG to
     dump the compiled fetcharg bytecode instructions as comments in
     dynamic_events.
   . Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN limit
     and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of long
     symbols, mangled Rust symbols and complex BTF expressions.
   . eprobe variable syntax: Allowed eprobes to reference event fields
     directly without requiring a '$' prefix.
   . Cleanup unused parameters, redundant codes, duplicate macros and
     pointer arithmetic.
   . Use a ternary operator for simplifying fetch_type_from_btf_type().
 
 - bootconfig / boottime-trace: Expanded dynamic probe support
   . Added boot-time tracing configuration support for event probes
     (eprobes), function probes (fprobes), and tracepoint probes
     (tprobes).
   . ftrace2bootconfig: Allowed comment lines ('#') in dynamic_events file.
 
 - fprobe / kprobe: Optimization, robustness, and cleanups
   . fprobe: Simplified fprobe_remove_ips() by reusing graph and ftrace
     helpers.
   . fprobe: Removed __packed attribute from struct __fprobe_header to avoid
     unaligned memory access penalties on RISC architectures.
   . kprobe & fprobe: Removed redundant memset() calls in perf event probe
     handlers.
   . kprobes: Replaced legacy __ASSEMBLY__ with __ASSEMBLER__ in header
     files.
 
 - selftests & refactoring:
   . Refactored parse_probe_arg() and parse_probe_vars(), and eliminated
     recursion in probe argument parsing to protect kernel stack depth.
   . Added selftests for BTF typecasts and module probing without module
     prefixes.
   . Forced LC_ALL=C in ftracetest to prevent test failures on localized
     systems.
   . Refactored btf_type_skip_modifiers() to remove ignored id parameter.
   . Sorted ERRORS list in trace_probe.h alphabetically.
   . Fixed typo in fprobe docs, and trace_fprobe function name.
   . Renamed FETCH_OP_DATA to FETCH_OP_IMMSTR.
   . Made file offset error message probe-agnostic.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqEbbEbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bpXsH/i61CqF8bt3/BNUG5qTV
 JP/j/Znl9utOq4+g01AeSt6tJREEp262w/b4ZwdXiu+Q41VYwyGazY93FxtX3rQC
 gcYnJcAGghzNUjf7ujI2VXDYa11t+GiYSR3Jv8hc/Xu7rq/ilExLObFwJfdhNZAb
 go7mC0x9TgRAyw/k/9ezwukBcXQUsuoBU3+IFvict9BrSVmvMPNFhCyvIi6Ps5Fj
 NldKTDAaWiKUOuIBDF1vXXSbHMoec31qNll/Ps4HG8RLpdrSWbW4nTOaazir2bbS
 RA6hUlVNwsYn7UN6x/taV2szojyAODDv1r6ULplCVjbsn5M0TcdmLFW8JUimaAIr
 wm0=
 =6KXI
 -----END PGP SIGNATURE-----

Merge tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes updates from Masami Hiramatsu:
 "BTF typecasting and variable fetch enhancements:

   - Typecast support across probe events: Extended BTF typecasting
     syntax (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and
     fprobes on function entry and return

   - Nested typecasts: Added support for chaining and nesting typecasts
     up to 3 levels, including casting registers and stack variables

   - Field specifier option: Added (STRUCT,FIELD) syntax to emulate
     container_of(), allowing retrieval of parent structures from member
     pointers

   - $current variable support: Introduced $current special variable to
     access the running task_struct via BTF dereferencing

   - Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr()
     fetcharg methods to trace CPU-local data safely

   - Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG
     to dump the compiled fetcharg bytecode instructions as comments in
     dynamic_events

   - Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN
     limit and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of
     long symbols, mangled Rust symbols and complex BTF expressions

   - eprobe variable syntax: Allowed eprobes to reference event fields
     directly without requiring a '$' prefix

   - Cleanup unused parameters, redundant codes, duplicate macros and
     pointer arithmetic

   - Use a ternary operator for simplifying fetch_type_from_btf_type()

  Expanded boot time dynamic probe support:

   - Add boot-time tracing configuration support for event probes
     (eprobes), function probes (fprobes), and tracepoint probes
     (tprobes)

   - Allow comment lines ('#') in dynamic_events file

  Optimization, robustness, and cleanups:

   - Simplify fprobe_remove_ips() by reusing graph and ftrace helpers

   - Remove __packed attribute from struct __fprobe_header to avoid
     unaligned memory access penalties on RISC architectures

   - Remove redundant memset() calls in perf event probe handlers

   - Replace legacy __ASSEMBLY__ with __ASSEMBLER__ in header files

  Selftests & refactoring:

   - Refactor parse_probe_arg() and parse_probe_vars(), and eliminate
     recursion in probe argument parsing to protect kernel stack depth

   - Add selftests for BTF typecasts and module probing without module
     prefixes

   - Force LC_ALL=C in ftracetest to prevent test failures on localized
     systems

   - Refactor btf_type_skip_modifiers() to remove ignored id parameter

   - Sort ERRORS list in trace_probe.h alphabetically

   - Fix typo in fprobe docs, and trace_fprobe function name

   - Rename FETCH_OP_DATA to FETCH_OP_IMMSTR

   - Make file offset error message probe-agnostic"

* tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (37 commits)
  fprobe: Simplify fprobe_remove_ips() by reusing existing helpers
  tracing/boot: Add support for eprobe, fprobe, and tprobe events
  selftests/ftrace: Force C locale in ftracetest
  tracing/probes: Treating longer symbol name on event comparation
  docs: trace: fprobe: fix 'thos' spelling
  tracing/probes: Fix extra whitespace in trace_probe_kernel.h
  tracing/kprobe: Remove redundant memset in kprobe_perf_func()
  tracing/fprobe: Remove redundant memset in fentry_perf_func()
  tracing/fprobe: Remove redundant snprintf in trace_fprobe_match_command_head()
  tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type()
  tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data()
  tracing/probes: Remove unused parameter from parse_probe_var_retval()
  tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type()
  tracing/probes: Remove redundant boolean conversion in trace_probe_has_single_file()
  tracing/probes: Remove duplicate MAX_ARRAY_LEN macro definition
  selftests/ftrace: Add test case for a symbol in a module without module name
  tracing/probes: Eliminate recursion in parse_probe_arg()
  tracing/probes: Extend max length of argument string
  tracing/probes: Sort ERRORS list in trace_probe.h alphabetically
  tracing/probes: Refactor parse_probe_arg()
  ...
2026-08-20 15:11:52 -07:00
Linus Torvalds
55ab7e1422 for-7.3/block-20260819
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqGD2AQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpomLD/9rr3SIQvdQRTnSCJlw1cFypSrnRhGAx1g8
 v1F7UXuf4Abt4GIerbdXmBTx9zZRctpcOC41ReQk3YKkYuukuvna+Z6tBGf5I5+e
 3SR3Zkrj2k4zyNC49g0/QkUJkTTS4tlsBFhNJtY3Q5BBIRMRd/sPvZ+cLnD7g/wH
 3zM9IaEMk9xu9mF1nGI7LRl1qY0IOr4ynQpqohl5sEL3TQWgIa0r2B0jhGacBAvC
 GGDwIwGDrM6oGwCn6mLN78O5odhLyTufIMNy3EnVw7BcDpLApcnJzYYjGzv+ElCM
 WLBJwWYj+PYeoenuJuFhbRihbOPg5gZT3Mn8CUhLxUYzwZvIdFGWOjcGffD9sVu/
 JO4nB6A+2AG/wgsb2YVKefhN86FoD0F/2hhdEdgZPJE6a+7+xeyyp9IzyQEWd0cg
 Seo06fxE4pwF+dczXT3jzU3LXSZb/Jbh9hzu163VMSWbGYDCpDzfipqZGeN6DWE7
 nG2NssAQtjtZrgdggYbZXtwecLZhu3cMj3jbhS4wSUzhQFW42yceJstCx4wpRhW9
 m9EXjHQnRFMAb2TjUC3FzEncjbxL+uACjcKhTetd1hLbTI5I8KArZXjam1OdJOHV
 urdtsru79LanQLAgRwWYPeKCZGNhX7I2o3OsmVDLQgHIDaZguTcPUVQs3wVui7Dk
 IDmmrtwzpg==
 =G1l4
 -----END PGP SIGNATURE-----

Merge tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block updates from Jens Axboe:

 - NVMe updates via Keith:
     - Enable Clang context analysis for the nvme host driver, adding
       context annotations across core, fabrics, rdma, tcp and pci
     - nvmet reservation state exposed through a new namespace-level
       debugfs directory, plus ABI documentation for the host sysfs and
       target configfs interfaces
     - nvme-tcp host memory disclosure fixes on the read path: reject a
       read that transferred too few bytes, don't accept C2HData based
       on blk_rq_payload_bytes() alone, and fix the R2T case for a read
       command
     - Parallelize nvme-rdma I/O queue allocation and startup (Surabhi)
     - Apple nvme fixes and quirks: page aligned admin queue buffers,
       destroy the admin queue on removal, and various DMA/NVMMU
       correctness fixes
     - A large pile of nvmet and host fixes for out-of-bounds reads,
       refcount/resource leaks, and NULL derefs across auth, zns,
       passthru, pci-epf, rdma and configfs
     - Various other fixes and cleanups

 - MD updates via Yu Kuai:
     - llbitmap reshape support, the large series wiring exact bitmap
       mapping and reshape lifecycle through raid5 and raid10, growing
       the page cache in place, and remapping checkpointed bits as
       reshape progresses
     - raid5 fixes for lockless max_nr_stripes and recovery_offset
       accesses, a reshape deadlock with more failed devices than max
       degraded, and bitmap batch counter consistency
     - Atomic write handling for raid1/raid10, and removal of the
       REQ_NOWAIT support from raid1/10/456
     - raid5-ppl use-after-free fix in ppl_do_flush()
     - A batch of smaller fixes across md core and the bitmap code

 - s390/dasd ESE full-track write support and the surrounding
   infrastructure, plus enabling CONTEXT_ANALYSIS for s390/block

 - RWF_DONTCACHE support for block devices, built on new task-context
   bio completion infrastructure, and wiring it up for the iomap and
   buffer dropbehind writeback paths

 - Async io_uring zone reset all, plus zone management command cleanups
   allowing REQ_NOWAIT and tightening conventional zone rejection

 - Block integrity refactoring: lift BIP_CHECK_FLAGS to the shared
   header, handle nogenerate/noverify properly in fs-integrity, and drop
   the blk-integrity.h include from bdev.c

 - Split out a new blk_plug.h header

 - ublk improvements: add UBLK_F_IO_DESC_SIZE, split request validation
   from io_desc init, reject non-power-of-2 zone sizes in SET_PARAMS,
   and a series of hardening fixes around map/unmap and auto buf reg

 - null_blk cleanups and configfs serialization fixes

 - nbd queue freeze removal on the setup paths, and a new
   pre_defined_connections module parameter for pre-created devices

 - blk-cgroup fixes for the race between policy activation and blkg
   destruction, and accounting per-cpu stats over possible CPUs across
   blk-stat, iolatency, iocost and kyber

 - Various dio fixes: leak on metadata mapping error, validate user
   space vectors during extraction, and set dma_alignment from the
   backing file for loop and zloop direct I/O

 - bio cleanups

 - Various other fixes and cleanups all over

* tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (241 commits)
  nbd: add pre_defined_connections module parameter for pre-created devices
  nbd: remove queue freeze for newly created nbd from netlink path
  nbd: factor out a nbd_genl_foreach_sock
  nbd: skip queue freeze when setting size at device startup
  nbd: remove queue freeze in nbd_add_socket
  nbd: clear queue limits on disconnect
  nbd: disallow NBD_SET_SOCK on an active device
  nbd: simplify find_fallback() by removing redundant logic
  blk-mq: add missing call to srcu_barrier() in blk_mq_free_tag_set()
  block: mtip32xx: synchronize ioctls with device removal
  ublk: avoid teardown retry loop on xarray allocation failure
  null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
  block: don't include blk-integrity.h in bdev.c
  xfs: avoid double deferrals for RWF_DONTCACHE writes
  loop: Fix recently introduced lock inversion
  block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
  swim3: Add missing MODULE_DESCRIPTION
  selftests: ublk: add SET_PARAMS validation test
  selftests: ublk: add helper for SET_PARAMS
  ublk: reject non-power-of-2 zone sizes in SET_PARAMS
  ...
2026-08-20 13:55:16 -07:00
Linus Torvalds
ae814200e8 bitmap updates for v7.3
- bitmap_find_next_zero_area_off() optimization (Sunyi);
  - bitmap_find_next_zero_area_off(): return size when no zero area is
    found (Yury);
  - bitmap vs IDA vs Maple Tree performance test (Yury);
  - get rid of cpumap_print_to_pagebuf() (Yury);
  - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing);
  - bitops: make the *_bit_le functions use unsigned long (Benjamin);
  - bitmap scatter & gather test fix (Christophe);
  - use __ASSEMBLER__ in bitmap header files (Thomas);
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEi8GdvG6xMhdgpu/4sUSA/TofvsgFAmqDX1YACgkQsUSA/Tof
 vsjcpwwAw7130xQPNFREr+ttdoUn3gN/aVUOl7K2Mi3kUOdlg8i9FEaQ/a07nE5L
 ozXRAWgSM7VxW1I7nkj5McsGRiRX0SRoXmTbjDfPugMiXbD1UBPqCz2n0rYHYR4P
 GfQ0RJK8LUN3Sq1eIu27HNirLG1HU1jCm3fsaTft2naaY6TnSPjklZdVE6Phz87E
 eblgm+AO8//EoKsggoMCnGVCVWKE3N1RrWzsaT4ltErGyHvIzvWEbCCk2cI764Qj
 orLLeefPf2xVDlbzywU7uUklNWYRe4miPxrbnT5TH2KmTipb3M62MkGjPa5dzYIq
 ssOvSnKoQEV9od9cNv1hPFGs5b+RO+kOolcrWKTqWeHFgVTv7dZZL0QvuGHeOfOa
 Fc5GPxE2SiXLPVuUEgMhlrg9DsXGf0d9u7JHTnJF+ZL/QhIE+4wOVnIYWUyBZiqx
 zF7Ic62xmeJOKz9kfYg9JQYPwUblhhyYtiWOmzLIisf8FXi5M3L9eH6rO6CEWcrk
 viEkTMbW
 =q8Lf
 -----END PGP SIGNATURE-----

Merge tag 'bitmap-for-7.3' of https://github.com/norov/linux

Pull bitmap updates from Yury Norov:
 "The usual set of fixes, cleanups and performance improvements together
  with a couple of new tests:

   - bitmap_find_next_zero_area_off() optimization (Sunyi)

   - bitmap_find_next_zero_area_off(): return size when no zero area is
     found (Yury)

   - bitmap vs IDA vs Maple Tree performance test (Yury)

   - get rid of cpumap_print_to_pagebuf() (Yury)

   - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing)

   - bitops: make the *_bit_le functions use unsigned long (Benjamin)

   - bitmap scatter & gather test fix (Christophe)

   - use __ASSEMBLER__ in bitmap header files (Thomas)"

* tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits)
  lib: test bitmap vs IDA vs Maple Tree performance for region allocations
  bitmap: Return size when no zero area is found
  media: s5p-mfc: Treat bitmap size as allocation failure
  crypto: ccp: Treat bitmap size as allocation failure
  powerpc/msi: Treat bitmap size as allocation failure
  ARM: dma-mapping: Treat bitmap size as allocation failure
  bitmap: drop bitmap_next_set_region()
  nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes()
  bitmap: Properly initialise destination bitmap for scatter & gather test
  lib/bitmap-str: get rid of cpumap_print_to_pagebuf()
  perf: Use sysfs_emit() for cpumask show callbacks
  PCI/sysfs: Use sysfs_emit() for cpumask show callbacks
  RDMA/hfi1: Use sysfs_emit() for cpumask show helper
  hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show
  fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show
  devfreq: Use sysfs_emit() for cpumask show callbacks
  cpu: Use sysfs_emit() for cpumask show callback
  x86/events: Use sysfs_emit() for cpumask show callbacks
  powerpc: Use sysfs_emit() for cpumask show callbacks
  arm: Use sysfs_emit() for cpumask show callbacks
  ...
2026-08-20 11:41:46 -07:00
Linus Torvalds
216b3f432a Kernel Concurrency Sanitizer (KCSAN) updates for v7.3
- Avoid unintended access checking in NMIs
 
 This change has had 3 weeks of linux-next exposure.
 -----BEGIN PGP SIGNATURE-----
 
 iIcEABYKAC8WIQR7t4b/75lzOR3l5rcxsLN3bbyLnwUCaoME4REcZWx2ZXJAZ29v
 Z2xlLmNvbQAKCRAxsLN3bbyLn2JYAQCHcMcgr9iqJGoqom0CdsnobYB5sa1l4mqm
 Tlok6vVVuQD6Aq8Vl7eOLrbq4XJkwSUMy4suyzv4ueNsOmcL7Qo2zAw=
 =nXoE
 -----END PGP SIGNATURE-----

Merge tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux

Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver:

 - Avoid unintended access checking in NMIs

* tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux:
  kcsan: avoid unintended access checking in NMIs
2026-08-20 11:32:27 -07:00
Linus Torvalds
11260c335e sched_ext: Changes for v7.3
This depends on the arena argument support in the BPF tree and should be
 pulled after the scheduler core and BPF pulls. The patches based on bpf-next
 were kept on a separate branch which was merged into for-7.3 just now. The
 same merged result was in linux-next for several days.
 
 Most of this cycle completes the enqueue-path support for hierarchical
 sub-scheduling, which makes sub-scheduler support feature complete: a root
 BPF scheduler can now hand a cgroup subtree over to a nested sub-scheduler
 together with revocable CPU grants, and the sub-scheduler owns all
 scheduling decisions for its tasks on those CPUs.
 
 Development volume was high and a number of changes plugging holes in the
 new support landed late in the cycle. Also included are core scheduling
 fixes that were completed too late for the v7.2 release and are routed
 through this pull request.
 
 - Sub-scheduler CPU delegation:
 
   - Parent schedulers now grant and revoke per-CPU capabilities (enqueueing,
     preemption, CPU frequency control) on their children, enforced on every
     path a scheduler can reach a CPU through. Previously only dispatching
     could be delegated; this lets sub-schedulers fully schedule their CPUs.
 
   - Rescue execution: a task whose scheduler doesn't have access to the CPUs
     the task needs to run on starved until the watchdog ejected the whole
     scheduler. The kernel now runs such tasks directly on a small bandwidth
     budget, turning a scheduler-killing failure into bounded degradation.
 
   - Cgroup integration: tasks migrating across a sub-scheduler boundary
     weren't re-homed to the new owner, causing wrong-scheduler scheduling
     and a use-after-free. Sub-schedulers now take over their cgroup subtree
     and receive its cgroup callbacks.
 
   - Arena objects now cross the kernel/BPF boundary as typed pointer
     arguments, translated transparently by the BPF tree's new arena argument
     support, replacing untyped arguments with manual translation.
 
   - scx_qmap now demonstrates full hierarchical sub-scheduling.
 
 - Robustness improvements: the abort path is now NMI-safe, fixing deadlocks
   when errors are raised from NMI context and making hardlockup recovery
   direct. Reenqueue loops that could monopolize a CPU ahead of the watchdog
   now eject the offending scheduler, and stalls are blamed on the scheduler
   actually responsible.
 
 - Hardening: BPF-writable arena memory is validated before kernel use, and
   task slice and vtime writes got explicit synchronization rules, closing
   corruption vectors open to buggy or malicious schedulers.
 
 - Core scheduling: sched_ext dispatching can drop the rq lock inside the
   core-wide pick, which let interleaving selections corrupt each other's
   state and hard-hang the machine. The selection now restarts when the lock
   was released. The task ordering callback was also invoked with its
   arguments swapped, and the default ordering is updated to work across
   sub-scheduler boundaries. The fixes are marked for stable.
 
 - Other fixes headed for stable: a task init leak on fork failure during
   enable, tooling compat macros that silently failed to detect newer
   kernels, and a crash on reenqueueing against a destroyed dispatch queue.
 
 - Tooling: scx_pair moves off deprecated callbacks, and the deprecated
   scx_bpf_cpu_rq() kfunc is removed.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoOA7w4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGQWqAP9Sy8GwS7dRdGze/eHwYlDBt5U9ayd2ntR0Z+H1
 1Hd23AEA5kYPaEN68OgCXh/XqmFljkvEgEisXtMtw8XsZA+pHQA=
 =OwIm
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext updates from Tejun Heo:
 "Most of this cycle completes the enqueue-path support for hierarchical
  sub-scheduling, which makes sub-scheduler support feature complete: a
  root BPF scheduler can now hand a cgroup subtree over to a nested
  sub-scheduler together with revocable CPU grants, and the
  sub-scheduler owns all scheduling decisions for its tasks on those
  CPUs.

  Development volume was high and a number of changes plugging holes in
  the new support landed late in the cycle. Also included are core
  scheduling fixes that were completed too late for the v7.2 release and
  are routed through this pull request.

  Sub-scheduler CPU delegation:

   - Parent schedulers now grant and revoke per-CPU capabilities
     (enqueueing, preemption, CPU frequency control) on their children,
     enforced on every path a scheduler can reach a CPU through.
     Previously only dispatching could be delegated; this lets
     sub-schedulers fully schedule their CPUs.

   - Rescue execution: a task whose scheduler doesn't have access to the
     CPUs the task needs to run on starved until the watchdog ejected
     the whole scheduler. The kernel now runs such tasks directly on a
     small bandwidth budget, turning a scheduler-killing failure into
     bounded degradation.

   - Cgroup integration: tasks migrating across a sub-scheduler boundary
     weren't re-homed to the new owner, causing wrong-scheduler
     scheduling and a use-after-free. Sub-schedulers now take over their
     cgroup subtree and receive its cgroup callbacks.

   - Arena objects now cross the kernel/BPF boundary as typed pointer
     arguments, translated transparently by the BPF tree's new arena
     argument support, replacing untyped arguments with manual
     translation.

   - scx_qmap now demonstrates full hierarchical sub-scheduling.

  Other fixes and updates:

   - Robustness improvements: the abort path is now NMI-safe, fixing
     deadlocks when errors are raised from NMI context and making
     hardlockup recovery direct. Reenqueue loops that could monopolize a
     CPU ahead of the watchdog now eject the offending scheduler, and
     stalls are blamed on the scheduler actually responsible.

   - Hardening: BPF-writable arena memory is validated before kernel
     use, and task slice and vtime writes got explicit synchronization
     rules, closing corruption vectors open to buggy or malicious
     schedulers.

   - Core scheduling: sched_ext dispatching can drop the rq lock inside
     the core-wide pick, which let interleaving selections corrupt each
     other's state and hard-hang the machine. The selection now restarts
     when the lock was released. The task ordering callback was also
     invoked with its arguments swapped, and the default ordering is
     updated to work across sub-scheduler boundaries. The fixes are
     marked for stable.

   - Other fixes headed for stable: a task init leak on fork failure
     during enable, tooling compat macros that silently failed to detect
     newer kernels, and a crash on reenqueueing against a destroyed
     dispatch queue.

   - Tooling: scx_pair moves off deprecated callbacks, and the
     deprecated scx_bpf_cpu_rq() kfunc is removed"

* tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (144 commits)
  sched_ext: Drop the dead SCX_DEQ_CORE_SCHED_EXEC test in dequeue_task_scx()
  sched_ext: Make core-sched task ordering hierarchy-aware
  sched_ext: Use runnable_at for the default core-sched task ordering
  sched_ext: Fix inverted ops.core_sched_before() invocation
  sched_ext: Move the config-off sub-cap kfunc stubs into sub.c
  sched_ext: Rename balance-era identifiers to dispatch terms
  sched_ext: Drop the stale keep_prev fixup in dispatch_pick()
  sched_ext: Keep kick_sync waiting on the rq's own CPU
  sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR
  sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
  sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
  sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
  sched_ext: Make scx_bpf_events() read the calling scheduler's counters
  sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable()
  selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
  selftests/sched_ext: Make numa idle validation race-free
  sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
  sched_ext/scx_flatcg: expire cached hweights on weight changes
  sched_ext: Fix exit_task leak on fork failure during enable
  sched_ext: fix stale references in doc comments
  ...
2026-08-20 11:01:37 -07:00
Linus Torvalds
40d8c81577 cgroup: Changes for v7.3
- cpuset:
 
   - Attach path bug fixes: migrations spanning multiple source or
     destination cpusets were mishandled, most visibly leaving thread
     affinities stale when the controller is disabled in a threaded subtree.
     Configuration writes could also race an in-flight attach and apply stale
     state, and the deadline task count could get corrupted by concurrent
     updates, skewing SCHED_DEADLINE admission decisions.
 
   - Memory binding bug fixes: which node masks get applied differed between
     the binding update paths, and tasks cloned with CLONE_INTO_CGROUP
     skipped rebinding entirely. Rebinding also now runs once per process
     instead of repeating for every thread sharing the mm.
 
   - Overhead removals with no behavior change: CPU hotplug iterated tasks of
     cpusets that just inherit the parent's effective masks, and the
     slab-spreading task flag was still being maintained although the SLAB
     allocator that consumed it is long gone.
 
 - Data-race annotations for benign races so that KCSAN reports stay
   meaningful, selftest coverage for the fixes above along with flakiness and
   portability fixes, and documentation corrections.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoNzqw4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGRxVAQDK5MAK0wUhxkG2bO7eSp0F74J/uAMXTSQdcXR+
 LR3wnQD/aYTHVPXecNc2XqU10uaVqPctHTuCt2qb4J7w8brHPQ8=
 =9TyI
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup updates from Tejun Heo:

 - Attach path bug fixes: migrations spanning multiple source or
   destination cpusets were mishandled, most visibly leaving thread
   affinities stale when the controller is disabled in a threaded
   subtree. Configuration writes could also race an in-flight attach and
   apply stale state, and the deadline task count could get corrupted by
   concurrent updates, skewing SCHED_DEADLINE admission decisions.

 - Memory binding bug fixes: which node masks get applied differed
   between the binding update paths, and tasks cloned with
   CLONE_INTO_CGROUP skipped rebinding entirely. Rebinding also now runs
   once per process instead of repeating for every thread sharing the
   mm.

 - Overhead removals with no behavior change: CPU hotplug iterated tasks
   of cpusets that just inherit the parent's effective masks, and the
   slab-spreading task flag was still being maintained although the SLAB
   allocator that consumed it is long gone.

 - Data-race annotations for benign races so that KCSAN reports stay
   meaningful, selftest coverage for the fixes above along with
   flakiness and portability fixes, and documentation corrections.

* tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (34 commits)
  selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_open
  selftests/cgroup: Preserve CPU hotplug write errors
  cgroup/cpuset: Add test for partition root invalidation returning wrong CPUs
  cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flag
  docs: cgroup-v2: fix stale "io" controller introduction
  selftests/cgroup: Avoid awk -e in cpuset tests
  cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
  selftests/cgroup: add user_usec sanity check in test_cpucg_nice
  cgroup: drop unneeded semicolon
  docs: cgroup-v2: mark memory.pressure and io.pressure as read-write
  selftests/cgroup: Fix minor defects in test_cpuset
  Docs/admin-guide/cgroup-v2: fix delay_nsec unit in io.latency doc
  selftests/cgroup: Remove redundant cg_enter_current() call in test_core
  selftests/cgroup: Add test for cpuset affinity on controller disable
  cgroup/cpuset: Handle the special case of non-moving tasks in cpuset_can_attach()
  cgroup/cpuset: Support multiple destination cpusets for cpuset_*attach()
  selftests/cgroup: fix missing TAP output in test_hugetlb_memcg
  cgroup/cpuset: Support multiple source cpusets for cpuset_*attach()
  cgroup/cpuset: Move mpol_rebind_mm/cpuset_migrate_mm() calls inside cpuset_attach_task()
  cgroup/cpuset: Make attach_ctx.old_cs track task group leader
  ...
2026-08-20 10:37:42 -07:00
Linus Torvalds
39e34e88ec workqueue: Changes for v7.3
- Worker wakeups moved out of pool->lock on the hot paths, shortening lock
   hold times. The wakeup can be expensive on arm64 due to the idle wakeup
   IPI, and the change improves the workqueue microbenchmark there by up to
   10%.
 
 - Stall diagnostics now report pools stuck with no running worker, with a
   backtrace of what the CPU is executing and the likely culprit worker,
   instead of dumping every in-flight worker.
 
 - Preparation for turning per-cpu workqueues into an affinity scope of
   unbound workqueues instead of a separate backend.
 
 - Race annotations for KCSAN and sparse warnings, and doc and monitoring
   script fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoNxSg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGWDfAP4tp2XFrNOOai4aCcWivKV99Arb0YFdjozM4vjX
 rx3HCwEAiwfLTduv+ZeLHYTIm3V3Nxrf246fitSEYUknb+Cx8QE=
 =XrZO
 -----END PGP SIGNATURE-----

Merge tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

Pull workqueue updates from Tejun Heo:

 - Worker wakeups moved out of pool->lock on the hot paths, shortening
   lock hold times. The wakeup can be expensive on arm64 due to the idle
   wakeup IPI, and the change improves the workqueue microbenchmark
   there by up to 10%

 - Stall diagnostics now report pools stuck with no running worker, with
   a backtrace of what the CPU is executing and the likely culprit
   worker, instead of dumping every in-flight worker

 - Preparation for turning per-cpu workqueues into an affinity scope of
   unbound workqueues instead of a separate backend

 - Race annotations for KCSAN and sparse warnings, and doc and
   monitoring script fixes

* tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (23 commits)
  workqueue: annotate racy p->wake_cpu accesses in kick_pool_pick()
  workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active()
  workqueue: use RCU accessors when populating wq->cpu_pwq
  workqueue: use rcu_dereference_sched() in workqueue_congested()
  workqueue: skip the node_nr_active update for non-unbound workqueues
  workqueue: rename alloc_unbound_pwq() to alloc_pwq()
  workqueue: allocate attrs for all workqueues
  workqueue: rename wq->unbound_attrs to wq->attrs
  workqueue: test WQ_UNBOUND explicitly in the hotplug loops
  workqueue: account nr_active by the backing pool
  workqueue: release pwq pools by pool type
  workqueue: factor out alloc_and_link_percpu_pwqs()
  workqueue: factor out get_percpu_pool()
  docs: workqueue: Fix bracket
  workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection
  workqueue: annotate racy PWQ_STAT_CPU_TIME update in wq_worker_tick()
  workqueue: dump the last woken worker for stalled pools
  workqueue: trigger a single-CPU backtrace for stalled pools
  workqueue: only show running workers in stall diagnostics
  workqueue: defer the worker wakeup outside pool->lock in process_one_work()
  ...
2026-08-20 10:34:25 -07:00
Linus Torvalds
9d2ed026f0 Summary
* Documentation
 
   Fix kernel-doc warnings by adjusting in file documentation.
 
 * Consolidate do_proc_* function into do_proc_vec.
 
   Consolidate three slightly different implementations of applying a converter
   on all elements of a vector. Fixes to this function now propagate to the three
   types.
 
 * Miscellaneous
 
   Replaced CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same) and
   restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)
 
 * Testing
 
   This series was run through sysctl selftests/kunit test suite in x86_64. And
   went into linux-next around rc2, giving it a bit more than a month of testing.
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmp0ga8ACgkQupfNUreW
 QU9RZQv/UFBopK15/HcUPWAp8h0Yq68Reij0ryPhuOuoqRaWjLrz5iT9SvNW4IZH
 WfAHal9+gVyAov2TvZUDHE0iojYa1S7l1MSBSvzlEijZnbglnt+63Ijfria3FTr2
 FIqk7gOxCpDg7kRh1GkIm8yc6Ke7T2IcbMT8XW5PAs43QqMPgGfeUry14sr6H89u
 pc1vXS/PcRDdsKkYKADCuljGG3ywL/7frDhSRcc+5WkCACOujzosmXTL10TVVs7H
 6Lz3vujtQyCnv3UxlHicsJQXD60m2gqbCLcqa5gndfE5jO2nS3ZTqRBALT9Cimuk
 43k+cKgJwOa5ry9OFXmp+in57hgOg8AZqWWENY2W0RaU6Tw7Ui5x6z36ZtE5PR9u
 NlNAOprv6UnKOQ6Bc4GGtfSMh+EviqQBSNQroEz4UxLdrFx2X7SxkSgz5I6gLbzf
 w+KZpQ3Y3Kjvr9ywkQUftekWqaeapv/OfrjGXRwiIBYhlurmKqvFpjjSQXmjow9u
 RD1bfR9X
 =aYrQ
 -----END PGP SIGNATURE-----

Merge tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl

Pull sysctl updates from Joel Granados:

 - Fix kernel-doc warnings by adjusting in file documentation

 - Consolidate do_proc_* function into do_proc_vec

   Consolidate three slightly different implementations of applying a
   converter on all elements of a vector. Fixes to this function now
   propagate to the three types.

 - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same)
   and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)

* tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL
  sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
  sysctl: repair some kernel-doc comments
  sysctl: add Returns: kernel-doc for all functions
  sysctl: Update API function documentation
  sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv
  sysctl: Group proc_handler declarations and document
  sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec
  sysctl: Add negp parameter to douintvec converter functions
  sysctl: Move default converter assignment out of do_proc_dointvec
2026-08-20 08:46:41 -07:00
Linus Torvalds
91ec203513 Networking changes for 7.3.
Core & protocols
 ----------------
 
  - A few steps lowering rtnl_lock dependence:
    - per-netns netdev unregistration for select SW drivers
      (e.g. veth, ipvlan, tunnels)
    - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
    - prepare software drivers and TC qdiscs for rtnl_lock-less GET
 
  - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve).
 
  - Support buffers larger than PAGE_SIZE in devmem zero-copy API.
 
  - Improve MPTCP handling of extreme memory pressure handling,
    when out-of-order queue had to be pruned.
 
  - Report the per-group user count via RTM_GETMULTICAST.
 
  - Expose the route deletion reason in RTM_DELROUTE.
 
  - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful
    handling of LSM denials when receiving SCM_RIGHTS messages: instead
    of truncating the message at the first blocked fd, keep every fd slot
    and store the LSM errno in the blocked slot.
 
  - IPv6 Segment Routing - support looking up the post-encap SID
    (address) in a different/specified routing table.
 
  - Support PRP RedBox (interlink) creation.
 
  - Support per-nexthop UDP dst port in VXLAN.
 
  - Continue converting getsockopt callbacks in a number of protocols
    to iov_iter.
 
 Ethernet
 --------
 
  - Marge initial CXL support for AMD/Solarflare NICs (shared branch
    with the CXL tree).
 
  - New drivers:
    - ADIN1140 10BASE-T1S MACPHY
    - Initial skeleton of Intel iXD and ZTE Dinghai drivers.
 
  - High-speed NICs:
    - AMD/Pensando:
      - support firmware flashing
    - Cisco (enic):
      - SR-IOV V2 admin channel and MBOX protocol
    - Huawei (hns3):
      - support for ethtool pfc_prevention_tout
    - nVidia/Mellanox:
      - support sharing bandwidth control across interfaces of
        the same device
    - Marvell (octeontx2-pf):
      - link RQ page pools to netdev for Netlink stats
    - Google vNIC:
      - XDP metadata support for DQ RDA
    - Microsoft vNIC:
      - support forcing full-page RX buffers
 
  - Other NICs:
    - Synopsys IP:
      - eic7700: support for eth1
    - Microchip (lan743x):
      - support for RMII interface
    - Wangxun:
      - support for ethtool -G and -C for VFs
      - add Tx timeout and PCIe error handling
    - Intel (igb/igc):
      - RSS key get/set support
      - support for forcing link speed without auto-negotiation
 
  - Switches:
    - NXP (dpaa2):
      - support bonding/LAG offload
    - Mediatek:
      - mt7530: EN7528 support
      - initial support for MT7628
    - Micrel (ksz8/9):
      - refactoring work to move towards library model
      - PTP support for KSZ8463
    - nVidia/Mellanox:
      - support rtnl-lock-less ethtool callbacks
    - Realtek:
      - rtl8366rb: use generic RTL83xx code
      - support SGMII and HSGMII for RTL8367S
 
  - PHYs:
    - Airoha:
      - EcoNet EN7528 PHY support
    - DAPU Telecom
      - DAPU Telecom DAP8211R(I) Gigabit PHY support
    - Realtek:
      - support RTL8261C_CG
      - support RTL8261D
 
 Wireless
 --------
 
  - nl80211: per-link statistics support for multi-link operation
 
  - mac80211: AQL/airtime-fairness support for multicast
 
  - Merge Peripheral Authentication Service (PAS) / TEE support
    for ath12k (shared branch with the firmware/qcom tree).
 
  - New drivers:
    - mm81x for Morse Micro Long-Range S1G devices
    - nxpwifi for NXP devices (mostly forked off from mwifiex)
 
  - Driver changes:
    - Broadcom (brcmfmac):
      - DPP support, some Cypress part update
    - MediaTek (mt76):
      - mt7928 support
      - mt7925 NAN support
      - mt7996 AP powersave improvements
    - Qualcomm (ath12k):
      - much kernel infrastructure integration work
      - AHB platform MultiPD support
    - Realtek (rt89):
      - LED support
      - RTL8922DE support
      - dual-BT coex for RTL8922D
    - Intel:
      - new FW version support
 
 Bluetooth
 ---------
 
  - HCI: add support for Shorter Connection Interval (SCI) feature.
 
  - af_bluetooth: add minimal context analysis annotations.
 
  - Driver changes:
    - Intel:
      - add Bluetooth SAR revision 2 support
      - add vendor_reset PCI sysfs for PLDR
    - Mediatek:
      - add USB IDs for MT7902 and MT7922 devices
    - Realtek:
      - add USB IDs for 8761CU and 8852BE devices
    - NXP:
      - add M.2 Bluetooth device support using pwrseq
 
 Misc
 ----
 
  - DPLL support for manual/numerical oscillator control (NCO)
    (implement in zl3073x).
 
  - MCTP support for MCTP over USB v1.1 (DMTF DSP0283).
 
  - Power-over-Ethernet: support Realtek PSE controllers.
 
  - Remove the IBM EHEA driver.
 
  - Remove tulip/xircom_cb driver.
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmqEwJ4ACgkQMUZtbf5S
 Irsegw//fmHJae525nxg3DHoXhrUz8EDDOVoLH6oyWyLQnh5bmbReAY/+oWA4m54
 3KKKO0b2rtgRvmY/7rnjAt3bjecYgCSjvZT7I+NosB0QbbBYc14PtHfYig9HffYm
 uCXfNJOk+aJ2QK4ncEvU2SjgE89Ya7cC+yARFBAwYx4zi/Qx24RB+ziOyvkQ8ksX
 atvMOZrnhwqvYUFOwnOLNHTpvdxB/ZsNwWY6iXcx6EYp9xrtPusbh3FlushWkwxH
 8cI/dNla44TcIKXAzRn0znRdgiEVmCMyHvOv7LKaOfy8P3I+knmuIf/mScYQqOEF
 T143HdXhVSBZFRtLtFKXIja/KsvCjX9lCeMn/2ak0brQDUREcacXxYbuZKDsNAAK
 zXt/+5qAcm/mO8W1gKR9Ulfli5bhFN4HKXgXMLjo5ucPtzfPxFN7HGxTiC3Cxv1v
 lSXexKaj74pNBVFmADrb5jWbq7oG+GzIdjzx3ycvm2q39Fr4nJ2SzrSPPNwc/ItQ
 IHv3tGLQKXlr8dl0+p2mDkRInmHXrawVNsB1UgN8E/jtcwT2QMwyWOV6s5G3uEDl
 a+0U/XsrPvDYBTUCRs/KaOJQGB90QkzLe9DATt159mf+rPzAX2/oCDo8xIEe+kWV
 aivP+YutFfMH/CSC9PMuvdLE2KmoPY4mibAeE4/4AYLKtJnc/yU=
 =zDto
 -----END PGP SIGNATURE-----

Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

Pull networking updates from Jakub Kicinski:
 "One of the 'small improvements all over the place' releases for us.

  It's hard to draw any direct comparisons because summer vacations
  disrupted our patch processing (and presumably - generation) quite a
  bit.

  Quick and dirty count suggests we (Paolo and I) merged a very similar
  number of net (632) and net-next (648) patches. This is not telling
  the full story either because 1/3 to 1/2 of the net-next patches also
  *seem* like AI-driven low priority fixes, cleanups and clarifications.

  We are completely overwhelmed, of course. The glimmer of hope is that
  we secured sufficient LLM budget and access (thank you Meta!) to run
  reviews with multiple frontier models on each patch. This eliminates
  some hallucinations. That said, in terms of review, the LLMs can only
  do so much.

  The sad truth is that our APIs (especially for rare events like PCIe
  errors, timeouts etc) have always been racy, and now LLMs don't let us
  ignore that. I expect our direction for the next release will be to
  tweak the reviews a little bit more, but start shifting focus to
  letting the LLMs take care of the busy work - managing patchwork,
  automating common process complaints, editing commit messages, and
  maybe applying patches which already got "reviewed-by" tags from
  people we trust...

  Core & protocols:

   - A few steps lowering rtnl_lock dependence:
      - per-netns netdev unregistration for select SW drivers (e.g.
        veth, ipvlan, tunnels)
      - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
      - prepare software drivers and TC qdiscs for rtnl_lock-less GET

   - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve)

   - Support buffers larger than PAGE_SIZE in devmem zero-copy API

   - Improve MPTCP handling of extreme memory pressure handling, when
     out-of-order queue had to be pruned

   - Report the per-group user count via RTM_GETMULTICAST

   - Expose the route deletion reason in RTM_DELROUTE

   - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more
     useful handling of LSM denials when receiving SCM_RIGHTS messages:
     instead of truncating the message at the first blocked fd, keep
     every fd slot and store the LSM errno in the blocked slot

   - IPv6 Segment Routing - support looking up the post-encap SID
     (address) in a different/specified routing table

   - Support PRP RedBox (interlink) creation

   - Support per-nexthop UDP dst port in VXLAN

   - Continue converting getsockopt callbacks in a number of protocols
     to iov_iter

  Ethernet:

   - Merge initial CXL support for AMD/Solarflare NICs (shared branch
     with the CXL tree)

   - New drivers:
      - ADIN1140 10BASE-T1S MACPHY
      - Initial skeleton of Intel iXD and ZTE Dinghai drivers

   - High-speed NICs:
      - AMD/Pensando:
         - support firmware flashing
      - Cisco (enic):
         - SR-IOV V2 admin channel and MBOX protocol
      - Huawei (hns3):
         - support for ethtool pfc_prevention_tout
      - nVidia/Mellanox:
         - support sharing bandwidth control across interfaces
           of the same device
      - Marvell (octeontx2-pf):
         - link RQ page pools to netdev for Netlink stats
      - Google vNIC:
         - XDP metadata support for DQ RDA
      - Microsoft vNIC:
         - support forcing full-page RX buffers

   - Other NICs:
      - Synopsys IP:
         - eic7700: support for eth1
      - Microchip (lan743x):
         - support for RMII interface
      - Wangxun:
         - support for ethtool -G and -C for VFs
         - add Tx timeout and PCIe error handling
      - Intel (igb/igc):
         - RSS key get/set support
         - support for forcing link speed without auto-negotiation

   - Switches:
      - NXP (dpaa2):
         - support bonding/LAG offload
      - Mediatek:
         - mt7530: EN7528 support
         - initial support for MT7628
      - Micrel (ksz8/9):
         - refactoring work to move towards library model
         - PTP support for KSZ8463
      - nVidia/Mellanox:
         - support rtnl-lock-less ethtool callbacks
      - Realtek:
         - rtl8366rb: use generic RTL83xx code
         - support SGMII and HSGMII for RTL8367S

   - PHYs:
      - Airoha:
         - EcoNet EN7528 PHY support
      - DAPU Telecom
         - DAPU Telecom DAP8211R(I) Gigabit PHY support
      - Realtek:
         - support RTL8261C_CG
         - support RTL8261D

  Wireless:

   - nl80211: per-link statistics support for multi-link operation

   - mac80211: AQL/airtime-fairness support for multicast

   - Merge Peripheral Authentication Service (PAS) / TEE support for
     ath12k (shared branch with the firmware/qcom tree)

   - New drivers:
      - mm81x for Morse Micro Long-Range S1G devices
      - nxpwifi for NXP devices (mostly forked off from mwifiex)

   - Driver changes:
      - Broadcom (brcmfmac):
         - DPP support, some Cypress part update
      - MediaTek (mt76):
         - mt7928 support
         - mt7925 NAN support
         - mt7996 AP powersave improvements
      - Qualcomm (ath12k):
         - much kernel infrastructure integration work
         - AHB platform MultiPD support
      - Realtek (rt89):
         - LED support
         - RTL8922DE support
         - dual-BT coex for RTL8922D
      - Intel:
         - new FW version support

  Bluetooth:

   - HCI: add support for Shorter Connection Interval (SCI) feature

   - af_bluetooth: add minimal context analysis annotations

   - Driver changes:
      - Intel:
         - add Bluetooth SAR revision 2 support
         - add vendor_reset PCI sysfs for PLDR
      - Mediatek:
         - add USB IDs for MT7902 and MT7922 devices
      - Realtek:
         - add USB IDs for 8761CU and 8852BE devices
      - NXP:
         - add M.2 Bluetooth device support using pwrseq

  Misc:

   - DPLL support for manual/numerical oscillator control (NCO)
     (implement in zl3073x)

   - MCTP support for MCTP over USB v1.1 (DMTF DSP0283)

   - Power-over-Ethernet: support Realtek PSE controllers

   - Remove the IBM EHEA driver

   - Remove tulip/xircom_cb driver"

* tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits)
  net/mlx5e: do not HW-GRO coalesce small frames
  net: openvswitch: fix nf_connlabels leak in ovs_ct_init
  net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
  net: openvswitch: fix flow mask use-after-free on flow deletion
  sctp: stop processing a packet once its association is deleted
  dpll: zl3073x: add PTP clock support
  dpll: zl3073x: add channel ToD, phase step and TIE operations
  dpll: zl3073x: scale poll interval proportionally to timeout
  ptp: vmclock: prevent read-only mappings from becoming writable
  ipv4: reject undersized MTUs in ip_do_fragment()
  bonding: initialize err for empty target lists
  net: dsa: initial support for MT7628 embedded switch
  net: dsa: initial MT7628 tagging driver
  net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs
  dt-bindings: net: dsa: add MT7628 ESW
  net: pse-pd: realtek-pse-mcu: add UART transport
  net: pse-pd: realtek-pse-mcu: add I2C transport
  net: pse-pd: add Realtek PSE MCU core
  dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU
  vsock: use sock_error() to consume sk_err after a failed connect
  ...
2026-08-20 08:16:04 -07:00
Linus Torvalds
5a8cd539ac Major changes:
- Redesign the verifier error reporting: failures now carry source and
   instruction annotations along with the causal event history that led
   to them, making program rejections far easier to debug and repair
   (Kumar Kartikeya Dwivedi)
 
 - Add arena argument support to kfuncs and struct_ops through the new
   __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
   Kumar Kartikeya Dwivedi, Ihor Solodrai)
 
 - Signed BPF program loader rework to accommodate both BPF and security
   community needs where the kernel runs the signature verification at
   BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann)
 
 - Add a set of ksock kfuncs which let BPF LSM and syscall programs
   create, connect and send on UDP sockets in order to emit telemetry
   data (Mahe Tardy)
 
 - Unify helper and kfunc call argument verification and classify kfunc
   arguments purely from BTF into a generated bpf_func_proto which is
   computed once at add-call time (Amery Hung)
 
 Other features and fixes:
 
 - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)
 
 - Add bidirectional VLAN support to bpf_fib_lookup() through the new
   BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags
   (Avinash Duduskar)
 
 - Infer zext_dst from static register liveness analysis to fix 32-bit
   zero-extension semantics, and remove the artificial limitations on
   pointer types eligible for spilling (Eduard Zingerman)
 
 - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops
   no longer pay a kfunc call on every iteration (Puranjay Mohan)
 
 - Add an arena-based bitmap data structure to libarena along with
   serial and parallel selftests (Emil Tsalapatis)
 
 - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets
   and to emit kfunc BTF decl tags, reducing the kernel build's
   dependency on pahole features (Ihor Solodrai)
 
 - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
   tunnel decapsulation can update the GSO and encapsulation state of
   the skb (Nick Hudson)
 
 - Fix the ring buffer pending_pos walk and the available-data
   accounting on 32-bit position wrap (Israel Téllez García)
 
 - Add memory usage accounting for arena maps and fix an mmap_lock
   deadlock on arena lock failure (Jiayuan Chen)
 
 - Add tracing_multi link info support to the kernel UAPI and bpftool,
   and refactor the stack map code to run with preemption disabled
   (Jiri Olsa)
 
 - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
   egress direction of the target's peer device (Jordan Rife)
 
 - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
   modules, can declare kfuncs safe to call under bpf_spin_lock instead
   of relying on the verifier's hard-coded allowlist (Kaitao Cheng)
 
 - Introduce global percpu data for BPF programs with libbpf probing
   and bpftool skeleton support, and stop exposing uninitialized kernel
   heap memory when copying per-CPU map values (Leon Hwang)
 
 - Add s390 JIT support for load-acquire and store-release instructions
   (Maxim Khmelevskii)
 
 - Fix a CFI mismatch in the task work callback and an arm64 KASAN
   false positive after bpf_throw() (Mykyta Yatsenko)
 
 - Reject writes through untrusted BTF pointers and bound the
   rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)
 
 - Invalidate RCU pointers only after the final spin unlock and account
   for preempt and IRQ disabled regions as overlapping RCU protection
   (Ning Ding)
 
 - Support mixing bpf2bpf calls and tail calls on RV64, add signed
   operations and 32-bit atomics to the RV32 JIT, and add timed may_goto
   support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)
 
 - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks
   and an mmap_lock leak in the irq_work path (Sanghyun Park)
 
 - Populate mmap-able BPF array map memory lazily which makes mmap() O(1)
   instead of proportional to the map size (Song Liu)
 
 - Introduce a jit_required flag and reject programs with inlined
   helpers when no JIT is available, where the interpreter would
   otherwise jump into an invalid address (Tiezhu Yang)
 
 - Fix the x86 JIT per-CPU address resolution into an extended register
   where the REX prefix dropped the high destination register bit
   (Vineet Gupta)
 
 - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
   the arena base, and mixed arena and ordinary atomic paths
   (Yiyang Chen)
 
 - Fix the trampoline handling of 128-bit arguments and of return values
   larger than 8 bytes (Yonghong Song)
 
 - Ensure that any fault prone load is rewritten with exception table
   handling, and fix the arena load-acquire and atomic fetch handling
   in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)
 
 - Many more fixes and cleanups across the verifier, arena, trampolines,
   sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf,
   bpftool, resolve_btfids and selftests.
 
 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
 -----BEGIN PGP SIGNATURE-----
 
 iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCaoNzBBUcZGFuaWVsQGlv
 Z2VhcmJveC5uZXQACgkQ2yufC7HISIOb3QEAy5cyrLXY+VWofhsC9wULkHyETOdj
 oTkdohQomZp4VhEA/1RZXdHVS1ANFgreWv0fMorUOHEKv2ZuNokfk3LWgW4L
 =VRyL
 -----END PGP SIGNATURE-----

Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Pull bpf updates from Daniel Borkmann:
 "Major changes:

   - Redesign the verifier error reporting: failures now carry source
     and instruction annotations along with the causal event history
     that led to them, making program rejections far easier to debug and
     repair (Kumar Kartikeya Dwivedi)

   - Add arena argument support to kfuncs and struct_ops through the new
     __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
     Kumar Kartikeya Dwivedi, Ihor Solodrai)

   - Signed BPF program loader rework to accommodate both BPF and
     security community needs where the kernel runs the signature
     verification at BPF_PROG_LOAD time before the LSM admission hook
     (Daniel Borkmann)

   - Add a set of ksock kfuncs which let BPF LSM and syscall programs
     create, connect and send on UDP sockets in order to emit telemetry
     data (Mahe Tardy)

   - Unify helper and kfunc call argument verification and classify
     kfunc arguments purely from BTF into a generated bpf_func_proto
     which is computed once at add-call time (Amery Hung)

  Other features and fixes:

   - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)

   - Add bidirectional VLAN support to bpf_fib_lookup() through the new
     BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash
     Duduskar)

   - Infer zext_dst from static register liveness analysis to fix 32-bit
     zero-extension semantics, and remove the artificial limitations on
     pointer types eligible for spilling (Eduard Zingerman)

   - Inline the numeric open-coded iterator kfuncs so that bpf_for()
     loops no longer pay a kfunc call on every iteration (Puranjay
     Mohan)

   - Add an arena-based bitmap data structure to libarena along with
     serial and parallel selftests (Emil Tsalapatis)

   - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID
     sets and to emit kfunc BTF decl tags, reducing the kernel build's
     dependency on pahole features (Ihor Solodrai)

   - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
     tunnel decapsulation can update the GSO and encapsulation state of
     the skb (Nick Hudson)

   - Fix the ring buffer pending_pos walk and the available-data
     accounting on 32-bit position wrap (Israel Téllez García)

   - Add memory usage accounting for arena maps and fix an mmap_lock
     deadlock on arena lock failure (Jiayuan Chen)

   - Add tracing_multi link info support to the kernel UAPI and bpftool,
     and refactor the stack map code to run with preemption disabled
     (Jiri Olsa)

   - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
     egress direction of the target's peer device (Jordan Rife)

   - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
     modules, can declare kfuncs safe to call under bpf_spin_lock
     instead of relying on the verifier's hard-coded allowlist (Kaitao
     Cheng)

   - Introduce global percpu data for BPF programs with libbpf probing
     and bpftool skeleton support, and stop exposing uninitialized
     kernel heap memory when copying per-CPU map values (Leon Hwang)

   - Add s390 JIT support for load-acquire and store-release
     instructions (Maxim Khmelevskii)

   - Fix a CFI mismatch in the task work callback and an arm64 KASAN
     false positive after bpf_throw() (Mykyta Yatsenko)

   - Reject writes through untrusted BTF pointers and bound the
     rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)

   - Invalidate RCU pointers only after the final spin unlock and
     account for preempt and IRQ disabled regions as overlapping RCU
     protection (Ning Ding)

   - Support mixing bpf2bpf calls and tail calls on RV64, add signed
     operations and 32-bit atomics to the RV32 JIT, and add timed
     may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)

   - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign
     tasks and an mmap_lock leak in the irq_work path (Sanghyun Park)

   - Populate mmap-able BPF array map memory lazily which makes mmap()
     O(1) instead of proportional to the map size (Song Liu)

   - Introduce a jit_required flag and reject programs with inlined
     helpers when no JIT is available, where the interpreter would
     otherwise jump into an invalid address (Tiezhu Yang)

   - Fix the x86 JIT per-CPU address resolution into an extended
     register where the REX prefix dropped the high destination register
     bit (Vineet Gupta)

   - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
     the arena base, and mixed arena and ordinary atomic paths (Yiyang
     Chen)

   - Fix the trampoline handling of 128-bit arguments and of return
     values larger than 8 bytes (Yonghong Song)

   - Ensure that any fault prone load is rewritten with exception table
     handling, and fix the arena load-acquire and atomic fetch handling
     in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)

   - Many more fixes and cleanups across the verifier, arena,
     trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390
     JITs, libbpf, bpftool, resolve_btfids and selftests"

* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits)
  selftests/bpf: Add tests for a store on a fault prone qdisc pointer
  selftests/bpf: Add tests for fault prone loads out of RCU pointers
  selftests/bpf: Add tests for pointer type merge at a shared load
  selftests/bpf: Remove duplicate copies of the arena spinlock qnodes
  selftests/bpf: Retry stat generation in cgroup_iter_memcg
  selftests/bpf: Test pseudo-function policy diagnostics
  bpf: Distinguish function references in policy diagnostics
  bpf: Preserve source attribution without source text
  selftests/bpf: Test kfunc argument diagnostics
  bpf: Correct kfunc argument diagnostics
  bpf: Use canonical stack argument names in diagnostics
  bpf: Preserve R0 lineage across helper calls
  selftests/bpf: Exercise negative optlen in cgroup getsockopt hook
  bpf: Reject negative optlen in cgroup getsockopt hook
  selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
  bpf: Clear decap state on skb_adjust_room shrink path
  bpf: Allow new DECAP flags and add guard rails
  bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
  bpf: Refactor masks for ADJ_ROOM flags and encap validation
  bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
  ...
2026-08-20 07:36:20 -07:00
Linus Torvalds
83453b6f51 audit/stable-7.3 PR 20260814
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmp/iW4UHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXP5gw/9FZSIJurmLZ9s+GPWczZFvkOB5aA9
 jcBy7qCcRLrzlCIzrb9X8yBvgfRuGZcXgUiY9yCLYLJfeo9CECfYtSaqSN+3lBgg
 0rTFjRmFijxc2m/xcimCxeh+5jMymWs/h7eqI8uPH5mrK65Ox2s2x9dCyHYHlvJ2
 /Gl9igndDJ8I8OfHN4lEljSWXai2tONnWe4BFRrkcFUm6MwI6IKpRVVke1Pi6yKz
 cEij/A3VIpVXuH+AYCnctBNrz/voKcU7VjK+opuaBG5Tx/R2g6pWsC8jGjsu0uiP
 VTMhPmwaFdoTmCnt8zrqrrBaNwRqKypIKMdWKd2g0EcnLE7qv4HNTTPCm9WQya7t
 UjBtBArytTbPg7TaIl5KP4/I18ZjFTHMVuAOjyjZUvWm/Sl4lf+V2/x8Hkh7nwbB
 ffOuqnMS1+f4L/GKUNgBG5eHtOkNa+f2ZbtMdvHU8D55dP+k5cK/2lGDPPWtsFoQ
 jdsgcBG9sGp6pWytacZ/se4vd3wRFeCMbRsntBRYaGJN4zNOf55fZPgmGhtx+30O
 r0K0SiXmc/mqNake/f8rqwUar3Pqd+lj3rmEi1uNzqAq+VPlkuGwhqRmf1mS+/26
 4n1wQsTp4yuR6wQ7PYyA+/TzeIYtTxRvMLA2lGdGMSe5SY8+D4I40yy7KIvK/yaC
 wHh9rRffxFx04Ek=
 =9fzH
 -----END PGP SIGNATURE-----

Merge tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore:

 - Drop BUG_ON() assertions from two functions

   While I don't recall any bug reports from either of these assertions
   in recent memory, neither of these checks warrant the kernel panic
   that could result from BUG_ON(). One of the BUG_ON() calls is
   converted to a WARN_ON_ONCE() and the other to a lockdep assertion.

 - Fix an audit tree reference counting problem

   Fix a corner case where audit could end up unintentionally dropping
   the last reference to an audit tree while the tree was still in use.

   We should probably revisit the audit tree handling code in full, but
   this patch works, and should be easy to backport to stable trees and
   downstream kernels.

 - Update the audit syscall classification tables

   Add some missing syscalls to the PERM class

* tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: avoid dropping live tree ref on fsnotify rule autoremove
  audit: drop BUG_ON() from audit_signal_info_syscall()
  audit: drop BUG_ON() from audit_add_to_parent()
  audit: add missing syscalls to PERM class tables
2026-08-19 16:21:32 -07:00
Linus Torvalds
cb8a75eec0 ring-buffer updates for 7.3:
- Remove unneeded semicolon
 
   A macro ended with a semicolon that wasn't needed.
 
 - Fix freeing cpu_buffer extra subbuffer with order greater than zero
 
   When the cpu_buffer was being freed, its "free" page, was using
   free_page() to free it when it could be more than one page.
 
 - Hold the cpu_buffer lock when resizing the subbuffer
 
   The freeing of the "free" page of the cpu_buffer was done without locking.
   The order of the data was being saved and then the "free" page was set to
   NULL. But there is a race that the "free" page could have been updated
   between those two operations. Add locking around it to prevent the race.
 
 - Save the order of the data along with the data in the free page
 
   The cpu_buffer would store just the data portion of the subbuffer page in
   its descriptor. But it did not store the order of the data pages. The order
   was being saved in the global buffer descriptor. But this leads to races.
 
   Have the cpu_buffer save the subbuf data along with its metadata (which
   includes the order of the page) to make sure when it frees it, it frees
   the correct order along with it.
 
 - Remove the subbuf_size and use the order directly when needed
 
   Having a size field for the size of the subbufer along with its order
   allowed for races to have them get out of sync. Remove the subbuf_size and
   use the order from the subbuf meta data directly under locks.
 
   Use the subbuf_order for other calculations in the ring buffer.
 
 - Remove the useless "cpus" field of trace_buffer
 
   The code has been restructured and the "cpus" field is no longer used.
   Remove it.
 
 - Remove the "mapped" field of the ring buffer and use a helper function instead.
 
   The "mapped" field has become a bit overused and made the code come
   complex in using a counter for what is denoted as being mapped or not.
   There are other fields that are set when the ring buffer is considered
   mapped. Add a helper function to check those fields and use that instead
   of keeping track of a counter.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaoC9jxQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qlJwAQDG/FAI6Zr4f2jUIoEWPL7KGkhmHeuv
 rP1bIJVeIoy+RgEA+vjq6PNNGvN2DO0qnotu5UAhHxywM1KaUKQjOCDaJQI=
 =f8Ym
 -----END PGP SIGNATURE-----

Merge tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull ring-buffer updates from Steven Rostedt:

 - Remove unneeded semicolon

   A macro ended with a semicolon that wasn't needed.

 - Fix freeing cpu_buffer extra subbuffer with order greater than zero

   When the cpu_buffer was being freed, its "free" page, was using
   free_page() to free it when it could be more than one page.

 - Hold the cpu_buffer lock when resizing the subbuffer

   The freeing of the "free" page of the cpu_buffer was done without
   locking. The order of the data was being saved and then the "free"
   page was set to NULL. But there is a race that the "free" page could
   have been updated between those two operations. Add locking around it
   to prevent the race.

 - Save the order of the data along with the data in the free page

   The cpu_buffer would store just the data portion of the subbuffer
   page in its descriptor. But it did not store the order of the data
   pages. The order was being saved in the global buffer descriptor. But
   this leads to races.

   Have the cpu_buffer save the subbuf data along with its metadata
   (which includes the order of the page) to make sure when it frees it,
   it frees the correct order along with it.

 - Remove the subbuf_size and use the order directly when needed

   Having a size field for the size of the subbufer along with its order
   allowed for races to have them get out of sync. Remove the
   subbuf_size and use the order from the subbuf meta data directly
   under locks.

   Use the subbuf_order for other calculations in the ring buffer.

 - Remove the useless "cpus" field of trace_buffer

   The code has been restructured and the "cpus" field is no longer
   used. Remove it.

 - Remove the "mapped" field of the ring buffer and use a helper
   function instead.

   The "mapped" field has become a bit overused and made the code come
   complex in using a counter for what is denoted as being mapped or
   not. There are other fields that are set when the ring buffer is
   considered mapped. Add a helper function to check those fields and
   use that instead of keeping track of a counter.

* tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Remove ring_buffer_per_cpu::mapped
  ring-buffer: Remove trace_buffer::cpus
  ring-buffer: Dynamically calculate max_data_size
  ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
  ring-buffer: Fix subbuf resize race with ring buffer readers
  ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
  ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
  ring-buffer: Free cpu_buffer::free_page with subbuf_order
  ring-buffer: drop unneeded semicolon
2026-08-19 14:22:07 -07:00
Linus Torvalds
1484625c59 tracefs updates for v7.3:
- Define event fields before directory creation
 
   Move the event_define_fields() call in event_create_dir() before the
   eventfs directory creation. Previously, a failure after directory
   creation wouldn't clean up eventfs_inode because the error path didn't
   call eventfs_remove_dir(). This eliminates the need to clean up the
   eventfs directories if event_define_fields() fails.
 
 - Add warning for out of bounds pos in __eventfs_iterate()
 
   Sashiko complains about the ctx->pos causing issues if it is less than 2
   or greater than MAX_INT in __eventfs_iterate(). The thing is, the logic
   prevents that from happening. But to make Sashiko happy, add a WARN_ON()
   and exit safely if the function ever does get input that is out of the
   range the function expects.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan+ZvBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qtTfAQC+70AlkM07/RxLkS6GYEEoJ1orM/CO
 eheyYNZvdjovogEAoUjt0VO+PEcqKDkIdCpx3l9M4hu+B7hN51S2gdEz8gE=
 =EqMA
 -----END PGP SIGNATURE-----

Merge tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracefs updates from Steven Rostedt:

 - Define event fields before directory creation

   Move the event_define_fields() call in event_create_dir() before the
   eventfs directory creation. Previously, a failure after directory
   creation wouldn't clean up eventfs_inode because the error path
   didn't call eventfs_remove_dir(). This eliminates the need to clean
   up the eventfs directories if event_define_fields() fails.

 - Add warning for out of bounds pos in __eventfs_iterate()

   Sashiko complains about the ctx->pos causing issues if it is less
   than 2 or greater than MAX_INT in __eventfs_iterate(). The thing is,
   the logic prevents that from happening. But to make Sashiko happy,
   add a WARN_ON() and exit safely if the function ever does get input
   that is out of the range the function expects.

* tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  eventfs: Add warning for out of bounds pos in __eventfs_iterate()
  eventfs: Define event fields before directory creation
2026-08-19 14:18:45 -07:00
Linus Torvalds
081e5bf2a9 tracing updates for v7.3:
- Expose btf_ids to trace events
 
   In order to allow BPF programs to attach to system call trace events (which
   are actually pseudo trace events built on top of raw_syscall events),
   expose the BTF ID of the events. This will allow BPF programs better
   precision in attaching to events.
 
 - Use "u64" to assign to hist_field->type
 
   Instead of using kstrdup("u64", GFP_KERNEL) to assign the hist_field->type,
   just point it to "u64" instead. The hist_field->type is freed via
   kfree_const().
 
 - Replace kmalloc()/strcpy() with kstrdup() for trace_printk
 
   Instead of having two calls to copy the module format string, just use
   kstrdup().
 
 - Use __free() in trace event histograms and triggres where possible
 
 - Use seq_buf in trace event code instead of strcat()
 
   Instead of calculating the size of the buffer to use and filling it with
   strcat(), use the seq_buf infrastructure that takes care of making sure
   not to overflow the string size.
 
 - Reject invalid preemptirq_delay_test CPU affinity
 
   The preempt_delay_test module can take an invalid CPU affinity mask and
   create confusing output. Simply have the module reject invalid affinity
   masks.
 
 - Prevent division by zero in ftrace_ops sample module code
 
   If the ftrace_ops sample module code receives the module parameter
   nr_function_calls set to zero, it can cause a division by zero error.
 
 - Warn when an event dereferences a parameter in TP_printk()
 
   On boot up and module load, the trace event TP_printk() is scanned for
   possible bugs. As the TP_printk() code is executed when the user reads the
   "trace" file and processes the data written when the trace_event executed,
   the data it reads can be literally days old. The scan currently checks for
   dereferencing printk formats like "%pI6". But it does not check if the
   parameters themselves have a dereference like:
 
   TP_printk("offset %08x: value %08x",
            (u32)(__entry->addr - __entry->edma->membase), __entry->value)
 
   __entry represents the pointer to the event on the ring buffer. The
   __entry->edma->membase is dereferencing a pointer on the ring buffer to
   find membase, but the __entry->edma may no longer be a valid pointer.
 
   Warn on this case too.
 
 - Replace some strcpy() with strscpy()
 
 - Clean up mmiotrace events to use assign_type() macro
 
   The assign_type() macro makes sure the event type is indeed the type that
   is being parsed. The mmiotrace trace was written before that macro was
   created so it just simply typecasted the pointer.
 
   Replace the typecasting with the macro.
 
 - Have the ENUM processing to numbers only process what is added
 
   The code that converts ENUMs to their numbers in the trace events scanned
   all events to do the processing. This was true when a module was loaded
   too. That is, instead of processing just the events for the module, it
   processed *all* events. Even the builtin ones that were processed at boot
   up.
 
   Add a check for the event->module matching mod if it is a module before
   processing it.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan+WhRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qk1sAQDIvuux39ii379T9hTm7hgXF9Dr8aH7
 RgxILUmr3c4y6QD+Iv9QQto+NfauqjkEMdPuVdOyUpDCYPTRw9i/YCty7Qk=
 =vya7
 -----END PGP SIGNATURE-----

Merge tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing updates from Steven Rostedt:

 - Expose btf_ids to trace events

   In order to allow BPF programs to attach to system call trace events
   (which are actually pseudo trace events built on top of raw_syscall
   events), expose the BTF ID of the events. This will allow BPF
   programs better precision in attaching to events.

 - Use "u64" to assign to hist_field->type

   Instead of using kstrdup("u64", GFP_KERNEL) to assign the
   hist_field->type, just point it to "u64" instead. The
   hist_field->type is freed via kfree_const().

 - Replace kmalloc()/strcpy() with kstrdup() for trace_printk

   Instead of having two calls to copy the module format string, just
   use kstrdup().

 - Use __free() in trace event histograms and triggres where possible

 - Use seq_buf in trace event code instead of strcat()

   Instead of calculating the size of the buffer to use and filling it
   with strcat(), use the seq_buf infrastructure that takes care of
   making sure not to overflow the string size.

 - Reject invalid preemptirq_delay_test CPU affinity

   The preempt_delay_test module can take an invalid CPU affinity mask
   and create confusing output. Simply have the module reject invalid
   affinity masks.

 - Prevent division by zero in ftrace_ops sample module code

   If the ftrace_ops sample module code receives the module parameter
   nr_function_calls set to zero, it can cause a division by zero error.

 - Warn when an event dereferences a parameter in TP_printk()

   On boot up and module load, the trace event TP_printk() is scanned
   for possible bugs. As the TP_printk() code is executed when the user
   reads the "trace" file and processes the data written when the
   trace_event executed, the data it reads can be literally days old.
   The scan currently checks for dereferencing printk formats like
   "%pI6". But it does not check if the parameters themselves have a
   dereference like:

	TP_printk("offset %08x: value %08x",
		(u32)(__entry->addr - __entry->edma->membase), __entry->value)

   __entry represents the pointer to the event on the ring buffer. The
   __entry->edma->membase is dereferencing a pointer on the ring buffer
   to find membase, but the __entry->edma may no longer be a valid
   pointer.

   Warn on this case too.

 - Replace some strcpy() with strscpy()

 - Clean up mmiotrace events to use assign_type() macro

   The assign_type() macro makes sure the event type is indeed the type
   that is being parsed. The mmiotrace trace was written before that
   macro was created so it just simply typecasted the pointer.

   Replace the typecasting with the macro.

 - Have the ENUM processing to numbers only process what is added

   The code that converts ENUMs to their numbers in the trace events
   scanned all events to do the processing. This was true when a module
   was loaded too. That is, instead of processing just the events for
   the module, it processed *all* events. Even the builtin ones that
   were processed at boot up.

   Add a check for the event->module matching mod if it is a module
   before processing it.

* tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (21 commits)
  tracing: Have trace_event_update_all() only handle module that is loading
  tracing: Cleanup event_enable_trigger_parse() by using __free()
  tracing: Report every TP_printk double dereference
  tracing/mmiotrace: Use trace_assign_type() in mmio_print_mark()
  tracing: Make per-template BTF id lists file-local
  tracing: Use seq_buf for string concatenation
  tracing: Use strscpy() instead of strcpy() in trace_sched_switch
  tracing: Warn when an event dereferences a pointer in TP_printk()
  samples/ftrace: Prevent division by zero when nr_function_calls is zero
  tracing: Reject invalid preemptirq_delay_test CPU affinity
  fgraph: Use trace_seq_putc() in print_graph_return()
  tracing/user_events: Replace a seq_printf() call by seq_puts() in user_seq_show()
  tracing/user_events: Use seq_putc() in two functions
  tracing: Bound histogram expression strings with seq_buf
  tracing: Return ERR_PTR() from expr_str()
  tracing: Use __free() for expr_str() buffer
  kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy()
  tracing: Point constant hist field type to string literal
  selftests/bpf: Add test for tracepoint btf_ids tracefs file
  tracing: Expose tracepoint BTF ids via tracefs
  ...
2026-08-19 14:06:14 -07:00
Linus Torvalds
00d66b29a6 ftrace updates for 7.3:
- Deprecrate ftrace_enabled in disabling ftrace
 
   The file /proc/sys/kernel/ftrace_enabled was created when ftrace was first
   introduced back in 2008. It was to be a "kill switch" if something was to
   go wrong. It was also used as a way to turn off function tracing for the
   latency tracers that would have it on by default. But in 2013 (Linux 3.10)
   the option "function-trace" was introduced to disable function tracing for
   the latency tracers as the "ftrace_enabled" file was considered too big of
   a hammer and caused too many side effects.
 
   When live kernel patching came along, disabling ftrace via the
   ftrace_enabled file would put the system into an unstable state if a live
   kernel patch was installed. This created the need to mark some function
   hooks as "PERMANENT".
 
   Now there's a need for BPF usage marked as PERMANENT for the same reasons.
 
   The file "ftrace_enabled" usage is no longer viable. It doesn't do what it
   says it does and there is no reason to use it.
 
   Make writing '0' to it a nop and print a message saying its usage is
   deprecated. The return value of writing '0' is -EOPNOTSUPP so that user
   space will error on that write (hopefully to inform any developer that it
   no longer works).
 
   Eventually the file should be removed completely, but for now just making
   it not do anything is the path forward to that.
 
 - Update the livepatch tests to handle ftrace_enabled being disabled
 
   Because in the past, livepatch was broken by ftrace_enabled being turned
   off, there's a test case that checks to make sure it still doesn't break.
   But having the write of '0' return an error caused that test to break.
   Updated the test to handle the new change.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan9buBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qkrAAP9lStpPUUVGUVprdRttG8tv4LlSMqX3
 +A5WdksIKD+XMAD+ODdXKQkjynRpTf9YnIV3PXNg6Adi3ItOXG1+UsbWGQY=
 =QLhM
 -----END PGP SIGNATURE-----

Merge tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull ftrace updates from Steven Rostedt:

 - Deprecrate ftrace_enabled in disabling ftrace

   The file /proc/sys/kernel/ftrace_enabled was created when ftrace was
   first introduced back in 2008. It was to be a "kill switch" if
   something was to go wrong. It was also used as a way to turn off
   function tracing for the latency tracers that would have it on by
   default. But in 2013 (Linux 3.10) the option "function-trace" was
   introduced to disable function tracing for the latency tracers as the
   "ftrace_enabled" file was considered too big of a hammer and caused
   too many side effects.

   When live kernel patching came along, disabling ftrace via the
   ftrace_enabled file would put the system into an unstable state if a
   live kernel patch was installed. This created the need to mark some
   function hooks as "PERMANENT".

   Now there's a need for BPF usage marked as PERMANENT for the same
   reasons.

   The file "ftrace_enabled" usage is no longer viable. It doesn't do
   what it says it does and there is no reason to use it.

   Make writing '0' to it a nop and print a message saying its usage is
   deprecated. The return value of writing '0' is -EOPNOTSUPP so that
   user space will error on that write (hopefully to inform any
   developer that it no longer works).

   Eventually the file should be removed completely, but for now just
   making it not do anything is the path forward to that.

 - Update the livepatch tests to handle ftrace_enabled being disabled

   Because in the past, livepatch was broken by ftrace_enabled being
   turned off, there's a test case that checks to make sure it still
   doesn't break. But having the write of '0' return an error caused
   that test to break. Updated the test to handle the new change.

* tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled
  ftrace: deprecate disabling via ftrace_enabled sysctl
2026-08-19 14:01:58 -07:00
Linus Torvalds
55ee4b931a Real-time Verifier updates for v7.3
- Switch LTL and DOT parsers to Lark in code generation tool
 
   The rvgen code generation tool originally parsed DOT files and LTL
   specifications using custom string parsing and Ply, which is no longer
   maintained. The DOT parser was fragile and prone to failure on minor
   format variations. Both LTL and DOT parsers have been rewritten to use
   the Lark parsing library.
 
 - Simplify Hybrid Automata clock variables
 
   The clock variables in hybrid automata monitors now use a single
   representation of the elapsed time since the clock was reset, rather
   than converting between invariant and guard representations.
   This allows simpler code generation for the newly refactored parser.
 
 - Generate cleanup hook for per-obj monitor
 
   The code generation scripts now adds a cleanup function to per-obj
   monitors for the user to wire to the appropriate event (e.g.
   sched_process_exit for tasks).
 
 - Reduce read_lock scope during per-task cleanup
 
   Take the tasklist_lock only when necessary, that is when iterating
   over for_each_process_thread().
 
 - Simplify task monitor slot management
 
   Only rely on the slot array for per-task slot management to avoid
   inconsistency with the unused counter.
 
 - Improve rvgen code robustness and templates
 
   Use pathlib in rvgen and improve kernel path discovery. Also improve
   consistency across templates when generating code (e.g. author
   placeholder and monitor struct name).
 
 - Update rtapp sleep monitor
 
   Simplify the sleep monitor by excluding kernel threads and
   updating the nanosleep check to focus only on CLOCK_REALTIME. Also
   switch to use the sched_exit tracepoint to run in the context of the
   offending (wakee) task.
 
 - Add wakeup monitor
 
   Add the new rtapp/wakeup monitor to detect when lower-priority tasks
   wake up higher-priority ones, complementing the existing sleep monitor
   by running in the waker context and capturing its stack trace.
 
 - Fix tools/rv exit status on failure
 
   Ensure the rv tool returns a failure exit code when a monitor fails to
   start because it was already running.
 
 - Add automated selftests for tools/rv and rvgen
 
   Introduced automated bash selftests to validate rv monitor listing and
   execution under different configurations. Added tests for the rvgen code
   generator, validating generated files against expected output (golden).
   Tests are reachable via make check.
 
 - Add KUnit test coverage for verification monitors
 
   Added comprehensive KUnit tests to validate the functionality of
   deterministic, hybrid, and LTL monitors by emulating event sequences
   and timing in a mock environment without affecting the running kernel
   while expecting mock reactions to fire. Ensure real RV monitors cannot
   run during KUnit tests to avoid state corruption.
 
 - Mock current in rv monitors
 
   Mock the call to current in rv monitors when the KUnit tests are built
   to allow them to run the test on dummy tasks. No overhead is expected
   when KUnit tests aren't running.
 
 - Introduce rvgen kunit subcommand
 
   Added a new 'kunit' subcommand to rvgen to automatically patch an already
   generated monitor with KUnit integration templates by parsing its event
   handlers and creating the required mock structures and initializations.
 
 - Refine kernel verification selftests
 
   Added new selftests for the deadline and stall monitors and rearranged
   the existing wwnr_printk test to resolve flakiness.
   Additionally, fixed an issue in the selftests framework where negative
   assertion failures were not correctly propagated due to shell rules.
 
 - Fix 32-bit build of nomiss KUnit test
 
   A previous commit introduced a division between an u64 and a constant
   value and that doesn't build on 32-bit systems. Use div_u64() instead.
 
 - Document changes in sleep monitor
 
   The sleep monitor introduced some changes in the past like allowing
   epoll_wait() as a valid sleep and a task going to runnable before
   scheduling as a valid wakeup. Document both.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan+BsRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qicKAQD5aLUnn4zrZGuT+k5qmNmmbOsAXriS
 g+TfUXShvRoL6QD+KrsUyNf9KzLd+IqJG1N3G3wbhOiVd60Y5srLZP87UgA=
 =iqRx
 -----END PGP SIGNATURE-----

Merge tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull Real-time Verifier updates from Steven Rostedt:

 - Switch LTL and DOT parsers to Lark in code generation tool

   The rvgen code generation tool originally parsed DOT files and LTL
   specifications using custom string parsing and Ply, which is no
   longer maintained. The DOT parser was fragile and prone to failure on
   minor format variations. Both LTL and DOT parsers have been rewritten
   to use the Lark parsing library.

 - Simplify Hybrid Automata clock variables

   The clock variables in hybrid automata monitors now use a single
   representation of the elapsed time since the clock was reset, rather
   than converting between invariant and guard representations. This
   allows simpler code generation for the newly refactored parser.

 - Generate cleanup hook for per-obj monitor

   The code generation scripts now adds a cleanup function to per-obj
   monitors for the user to wire to the appropriate event (e.g.
   sched_process_exit for tasks).

 - Reduce read_lock scope during per-task cleanup

   Take the tasklist_lock only when necessary, that is when iterating
   over for_each_process_thread().

 - Simplify task monitor slot management

   Only rely on the slot array for per-task slot management to avoid
   inconsistency with the unused counter.

 - Improve rvgen code robustness and templates

   Use pathlib in rvgen and improve kernel path discovery. Also improve
   consistency across templates when generating code (e.g. author
   placeholder and monitor struct name).

 - Update rtapp sleep monitor

   Simplify the sleep monitor by excluding kernel threads and updating
   the nanosleep check to focus only on CLOCK_REALTIME. Also switch to
   use the sched_exit tracepoint to run in the context of the offending
   (wakee) task.

 - Add wakeup monitor

   Add the new rtapp/wakeup monitor to detect when lower-priority tasks
   wake up higher-priority ones, complementing the existing sleep
   monitor by running in the waker context and capturing its stack
   trace.

 - Fix tools/rv exit status on failure

   Ensure the rv tool returns a failure exit code when a monitor fails
   to start because it was already running.

 - Add automated selftests for tools/rv and rvgen

   Introduced automated bash selftests to validate rv monitor listing
   and execution under different configurations. Added tests for the
   rvgen code generator, validating generated files against expected
   output (golden). Tests are reachable via make check.

 - Add KUnit test coverage for verification monitors

   Added comprehensive KUnit tests to validate the functionality of
   deterministic, hybrid, and LTL monitors by emulating event sequences
   and timing in a mock environment without affecting the running kernel
   while expecting mock reactions to fire. Ensure real RV monitors
   cannot run during KUnit tests to avoid state corruption.

 - Mock current in rv monitors

   Mock the call to current in rv monitors when the KUnit tests are
   built to allow them to run the test on dummy tasks. No overhead is
   expected when KUnit tests aren't running.

 - Introduce rvgen kunit subcommand

   Added a new 'kunit' subcommand to rvgen to automatically patch an
   already generated monitor with KUnit integration templates by parsing
   its event handlers and creating the required mock structures and
   initializations.

 - Refine kernel verification selftests

   Added new selftests for the deadline and stall monitors and
   rearranged the existing wwnr_printk test to resolve flakiness.
   Additionally, fixed an issue in the selftests framework where
   negative assertion failures were not correctly propagated due to
   shell rules.

 - Fix 32-bit build of nomiss KUnit test

   A previous commit introduced a division between an u64 and a constant
   value and that doesn't build on 32-bit systems. Use div_u64()
   instead.

 - Document changes in sleep monitor

   The sleep monitor introduced some changes in the past like allowing
   epoll_wait() as a valid sleep and a task going to runnable before
   scheduling as a valid wakeup. Document both.

* tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (40 commits)
  Documentation/rv: Explain epoll and aborted sleeps
  rv: Fix 32-bit build of nomiss KUnit test
  selftests/verification: Add selftests for deadline and stall monitors
  selftests/verification: Rearrange the wwnr_printk test
  selftests/verification: Fix wrong errexit assumption
  rv: Add KUnit tests for some LTL monitors
  rv: Add KUnit mock for current
  rv: Add KUnit tests for some DA/HA monitors
  rv: Export task monitor slot and react symbols
  verification/rvgen: Add selftests for rvgen kunit
  verification/rvgen: Add the rvgen kunit subcommand
  verification/rvgen: Add selftests
  verification/rvgen: Add golden and spec folders for tests
  tools/rv: Add selftests
  verification/rvgen: Improve consistency in template files
  verification/rvgen: Use pathlib instead of os.path
  verification/rvgen: Improve rv_dir discovery in RVGenerator
  tools/rv: Fix exit status when monitor execution fails
  rv: Use generic rv_this for the rv_monitor variable in LTL
  rv/rtapp: Add wakeup monitor
  ...
2026-08-19 13:29:22 -07:00
Petr Mladek
3783364ce6 Merge branch 'for-7.3-console-registration-cleanup' into for-linus 2026-08-19 10:00:46 +02:00
Linus Torvalds
104a813376 VDSO updates:
- Consolidate the VDSO datastore further and provide support for
    mlock_all() and prefaulting.
 
  - Provide 32-bit legacy time related functionality only if
    CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists, but
    architecture code still exposes the legacy functionality even disabled.
 
    Clean this up by adding the missing guards and validating at build time
    that the VDSO is legacy free if disabled.
 
  - Consolidate the VDSO related config options in core and drivers, which
    removes some non-sensical dependencies and quite an amount of #ifdeffery.
 
  - Clean up the PAGE_SIZE definition maze
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCxfkQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoSQkEADEOmcrm3vwMbaElrAfQRp4MOQMnDpKPCDa
 0EwdkXKJyqfOGx1PNKbcWZe10qShpXqyz+q3MUbHiOVh7KxkaGj0GOA/+xD+Tgs5
 RAFXCq+CY4Ccjix7vlyOBLvGgomuznAtRDCFprVq5OTXyQfVvS++5SHzaU/0xXiY
 ZZEInrFP61BEJ8LJycpoN5431EBcUX7XpSkr9eHtuSOslOBzbTEtBbDp0AjDGse0
 5qM/oZDufZDQQr31kVQiL0dN9bBWwdGNtBwZBjsf6KioY9M00LO0E9twSCSrI39F
 kgD2N97RDjTewu/zEe0fvCDVypqel2mBvjfiYU4c8g6pprdJ4Hq1qMcDAtMBUDBZ
 9jR8B09eYZwHLdbM5PFjiMf9d6p25P7X+twFI9Hylcm1YZtM4OTnamDhQOQDp1Fd
 QdrFevXg1zvYVi1rrDYarcPfg/tGsetOTujMQ1m50/AJZOoEdcX9jZR/wfdW8ti6
 X9TIn3SDzhauXkmeR86tHxtOmHDirVfBWCCCEyVT2YzGIIje25cf266fCPdcGRYl
 kzhtycg8LqpTRMWjhlaf56NtD9qQlbvDY8L23tQLJUYhDp8xOxqyuRPRdpJVM0b3
 4vp/Z8Sgz8tpEHO2ARsXfuu2CzilTBH0B2KL3f+a8CwpzIEadjIfc+6EEYqwgOAn
 +/RhckFp/A==
 =jHl1
 -----END PGP SIGNATURE-----

Merge tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull VDSO updates from Thomas Gleixner:

 - Consolidate the VDSO datastore further and provide support for
   mlock_all() and prefaulting.

 - Provide 32-bit legacy time related functionality only if
   CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists,
   but architecture code still exposes the legacy functionality even
   disabled.

   Clean this up by adding the missing guards and validating at build
   time that the VDSO is legacy free if disabled.

 - Consolidate the VDSO related config options in core and drivers,
   which removes some non-sensical dependencies and quite an amount of
   #ifdeffery.

 - Clean up the PAGE_SIZE definition maze

* tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits)
  random: vDSO: Drop custom PAGE_SIZE definitions
  LoongArch: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  clocksource/drivers/timer-riscv: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  clocksource/drivers/arm_arch_timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  clocksource/drivers/mips-gic-timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  MIPS: csrc-r4k: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY
  kbuild: Support generated asm-headers in subdirectories
  vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTORE
  vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig files
  vdso: Automatically select HAVE_GENERIC_VDSO if necessary
  MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSO
  vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATA
  futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCK
  vdso/gettimeofday: Verify COMPAT_32BIT_TIME interactions
  sparc: vdso: Respect COMPAT_32BIT_TIME
  MIPS: VDSO: Respect COMPAT_32BIT_TIME
  powerpc/vdso: Respect COMPAT_32BIT_TIME
  ARM: VDSO: Respect COMPAT_32BIT_TIME
  arm64: vdso32: Respect COMPAT_32BIT_TIME
  ...
2026-08-18 16:56:25 -07:00
Linus Torvalds
3b4128b9f3 Timers and timekeeping core updates:
- Fix a subtly inconsistency in the timekeeping code, which fails to
     account for the monotonicity adjustment in ntp_error. For small changes
     of the clocksource multiplicator (+/-1) which are typically used by the
     NTP PLL this is hardly to observe. But for larger adjustments,
     e.g. caused by a direct frequency setting through adjtimex() the
     one-time uncompensated offset is significant.
 
     Cure this by adjusting ntp_error with the resulting offset so that the
     discrepancy is smoothed away over time
 
   - Make tick length calculations correct in NTP. The timekeeping core
     takes the quantisation of the clocksource into account when calculating
     the tick length to compensate for the deviation of the nominal
     NTP_INTERVAL_LENGTH. While timekeeping gets this right, NTP is not
     aware of that, which means it operates on the nominal value and not on
     the actual value which is determined by the clock source frequency. The
     rounding of a coarse clocksource like the ACPI PM timer results in a
     +127 PPM deviation.
 
     Cure this by exposing the deviation to the NTP code so that it can
     operate on the same data as the timekeeping core. This is purely kernel
     internal. User space still sees the nominal tick lenght via adjtimex().
 
   - The accuracy of the NTP adjustments is fairly approximate as the code
     assumes that the invocations are precisely in NTP interval frequency
     ticks and the final adjustment can over and under-run.
 
     Cure this by adjusting ntp_error by the intended skew on each tick to
     achieve the desired rate.
 
   - Handle the two competing skews of time offset and time adjustment
     correctly by calculating the conflict portion between the skews and
     adjusting both accordingly.
 
   - A set of updates and improvements for the selftests
 
   - The usual small fixes and improvements all over the place
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCwxwQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoaOwD/45XBW2s5/L+GSy52r/APrzYOqgjYQdn2UQ
 XI85iTjDqg9sfZQNFbr7toJ84gY/wQ0ZxykLMi+LlOSZVe5azSepoUHMg9XGk8S0
 4kI+GLznmnDLFypTezpzk3DUgNgu8rhOYvPsgwQEgx0DuzWHRZgNoNDk4AfJ8HP6
 8cRgPIJ7CpIbP7/p0Kc5IjW3ybo849wBirl7ZDxNRRao+Dkc56ArZvSfQgnQu5Kw
 D3Ei+AFcxpBQ2GEJT4Z/92yNf1x2AXjkhfijgO6hIFzPAR+c049fG5sgneo3GoLQ
 riduEPQHvoiJO3gVGzoICF2DAuVOwMHwIBlGtNEDd+FcMAvMU4V3lQi8lJV+9CpH
 SJwa5R6KJHg2aTuoPup8lmfJN7BqmthrkZwcYVrv2Ikt5yWGYuoW0/e00So9IfUO
 R7UG/VlruckK+T0GCuKBAAfm/+zm6Sbir+4liPDZwDz4dW2lkvkZnAb6xHPCev8S
 ioYL/Jqr3GmIMgK7UelUkQ/gy5YCek89JAszdlD+blLAjUMcDeYsZaAN9rSdjzSu
 dbEA4Hze6Q8HpIW35bHkytyyjNNhvL6xobjKBNRuOPUHTFMe+s5itMApRlhsu32J
 6EL/D1TuwkiHlqaSek7ZqUAiitZoNWxa1NyreM9EuZ7qWPjUWOzlsDXkP2v298+t
 p27xt+/8sA==
 =prJt
 -----END PGP SIGNATURE-----

Merge tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer and timekeeping core updates from Thomas Gleixner:

 - Fix a subtly inconsistency in the timekeeping code, which fails to
   account for the monotonicity adjustment in ntp_error.

   For small changes of the clocksource multiplicator (+/-1) which are
   typically used by the NTP PLL this is hard to observe. But for larger
   adjustments, e.g. caused by a direct frequency setting through
   adjtimex() the one-time uncompensated offset is significant.

   Cure this by adjusting ntp_error with the resulting offset so that
   the discrepancy is smoothed away over time

 - Make tick length calculations correct in NTP.

   The timekeeping core takes the quantisation of the clocksource into
   account when calculating the tick length to compensate for the
   deviation of the nominal NTP_INTERVAL_LENGTH.

   While timekeeping gets this right, NTP is not aware of that, which
   means it operates on the nominal value and not on the actual value
   which is determined by the clock source frequency. The rounding of a
   coarse clocksource like the ACPI PM timer results in a +127 PPM
   deviation.

   Cure this by exposing the deviation to the NTP code so that it can
   operate on the same data as the timekeeping core. This is purely
   kernel internal. User space still sees the nominal tick lenght via
   adjtimex().

 - The accuracy of the NTP adjustments is fairly approximate as the code
   assumes that the invocations are precisely in NTP interval frequency
   ticks and the final adjustment can over and under-run.

   Cure this by adjusting ntp_error by the intended skew on each tick to
   achieve the desired rate.

 - Handle the two competing skews of time offset and time adjustment
   correctly by calculating the conflict portion between the skews and
   adjusting both accordingly.

 - A set of updates and improvements for the selftests

 - The usual small fixes and improvements all over the place

* tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits)
  selftests: timers: nsleep-lat: Check all calls to clock_nanosleep() and clock_gettime()
  selftests: timers: nsleep-lat: Reuse kselftest error numbers
  selftests: timers: nsleep-lat: Explicitly list the tested clocks
  selftests: timers: nsleep-lat: Use NSEC_PER_MSEC define for unreasonable latency
  selftests: timers: nanosleep: Report each test separately
  selftests: timers: nanosleep: Explicitly handle timer_delete() failure
  selftests: timers: nanosleep: Move all single clock tests out of the loop in main()
  selftests: timers: nanosleep: Reuse kselftest error numbers
  selftests: timers: nanosleep: Explicitly list the tested clocks
  selftests: timers: nanosleep: Drop output alignment
  selftests: timers: Use clock_name() and constants from clock-helpers.h
  selftests: Add clock-helpers.h
  timer_list: Use ktime_t over nanoseconds
  timer_list: Use standard 'long long' format placeholders
  hrtimer: Add a lockdep assertion to hrtimer_update_base()
  timekeeping: Use u32 for clock_was_set_seq
  timekeeping: Rename clockid_aux_valid() to clockid_is_aux_clock()
  hrtimer: Account nr_retries on recovered interrupt retries
  timers/itimer: Zero-init old itimerval before copy to userspace
  nohz: Replace dead select with choice default
  ...
2026-08-18 16:23:56 -07:00
Linus Torvalds
0dd1a54f44 SMP core updates:
- Reduce the preemption disabled sections in smp_call_function*().
 
     The various smp call functions keep preemption disabled accross the
     full operation which includes the wait for completion. Especially the
     latter can take some time when one of the target CPUs is not
     immediately responding to the IPI, which can result in large latency
     spikes.
 
     To improve this provide a per task CPU mask to track the CPUs to wait
     for. That makes the information required for the wait task local and
     therefore allows to reenable preemption before the wait. While this
     comes with moderate extra memory cost this reduces SMP function call
     induced latency measured in a fleet for high priority tasks from ~17ms
     to ~1.5ms (~90%).
 
   - Reduce the overhead of the CSD debug code by replacing the heavy memory
     barriers with smp_store_release()/acquire().
 
   - Remove obsolute unused hotplug states
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqC7pcQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoTL1D/9dgn7nuKCC4iwnihq2gZnM39780kNgsRCB
 9lAGAEEr1u2iciYIA+oXMqVLBGqrOkpCNMcChUqnyrH5H0coOgDFICTWTM4qLZxi
 ujPRcbwRDFqoHrd7PcHb7z6z9OIyiUQBRbQAJjk6+QnfA6IDbqcYB9RI2FrEexfG
 Wojl2VX1vITd4q55bhSdbUHHYm+QOP5cpBfUSkS1QjkH577kCJ0kkLhYg/8fuakr
 w1RaqU35I0W6z0AOh709vLxvchb60rMMX5/UkDHrRJx11gceimpQ+MTaz3PvZZmK
 djzCip9mLcZryP5bgdfJTVTGtEaQj0ggnDMmi2MiAuJhcvqokjaZpYfH/+wiNDuh
 vaNK+oZx9E3A3AKXs7MeXm9vqSh+nEHN4UcXosdT+gZqGrHTh4Mj4MT0gDwDzXXY
 A8WB3K95PJkucaqtXU+6bZZeVj7Pzc8tXySr7GUlxRipW/6ZJsz99s+mIG4zvMjo
 Y11pJIH7PLhnuAffMdgpmuQfiq6DKaGCjvWertB4TZPm+l/aBMvoA1QZbfNrUUPp
 Gf/IMHqcb3fmurgChn1bSlm9HDktjPzlmLWhHaVDJFrYZLYmbIzXzUNQCrBAuPQW
 Ui8BBOE2c5sn8bO411rxFOK3JETH/BBCNxmY4YQZAlU0na2/rVJ7ofKhT3zKMijd
 3M6BaQAxsw==
 =0b4v
 -----END PGP SIGNATURE-----

Merge tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull SMP core updates from Thomas Gleixner:

 - Reduce the preemption disabled sections in smp_call_function*().

   The various smp call functions keep preemption disabled accross the
   full operation which includes the wait for completion. Especially the
   latter can take some time when one of the target CPUs is not
   immediately responding to the IPI, which can result in large latency
   spikes.

   To improve this provide a per task CPU mask to track the CPUs to wait
   for. That makes the information required for the wait task local and
   therefore allows to reenable preemption before the wait.

   While this comes with moderate extra memory cost this reduces SMP
   function call induced latency measured in a fleet for high priority
   tasks from ~17ms to ~1.5ms (~90%).

 - Reduce the overhead of the CSD debug code by replacing the heavy
   memory barriers with smp_store_release()/acquire()

 - Remove obsolute unused hotplug states

* tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  scftorture: Remove preempt_disable() in scftorture_invoke_one()
  smp: Remove preempt_disable() from on_each_cpu_cond_mask()
  smp: Remove preempt_disable() from smp_call_function()
  smp: Enable preemption early in smp_call_function_many_cond()
  smp: Alloc percpu csd data in smpcfd_prepare_cpu() only once
  smp: Use task-local IPI cpumask in smp_call_function_many_cond()
  smp: Refactor remote CPU selection in smp_call_function_any()
  smp: Enable preemption early in smp_call_function_single()
  smp: Disable preemption explicitly in __csd_lock_wait()
  cpu/hotplug: Remove CPUHP_AP_ARM_CORESIGHT_CTI_STARTING
  smp: Use release stores for csd_lock_record() state
2026-08-18 15:29:53 -07:00
Linus Torvalds
b844715e8a Futex updates:
- A set of improvements to various futex self tests
 
     - Conversion to the selftest harness
 
     - Provide and use thread creation and synchronization helpers to reduce
       the dependency on delays, which tend to fail on loaded test systems
 
     - New tests for validating owner exit scenarios for robust and PI futexes
 
     - Runtime detect supported features and skip the tests if the kernel
       has no support
 
     - A few minor fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqC2iUQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoTPBD/4sMc+o2TiWn4bf7vcoln3XlVA8oWkiJCIB
 UUIW1n77CTK9jF50/xb77uvDvSHYr7Zx/Gm1QOvz/xdMvbgqUtPCExBoQXEz/1VV
 y+s7x3K4pwI7BLzEPNsvC2kN0+cVisMXdCi5C5ot7xo3AilfcxxSIwauGyEdQuqZ
 ArvVJjaBCXjRE1EtaVTeiGSINeR4kWPohOkH7dou/OISSd+EcA1kOsTrWlgVa2AA
 o7Vy4u5VsYK7m+UVZUYmwf7+pU91iDj0FZ9fMYYskOw5F+Xax4seNO4bozre80LJ
 3LE2aB8Rg5qGYCTL3D54O1c/2wczJueqGPHy+bF9SOOdlzo0N4Ro8wYUa3MmQuY5
 8+JyfFOsFcqflCYFK/ketzu3JrlZdu8DV9pJ67+RIKpHIXG5VRZHBDDrkL60PF7x
 TQoaZ57sOP7e5GJ+ByxxkltPuXGsIILcPytZoTtm6NwQIh2eSOtPSEPh9VprSChn
 vhY50WJuZ6L//Z7YQfXPQ9B7Xe+39OIWgY1GnUKF09BNVx6V4/As7Nc8llH+7cR7
 eyiVqs0uRDlnpe5zQkAj0hdYR9WK/XVAQ26rsHZDJnSnoalJbl2AjdH1FIg8xm7n
 0PPKqr3hZC4lilpwoBXXPQLIOBKNAUXZpVWxEopGSFIZ5tdrcnNcxgYFMuKiN5cQ
 glxSVQVl0g==
 =6VmJ
 -----END PGP SIGNATURE-----

Merge tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull futex updates from Thomas Gleixner:

 - Improvements to various futex self tests:

    - Conversion to the selftest harness

    - Provide and use thread creation and synchronization helpers to
      reduce the dependency on delays, which tend to fail on loaded test
      systems

    - New tests for validating owner exit scenarios for robust and PI
      futexes

    - Runtime detect supported features and skip the tests if the kernel
      has no support

 - A few minor fixes

* tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  selftests/futex: Give circular-list nodes static storage
  selftests/futex: Use thread synchronization helpers instead of usleep()
  selftests/futex: Provide thread creation and synchronization helpers
  selftests/futex: Dynamically skip unsupported tests
  selftests/futex: Add FUTEX_LOCK_PI owner-exiting coverage
  selftests/futex: Migrate robust_list to harness
  selftests/futex: Migrate futex_priv_hash to harness
  selftests/futex: Migrate futex_numa_mpol to harness
  selftests/futex: Migrate futex_requeue_pi_signal_restart to harness
  selftests/futex: Migrate futex_requeue_pi_mismatched_ops to harness
  selftests/futex: Migrate futex_requeue_pi to harness
  selftests/futex: Migrate futex_requeue to harness
  selftests/futex: Migrate futex_wait_uninitialized_heap to harness
  selftests/futex: Migrate futex_wait_private_mapped_file to harness
  selftests/futex: Migrate futex_wait to harness
  selftests/futex: Correct validation logic in waitv
  selftests/futex: Migrate functional tests to harness
  selftests/futex: Remove static keyword from 'head'
  futex: Remove unnecessary NULL check before kvfree()
  selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
2026-08-18 15:26:35 -07:00
Linus Torvalds
762fffa407 Generic interrupt subsystem updates:
- Remove pointless NULL checks of the kstats_irqs field. That's a
    historical left over and not longer required.
 
  - Add Radu Rendec as reviewer. Radu thankfully stepped up to help
    reviewing the interrupt core and the related drivers code.
 
  - The usual small improvements and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCtM8QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoV4SD/465axAMEli+6LbBcxWVmX1SCUasn+VM/2g
 VUUPONEDuf/Ucig+OC1QlvfZ/5d9pLiIwh3TakWPbkFtZpyfi60KiEQw5OW67TYB
 5TYgJI8BquIAQGzjUCKIzZmEvQhbuJzRjz07CIZnCtQBK3b/ftSDCwm6ynhhYRQC
 5yX/ay84pHPCyWVupkXV8jwjFm6v28U17j8TVd2VwEIOrEBa8dbOxOqUlRzrjbwE
 2dmo7r3BPSpyI/VpYiOW3wEXYq03+sR3MTNXQ9VWqLVcaUJUdDnbTnXqMbaXpGcO
 oV4vnuPv2Ah2TkB8xF9KTcyCKJbS2BKb5BtUXEJBQ/kPnB1wD712N2oZNuaN3omF
 SM4QoWojDpNPrPYWG99T4sNbemxfiyhIJzPSE/SgE6g0cWxh3d3wh5VfOnkp4ige
 gZKHVz7EcpjcyVz4xgYhaZk+7FmzAb6FMi4UhLZ9KHbAhdH87LSDDxvcUua2X3Js
 v1RdV3pkH1M3tBcLfO0D1neGL4VCL9zs8Ldf0jJBvcOy8kmjcs4uCll54hEbCQwI
 N7Qt7JF/r1LwxJRMC4OzsXp2upCbT5gaCOeG2HJuQUSy//0RL72NzjQe4cJSw5ya
 5Xnv5d/6L+hnwkOo7LPp9JYORXZ673D/vQgBg9Nf64Iz0i9SWnNB/fsmiSoTjw/c
 ZmqKGgEyHA==
 =6wX8
 -----END PGP SIGNATURE-----

Merge tag 'irq-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull generic interrupt subsystem updates from Thomas Gleixner:

 - Remove pointless NULL checks of the kstats_irqs field. That's a
   historical left over and not longer required.

 - Add Radu Rendec as reviewer. Radu thankfully stepped up to help
   reviewing the interrupt core and the related drivers code.

 - The usual small improvements and fixes

* tag 'irq-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  MAINTAINERS: Add Radu Rendec as reviewer for the interrupt subsystem
  genirq/msi: Move misplaced EXPORT_SYMBOL_GPL for msi_domain_free_irqs_all()
  parisc: Remove unnecessary NULL check of the kstat_irqs field
  genirq: Remove unnecessary NULL check of the kstat_irqs field
  irqdomain: Remove unnedded NULL check in __irq_domain_[de]activate_irq()
  genirq/manage: Use irqd_get_parent_data() helper in __irq_get_irqchip_state()
  irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path
2026-08-18 15:19:50 -07:00
Linus Torvalds
3424d8c18a Generic entry code updates:
- Make syscall user dispatching configurable
 
     Not all architectures can makes use of syscall user dispatching. Allow
     them to disable the feature completely.
 
   - Consolidate stack randomization for the generic entry code and the
     architectures using it.
 
     Stack randomization on syscall entry was sprinkled throughout the
     architecture specific low level entry code and in some cases at the
     wrong points, e.g. before establishing state, which violates the
     non-instrumentable constraints of that code.
 
     Clean this up by integrating stack randomization into the generic entry
     code helpers so that it is invoked at the earliest possible point right
     after establishing state and converting all generic entry code using
     architecture over.
 
   - Clean up the syscall number handling in the generic entry code. It
     works correctly for architectures which have a separate return value
     storage in pt_regs, but fails to distinguish the case where user space
     handed in -1 as syscall number from the case where the entry code
     rejects it by returning -1 to the callers. Aside of that the return
     value functionality of those interfaces is not really intuitive.
 
     Fix this by separating the decision to reject a syscall (user dispatch,
     ptrace, seccomp ...) from the potential modification of the syscall
     number through these mechanisms.
 
     This solves most of the problems for architectures which do not have a
     separate return value storage in pt_regs except for the case where a
     tracepoint has a BPF script or a probe attached which overwrite both
     the syscall number and the return value. But that's a problem which
     cannot be solved in the generic code, that only can be addressed by
     separating the storage model in the affected architectures.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCs10QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoaf6D/0ZBG1Yb0/C/6lrI185qPu38aGOROuAcxP+
 RV1O1x6C83w2hCLBH8LeswY2x4/iGbdftne/hfmvu8eNCE5MzBfYvXhLL4If75Tc
 IJ6C8uummnDmrT1TFuWHryTAfjyF28gt0+GGq0Zy5Hyz9b4CTJqOMx5u6KV4cZuJ
 odoNQpE/GlWo40wCSTYP/Tt5xONrogk2pMQtFyV8JEoaXkdYSj/V815yojEmofYU
 fmgPPO5/vOnZzE4b29gZyndXnU1Boah7r1l5fg7c9za376yCEEzh/ApPhovHyY0A
 t8zjnrtooZ27IUKbcsyycrAM14asfcmViDNDgaCj8ttBioQaCnxO1BpKWjVxEZhE
 AbM6q3Q66ER4Df6GNhZjPqT5Lr7E7+vLLarhXLWztsGQklIx4AFbrsa73hA20UC9
 1PSeMd45JSxH3yA8vMauXAGHFK1tD1V8Lgofu69+2Z3jtKB+aU0fqWeL1jesSEM0
 oCGhUb3hIC1pz3KVA0MGmNTm0yyQJYTGZL7wADYNV5NbxJVqXgo37qa/0n94Gf/4
 TG3OwY4Sb/H/sve7v/eY4IvxVh+xs3dLZP8ZoqMlPCp9JIxc6iNoe6VHqPI7PFnM
 fXwDtsy+bRF/SKnB/32qxnR7UJqmdNH3XIjd+lXWliKt6UYoC79/MEKN5DmJcO9P
 CykZUWa72A==
 =XUd9
 -----END PGP SIGNATURE-----

Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull generic entry code updates from Thomas Gleixner:

 - Make syscall user dispatching configurable

   Not all architectures can makes use of syscall user dispatching.
   Allow them to disable the feature completely.

 - Consolidate stack randomization for the generic entry code and the
   architectures using it.

   Stack randomization on syscall entry was sprinkled throughout the
   architecture specific low level entry code and in some cases at the
   wrong points, e.g. before establishing state, which violates the
   non-instrumentable constraints of that code.

   Clean this up by integrating stack randomization into the generic
   entry code helpers so that it is invoked at the earliest possible
   point right after establishing state and converting all generic entry
   code using architecture over.

 - Clean up the syscall number handling in the generic entry code. It
   works correctly for architectures which have a separate return value
   storage in pt_regs, but fails to distinguish the case where user
   space handed in -1 as syscall number from the case where the entry
   code rejects it by returning -1 to the callers. Aside of that the
   return value functionality of those interfaces is not really
   intuitive.

   Fix this by separating the decision to reject a syscall (user
   dispatch, ptrace, seccomp ...) from the potential modification of the
   syscall number through these mechanisms.

   This solves most of the problems for architectures which do not have
   a separate return value storage in pt_regs except for the case where
   a tracepoint has a BPF script or a probe attached which overwrite
   both the syscall number and the return value. But that's a problem
   which cannot be solved in the generic code, that only can be
   addressed by separating the storage model in the affected
   architectures.

* tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits)
  entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution
  entry: Make return type of syscall_trace_enter() bool
  entry: Rework trace_syscall_enter()
  entry: Rework syscall_audit_enter()
  syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH
  entry: Fix seccomp bypass after ptrace with TSYNC
  x86/entry: Simplify the syscall number logic
  x86/entry: Get rid of the sys_ni_syscall() indirection
  x86/entry: Make syscall functions static
  ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry()
  seccomp, treewide: Rename and convert __secure_computing() to return boolean
  entry: Use syscall number instead of rereading it
  entry: Remove syscall_enter_from_user_mode()
  x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack()
  s390/syscall: Use enter_from_user_mode_randomize_stack()
  riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  entry: Provide [syscall_]enter_from_user_mode_randomize_stack()
  randomize_kstack: Provide add_random_kstack_offset_irqsoff()
  ...
2026-08-18 15:00:56 -07:00
Linus Torvalds
e2457a664e Scheduler updates for v7.3:
Load-balancing updates:
 
  - Series to 'flatten the pick': improve cgroup scheduling, which has
    always been problematic and painful, which has caused various
    scheduling misbehavior such as the mishandling of reniced tasks et al.
    Add various cgroup weight distribution methods via cgroup_mode:
    'up', 'max', 'concur' and 'tasks' - with the default being 'concur'
    which is the most precise yet also most expensive version.
    Finally, change cgroup scheduling to a single runqueue.
    (Peter Zijlstra)
 
  - Series to improve the scheduling latency of short slice tasks
    (Vincent Guittot)
 
  - Series to fix cluster scheduling in the presence of asymmetric capacity
    (Ricardo Neri)
 
  - Prefer fully idle cores for NOHZ balancing (Andrea Righi)
 
  - Don't trigger active load-balancing if src_rq->curr is not on_rq
    (Xin Zhao)
 
 PSI updates:
 
  - Skip irqtime accounting when no new irq time has elapsed
    (Usama Arif)
 
 Scheduler debugging updates:
 
  - Remove unused schedstats (Shrikanth Hegde)
 
  - Defer freeing of cpumask memblock memory to initcall
    (Waiman Long)
 
 Misc fixes and updates by Yu C Chen, K Prateek Nayak, Peter Zijlstra,
 Vincent Guittot, Xin Zhao, Yury Norov, Zhan Xusheng.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC3WARHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hawRAAuVAreXtsp7Ok6aRHmiOMR+Va2EsHIL4B
 3MY5do2oUfiJSCDtIn3BXqjM3djOXdbQLQwm6r9/NkyJ6hsOsRgZaP1L/w07FiY0
 33ilIhZIH9QZ2RzvEjZcFXVwnWH6zP8Ag/gTsch3g8TIX2JJcZBzcJjQM8ZIdcBL
 oxwWNe9z3Mh0/x2N+N/s1xstaZf95bWQKeBVBGjiOAakGRWMEaQmMtOUujJNmx/p
 YFtNcJL6pLGfD+ASOtLxYWts4z1JyDmwvje8SZmRsgjZdhoxRlnEIgU6jrNjmPqu
 NfR5w6R193Pa+FapawYi0ttuawapHvvSDDUxjl+eIccPMw0mBdjzn1XuNIt6pclC
 Q4VDUQEDBYvbeznNfLuvvsLVBq/QIjim391lg9DuAGreuRx00Ij0hXOCPk6TM4H8
 tfUZ8N25vIAbYrFajSDyOYdgAa2Z2VnM1Q1ko29LPb3WFfZsEqgIg7+ukoXCZ5n8
 67pUrOYLuSlLXJGlJY9WDz1nbeUh3e0f2390fif3VBcQ7roPEmoL8CYZhh8Vd2rq
 ug8kOpL/91/PDgSPbxRRIEYhe9X1kzWZxqpjvO93tZ+GhXUxtLFG4PjnbQhINy1A
 BMNlxcq4ktVHk9gwLaG9wcySjINnN/wK91o3dQ9YjwTuCAxFi/AqUVjY+OOmguAh
 TO0mkEq99M0=
 =HTPk
 -----END PGP SIGNATURE-----

Merge tag 'sched-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler updates from Ingo Molnar:
 "Load-balancing updates:

   - 'flatten the pick': improve cgroup scheduling, which has always
     been problematic and painful, which has caused various scheduling
     misbehavior such as the mishandling of reniced tasks et al.

     Add various cgroup weight distribution methods via cgroup_mode:
     'up', 'max', 'concur' and 'tasks' - with the default being 'concur'
     which is the most precise yet also most expensive version.

     Finally, change cgroup scheduling to a single runqueue (Peter
     Zijlstra)

   - Series to improve the scheduling latency of short slice tasks
     (Vincent Guittot)

   - Series to fix cluster scheduling in the presence of asymmetric
     capacity (Ricardo Neri)

   - Prefer fully idle cores for NOHZ balancing (Andrea Righi)

   - Don't trigger active load-balancing if src_rq->curr is not on_rq
     (Xin Zhao)

  PSI updates:

   - Skip irqtime accounting when no new irq time has elapsed (Usama
     Arif)

  Scheduler debugging updates:

   - Remove unused schedstats (Shrikanth Hegde)

   - Defer freeing of cpumask memblock memory to initcall (Waiman Long)

  Misc fixes and updates by Yu C Chen, K Prateek Nayak, Peter Zijlstra,
  Vincent Guittot, Xin Zhao, Yury Norov, Zhan Xusheng"

* tag 'sched-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits)
  sched/fair: Fix flat hierarchy
  sched/isolation: Defer freeing of cpumask memblock memory to initcall
  sched/topology: Restore SD_PREFER_SIBLING in domains with asymmetric capacity
  sched/fair: Allow load balancing between CPUs of identical capacity
  sched/fair: Skip misfit load accounting when the destination CPU cannot help
  sched/fair: Check CPU capacity before comparing group types during load balance
  sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
  sched/fair: Do not skip CPUs of similar capacity with busy SMT siblings
  sched/fair: Prefer fully idle cores for NOHZ balancing
  stop_machine: Make stop_one_cpu_nowait() return void
  sched/eevdf: Delayed dequeue task can't preempt
  sched/fair: Fix stale comments referring to removed CFS concepts
  sched/debug: Remove unused schedstats
  sched/psi: skip irqtime accounting when no new irq time has elapsed
  sched/fair: Reflow sched_balance_rq()
  sched/fair: Simplify balance_interval reset logic in sched_balance_rq()
  sched/fair: Don't trigger active lb if src_rq->curr is not on_rq
  sched/eevdf: Speedup short slice task scheduling
  sched/eevdf: Always update slice protection
  sched/eevdf: Cancel slice protection if short slice task is eligible
  ...
2026-08-18 13:39:48 -07:00
Linus Torvalds
dfa35434d7 Locking updates for v7.3:
Futexes:
 
  - Use runtime constants for futex_hash computation
    (K Prateek Nayak, Peter Zijlstra)
 
  - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)
 
  - Avoid private hash use-after-free on final put (Felix Hoffmann)
 
  - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)
 
 Rust integration updates:
 
  - Implement refcounted interrupt disable and SpinLockIrq for Rust
    (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)
 
  - Rust sync: add helpers for mb, dma_mb and friends;
    add generic memory barriers and use LKMM atomics
    instead of Rust atomics in the revocable code (Gary Guo)
 
  - Add abstraction and integrate synchronize_rcu() (Philipp Stanner)
 
 Lock debugging:
 
  - Add qspinlock contended_release tracepoint
    (Dmitry Ilvokhin, Peter Zijlstra)
 
  - Enable the printing of held locks of remote running tasks and print
    task CPU (Ingo Molnar)
 
  - percpu-rwsem: Annotate intentional data race in readers_active_check()
    (Sun Shaojie)
 
 Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
 Naveen Kumar Chaudhary and Thomas Huth.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC2KMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gNwg//awvTQONfhPanAyTgl7CLDSlMSHdqmlyh
 Ue0/Q8Ef1Cy4jwXY2FE2A0b1VcM6cGpDPoryVdg/wMdUXRNwinzAEXmxIkRy9kve
 4LybrZwDShgLxJ7pJ6KKhgjgDiat8EdYmOwCBEE3LnP7AYhkAb8BFetA3YZJvzPa
 KfA2BRYCgvBTid6yOAuXWm55Ev92AczOBamBzTxCadcaDGtNGXtQO6LfnqiQDOav
 X5tVoANBeaQtSs1+LxE41WdNOiRoBuy0IFFvXtZRal6PZYuGGmZ5tbQvscD099em
 haVwQyzDHQrqzglv71M0KRTXvYzdGveMRg/Au1SQnuLO3V6Vd5rMQ1g7I2M9Ln0f
 Pg+tlRvQ77mLoqcgrtl0W/u0fRR4eDkiJ1pmG+98oniPwau23RdbFhC0vKFz3ikF
 WHMgk3/9TcULylgF1Tj6QLmNrBY3Vx8LBdsFjhflEw7bG4cW42D91npmXIiEDE6K
 tJc9CcaVdyE75o59z2Dtjj+qQVBlNPlfKQFXFL7p3jU/gFw2SzYuqon66X3kGmr0
 mKJ9UNJdkLdiCjxS/QiMcDeYhwJksJqxFBkH50z3Kzmo84JsSpUFkoa6GM4aSiGn
 HEwgC0Q7oOXVNIKUBYk5QaRW0HSk55hbsX2TWkvpeBYkE1zXshVZCCmgpaTSJgb5
 oFmiwrGfUjo=
 =slqC
 -----END PGP SIGNATURE-----

Merge tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking updates from Ingo Molnar:
 "Futexes:

   - Use runtime constants for futex_hash computation (K Prateek Nayak,
     Peter Zijlstra)

   - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)

   - Avoid private hash use-after-free on final put (Felix Hoffmann)

   - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)

  Rust integration updates:

   - Implement refcounted interrupt disable and SpinLockIrq for Rust
     (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)

   - Rust sync: add helpers for mb, dma_mb and friends; add generic
     memory barriers and use LKMM atomics instead of Rust atomics in the
     revocable code (Gary Guo)

   - Add abstraction and integrate synchronize_rcu() (Philipp Stanner)

  Lock debugging:

   - Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter
     Zijlstra)

   - Enable the printing of held locks of remote running tasks and print
     task CPU (Ingo Molnar)

   - percpu-rwsem: Annotate intentional data race in readers_active_check()
     (Sun Shaojie)

  Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
  Naveen Kumar Chaudhary and Thomas Huth"

* tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits)
  rust: sync: Introduce SpinLockIrq::lock_with() and friends
  rust: sync: Add SpinLockIrq
  rust: sync: Use super::* in spinlock.rs
  rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers
  rust: Introduce interrupt module
  s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
  arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
  preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS
  sched: Avoid signed comparison of preempt_count() in __cant_migrate()
  sched: Remove the unused preempt_offset parameter of __cant_sleep()
  locking: Switch to _irq_{disable,enable}() variants in cleanup guards
  irq: Add KUnit test for refcounted interrupt enable/disable
  irq,spin_lock: Add counted interrupt disabling/enabling
  openrisc: Include <linux/cpumask.h> in smp.h
  preempt: Introduce __preempt_count_{sub,add}_return()
  preempt: Introduce HARDIRQ_DISABLE_BITS
  preempt: Track NMI nesting to separate per-CPU counter
  futex: Tell kmemleak we're not leaking __futex_queues
  x86/paravirt: Trace contended_release on unlock
  tracing/lock: Use TRACE_EVENT_FN() for contended_release
  ...
2026-08-18 13:07:17 -07:00
Linus Torvalds
8915457146 Performance events updates for v7.3:
uprobes updates:
 
  - Patch series to fix a category of bugs with optimized uprobes that
    can clobber the redzone area with call instruction storing return
    address on stack where user code may keep temporary data without
    adjusting RSP. Fix this by moving the optimized uprobes on top of
    10-bytes NOP instruction, so we can squeeze another instruction to
    escape the redzone area before doing the call.
    (Jiri Olsa, Andrii Nakryiko)
 
  - Switch uretprobes_srcu to SRCU-fast-updown, to improve performance
    (Puranjay Mohan)
 
 Intel CPU PMU driver updates:
 
  - Optimize ACR handling in match_prev_assignment() (Dapeng Mi)
  - Patch series to fix various PMU driver bugs and data leaks (Dapeng Mi)
  - Fix Intel PT stop/start with no update (Adrian Hunter)
 
 Intel uncore PMU driver updates:
 
  - Series to fix various uncore PMU setup robustness bugs (Zide Chen)
 
 AMD uncore PMU driver updates:
 
  - Add group validation (Sandipan Das)
 
 Misc fixes and updates by Dapeng Mi, Randy Dunlap and Zide Chen.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC1G0RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gMehAAh/p3A42YKWgcEjnlmCTJ+RTGTrLbL/OB
 Q2uj4H9D32lBV8+ZyBjt3iVT5u8Z3pliUMAq4yaLua6SiWO4gbb/XLp7K9tnHSj9
 J/9zvOdxC74ZmnuKYzcjmSAFzYL0VmfHoHUMXNKEqjP/cfZnlp7Zhs7n0s+aEt9h
 IzkgzUt3maY7xjXnBXiHHmIvOrGt5i2avXFJxUeE6YPnRjUK6+8b8jzJTsvL7GrM
 lVTG7D0ptRELVKpgvbHWAK4738Oxls0tB6KmEHO+lMwM5i2OFy/Xs3PxX7Z6ruII
 3+RUAk9K8MNpxG+eIUzBs+Qu3a3cS/bAMS4LiD+oKSg0OxAbnvRey1l0uQOZLevb
 UUG3mNMpOJ0rfQIBMT0FhJZ7Rk6V0XRCfjyXnrZhfjCa879g+GPxrHoSAVjMa0PG
 S1y51mj5QNeXwMi7U9Pwl88GF2TLsxj1kNlpgMrFfZywjXD5wp2Oqd6s+fVuFk/X
 5FuUcY7evchxXjlfrYM84gtBBklVeOmd4yrqAGmhM5LUoFBCTt6HPzzn8U9Z8BIm
 qZvtSsZ4/FGQPNrAbGXXQ1tWxxP+g0HeRYmyxoj2n6Xpope8vDdWzs/cA1NeG9Dl
 4sbwkiOmWUCBniR05oTTCFtSejnr3UIq/H/ulUJRSRHocGaveFVhuUJYqQRsfUSX
 d223r/dlwj0=
 =V8n9
 -----END PGP SIGNATURE-----

Merge tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull performance events updates from Ingo Molnar:
 "uprobes updates:

   - Fix a category of bugs with optimized uprobes that can clobber the
     redzone area with call instruction storing return address on stack
     where user code may keep temporary data without adjusting RSP.

     Fix this by moving the optimized uprobes on top of 10-bytes NOP
     instruction, so we can squeeze another instruction to escape the
     redzone area before doing the call (Jiri Olsa, Andrii Nakryiko)

   - Switch uretprobes_srcu to SRCU-fast-updown, to improve performance
     (Puranjay Mohan)

  Intel CPU PMU driver updates:

   - Optimize ACR handling in match_prev_assignment() (Dapeng Mi)

   - Fix various PMU driver bugs and data leaks (Dapeng Mi)

   - Fix Intel PT stop/start with no update (Adrian Hunter)

  Intel uncore PMU driver updates:

   - Fix various uncore PMU setup robustness bugs (Zide Chen)

  AMD uncore PMU driver updates:

   - Add group validation (Sandipan Das)

  .. and misc fixes and updates by Dapeng Mi, Randy Dunlap and Zide Chen"

* tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits)
  perf/x86: Optimize ACR handling in match_prev_assignment()
  perf/x86/intel: Fix intel_cap handling on hybrid PMUs
  perf/x86: Remove stale fixed counter helper and fix hybrid PMU access
  perf/x86/intel: Unwind cpuc state if PEBS buffer setup fails
  perf/x86: Guard intel_pmu_cpu_dead() against invalid hybrid PMU casts
  perf/x86: Free hybrid state on PMU init failure
  perf/x86: Unregister PMI handler on PMU init failure
  perf/x86/intel/pt: Fix stop/start with no update
  perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
  perf/x86/intel/pt: Factor out pt_config_enable()
  uprobes: Switch uretprobes_srcu to SRCU-fast-updown
  srcu: Add lock guard for srcu_fast_updown flavor
  perf/x86/intel/pt: Drop kernel-doc for deleted struct members
  perf/x86/amd/uncore: Add group validation
  selftests/bpf: Add tests for forked/cloned optimized uprobes
  selftests/bpf: Add tests for uprobe nop10 red zone clobbering
  selftests/bpf: Add reattach tests for uprobe syscall
  selftests/bpf: Change uprobe/usdt trigger bench code to use nop10
  selftests/bpf: Change uprobe syscall tests to use nop10
  selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch
  ...
2026-08-18 12:31:07 -07:00
Linus Torvalds
7b24dd46a7 liveupdate: updates for v7.3-rc1
KHO:
 * Fix size calculation in kho_preserved_memory_reserve() for preservations
   larger than 2 GiB
 
 LUO:
   * move liveupdate selftest utilities into a library so that selftests of
     subsystems participating in liveupdate, e.g. PCI and VFIO, can use them and
     drop direct ioctl calls from the tests
   * add end to end liveupdate test infrastructure that allows running the
     tests across a kexec in QEMU
   * remove redundant INIT_LIST_HEAD in luo_session_alloc()
   * remember the error status of an FLB retrieve() and return it on subsequent
     attempts rather than retrying retrieve() with an FLB in an unexpected
     state
   * reference count the outgoing FLB so that it cannot be freed while a caller
     is using it, the same way it's done for the incoming FLB
   * reject nonzero reserved field in LIVEUPDATE_SESSION_FINISH so that it can
     be reused by a future extension
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmp9oz8ACgkQOQOGJssO
 /ZHtBwf+LyzW59fGyPd8hHASkqcGzlvRGe9E1ML1XjbR7vMPPxCwt/WbJ6V5dbIb
 Se/jNVrcnaI0NE1vudeA3uNqdboQwOQ8+KiPdLp/SjGsPptlQgpORX86gMf5ggYR
 rVl7FFCqQcZmVHbAvLWhuSdVfhdADBjeR50JfqVcLUch1L48ykkHLJG+n7cEsClg
 2YGsANNyM+l72JPBHzjRsy57O4fxCr5z9AQLJTHJYkT7N3j3aXprCzY00duFfiZw
 4xOlvgUAkcxEOs5J27Ra8X+Wy6EmNwL72vZQLC7JuLCaGnfQ0EAtHuOB/E5CQX9G
 o9fwgR8mY4/UPM2ao7+MjkV2cv23yA==
 =p+yU
 -----END PGP SIGNATURE-----

Merge tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

Pull liveupdate updates from Mike Rapoport:
 "Kexec Handover:

   - Fix size calculation in kho_preserved_memory_reserve() for
     preservations larger than 2 GiB

  Live Update Orchestrator:

   - move liveupdate selftest utilities into a library so that selftests
     of subsystems participating in liveupdate, e.g. PCI and VFIO, can
     use them and drop direct ioctl calls from the tests

   - add end to end liveupdate test infrastructure that allows running
     the tests across a kexec in QEMU

   - remove redundant INIT_LIST_HEAD in luo_session_alloc()

   - remember the error status of an FLB retrieve() and return it on
     subsequent attempts rather than retrying retrieve() with an FLB in
     an unexpected state

   - reference count the outgoing FLB so that it cannot be freed while a
     caller is using it, the same way it's done for the incoming FLB

   - reject nonzero reserved field in LIVEUPDATE_SESSION_FINISH so that
     it can be reused by a future extension"

* tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  kho: fix size calculation in kho_preserved_memory_reserve()
  selftests/liveupdate: Move luo_test_utils.* into a reusable library
  selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIs
  liveupdate: Remember FLB retrieve() status
  liveupdate: Reference count outgoing FLB data
  liveupdate: reject nonzero reserved value for SESSION_FINISH
  liveupdate: Remove redundant INIT_LIST_HEAD in luo_session_alloc
  selftests/liveupdate: add end to end test infrastructure and scripts
2026-08-18 10:43:01 -07:00
Linus Torvalds
ba24659b1d kexec: updates for v7.3-rc1
* Deduplicate crash memory allocation and the exclusion of reserved crash
   kernel regions from architecture specific code into a generic
   crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and
   riscv reservation on arm64 and riscv.
 * Skip purgatory checksum verification when the kexec segments cannot be
   corrupted by DMA, which saves about 250ms on kexec.
 * Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in
   include/linux/kexec.h.
 * Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore
   path, which over-dropped the user keyring reference when more than one key
   was restored.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmp9ouoACgkQOQOGJssO
 /ZEH/Af/b1qmnw8uUe2wzd1zcAEEsk6YwF8lmS5o4k7skiVKlHWQuDzPrwrxFTvg
 d6obJrLllMN2ULyLQ8ghMKbsdo8RCGBIpXF+bPEXmIF8bA/PhtDaxvi3scsxvie6
 zU3geZbExlzg0Ik525I0DyPoEZc2JAg5ietp8bF6ZN5HNkDtBoNvi2ROc4mR9kzO
 agrczVnIEuIE3Tk+IfD6081iS3Wz/PjRC+yPBU1yYFobA6/bL7kFma7kED8PnxvI
 2+oENcd1FtC/WBlmluZE0BC4SjNcsT1geyzAFlGlRvNzbHdtj13j6mTBSsbRpJMW
 WdewVpIpFGUqRbUIIdvOISLOcf62lg==
 =PjFs
 -----END PGP SIGNATURE-----

Merge tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

Pull kexec updates from Mike Rapoport:

 - Deduplicate crash memory allocation and the exclusion of reserved
   crash kernel regions from architecture specific code into a generic
   crash_prepare_headers() and enable crashkernel CMA reservation on
   arm64 and riscv reservation on arm64 and riscv.

 - Skip purgatory checksum verification when the kexec segments cannot
   be corrupted by DMA, which saves about 250ms on kexec.

 - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in
   include/linux/kexec.h.

 - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key
   restore path, which over-dropped the user keyring reference when
   more than one key was restored.

* tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  crash_dump: release keyring reference at the correct time
  kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file
  kexec_file: skip checksum verification when safe
  riscv: kexec_file: Add support for crashkernel CMA reservation
  arm64: kexec_file: Add support for crashkernel CMA reservation
  powerpc/kexec_file: Use crash_exclude_core_ranges() helper
  LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code
  riscv: kexec_file: Use crash_prepare_headers() helper to simplify code
  x86/crash: Use crash_prepare_headers() helper to simplify code
  arm64: kexec_file: Use crash_prepare_headers() helper to simplify code
  crash: Add crash_prepare_headers() to exclude crash kernel memory
  powerpc/crash: sort crash memory ranges before preparing elfcorehdr
  riscv: kexec_file: Fix crashk_low_res not exclude bug
2026-08-18 10:28:28 -07:00
Linus Torvalds
a5778046a0 Power management updates for 7.3-rc1
- Minor fixes and cleanups in assorted cpufreq drivers (Dan Carpenter,
    Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha Finkelstein,
    and Pan Chuang)
 
  - Fix cpufreq table creation and bios_limits() callback in the Rust
    bindings (Priya Bala Govindasamy)
 
  - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan)
 
  - Adjust the .adjust_perf() cpufreq driver callback to allow the
    maximum performance value to be passed to drivers and update the
    intel_pstate driver to use it (Rafael Wysocki)
 
  - Set policy->cur to the actual requested frequency in the intel_pstate
    driver when the performance policy is used (Rafael Wysocki)
 
  - Simplify HWP handling on Broadwell processors in intel_pstate (Rafael
    Wysocki)
 
  - Fix setting minimum P-state at init time in intel_pstate (Rafael
    Wysocki)
 
  - Consolidate frequency values computation in intel_pstate and clean up
    code in that driver (Rafael Wysocki)
 
  - Add missing kernel-doc descriptions for structure and union members
    in the amd-pstate driver (David Vernet)
 
  - Handle missing policy in dynamic EPP callbacks in the amd-pstate
    driver (EDAMAMEX)
 
  - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver
    symbols to the amd-pstate-ut subdriver (K Prateek Nayak)
 
  - Add dynamic EPP as an "energy_performance_preference" mode in
    amd-pstate, remove the "amd_dynamic_epp" kernel command line option
    and the "dynamic_epp" sysfs attribute, and update the dynamic_epp
    documentation accordingly (K Prateek Nayak)
 
  - Add unit tests for CPPC Performance Priority and the "dynamic" EPP
    mode in the amd-pstate driver (K Prateek Nayak)
 
  - Set min_limit_freq based on bios_min_perf in amd-pstate and remove
    the defensive check for bios_min_perf from it (K Prateek Nayak)
 
  - Fix EPP return type and handle errors in amd-pstate during
    initialization, toggle auto_sel in active mode on shared memory
    systems, and cache the firmware programmed EPP value (Marco Scardovi)
 
  - Skip tests in amd-pstate-ut if the amd-pstate driver is not in active
    use (Qianheng Peng)
 
  - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq
    schedutil governor and fix a self-contradictory comment in
    sugov_iowait_apply() (Zhongqiu Han)
 
  - Fix the usage example for the sampling_rate tunable of the ondemand
    cpufreq governor in admin-guide (wangxiaodong)
 
  - Avoid using deep idle states during initialization in the intel_idle
    driver to work around device handling issues (Rafael Wysocki)
 
  - Fix and refactor the ACPI processor driver code related to ACPI _LPI
    support and add ACPI _LPI support to intel_idle based on that ACPI
    processor driver update (Rafael Wysocki)
 
  - Backup and restore governor for cpufreq sptests (Yiwei Lin)
 
  - Remove unnecessary sudo from quick_shuffle() and remove unused local
    variables from switch_show_governor() in cpufreq selftests (Jinseok
    Kim)
 
  - Rename the PM core module parameter prefix to "pm" and allow the PM
    transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih)
 
  - Fix off-by-one in wakelocks number limit check in the system sleep
    sysfs interface (Haowen Tu)
 
  - Remove kernel-doc markings from helper descriptions in the core
    hibernation code (Adi Nata)
 
  - Use %pe to print error pointer values in the hibernation core (Ronan
    Marchal)
 
  - Fix memory leak in snapshot_write_next() error path (Malaya Kumar
    Rout)
 
  - Delay allocating and linking the next swap_map_page in the
    hibernation image saving code until another image page actually
    needs to be recorded (Haesung Kim)
 
  - Fix cleanup ordering around scope-based pointers in OPP (Gregor
    Herburger).
 
  - Use clk_get_optional() for optional clocks in OPP (Praveen Talari).
 
  - Stop setting runtime_error on runtime resume callback failures to
    allow drivers to recover from resume issues (Praveen Talari)
 
  - Handle PMU registration failure during probe in the intel_rapl_tpmi
    driver (Sumeet Pawnikar)
 
  - Avoid optional imports in intel_pstate_tracer unless they are really
    needed (Yousef Alhouseen)
 
  - Add generic CPPC performance display to the cpupower utility, build
    and call CPPC information on non-AMD processors, make cpupower print
    kernel and hardware frequency information, and add libm to cpupower
    for generic CPPC view (Jeremy Linton)
 
  - Remove conditional return with no effect from cpupower (Sang-Heon
    Jeon)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmp+DXsSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO10Z4IAIYwM9RKwbwCqPMKGvWExIb+1kpEy1aw
 wyFnYSiQd09XCt8/YjERFR9gB7CfGduisTxEOqOdCIpGX2rT9Me5xO5aR5Gz4FE3
 bML7KyulS9tVyaEVBjFx1yDZxGTNooTQVTLIxBYbCVB1RrgiCGdLyC2okn79XHlk
 olTZemq59Kn0B6t7BP7UQ0WCCCAs3RlbrQIZSrVh0HydoO0DHlJvttN2fc7bjeiM
 Je/dSm14o+vjglkVpY1kbxzBHJOH7/XH5nqSQRoHoAZWdllWK4+iQtll63Un4A72
 2KG0O5+nFrS3d166TEjDEInnEwR012Sod/8Gk72M0IZZhG/naqs5ekE=
 =mn7E
 -----END PGP SIGNATURE-----

Merge tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management updates from Rafael Wysocki:
 "As has been the case for quite some time, this set of changes is
  dominated by cpufreq updates including intel-pstate and amd-pstate
  driver updates, minor fixes and cleanups of other assorted cpufreq
  drivers, schedutil governor updates, fixes of the Rust bindings, new
  hardware support (IPQ5210 in qcom-nvmem), and some updates of self
  tests related to cpufreq.

  The second largest group of changes are cpuidle updates consisting of
  intel_idle driver updates and ACPI processor idle driver updates, both
  mostly related to ACPI _LPI support.

  There are also updates related to system sleep, mostly in the
  hibernation core code, two operating performance points (OPP) updates,
  one runtime PM framework update, one power capping update, and some
  tools updates including the addition of ACPI CPPC support to cpupower.

  Specifics:

   - Minor fixes and cleanups in assorted cpufreq drivers (Dan
     Carpenter, Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha
     Finkelstein, and Pan Chuang)

   - Fix cpufreq table creation and bios_limits() callback in the Rust
     bindings (Priya Bala Govindasamy)

   - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan)

   - Adjust the .adjust_perf() cpufreq driver callback to allow the
     maximum performance value to be passed to drivers and update the
     intel_pstate driver to use it (Rafael Wysocki)

   - Set policy->cur to the actual requested frequency in the
     intel_pstate driver when the performance policy is used (Rafael
     Wysocki)

   - Simplify HWP handling on Broadwell processors in intel_pstate
     (Rafael Wysocki)

   - Fix setting minimum P-state at init time in intel_pstate (Rafael
     Wysocki)

   - Consolidate frequency values computation in intel_pstate and clean
     up code in that driver (Rafael Wysocki)

   - Add missing kernel-doc descriptions for structure and union members
     in the amd-pstate driver (David Vernet)

   - Handle missing policy in dynamic EPP callbacks in the amd-pstate
     driver (EDAMAMEX)

   - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver
     symbols to the amd-pstate-ut subdriver (K Prateek Nayak)

   - Add dynamic EPP as an "energy_performance_preference" mode in
     amd-pstate, remove the "amd_dynamic_epp" kernel command line option
     and the "dynamic_epp" sysfs attribute, and update the dynamic_epp
     documentation accordingly (K Prateek Nayak)

   - Add unit tests for CPPC Performance Priority and the "dynamic" EPP
     mode in the amd-pstate driver (K Prateek Nayak)

   - Set min_limit_freq based on bios_min_perf in amd-pstate and remove
     the defensive check for bios_min_perf from it (K Prateek Nayak)

   - Fix EPP return type and handle errors in amd-pstate during
     initialization, toggle auto_sel in active mode on shared memory
     systems, and cache the firmware programmed EPP value (Marco
     Scardovi)

   - Skip tests in amd-pstate-ut if the amd-pstate driver is not in
     active use (Qianheng Peng)

   - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq
     schedutil governor and fix a self-contradictory comment in
     sugov_iowait_apply() (Zhongqiu Han)

   - Fix the usage example for the sampling_rate tunable of the ondemand
     cpufreq governor in admin-guide (wangxiaodong)

   - Avoid using deep idle states during initialization in the
     intel_idle driver to work around device handling issues (Rafael
     Wysocki)

   - Fix and refactor the ACPI processor driver code related to ACPI
     _LPI support and add ACPI _LPI support to intel_idle based on that
     ACPI processor driver update (Rafael Wysocki)

   - Backup and restore governor for cpufreq sptests (Yiwei Lin)

   - Remove unnecessary sudo from quick_shuffle() and remove unused
     local variables from switch_show_governor() in cpufreq selftests
     (Jinseok Kim)

   - Rename the PM core module parameter prefix to "pm" and allow the PM
     transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih)

   - Fix off-by-one in wakelocks number limit check in the system sleep
     sysfs interface (Haowen Tu)

   - Remove kernel-doc markings from helper descriptions in the core
     hibernation code (Adi Nata)

   - Use %pe to print error pointer values in the hibernation core
     (Ronan Marchal)

   - Fix memory leak in snapshot_write_next() error path (Malaya Kumar
     Rout)

   - Delay allocating and linking the next swap_map_page in the
     hibernation image saving code until another image page actually
     needs to be recorded (Haesung Kim)

   - Fix cleanup ordering around scope-based pointers in OPP (Gregor
     Herburger).

   - Use clk_get_optional() for optional clocks in OPP (Praveen Talari).

   - Stop setting runtime_error on runtime resume callback failures to
     allow drivers to recover from resume issues (Praveen Talari)

   - Handle PMU registration failure during probe in the intel_rapl_tpmi
     driver (Sumeet Pawnikar)

   - Avoid optional imports in intel_pstate_tracer unless they are
     really needed (Yousef Alhouseen)

   - Add generic CPPC performance display to the cpupower utility, build
     and call CPPC information on non-AMD processors, make cpupower
     print kernel and hardware frequency information, and add libm to
     cpupower for generic CPPC view (Jeremy Linton)

   - Remove conditional return with no effect from cpupower (Sang-Heon
     Jeon)"

* tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (76 commits)
  cpufreq: imx6q: fix out-of-bounds write when probed more than once
  cpufreq: imx6q: fix devres accumulation across driver rebind
  rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
  rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
  opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer
  intel_idle: Avoid using deep idle states during initialization
  cpupower: remove conditional return with no effect
  cpufreq: intel_pstate: Adjust policy->cur in active mode to policy
  cpufreq/amd-pstate: Document missing kernel-doc members
  cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority
  cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode
  cpufreq/amd-pstate: Reduce the scope of exported symbols
  Documentation/amd-pstate: Update dynamic_epp documentation with new behavior
  cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs
  cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode
  cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper
  cpufreq/amd-pstate: Remove the defensive check for bios_min_perf
  cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
  powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
  PM: sleep: Allow disabling DPM watchdog by default
  ...
2026-08-18 08:47:09 -07:00
Tejun Heo
fab183d632 sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3
Pull to receive the __arena argument conversion:

 67f1f4a48c ("sched_ext: Pass kernel arena pointers to ops_cid callbacks")
 a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")
 a05c5b5cb5 ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments")

along with the bpf-next branch carrying the __arena argument support they
depend on.

Conflict in kernel/sched/ext/ext.c between:

 c384ab8a0b ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c")

and:

 a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")

which updated the stubs in their old ext.c location. Resolved by keeping
ext.c without the stubs and applying the prototype conversion to the
relocated stubs in sub.c.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-17 11:20:34 -10:00
Linus Torvalds
55668d04e3 vfs-7.3-rc1.netfs
Please consider pulling these changes from the signed vfs-7.3-rc1.netfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
 oq5VAPwLHEyDBJUM581Nsj9O7NnkSRhffjp4//Cp2jHRYkaR4wEAiceqF+rONVWK
 VYCyLEDSU5TPP9EeON95qSzq0khbswo=
 =kcGi
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull cachefiles ondemand removal from Christian Brauner:
 "This sunsets cachefiles ondemand mode.

  It was an effort to make fscache usable as a kernel cache for lazy
  pulling. EROFS over fscache was its only in-tree user. fscache has
  since become netfslib-oriented while EROFS never acts as a network
  filesystem and EROFS over fscache has been removed.

  So this cleans up the netfs, fscache and cachefiles side as well"

* tag 'vfs-7.3-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  cachefiles,netfs: sunset ondemand mode
2026-08-17 13:32:50 -07:00
Linus Torvalds
fff0150b02 vfs-7.3-rc1.kthread
Please consider pulling these changes from the signed vfs-7.3-rc1.kthread tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
 ohHuAQCFeGhxqsb44KhuJaWXewiXbefr6eg31lXmxgSfg0DILAD/Tw/WmpiUbX5M
 H+/jh6NmLKnQ/ADjlWFRy3R1K1Il3w4=
 =jwPP
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull kthread vfs updates from Christian Brauner:
 "This stops kernel threads from sharing filesystem state with
  userspace. This work is about 3 cycles old and has been in -next
  for about that time.

  When the kernel boots init_task creates PID 1 and then kthreadd. From
  that point every kthread and PID 1 share the same fs_struct. That is
  why pivot_root() has to rewrite the fs_struct of all kthreads. The
  rewriting exists so that kthreads can use init's filesystem state when
  they want to. It also means userspace can move the ground out from
  under the kernel.

  PID 1 now gets a completely separate fs_struct. All kthreads are
  anchored in a private SB_KERNMOUNT instance of nullfs that cannot be
  mounted on and cannot be used to follow other mounts. Userspace init
  can no longer affect kthread filesystem state and kthreads can no
  longer affect userspace fs state without explicit opting in to that.

  Path lookup from a kthread now fails by default. It makes it
  deliberately hard to offload security sensitive operations into init's
  filesystem state from a kthread.

  Places that legitimately need to look something up there opt in
  through the new scoped_with_init_fs() which temporarily overrides the
  caller's fs_struct with init's. usermodehelpers remain the only kernel
  tasks that genuinely share init's filesystem state, since they execute
  random binaries in the root filesystem (excellent...).

  The visible result is that /proc/2/root is a nullfs with an empty
  mountinfo while /proc/1/root is the real root"

* tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (26 commits)
  initramfs_test: use test init/exit hooks to override init fs
  fs: stop rewriting paths for PF_EXITING | PF_DUMPCORE
  fs: stop rewriting kthread fs structs
  fs: start all kthreads in nullfs
  nullfs: make nullfs multi-instance
  devtmpfs: create private mount namespace
  fs: add umh argument to struct kernel_clone_args
  fs: stop sharing fs_struct between init_task and pid 1
  af_unix: use scoped_with_init_fs() for coredump socket lookup
  initramfs: use scoped_with_init_fs() for rootfs unpacking
  pnfs/blocklayout: use scoped_with_init_fs() for SCSI device lookup
  ksmbd: use scoped_with_init_fs() for VFS path operations
  ksmbd: use scoped_with_init_fs() for filesystem info path lookup
  ksmbd: use scoped_with_init_fs() for share path resolution
  fs: use scoped_with_init_fs() for kernel_read_file_from_path_initns()
  coredump: use scoped_with_init_fs() for coredump path resolution
  btrfs: use scoped_with_init_fs() for update_dev_time()
  scsi: target: use scoped_with_init_fs() for APTPL metadata
  scsi: target: use scoped_with_init_fs() for ALUA metadata
  crypto: ccp: use scoped_with_init_fs() for SEV file access
  ...
2026-08-17 11:35:12 -07:00
Linus Torvalds
b9cba7ebfe vfs-7.3-rc1.binfmt
Please consider pulling these changes from the signed vfs-7.3-rc1.binfmt tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
 ovtnAQDiMF2CvH2vr/eiUEUNdDjeyzRKipkh3a9krO0XbFxpnAD8CZypBFw/oWOQ
 7z3PDGhHp10ie6KYC45XbUc+a4b6vgQ=
 =X9RZ
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull binfmt updates from Christian Brauner:
 "This contains a bunch of work for binfmt_misc. It fixes a bunch of
  old bugs, reworks the locking, and then extends the format registry
  so a binary type can be matched programmatically and its interpreter
  computed per exec instead of being a fixed string recorded at
  registration time.

  This allows nixos and other to e.g., implement relocatable binaries
  meaning the interpreter/dynamic loader can be determined
  programatically, say found relative to the binary. The mechanism is
  flexible and can support other policies:

   - Handler lookup is now an rcu walk. An exec that matches no
     binfmt_misc entry should now never write to a shared cacheline

   - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles

   - convert the entry file to a seq_file which simplifies things quite
     a bit and kills a lot of custom logic

   - make flags proper enums

   - rename struct Node to binfmt_misc_entry

   - allow entries to be removed with unlink(2)

   - Add the ability to attach bpf programs to binfmt_misc entries so
     it's possible to dynamically choose the execution environment such
     as the loader or interpreter on a per binary basis.

     A handler is an instance of a binfmt_misc_ops struct_ops with a
     ->match() and a ->load() program. match() decides from the entry
     lookup walk whether the handler applies under the same
     registration-order. It can read file content as needed not only the
     prefetched 256 bytes in bprm->buf.

     load() then selects the interpreter and stages it through the new
     bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and
     bpf_binprm_set_flags() kfuncs.

     Handlers are published in a registry keyed by the registering
     task's user namespace and activated through the existing text
     interface with a new 'B' type carrying the handler name:

	echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register

     The permission and namespacing model is unchanged. Activating a
     handler requires the same write access to an instance as any other
     registration. A container mounting its own instance escapes the
     host's entries exactly as before. The computed interpreter is
     opened with open_exec() under the caller's credentials and goes
     through full LSM vetting as the next binprm level. A program can
     only ever redirect the caller to something the caller could exec
     anyway.

   - Two dispatch modes are added. So far the chosen interpreter owns
     the whole process identity (argv[0], /proc/pid/cmdline,
     /proc/self/exe all name interpreter information). So relocatable
     find the dynamic linker instead. Also a binary passed to execveat()
     as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips
     because AT_ENTRY and AT_PHDR do not match the exe file. So PIE
     symbols are unrelocated.

     This adds transparent dispatch which allows the interpreter to load
     the binary through AT_EXECFD and leaves the argument vector exactly
     as the caller built it and labels mm->exe_file and comm with the
     binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector
     bit. The interpreter keeps control of mapping the binary.

     The second mode is loader substitution. This allows a binary to be
     executed natively and only the interpreter to be changed.

   - Last, interpreters can be bound at registration time. Each
     interpreter is opened by its own write with the credentials the
     entry file was opened with. The program picks one per exec with
     bpf_binprm_select_interp().

     Ucounts are used to properly account for pre-opened interpreters
     via /proc/sys/user/max_binfmt_misc_interpreters"

* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits)
  binfmt_misc: document the pre-opened interpreter limit
  selftests/exec: test the pre-opened interpreter limit
  binfmt_misc: correctly account pre-opened interpreters
  binfmt_misc: document interpreters bound by a 'B' entry
  selftests/exec: test interpreters bound to a 'B' entry
  binfmt_misc: let a 'B' entry bind its interpreters
  binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp
  selftests/exec: share the bpf handler preconditions
  binfmt_misc: document registering an entry disabled
  selftests/exec: test registering an entry disabled
  selftests/exec: let binfmt_flag_supported() return a bool
  selftests/exec: check that a binfmt_misc instance cannot be pinned
  binfmt_misc: let a register string create an entry disabled
  binfmt_misc: document loader substitution
  selftests/exec: test binfmt_misc loader substitution
  binfmt_misc: let a bpf handler request loader substitution
  binfmt_misc: add the 'L' loader substitution flag
  binfmt_elf_fdpic: consume a stashed PT_INTERP substitute
  binfmt_elf: consume a stashed PT_INTERP substitute
  exec: carry a PT_INTERP substitute in struct linux_binprm
  ...
2026-08-17 08:35:25 -07:00
Linus Torvalds
043d7a2b40 ipc-7.3-rc1.misc
Please consider pulling these changes from the signed ipc-7.3-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
 ooOoAP9pECC4lIvizRLhV+8id21aYyyHP6svcZDgMv7yI8E7qgD/Zaxt0hS/rsLY
 IUA9iphoZ6pWyPyv/Lq6M0mk3wyoigM=
 =KcXC
 -----END PGP SIGNATURE-----
mergetag object d7337cad4d
 type commit
 tag kernel-7.3-rc1.misc
 tagger Christian Brauner <brauner@kernel.org> 1786695972 +0200
 
 kernel-7.3-rc1.misc
 
 Please consider pulling these changes from the signed kernel-7.3-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
 osV7AP0cdSyVJmxYRbryVuQykwbH83e+VyUwla8Qy4Lx7DaPqgEAg6MyH2kFZCKY
 eahHCBwW7B5ef9x08zw1BpLwjhHNkQU=
 =MhTX
 -----END PGP SIGNATURE-----

Merge tags 'ipc-7.3-rc1.misc' and 'kernel-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc ipc and core updates from Christian Brauner:

 - reject mq_notify() with a zero signal number

 - fix coding style in the exit path

* tag 'ipc-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  mqueue: reject mq_notify with signo 0

* tag 'kernel-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  kernel: exit: fix coding style missing spaces
2026-08-17 08:27:30 -07:00
Kumar Kartikeya Dwivedi
fc009f4658
bpf: Distinguish function references in policy diagnostics
add_subprogs() rejects both BPF-to-BPF calls and BPF_PSEUDO_FUNC loads for
unprivileged programs. The latter loads a subprogram address for use as a
callback, but its Policy report currently describes it as a function call and
suggests avoiding calls that the program does not contain.

Select the operation and suggestion from the instruction kind. Preserve the
existing call wording for BPF_PSEUDO_CALL, and describe BPF_PSEUDO_FUNC as a
BPF function reference.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/d02e6a6d3b2dc43a207b8ba836ce62497b250dede9252e7409c5212201c794b7@mail.kernel.org
Link: https://lore.kernel.org/bpf/20260816015746.2632990-14-memxor@gmail.com
2026-08-17 11:58:24 +02:00
Kumar Kartikeya Dwivedi
6bd520a6e3
bpf: Preserve source attribution without source text
GCC emits BTF line records with a file name and line number, but leaves the
source line string empty. bpf_diag_source() currently treats that empty string
as if the complete line record were unavailable, so diagnostics fall back to
an instruction number and discard the function, file, and line attribution.

Print the available source location before deciding whether source context can
be rendered. When source text is absent, omit only the source context and retain
the diagnostic annotation and instruction context.

Fixes: b9c5d822f6 ("bpf: Add source and instruction diagnostic context")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260816015746.2632990-12-memxor@gmail.com
2026-08-17 11:58:23 +02:00
Kumar Kartikeya Dwivedi
cc782c7ad0
bpf: Correct kfunc argument diagnostics
The Call Type Safety diagnostics mishandle three kfunc argument classes.

BTF type ID 0 represents void, but btf_show_name() also uses zero to end
type traversal. A pointer that resolves to void therefore loses its pointee
name and is rendered as "()". End traversal directly for concrete terminal
types, but resolve referenced types before testing for ID zero, and name the
void terminal type explicitly. Format the complete parameter pointer type
for nullable kfunc arguments, so void pointers are reported as (void *).

Also add the missing structured report when an __szk memory-size argument is
not a verifier-known constant. Describe the generic bpf_refcount_acquire()
contract without deriving an object type from its void pointer prototype.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/668871823f90f69896d3db27b56db2f53e481162.camel@gmail.com
Link: https://lore.kernel.org/bpf/20260816015746.2632990-7-memxor@gmail.com
2026-08-17 11:58:22 +02:00
Kumar Kartikeya Dwivedi
09a0c2d678
bpf: Use canonical stack argument names in diagnostics
The main diagnostic identifies the first outgoing stack slot as stack
argument 1 and the sixth function argument. The causal history instead
labels the same value as stack arg6, making it look like a different slot.

Render causal-history targets in the verifier's canonical stack-argument
location form. The first outgoing slot is now shown as *(R11-8), matching
reg_arg_name(), while the main diagnostic retains its fuller slot and
ordinal description.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/eb1be5327d136b7e5bd6d68e76fef6de20c40790.camel@gmail.com
Link: https://lore.kernel.org/bpf/20260816015746.2632990-6-memxor@gmail.com
2026-08-17 11:58:22 +02:00
Kumar Kartikeya Dwivedi
b26c0b2dd5
bpf: Preserve R0 lineage across helper calls
check_helper_call() clears all caller-saved registers before taking the
diagnostic snapshot of R0. This records NOT_INIT as the old state for every
helper return and loses the lineage of the value held in R0 before the call.
bpf_diag_record_caller_saved() deliberately skips R0 because the paired
modification scope is responsible for it.

Open the R0 modification scope before clearing caller-saved registers,
matching the kfunc, ld_abs, and subprogram call paths.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260815073833.A93A91F000E9@smtp.kernel.org
Link: https://lore.kernel.org/bpf/48e6f021b89562f68850fe21ef8c78719819b04cf9c4e4f50bc791937d37ace8@mail.kernel.org
Link: https://lore.kernel.org/bpf/20260816015746.2632990-4-memxor@gmail.com
2026-08-17 11:58:21 +02:00
Junseo Lim
1b5aacd5b2 bpf: Reject negative optlen in cgroup getsockopt hook
A cgroup getsockopt BPF program can shrink ctx->optlen after the
kernel getsockopt handler has run. The kernel-buffer variant, used by
TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
length.

If BPF writes a negative optlen, that value is accepted and propagated
back to the TCP getsockopt code. It can then be passed to
copy_to_sockptr() as a size_t and trigger the hardened usercopy
bytes > INT_MAX warning.

Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
matching the lower-bound validation already present in the sockptr-based
getsockopt hook.

Fixes: 9cacf81f81 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
Reported-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Junseo Lim <zirajs7@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/187a4d756275aaaee5d65eecb63c1477b3b66554.1786448307.git.zirajs7@gmail.com
2026-08-17 11:33:29 +02:00
Daniel Borkmann
d99bda7f01 bpf: Rewrite any fault prone load out of a mem or btf_id pointer
bpf_convert_ctx_accesses() turns a BPF_LDX into a BPF_PROBE_MEM one by
matching the type recorded for the insn against a list of exact pointer
types. The list cannot keep up with the flag combinations the verifier
produces, and a type which is missing from it ends up as a plain load
without an exception table entry, so a bad address panics the kernel
instead of being handled.

Two such types exist today and are reachable:

  - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_ALLOC | NON_OWN_REF
  - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_RCU

Rather than adding the two, just drop the list and state the property
itself in the default case of the switch. This is a superset of what
the list matched, the untrusted PTR_TO_MEM does not have to carry
MEM_RDONLY for it anymore, and it stays in sync with the verifier side
which uses the same match in save_aux_ptr_type() and reg_type_mismatch_ok().

Assert that a fault prone type which does not get the rewrite for whatever
reason is rejected at load time rather than left to fault at runtime to
catch any future cases.

Fixes: 1b12171533 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref")
Fixes: 6fcd486b3a ("bpf: Refactor RCU enforcement in the verifier.")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260814215301.709827-4-daniel@iogearbox.net
2026-08-17 10:06:42 +02:00
Daniel Borkmann
ee9ad135b2 bpf: Reject a store through a fault prone pointer
check_ptr_to_btf_access() allows the program to store before the default
BTF access path gets to reject a non read access. ac65c710cc ("bpf:
Reject writes through untrusted BTF pointers") closed that for a
PTR_UNTRUSTED pointer, but a bare PTR_TO_BTF_ID may fault on a dereference
just the same and is let through.

A BPF_LDX gets the BPF_PROBE_MEM rewrite in bpf_convert_ctx_accesses()
and a bad address is handled, but a BPF_STX does not and cannot, there
is no probed store to rewrite. The store is emitted as a plain one without
an exception table entry and a bad address panics the kernel.

A bpf_qdisc program can reach this, bpf_qdisc_btf_struct_access() permits a
write to Qdisc::limit and Qdisc::next_sched is a plain struct Qdisc pointer
which the walk turns into the compat type:

  struct Qdisc *next = sch->next_sched;

  next->limit = 1000;

  BUG: kernel NULL pointer dereference, address: 0000000000000014
  RIP: 0010:bpf_prog_c6e14e7f32c8e325_bpf_fifo_enqueue+0x3a/0x12b
  Code: [...] bf e8 03 00 00 <89> 7e 14 41 8b 7f 14 [...]
  Kernel panic - not syncing: Fatal exception in interrupt

Fix by widen the check to bpf_may_fault_on_deref() so that it covers both.

Fixes: 27ae7997a6 ("bpf: Introduce BPF_PROG_TYPE_STRUCT_OPS")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260814215301.709827-3-daniel@iogearbox.net
2026-08-17 10:06:16 +02:00
Daniel Borkmann
f438ba7a4c bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch
reg_type_mismatch_ok() enumerates the pointer types which must not
silently share a BPF_LDX with a different one, since the type recorded
for the insn drives a rewrite in bpf_convert_ctx_accesses().

f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()") added
PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED as another type in need of one,
namely the BPF_PROBE_MEM rewrite, but did not add it there. Fix it by
adding the missing case to reg_type_mismatch_ok(), so that a PTR_TO_MEM
which may fault on deref is not mismatch ok anymore. The triage in
save_aux_ptr_type() then merges them.

Fixes: f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260814215301.709827-2-daniel@iogearbox.net
2026-08-17 10:05:39 +02:00
Daniel Borkmann
09c447564f bpf: Keep fault protection when merging pointer types
When the same BPF_LDX instruction is reached through paths that yield
different pointer types, save_aux_ptr_type() merges them into a single
type which is later used by bpf_convert_ctx_accesses() to decide whether
the load has to be rewritten into a BPF_PROBE_MEM one.

Before f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()")
the merge only accepted two PTR_TO_BTF_ID pointers and unconditionally
fell back to PTR_TO_BTF_ID | PTR_UNTRUSTED, so the merged type was always
one that gets the BPF_PROBE_MEM rewrite. However, the mentioned commit
widened the merge to also cover a PTR_TO_MEM base and replaced the
fallback by a union of the PTR_UNTRUSTED and MEM_RDONLY flags.

A union of flags though cannot express the property the later rewrite
is built upon, some examples:

  - PTR_TO_MEM merged with PTR_TO_BTF_ID | PTR_UNTRUSTED gets
    PTR_TO_MEM | PTR_UNTRUSTED but only the MEM_RDONLY variant is valid
  - PTR_TO_MEM merged with a plain PTR_TO_BTF_ID gets PTR_TO_MEM
    dropping the rewrite the latter type would have gotten
  - PTR_TO_MEM | MEM_RDONLY merged with a plain PTR_TO_BTF_ID gets
    PTR_TO_MEM | MEM_RDONLY which is not rewritten either since only
    its PTR_UNTRUSTED variant is

In all three cases a program can take the unsafe path at runtime with a
NULL or otherwise bad pointer and panic the kernel on the faulting load:

  BUG: kernel NULL pointer dereference, address: 0000000000000038
  RIP: 0010:bpf_prog_77531a87032eeaf1_mixed_mem_btf_id_type+0x4b/0x65
  Call Trace:
   <TASK>
   bpf_test_run+0x20b/0x460
   bpf_prog_test_run_skb+0x650/0xbe0
   __sys_bpf+0xb96/0x3140
   __x64_sys_bpf+0x2c/0x40
   do_syscall_64+0xba/0x590
  Kernel panic - not syncing: Fatal exception in interrupt

Note that the last two shapes have to be fixed right here, otherwise
the merged type retains nothing which marks the load as fault prone,
thus no rule in bpf_convert_ctx_accesses() can recover it. Fix it by
normalizing the merged type instead.

Reuse it in is_load_acq_unsafe() to avoid open coding, and trim the
overly verbose comment which is more of an implementation detail of
bpf_convert_ctx_accesses() anyway.

Fixes: f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260814215301.709827-1-daniel@iogearbox.net
2026-08-17 10:05:16 +02:00
Yiyang Chen
4bc49ae344 bpf: Check pointer type for all atomic RMW paths
Atomic RMW verification records an instruction pointer type only when the
current destination is PTR_TO_ARENA. A second path can therefore reach the
same instruction with an ordinary pointer without comparing it against the
saved arena type.

The post-verification fixup uses the saved type to rewrite the instruction
to BPF_PROBE_ATOMIC for every path. Record the actual destination type for
all atomic RMW paths so the existing mismatch check rejects incompatible
uses of one instruction.

Fixes: d503a04f8b ("bpf: Add support for certain atomics in bpf_arena to x86 JIT")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260816-bpf-next-038-mixed-atomic-v1-v2-1-4644c1886dbc@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-16 15:54:17 -07:00
Linus Torvalds
fd923b32d7 - Make sure a delayed sched entity's runtime stats are updated at the right
time so that it receives the proper lag compensation
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB/CQACgkQEsHwGGHe
 VUq4Eg//ZeldqtFqUxohjcy5ZrgJ9dhdxwRfqZgYhZCSqTJHVLqAxWVAHnJZWfiz
 Vh63rnt78rIPpVX6E/lZLnYm2VwhEO6P6piMzG4CVlh2pMySjhoRIQ3ufNAQRt0o
 P79Y29rLhDhHkOaL+jjgSr+ePiDzerrkBfYHK0wJ+BAjphjWxML1wYyCGwhWk/Lu
 KuXN/jzbEbAn2QWEwEy9KyxztzJlTYTE+l8jiGfRywAeZOBo8HaXg0HhuCwLnaXb
 yPmarhof2/7XUdW/CBGYggLaXF+mW6VeMaiqdhxSKl48KMpIfPnBC99/YCJy6vmQ
 pD+kOiysGSFy+3vMbTvjwOYV8T3g7LOpeVkY8KkVmAHUFVF9wBSyPULyooNuxGS9
 2pBv6Uz2ojm3wMVk+gggt2VU5uVNLsn9IKpNObyuBRDkt3My4Jej3cQ89LeqyS8Z
 q49JbAhEwCRfGpxq92WW6izMWjOnduhiTd9TXF/WoXVtcT9ZSbyxJ3sCxbTBrJxd
 na7xln2xsR8w9+G91DmmNPRnBtBkBOJ6xRGacKDeV8dcfKcZGGH6/sRMN9mIhP8v
 huCVazSwNCVWDaHn8o/ORBJ0dEJ/536a806ysYfB6MdNzZYtU8iepCj5Lr+uAG/Q
 W49ftqYFst9o22wT2i4ZdTfrDrkbekVU67BLv9yu8VcmoQJgt90=
 =bK3W
 -----END PGP SIGNATURE-----

Merge tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fix from Borislav Petkov:

 - Make sure a delayed sched entity's runtime stats are updated at the
   right time so that it receives the proper lag compensation

* tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched: Update time before requeueing delayed entities
2026-08-16 11:15:23 -07:00