mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
v7.4-rc1
11290 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
7a3d2740d1 |
Misc timer fixes:
- Fix on-stack hrtimer cleanup in play_idle_precise(), and
add the hrtimer_on_stack cleanup class to facilitate the fix
(Hui Su)
- Fix clock_getres() system call's handling of NULL output
pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)
- Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time
is exactly equal to the nonzero expiry (Hungyu Lin)
- Fix do_timens_ktime_to_host() time offset subtraction underflow
check (Hungyu Lin)
- Report zero remaining time for disarmed SIGEV_NONE posix timers,
and add a self-test to detect this bug in the future (Hung-Jui Lin)
- Fix NOHZ 'full kick' handling bug that can cause missed
tick updates (Peng Wang)
- Fix field access bug in the vdso/gettimeofday code that works
only by accident (Thomas Weißschuh)
- Fix & prevent immediate clocksource watchdog rerun after a delay
(Karl Mehltretter)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrm49IRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iTDA/5Aebi9AA+RG07pniYhgx8D47I+mEB+5EG
Jthzq2OZ2rdH4IlI+YKN4KsQNnksNEkXzFmOe4KjVdogfr4JJqJ3UOv0HeNSaOtK
2MD68CswEOZQR9L/8X6VaVoCZp3TkoRP6OPU0DSJeD/ELU8xeKhyBlerA0isgluU
Oc9fePsQniN3zay7QkfViBM5D1D9SA54rp8TPaq9ZxstLqPFjzFcMtFLILm1syeZ
vnsCz1dX5sUkEKkcDClcv3gp8LL7l3r+M+z7MuplO7NYYqCFzD/DFodKVIVMBr1u
pd9XuGHo+6qF9+WXzC3wlLd6ZauC0gSFqOGdqeQoiQrOwt2xxNNFtr2NvHPtCmOL
2014sHRk2KxZP1Hc7VvwGRD/fSTrkTYlQMXkuP5zQMzlpSiWLzmffH5Y2RohS6BB
NyEw7bI9LaQ1zUatuYPkwKKcZQNhM6uaUIjfWvCIQYC0WmgIhN2r+4gTDc4jenU4
6YDnxmE3dyTHlPgksBViDN/p6sNszeoq/KgRSRuM8H7VD6TlKgcHEmGXF3LhgAtY
U7tfQ63ReDWuj2KmNyhT1lP0kBEJKbTouXn3CuGvtsmupLR+gmgZ13p8iPPpqgbO
P8GH+5l2Cz9SieFbJqoXZ5D8dOEB5sVjAden7iZol2ALjIlWySDPaFWFJjqsDUfy
Lmfu0V5K5ZU=
=WzWb
-----END PGP SIGNATURE-----
Merge tag 'timers-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix on-stack hrtimer cleanup in play_idle_precise(), and
add the hrtimer_on_stack cleanup class to facilitate the fix
(Hui Su)
- Fix clock_getres() system call's handling of NULL output
pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)
- Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time
is exactly equal to the nonzero expiry (Hungyu Lin)
- Fix do_timens_ktime_to_host() time offset subtraction underflow
check (Hungyu Lin)
- Report zero remaining time for disarmed SIGEV_NONE posix timers,
and add a self-test to detect this bug in the future (Hung-Jui Lin)
- Fix NOHZ 'full kick' handling bug that can cause missed
tick updates (Peng Wang)
- Fix field access bug in the vdso/gettimeofday code that works
only by accident (Thomas Weißschuh)
- Fix & prevent immediate clocksource watchdog rerun after a delay
(Karl Mehltretter)
* tag 'timers-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
clocksource: Prevent immediate watchdog rerun after a delay
vdso/gettimeofday: Correct the read of tz_minuteswest and tz_dsttime
tick/nohz: Reevaluate the tick for kicks flushed outside hardirq
selftests: timers: Add a test for disarmed SIGEV_NONE timers
posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers
time/namespace: Fix overflow when converting absolute deadlines
timers/itimer: Keep a nonzero value at CPU timer expiry
posix-timers: Accept NULL clock_getres() output in stubs
sched/idle: Use hrtimer cleanup class in play_idle_precise()
hrtimer: Add cleanup class for on-stack timers
|
||
|
Linus Torvalds
|
2a500a04d6 |
Driver core fixes for 7.4-rc1
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind operations associated with misleading fuzzing reports. It also taints established workflows, including VFIO device passthrough; a more targeted approach will be revisited after 7.4. - Rate limit synthetic uevent failure messages to prevent log flooding from repeated invalid writes to sysfs uevent files -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCauOoegAKCRBFlHeO1qrK Li9DAP40jVb0AyHVlniDMGwdCajihY4NweTKKMAdiJJ5f+FX/AEAtm5ZK7rflqQn z5b4dHsFFGPEWfaKZ+w1Qx7L39njJQo= =UZoc -----END PGP SIGNATURE----- Merge tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull more driver core fixes from Danilo Krummrich: - Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind operations associated with misleading fuzzing reports. It also taints established workflows, including VFIO device passthrough; a more targeted approach will be revisited after 7.4. - Rate limit synthetic uevent failure messages to prevent log flooding from repeated invalid writes to sysfs uevent files * tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers" driver core: Limit the messages on a refused uevent |
||
|
Linus Torvalds
|
0c8bf38058 |
vfs-7.4-rc1.fixes
Please consider pulling these changes from the signed vfs-7.4-rc1.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCauTJqQAKCRCRxhvAZXjc
okLyAP0bHWHQ8CIbegVzZbMVssaMJl1KiqxfkGbS6Nk/j1StkwEA5+UGbFnQ2qG6
uxDILfnlsd834jlOlOauzaSpbAJgwQk=
=uPnP
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- writeback:
- Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The
list was left out of order so move_expired_inodes() could stop
before older inodes, and the lazytime expiration timestamp was
reset
- Clear the old wb's dirty-I/O state and bandwidth contribution when
a batch of inode switches leaves its dirty lists empty. An empty
wb stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth
- Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
inodes let a scan racing a sync()'s queue_io() move lazytime
inodes past the sync's cutoff, so sync() returned without
persisting their timestamps
- Don't kick writeback for an IOCB_DONTCACHE write on an inode that
has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
write to a block device dereferenced NULL
- statmount/listmount/listns:
- Refuse statmount() string requests with a buffer that isn't larger
than struct statmount
- Don't wrap around with a U64_MAX cursor in listmount() and
listns()
- Don't end listns() at an inactive namespace
- Only add init_ipc_ns and init_net to the namespace trees if
CONFIG_IPC_NS and CONFIG_NET_NS are enabled
- iomap:
- Only mark blocks uptodate in __iomap_write_begin() after reading
them and let __iomap_write_end() mark the zeroed blocks uptodate
once the copy from userspace succeeded
- Check a chunk against max_integrity_io_size() on its own before
the bio size check
- Only enforce block alignment for direct I/O into holes and
unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set
- backing-file:
- Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
passthrough opens the backing file with vfs_open() which skips
may_open(), so anyone who may open the FUSE file for writing could
overwrite an append-only backing file anywhere or write to an
immutable one. Open, mmap and writes now check the backing inode
the way may_open() and do_mmap() do
- Always call kiocb_end_write() for a queued write
- Let backing files inherit FMODE_NONOTIFY from the user file. The
event fds fanotify creates for permission events on a stacked
filesystem raised FS_OPEN_PERM on the real path from inside the
listener's read() and deadlocked listeners with marks on both
layers
- pidfs:
- Look the task up before checking for exit information in
PIDFD_GET_INFO and start over if the task no longer owns the pid
once all fields have been read. A caller racing release_task() got
neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
exit information was available, and a caller racing a sub-thread's
exec reported that thread's tid as the pid
- Clear the mask bits of fields that lie beyond the struct size the
caller passed. The uapi header promises that the mask names no
such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
coredump and supported mask bits set for fields that were never
written
- aio:
- Give the aio ring a ->read_folio that fails with EIO so a fault on
a ring whose file was truncated gets SIGBUS instead of jumping to
NULL
- Check nr_events against the ring size before doubling it in
ioctx_alloc()
- splice:
- Only write back an implicit file position in do_splice() when the
splice helper succeeded. splice doesn't take f_pos_lock so a
failed splice restored a stale snapshot over a position that a
concurrent getdents() had moved. On ext2 the next readdir then
trusted an offset inside a directory entry
- Retry tee() when the input pipe was emptied or the output pipe
filled between the prep steps and link_pipe() instead of returning
0 while the input pipe still has writers, as splice_pipe_to_pipe()
does
- ucount:
- Take the reference that pins a ucounts level on the 0 -> 1
transition before checking the rlimit
- Read the parent ucounts before dropping the rlimit count in
do_dec_rlimit_put_ucounts()
- inode:
- Rotate inodes whose page cache couldn't be dropped to the tail of
the LRU
- Skip inodes that another LRU walker is isolating
- setns:
- Set nsset->flags before anything in prepare_nsset() can fail so
the error path drops the cred prepared for CLONE_NEWUSER. A
failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
together with its user namespace
- Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
again when more namespaces are requested
- minix:
- Restore uptodate on the pinned bitmap buffers before redirtying
them after a failed writeback instead of tripping the warning in
mark_buffer_dirty(), as ext2 and ext4 do for their superblock
buffers
- Reject rmdir() of a directory with a corrupted link count with
EFSCORRUPTED instead of hitting the drop_nlink() warning
- userns: Keep the exec securebits and their locks when creating or
joining a user namespace. set_cred_user_ns() reset all securebits to
SECUREBITS_DEFAULT so anyone who may create a user namespace could
shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
a single unshare(CLONE_NEWUSER)
- fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
pwrite64(), preadv() and pwritev() wrappers
- proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
last vread_iter() copy instead of the running total
- eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
can't be created in EPOLL_CTL_MOD instead of reporting success
without suspend protection
- coredump: Mark do_coredump() noinline_for_stack
- nsfs: Check the trailing bytes of a namespace file handle in bytes
instead of words
- netfs: Restore the per-level and per-point decoding of the debug mask
- exportfs: Release the directory file get_name() opened with
__fput_sync(). From nfsd's kernel threads the deferred fputs arrived
faster than delayed_fput retired them and each pinned the directory's
readdir state, growing unreclaimable slab by about 90 MB per second
under a parallel tree walk
- fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
unmounted as of v7.0 its struct ramfs_fs_info was leaked
- signal: Check the blocked mask for every entry
dequeue_synchronous_signal() looks at. The scan could select a
blocked synchronous signal and deliver it while blocked
- super: Convert the superblock device table from an rhltable to a
plain hashtable under a spinlock. This fixes a bug from v7.3 where
fs_bdev_freeze() froze a btrfs filesystem through a stale member that
open_ctree() had already released while the freeze was waiting for
SB_BORN
- fork: Leave rcu_users at zero until copy_process() can't fail
anymore. bpf_task_acquire() handed out trusted references to the new
task from the task_alloc LSM hook and sched_ext's ops.init_task() and
a failing fork freed the task behind them
- xattr: Always run cap_convert_nscap() for a security.capability
write. A zero-length setxattr() skipped it and let an unprivileged
caller without CAP_SETFCAP or write permission on the file plant an
empty security.capability xattr that made every execve() of the
binary fail with EINVAL
- namei: Skip the S_ISDIR assertion in
- proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
first lookup by anyone with search permission ran d_invalidate() on
the dentry and detached every mount on it, locked mounts included
- libfs: Hold one mount reference for all pins instead of one per pin.
The pin count is what keeps the mount alive, so the per-pin reference
only cost a mntget() and a mntput() through
mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
configfs file that comes and goes
- iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
any type
- watch_queue: Give info_id its own storage instead of overlaying it
with rcu_head
- filelock: Take an active superblock reference while waiting for a
delegation break. After a lazy umount closing the delegation holder
could shut down the superblock under the waiter whose final iput()
then ran shmem_evict_inode() on freed state
- fs: Skip the copy_file_range() write limit checks when there is no
data to copy
- bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
close_range() became synchronous this cycle close(), close_range()
and the closes on exec and exit no longer go through filp_close().
fexit stays rejected since the file may be gone by then
- fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
spuriously woken waiter kept its on-stack entry queued, took that as
proof that the pin was alive and used the freed acct structure when
umount() of the accounting file raced acct(2)
- dcache: Don't fail __d_obtain_alias() for an inode without links and
aliases. The ESTALE check added this cycle broke open_by_handle_at()
and nfsd file handle decoding on NFS and FUSE where i_nlink is just
what the server last reported and the handle may well still be valid
- selftests/ovl: Fix the mountinfo expectations of the detached layer
test which has failed since it was added
* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
fs: don't fail __d_obtain_alias() for unlinked inodes
ns: don't add init_ipc_ns and init_net without namespace support
aio: avoid request count overflow in ioctx_alloc()
selftests/ovl: fix detached layer mountinfo expectations
bpf: Allow bpf_d_path() from filp_close_sync()
fs: skip copy_file_range write limits when there is no data
minix: reject rmdir of a directory with a corrupted link count
fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
ucount: read the parent ucounts before dropping the rlimit count
splice: retry tee() instead of returning 0 when it races
selftests/pidfd: test that fields beyond the struct size are not reported
pidfs: do not report fields that do not fit into the caller's struct
fs: let backing files inherit FMODE_NONOTIFY from the user file
splice: avoid stale f_pos writeback on error
backing-file: always end a queued write
filelock: keep superblock active through delegation wait
watch_queue: keep info_id separate from rcu_head
iomap: only follow dio alignment requirement if specified
iov_iter: fix NULL deref in iov_iter_alignment()
backing-file: enforce append-only and immutable backing inodes
...
|
||
|
Chris Mason
|
a290a9e5cf
|
iov_iter: fix NULL deref in iov_iter_alignment()
Since commit |
||
|
Josef Bacik
|
a01c8e5b1d |
driver core: Limit the messages on a refused uevent
A write to a "uevent" file which is no valid action makes
kobject_synth_uevent() print a warning and uevent_store() an error every
time. This is generally considered a bad thing so rate limit these
messages.
Fixes:
|
||
|
Linus Torvalds
|
8a36f53fd5 |
mm.git review status for linus..mm-stable
Everything:
Total patches: 213
Fixes: tags: 69
cc:stable patches: 43
Reviews/patch: 2.04
Reviewed rate: 86%
Excluding DAMON:
Total patches: 192
Fixes: tags: 63
cc:stable patches: 39
Reviews/patch: 2.18
Reviewed rate: 89%
Excluding DAMON and selftests:
Total patches: 182
Fixes: tags: 57
cc:stable patches: 39
Reviews/patch: 2.23
Reviewed rate: 89%
Summary of series in this merge:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL"
(Lorenzo Stoakes (ARM)):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner to
avoid its fork-dependent timeout command and document the build and
runtime requirements.
- "mm/collapse: separate a collapse from its callers"
(Kiryl Shutsemau (Meta)):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN"
(Lorenzo Stoakes (ARM)):
Provide a common helper for testing whether a VMA has anonymous reverse
mappings. Document the locking rules, annotate intentional concurrent
reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand (Arm)):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport (Microsoft)):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code and
data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths"
(Muchun Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use pagemap
and page flags instead of VMA-boundary assumptions which fail when glibc
has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their IDs.
Move ID references to reparentable objcgs, with the necessary swap
accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios. Fix
a lookup race and split-failure handling, and handle minimum folio orders
for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can also
express free-memory goals without adding separate metrics. Add the sysfs
interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman Khandual):
Use the generic formatter for arm64 page-table entries, ready for future
wider entries. Move the safe-PTE-update check out of the header to avoid
an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations. Free
backing pages before removing their mappings, and share the teardown with
partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes"
(Karl Mehltretter):
Preserve running DAMOS quota state while validating parameter updates.
Even rejected updates could reset accounting and exceed the quota window;
add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and allocations
spanning vmap zones. These allocations were being missed in diagnostic
output.
- "mm: various (urgent?) fixes" (David Hildenbrand (Arm)):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations on
failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add a
regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to its
new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young. Share
hugetlb folio acquisition code and add a regression test for the
previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit"
(SJ Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current memory
pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and zero
effective quotas, which could stop schemes making progress. Add boundary
tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls. The
DMA API already selects the zone from device limits and ignores the
caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false passes
and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds the
right maintainers. Also label the closing hugetlb_cgroup.h include
guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry fix
stops defrag_mode from spinning under memory.low protection; a reported
file-creation stress test ran 5.7 times faster, with far less memory
pressure. Narrower hugetlb invalidations also spare KVM guests needless
refaults: the reported Redis-in-VM P99 QPS penalty while punching holes
fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree huge-page
races with mremap()/munmap() could lose data or access freed memory, and
MADV_COLD could lose a concurrent write's dirty bit. Another fix
prevents stale migration entries from outliving large folios. On
filesystems with blocks smaller than a page, extending a file by 4 GiB
or more could expose bytes written past the old EOF through mmap instead
of zeroes. That is fixed, along with use-after-free races in
PAGEMAP_SCAN during process exit and in memory-cgroup accounting on
PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A further
fix keeps userfaultfd tracking intact on neighboring mappings. NUMA
binding no longer prevents long-term pins when the chosen node has only
movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes with
memory cgroups disabled at boot, notably in small crash kernels.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCat66sAAKCRDdBJ7gKXxA
jrQrAP99kgSXRdlmRZbHeRBHQ6KvI4XnLvQ78MDIzZ3zmBaOugEA5jiIsK2/snFD
3VaV0oipVZpuwJkVJE6zFkh0tcHgTAo=
=DHrN
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.
- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):
Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):
Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):
Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.
- "mm: various (urgent?) fixes" (David Hildenbrand):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.
* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...
|
||
|
Linus Torvalds
|
7d1f84f1b9 |
mm.git review status for linus..mm-nonmm-stable
Total patches: 134 Fixes: tags: 86 cc:stable patches: 52 Reviews/patch: 0.73 Reviewed rate: 59% Summary of patch series in this merge: - "ocfs2: exit recovery thread on mount error path" (Joseph Qi): Stop OCFS2 recovery before freeing failed-mount state and replay slots, closing use-after-free and double-free races. Defer suballocator reclaim to break a transaction-lock deadlock with dismount. - "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph Qi): Validate OCFS2 metadata suballocator slots, bits and directory index block locations. Reject corrupt metadata with filesystem errors instead of BUGs or out-of-bounds accesses. - "ocfs2: deal with legacy signed name hash values" (Joseph Qi): Restore OCFS2 lookups for non-ASCII names stored with legacy signed hashes. Use stored xattr hashes during bucket splits to avoid duplicate entries and spurious ENOSPC failures. - "ocfs2: stabilize dentry names in file and setattr traces" (Cen Zhang): Snapshot OCFS2 names during file and setattr tracing to prevent rename races using freed storage or mismatched names and lengths. Preserve trace formats and the locked release open-count sample. - "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley Morgan): Fix panic_force_cpu races and NMI redirection so crash-kernel CPU selection is honored. Preserve variable arguments on failed redirects and use a static message buffer. - "fat: allocate multiple clusters in fallocate" (Matheus Alves de Almeida): Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch FAT updates. This removes repeated single-cluster allocation overhead, particularly on synchronous mounts. - "scripts/gdb: fix radix tree lookup and stack depot diagnostic" (Ting-Han Hou): Fix GDB radix-tree lookup and its handling of XArray sibling, retry and zero entries. Also repair the stack-depot diagnostic for an out-of-range pool index. - "hung_task: Improve warning budget handling and task reporting" (Aaron Tomlin): Reset the hung-task warning budget after recovery so later hangs remain visible. Keep the configured limit intact and emit one summary per scan when detailed reports exhaust the budget. - "bootconfig: Reject unexpected data after null character and cleanups" (Masami Hiramatsu (Google)): Reject bootconfig data after an embedded null while accepting trailing padding. Validate the full input in the userspace tool, and retain internal tree sanity checks there rather than in the kernel. - "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin Khorenko): Use the actual GCOV build flags in the prefer-atomic compiler probe. Move flag setup into scripts/Makefile.gcov and skip the probe when GCOV is disabled. - "ocfs2: xattr bucket validation fixes" (Joseph Qi): Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding false read-only remounts. Reject misaligned buckets and return errors instead of panicking on corrupt defrag metadata. - "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi): Reserve enough OCFS2 metadata for new and relocated xattr value trees. Fix shortfalls which could cause ENOSPC, dropped entries and leaked clusters on fragmented filesystems; remove duplicate reservations. - "Introduce arch_do_panic" (Mete Durlu): Add arch_do_panic() and move s390 and sparc handling out of generic panic code. The architecture-specific actions now follow the end-of-panic marker. - "checkpatch: userspace improvements" (Petr Vorel): Improve checkpatch's userspace detection and suppress kernel-only checks. Recognize standard inttypes macros and add explicit --userspace and --no-userspace overrides. - "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph Qi): Check OCFS2 directory index generations and leaf block numbers. Reject stale or misplaced blocks instead of using metadata left by a previously formatted filesystem. - "selftests/membarrier: Skip an unregistered memory barrier test on Musl" (Chris Gellermann): Skip the unregistered membarrier test when libc has already registered the command. Musl does this during thread creation, causing false failures in the multithreaded test. - "init: fix array boundary bugs in boot parameter parsing" (Wilson Felipe Pereira): Fix boot argument boundary cases which leave stale arguments in init's command line or panic when replacing the final environment variable. Clear the last slot and check duplicates before the limit. Summary of the 87 singletons in this merge: The OCFS2 singletons fix deadlocks between xattr updates and inline truncation, and during inode reclaim. Corrupt quota and extent metadata could also crash the kernel or corrupt memory; these paths now check the layout before using it. Other fixes close use-after-free and publication races around cluster reconfiguration, node failure, quota remount errors and shared refcount trees. New files now retain security labels from all stacked LSMs instead of silently dropping all but one. Valid xattr insertions also stop tripping FORTIFY on builds with counted arrays. Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck in unkillable sleep and block further I2C traffic. That is fixed, as are kernel memory leaks in POSIX message-queue notifications and tmpfs casefold setup which could grow until memory is exhausted. A driver removal race which could crash the kernel is fixed too. The hibernation command through reboot() also stops taking the same mutex twice, avoiding a deadlock before suspension. On the boot side, bzip2 decoding now accepts valid full blocks emitted by lbzip2, fixing failures to boot those compressed kernels. Malformed bzip2 streams can no longer overflow the decode buffer, and LZ4 initrds are checked before the decoder can read past their end. FAT rejects geometry which overflows the data-area calculation on 32-bit systems, and rolls back entries when inode setup fails, preventing failed creations from reappearing after remount. The x86 XOR and RAID6 AVX paths also avoid imposing a slowdown on subsequent SSE code. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCat57YgAKCRDdBJ7gKXxA jofGAQDBRlA6AI/WIWAuSb9FH4RIMe16EU3klIYoNqgY3eMbLwD/f8J1rm4gBpBl eXV7nwZMb8Ackw1+2CuBtbvpLfjQUA4= =JLjf -----END PGP SIGNATURE----- Merge tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "ocfs2: exit recovery thread on mount error path" (Joseph Qi): Stop OCFS2 recovery before freeing failed-mount state and replay slots, closing use-after-free and double-free races. Defer suballocator reclaim to break a transaction-lock deadlock with dismount. - "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph Qi): Validate OCFS2 metadata suballocator slots, bits and directory index block locations. Reject corrupt metadata with filesystem errors instead of BUGs or out-of-bounds accesses. - "ocfs2: deal with legacy signed name hash values" (Joseph Qi): Restore OCFS2 lookups for non-ASCII names stored with legacy signed hashes. Use stored xattr hashes during bucket splits to avoid duplicate entries and spurious ENOSPC failures. - "ocfs2: stabilize dentry names in file and setattr traces" (Cen Zhang): Snapshot OCFS2 names during file and setattr tracing to prevent rename races using freed storage or mismatched names and lengths. Preserve trace formats and the locked release open-count sample. - "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley Morgan): Fix panic_force_cpu races and NMI redirection so crash-kernel CPU selection is honored. Preserve variable arguments on failed redirects and use a static message buffer. - "fat: allocate multiple clusters in fallocate" (Matheus Alves de Almeida): Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch FAT updates. This removes repeated single-cluster allocation overhead, particularly on synchronous mounts. - "scripts/gdb: fix radix tree lookup and stack depot diagnostic" (Ting-Han Hou): Fix GDB radix-tree lookup and its handling of XArray sibling, retry and zero entries. Also repair the stack-depot diagnostic for an out-of-range pool index. - "hung_task: Improve warning budget handling and task reporting" (Aaron Tomlin): Reset the hung-task warning budget after recovery so later hangs remain visible. Keep the configured limit intact and emit one summary per scan when detailed reports exhaust the budget. - "bootconfig: Reject unexpected data after null character and cleanups" (Masami Hiramatsu): Reject bootconfig data after an embedded null while accepting trailing padding. Validate the full input in the userspace tool, and retain internal tree sanity checks there rather than in the kernel. - "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin Khorenko): Use the actual GCOV build flags in the prefer-atomic compiler probe. Move flag setup into scripts/Makefile.gcov and skip the probe when GCOV is disabled. - "ocfs2: xattr bucket validation fixes" (Joseph Qi): Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding false read-only remounts. Reject misaligned buckets and return errors instead of panicking on corrupt defrag metadata. - "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi): Reserve enough OCFS2 metadata for new and relocated xattr value trees. Fix shortfalls which could cause ENOSPC, dropped entries and leaked clusters on fragmented filesystems; remove duplicate reservations. - "Introduce arch_do_panic" (Mete Durlu): Add arch_do_panic() and move s390 and sparc handling out of generic panic code. The architecture-specific actions now follow the end-of-panic marker. - "checkpatch: userspace improvements" (Petr Vorel): Improve checkpatch's userspace detection and suppress kernel-only checks. Recognize standard inttypes macros and add explicit --userspace and --no-userspace overrides. - "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph Qi): Check OCFS2 directory index generations and leaf block numbers. Reject stale or misplaced blocks instead of using metadata left by a previously formatted filesystem. - "selftests/membarrier: Skip an unregistered memory barrier test on Musl" (Chris Gellermann): Skip the unregistered membarrier test when libc has already registered the command. Musl does this during thread creation, causing false failures in the multithreaded test. - "init: fix array boundary bugs in boot parameter parsing" (Wilson Felipe Pereira): Fix boot argument boundary cases which leave stale arguments in init's command line or panic when replacing the final environment variable. Clear the last slot and check duplicates before the limit. Summary of the 87 singletons in this merge: The OCFS2 singletons fix deadlocks between xattr updates and inline truncation, and during inode reclaim. Corrupt quota and extent metadata could also crash the kernel or corrupt memory; these paths now check the layout before using it. Other fixes close use-after-free and publication races around cluster reconfiguration, node failure, quota remount errors and shared refcount trees. New files now retain security labels from all stacked LSMs instead of silently dropping all but one. Valid xattr insertions also stop tripping FORTIFY on builds with counted arrays. Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck in unkillable sleep and block further I2C traffic. That is fixed, as are kernel memory leaks in POSIX message-queue notifications and tmpfs casefold setup which could grow until memory is exhausted. A driver removal race which could crash the kernel is fixed too. The hibernation command through reboot() also stops taking the same mutex twice, avoiding a deadlock before suspension. On the boot side, bzip2 decoding now accepts valid full blocks emitted by lbzip2, fixing failures to boot those compressed kernels. Malformed bzip2 streams can no longer overflow the decode buffer, and LZ4 initrds are checked before the decoder can read past their end. FAT rejects geometry which overflows the data-area calculation on 32-bit systems, and rolls back entries when inode setup fails, preventing failed creations from reappearing after remount. The x86 XOR and RAID6 AVX paths also avoid imposing a slowdown on subsequent SSE code. * tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits) scripts/gdb: fix stack depot out-of-bounds diagnostic scripts/gdb: fix radix tree lookup pointer handling ocfs2/cluster: remove zero-address nodes from IP tree on teardown ocfs2: snapshot the dentry name while tracing file release ocfs2: snapshot dentry names in file and setattr traces ocfs2/dlm: drain join handlers before releasing module text MAINTAINERS: update Markus's e-mail address mailmap: add entries for Andrew Jones stackdepot: stop preallocating after the final pool ocfs2: drain quorum work before removing the cluster watchdog: force console verbose when reporting lockups profiling: fix sampling step on 64-bit big-endian systems kernel/reboot: avoid potential deadlocks during suspension compat: avoid double rounding in times() ocfs2: pin owning modules for open debugfs files ocfs2/cluster: initialize heartbeat regions before publishing them selftests/proc: proc-pid-vm: fix unused variable warning on non-x86 ocfs2: pin refcount trees before dropping the lookup lock ocfs2: validate the xattr tree root of an indexed xattr block ocfs2/dlm: hold the lookup reference across convert AST enqueue ... |
||
|
Linus Torvalds
|
ed02f4f7ad |
for-7.4/io_uring-dmabuf-20261023
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrbkFsQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpiHpD/9MdThoGJTZ3mKgaZPd7lOgkxWL51CY/ULB
X9zzyfHP9hpXxwXqpSGm8XhN7cmSDXGaCYvhVPS2YQQv0458s1UGMWDi8PJNulFS
6M8ng6Hex2z/Uq+u6vMkruz+hH76c3ajo6kGOhJnWye+/Rq1bqqFcYBWMpLBE/yj
lp8JGG92HyMnsIo5gzBHbUoNEc+X0+jz88mk0JRZoONJD4cNb1S1bW5v+uAk0Nvc
/qPE9AXU2DnngvbzhfKGza/4Lkx9WKBXFmxJSiG9ZH6GJn3yndBNBi7RAODku+/E
i+SiukHPDhn3M5cWZuJ8ilTpVWRCnnsbhavM1PN2tvcW6IfZrAz+m321+JVkzKu0
cLUDvmz2WS0+PcodXGn3KcGVYt7vAjtQVZwZLbq2012u5xSvZN/VaeiVDIRr1uC/
hQPiD51ZpsTt/2lAyrFGmLBsskNWc0Xhd6ePX7euNCdhfHj5UuWKcXUiQeeGiUvT
X2JyQAJSY9VZ6eO02w77bta0II+3SSnZlA6xVmE3+Nwv2z6qr3b31gcfMIiap3Tu
jUkKvDuB9Dw9hhgLr1t6BCuaPS3ktyd1F3dBvbs8YXyyeworU2KGtSF7mraJxts8
GCH+DOAR1j29qMi4/bjhxOKQYAKzhWbptCiJgyReL6V+uFO6JxAeWn3qn36mjezp
BuHNTX1A5g==
=hlkK
-----END PGP SIGNATURE-----
Merge tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring dma-buf support from Jens Axboe:
"This adds native dma-buf support to the I/O path, exposed through
io_uring. It's been in development for a while and should be ready to
go now.
- dma-buf file I/O infrastructure: a dma_buf_io_ctx created through a
new ->init_dma_buf_io_ctx file operation, and a dma_buf_io_map
holding the device DMA mapping. The two are split so a mapping can
be invalidated and re-established underneath a live context, with
the map counting in-flight requests so it can be torn down safely.
- A new iov_iter type for dmabuf maps, and a dma map backed bio type
for the block layer, with raw block device support on top.
- nvme-pci backend implementing dma-buf backed requests, including
SGL support.
- io_uring dmabuf backed registered buffers, built on a reworked
buffer registration structure with an extended update path, regbuf
import flags, an uncloneable flag for buffer types that can't be
cloned, and cloning support for registered dma-bufs"
* tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/dma-buf: don't fail fixed buffers without dma-buf support
nvme-pci: detach dma-bufs only on removal
block: reject dma-bufs larger than 4GiB
io_uring/dma-buf: allow cloning registered dma-bufs
dma-buf-io: document dma_buf_io_init_map
dma-buf-io: fix typos in kernel docs
block: fix indention for dma-buf checks
io_uring/rsrc: add dmabuf backed registered buffers
io_uring/rsrc: add regbuf import flags
io_uring/rsrc: add uncloneable regbuf flag
io_uring/rsrc: extend buffer update
io_uring/rsrc: introduce buf registration structure
nvme-pci: add SGL support for the dmabuf path
nvme-pci: implement dma-buf backed requests
nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl
block: add dma-buf support for raw bdev
block: introduce dma map backed bio type
block: always adjust bi_offset on bio_advance_iter
iov_iter: add iterator type for dmabuf maps
dma-buf: introduce initial file I/O infrastructure
|
||
|
Thomas Weißschuh
|
cbd0f65b48 |
vdso/gettimeofday: Correct the read of tz_minuteswest and tz_dsttime
When these fields got moved from 'struct vdso_time_data' to the new
'struct vdso_clock', this access was forgotten.
'vd' is not an array, but a pointer to a single structure. The code
works by accident in its current form as CS_HRES_COARSE is 0.
Replace the incorrect array access with a regular pointer dereference.
Fixes:
|
||
|
Linus Torvalds
|
89d2d7bf06 |
EFI updates for v7.4
- Set the LoaderDevicePartUUID EFI variable from the stub to help systemd discover the file system layout when booting straight into Linux without GRUB or systemd-boot (Vincent Mailhol) - Some GUID deduplication work from Vincent - Remove pointless UTF16->UTF8 and vice versa conversions from the stub, including some prerequisite work on the x86 decompressor to accommodate that - Some kmap() -> kmap_local_page() conversions in the capsule loader - Add a runtime control to en/disable EFI runtime services so that PREEMPT_RT systems can enable them as needed - Add a 'nostatfs' mount option to efivarfs so that the cost of querying the EFI variable store (which is already rate limited) can be avoided entirely on systems where it is disproportionately costly - Rework the EFI libstub Makefile to align x86 with other architectures, and inherit/adapt the global CFLAGS variable rather than reconstruct it from scratch - Constify attributes of statically allocated sysfs nodes - Avoid register x18 when building the arm64 EFI stub, in order to comply with the UEFI spec, and to permit it to execute in a context where x18 is special - Preserve the physical addresses of all EFI config tables that may be of interest to an incoming kexec kernel - Add some LKDTM tests for EFI runtime crashes where the faulting address is inside a EFI memory region - Other minor bug fixes and cosmetic cleanups -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQQm/3uucuRGn1Dmh0wbglWLn0tXAUCatSJtAAKCRAwbglWLn0t XEvXAQCpluirdoc3LaABTQUceGfFmM9EeETcB8FMuQv5+ATo8gEAy536vpGMlosG l3dwbsdEHBTGK0bvpViOqOelNH/5xQs= =3fkP -----END PGP SIGNATURE----- Merge tag 'efi-next-for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Set the LoaderDevicePartUUID EFI variable from the stub to help systemd discover the file system layout when booting straight into Linux without GRUB or systemd-boot (Vincent Mailhol) - Some GUID deduplication work from Vincent - Remove pointless UTF16->UTF8 and vice versa conversions from the stub - Some kmap() -> kmap_local_page() conversions in the capsule loader - Add a runtime control to en/disable EFI runtime services so that PREEMPT_RT systems can enable them as needed - Add a 'nostatfs' mount option to efivarfs so that the cost of querying the EFI variable store (which is already rate limited) can be avoided entirely on systems where it is disproportionately costly - Rework the EFI libstub Makefile to align x86 with other architectures, and inherit/adapt the global CFLAGS variable rather than reconstruct it from scratch - Constify attributes of statically allocated sysfs nodes - Avoid register x18 when building the arm64 EFI stub, in order to comply with the UEFI spec, and to permit it to execute in a context where x18 is special - Preserve the physical addresses of all EFI config tables that may be of interest to an incoming kexec kernel - Add some LKDTM tests for EFI runtime crashes where the faulting address is inside a EFI memory region - Other minor bug fixes and cosmetic cleanups * tag 'efi-next-for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (35 commits) lkdtm: Add more EFI runtime tests efi: Initialize all configuration table addresses to EFI_INVALID_TABLE_ADDR efi: Retain the address of the LINUX_EFI_MEMRESERVE table efi/libstub: Don't replace an existing LINUX_EFI_MEMRESERVE table efi/runtime-wrappers: Don't park the worker after a recovered firmware fault efi: Use sysfs_emit() not sprintf() to generate sysfs file contents efi: Constify sysfs attributes efi/libstub: Disable kernel stack erasing in the common flags efi/libstub: Build the x86 stub from KBUILD_CFLAGS efi/libstub: Declare the x86 stub's assembly entry points efi/libstub: arm64: Don't use the platform register x18 efi/libstub: Free cmdline_ptr in efi_pe_entry efi/riscv: libstub: Don't set image_size in handle_kernel_image() efi/libstub: Fix error unwind freeing fdt in allocate_new_fdt_and_exit_boot() efivarfs: add nostatfs mount option to skip QueryVariableInfo() efi/libstub: add initial Boot Loader Interface support efi/libstub: Add efi_snprintf() to construct wide strings efi/libstub: Add support for printing human readable GUIDs efi/libstub: Output UTF-16 directly from vsnprintf() efi/libstub: Avoid efi_puts() for compile time constant strings ... |
||
|
Linus Torvalds
|
0dfc0090b9 |
fbdev fixes and cleanups for 7.4-rc1:
Fixes:
- core: initialize modelist in framebuffer_alloc()
- core: bitblit: fix glyph clipping when fbcon pans
- fbcon: restore font geometry if font rotation fails
- sh_mobile_lcdcfb: restore the per-overlay sysfs attributes
- udlfb: don't rebuild the mode list while the framebuffer is in use
- atmel_lcdfb: prevent FIFO work after removal
Cleanups:
- vt, fbcon, vgacon: cursor code rework & cleanups
- MAINTAINERS: name the deller/linux-fbdev for-next branch
- drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option
- acornfb: remove unused code
- atafb: fix sparse warnings and avoid casts
- sstfb: use managed PCI device enable
- gxt4500, kyro, nvidia: release write-combining handle on probe failure
- various drivers: typo fixes in comments
- various drivers: fix error path on fb_deferred_io_init() failure
- various drivers: use FB blanking constants instead of VESA constants
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCatp6agAKCRD3ErUQojoP
XxeEAQCwaTwk3BQIuOi+UAGANLrLKTPkgEoTluPAhgfBYRoObgD/QJPzhRMFts1h
Lxyrap4AJqTy3webD3PhYCqN8m2sYAE=
=qS61
-----END PGP SIGNATURE-----
Merge tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev updates from Helge Deller:
"A whole lot of small fixes all over many drivers, but the majority of
changes are related to code cleanups regarding the cursor handling in
vt and fbcon.
Fixes:
- core: initialize modelist in framebuffer_alloc()
- core: bitblit: fix glyph clipping when fbcon pans
- fbcon: restore font geometry if font rotation fails
- sh_mobile_lcdcfb: restore the per-overlay sysfs attributes
- udlfb: don't rebuild the mode list while the framebuffer is in use
- atmel_lcdfb: prevent FIFO work after removal
Cleanups:
- vt, fbcon, vgacon: cursor code rework & cleanups
- MAINTAINERS: name the deller/linux-fbdev for-next branch
- drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option
- acornfb: remove unused code
- atafb: fix sparse warnings and avoid casts
- sstfb: use managed PCI device enable
- gxt4500, kyro, nvidia: release write-combining handle on probe failure
- various drivers: typo fixes in comments
- various drivers: fix error path on fb_deferred_io_init() failure
- various drivers: use FB blanking constants instead of VESA constants"
* tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (53 commits)
fbdev: xilinxfb: Use FB blanking constants
fbdev: platinumfb: Use FB blanking constants
fbdev: sa1100fb: Remove comment on VESA DPMS modes
fbdev: i810fb: Use FB blanking constants
fbdev: au1100fb: Use FB blanking constants
fbcon: Retry rotated font allocation after failure
fbcon: Rebuild rotated font buffer on font change
fbcon: Include font geometry in the rotated font cache
fbdev: bitblit: Fix glyph clipping when fbcon pans
fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph()
lib/fonts: Add font_glyph_cursor() helper
vgacon: Use vt_cursor_{start,end}()
vgacon: Remove trailing whitespaces
vt: Add cursor-size helpers
MAINTAINERS: name the deller/linux-fbdev for-next branch
fbdev: atafb: avoid cast when assigning buffer address pointer
fbdev: atafb: fix sparse warnings
fbdev: atyfb_base: fix typos in comments
fbdev: aty128fb: fix typos in comments
fbdev: mach64: fix typos in comments
...
|
||
|
Dimitris Charisis
|
0fd2712308 |
test_maple_tree: test maple_range_64 node in RCU mode
This commit adds a test that builds two maple_range_64 trees in RCU mode. The first tree has a root that is a full maple_range_64 node and ensures that the destruction under RCU does not misinterpret the last slot as metadata. 226 insertions produce such a root on a 64-bit build. The second tree is a height 3 tree whose root holds 15 child pointers and metadata in its last slot, so every slot is non-zero and ensures that the destruction under RCU does not descend into the metadata slot. 3166 insertions produce such a tree on a 64-bit build. Link: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-2-ebe7fb278e20@cslab.ece.ntua.gr Signed-off-by: Dimitris Charisis <dchar@cslab.ece.ntua.gr> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Liam R. Howlett (Google) <liam@infradead.org> Cc: Alice Ryhl <aliceryhl@google.com> Cc: Andrew Ballance <andrewjballance@gmail.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Florian Schmaus <florian.schmaus@codasip.com> |
||
|
Dimitris Charisis
|
baed735a95 |
maple_tree: fix maple_range_64 crashes in RCU mode
Patch series "maple_tree: fix maple_range_64 crashes in RCU mode", v3.
The patch series fixes two RCU destroy path issues on maple_range_64
nodes. Both arising from the fact that a maple_range_64 node repurposes
the last slot to hold metadata when the node is not full. Patch 1
addresses the issues, and patch 2 adds a test used to catch them.
Currently there is no in-tree user of maple_range_64 nodes in RCU mode.
All in-tree users of MT_FLAGS_USE_RCU also set MT_FLAGS_ALLOC_RANGE which
makes the internal nodes maple_arange_64.
Below is the minimal reproducer used during debugging:
static DEFINE_MTREE(tree);
static int __init maple_fix_init(void)
{
unsigned long i, j;
for (i = 10; i < 4000; i++) {
mt_init_flags(&tree, MT_FLAGS_USE_RCU);
for (j = 0; j < i; j++) {
mtree_insert_range(&tree, j * 10, j * 10 + 9,
xa_mk_value(j), GFP_KERNEL);
}
mtree_destroy(&tree);
rcu_barrier();
}
return 0;
}
The splat for the first issue addressed by the first patch is shown below.
mt_clear_meta() runs after the slots have been rewritten with raw
pointers by mte_dead_leaves(), so it cannot recognize a valid last pointer
because the type information is stripped. On my 64-bit LE machine, it
clears bytes 248 and 249 of the maple_range_64 which are the two least
significant bytes of the last pointer. The lowest byte is already zero,
since nodes are 256-byte aligned, but zeroing byte 249 corrupts the
pointer.
KASAN catches it as a double-free, because that corrupted pointer happens
to land on a node that was freed previously. The splat appears at 226
insertions in the reproducer. This is when the tree has a full root node
on a 64-bit build.
==================================================================
BUG: KASAN: double-free in mt_free_walk+0x138/0x3a0
Free of addr ffff0000f3d40000 by task swapper/2/0
[...]
Call trace:
[...]
kmem_cache_free_bulk+0x5b8/0xc18
mt_free_walk+0x138/0x3a0
rcu_core+0x5d0/0x1638
rcu_core_si+0x18/0x30
[...]
Allocated by task 1218:
[...]
kmem_cache_alloc_from_sheaf_noprof+0xa8/0x2f0
dst_setup+0x210/0x630
mas_wr_split+0x568/0x26e0
mas_wr_store_entry+0x98c/0x1de0
mas_insert.isra.0+0x3d0/0x5d8
mtree_insert_range+0xec/0x1c8
maple_fix_init+0x94/0xff8 [maple_fix_obj]
[...]
Freed by task 0:
[...]
__kasan_slab_free+0x88/0xb8
__rcu_free_sheaf_prepare+0x94/0x360
rcu_free_sheaf+0x30/0x138
rcu_core+0x5d0/0x1638
rcu_core_si+0x18/0x30
[...]
The buggy address belongs to the object at ffff0000f3d40000
which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
256-byte region [ffff0000f3d40000, ffff0000f3d40100)
[...]
Memory state around the buggy address:
ffff0000f3d3ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000f3d3ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000f3d40000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000f3d40080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000f3d40100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
The second issue fixed in the first patch is in the mt_free_walk().
mt_free_walk() descends by checking if the corresponding slot[offset]
entry is non-zero. In a maple_range_64 node that has
MAPLE_RANGE64_SLOTS-1 valid pointers to child nodes, all slots will be
non-zero, since the last slot holds the metadata. Thus, mte_dead_walk()
dereferences the metadata as if it were a node and hits the
null-ptr-deref as shown in the splat below.
After fixing the first issue, the reproducer reaches this case at 3166
insertions. The affected node is the root on a tree with height 3 and it
has 15 valid child nodes on a 64-bit machine. The first fix does not
introduce this bug, but it exposes it for the root node because it no
longer clears the root metadata. On an unmodified kernel, the same bug
exists and is reachable when such a maple_range_64 node appears below
the root, where mt_clear_meta() is not called.
Second KASAN splat:
Unable to handle kernel paging request at virtual address dfff800000000006
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[...]
Call trace:
mte_dead_walk+0x78/0x140 (P)
mt_free_walk+0x1f8/0x3a0
rcu_core+0x5d0/0x1638
rcu_core_si+0x18/0x30
[..]
Both splats are from an arm64 QEMU guest. The test_maple_tree and the
userspace suite pass after each patch in the series.
This patch (of 2):
This commit fixes two issues in maple_range_64 nodes under RCU mode. A
maple_range_64 node repurposes its last slot to hold metadata whenever
the node is not full. Both issues arise from mishandling that last slot.
More specifically the two fixes are:
1. Remove mt_clear_meta() function. mt_clear_meta() decides whether the
last slot of a maple_range_64 node holds a child pointer or a
struct maple_metadata with the check
if (unlikely((mte_to_node(next) &&
mte_node_type(next))))
return; /* no metadata, could be node */
The check expects the pointer to be encoded. But the only callsite
of mt_clear_meta() is mt_destroy_walk() on the RCU destroy path, and
by the time it runs, mte_dead_leaves() has overwritten every slot on
a full node with a raw pointer, stripping the type information. Thus,
the check above never returns early for a full node as it should. It
falls through and then:
meta->gap = 0;
meta->end = 0;
zeroes two bytes of a valid child pointer. Later, mt_free_walk()
dereferences the corrupted pointer.
Fix this by removing mt_clear_meta() along with its only callsite.
mt_clear_meta() is only called for the root of each sub-tree destroyed
under RCU. Descendant nodes retain their metadata until they are
freed. RCU readers may use the metadata while traversing a node, but
do not use cleared metadata to detect that a node has been removed.
They detect a dead node via ma_dead_node().
2. Fix invalid memory access in mt_free_walk(). mt_free_walk() descends
to the left-most unvisited "parent-of-a-leaf" node by checking the
condition:
if ((offset < mt_slots[type]) &&
rcu_dereference_protected(slots[offset],
lock_is_held(&rcu_callback_map)))
slots = mte_dead_walk(&enode, offset);
On a maple_range_64 node with MAPLE_RANGE64_SLOTS-1 children *all*
slots are non-NULL. The first MAPLE_RANGE64_SLOTS-1 hold valid
pointers to child nodes, and the last slot contains metadata. The
above check therefore passes for all offsets, and mte_dead_walk()
dereferences the metadata as if it were a node.
To trigger this, a node at least two levels above the leaves has to
have exactly MAPLE_RANGE64_SLOTS-1 valid pointers to other nodes.
maple_arange_64 nodes cannot hit this since they store the metadata
in a separate field.
Fix this by bounding the descent with slot_len which holds the number
of children of a dead node.
Link: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-0-ebe7fb278e20@cslab.ece.ntua.gr
Link: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-1-ebe7fb278e20@cslab.ece.ntua.gr
Fixes:
|
||
|
Caleb Kan
|
8f56ea8e07 |
stackdepot: stop preallocating after the final pool
depot_init_pool() decides whether another pool is needed before it
increments pools_num. When it registers the last allowed pool, pools_num
is still one below stack_max_pools, so the existing comparison clears
new_pool.
With new_pool cleared, stack_depot_save_flags() can allocate another
order-2 pool after a lookup miss. depot_keep_new_pool() retains its pointer
in the global new_pool, so the allocation is not lost. However, pools_num
has already reached stack_max_pools, and depot_init_pool() rejects every
attempt to register the pool. It remains allocated and unusable until
reboot. The non-NULL pointer prevents later saves from allocating more
spare pools.
Account for the pool being registered in the limit check so registering
the final pool installs STACK_DEPOT_POISON and prevents the extra
allocation.
Link: https://lore.kernel.org/20261022083330.3159793-1-matt@readmodwrite.com
Fixes:
|
||
|
Linus Torvalds
|
55fbedcec6 |
bpf-next-7.4
-----BEGIN PGP SIGNATURE-----
iQJRBAABCgA7FiEE+soXsSLHKoYyzcli6rmadz2vbToFAmrY/GYdHGFsZXhlaS5z
dGFyb3ZvaXRvdkBnbWFpbC5jb20ACgkQ6rmadz2vbTrF3w//W1IXtb7BHM5DqyRY
+IUpLlVdJETLJpdxHGq4SMGU7T+JpBJ7e58HIa9bNfyFaeOFuIvH4dy284RHhr8T
3wPR61KmX4hZlmqz17lSKM4E4cnaYW/NMYfp4acA/VRNcvcM+IiGnuhzcFyIMs3w
mPlw/r3rW7Cn7E2Ri2hRV/ZQoT7FyI7LtUEtHU8TUE9kh+T2LTut+FWMJrHe5w0J
LDFwhVqZE0dWZ4695PK6cEIh8uxRJBnmIyMtN+zLBOtqAjiOSNNhFssdSCIkjPEe
X9Xz1Zvqa8Z5QsyRsrwK4S62pnh0pVshQ8fDjrXKY7fkMPpzTvOfqOGS3qhOlw2y
sz853Repug0ZerePFnPnfTIhRIcXagTT11BJUDhUzgy9/Cra3s0vY6c9/MrxTamh
3Xpu/UNl8AIqC/OnbAo8kJ9aKAG6olIBHYIsVOUYk3tH8m2HaVqpKXKRKfqshSDT
YyKoGQE8g9gemS44/RSHKi6QI2jUxNwcOI8FBzViDZaeE476Zvv/fHNC5Tv7lwmm
5qGbcem9sakcd+n17aLy0xKYE2kUSQQLi/J80AY7gMR9VlGsbYPZ8KX8HeSaSLRy
7SMn2dBvNmFaFNgWdLQn4dmBFhvuVgZP6A/ZTreCLuXjBcPo1TnYkVwi3eye4eY/
CwgWBoUJTIqMMt+bRyNgBK0+5rQ=
=kneb
-----END PGP SIGNATURE-----
Merge tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Pull bpf updates from Alexei Starovoitov:
"Major changes:
- Introduce scalar evolution (SCEV) analysis in the verifier.
It infers how registers and stack slots change in a loop and lets
the verifier check bounded loops with induction variables as ranges
instead of walking every iteration. The number of processed insns
drops ten fold in programs with loops (Eduard Zingerman)
- Add 'callx' instruction: indirect call of a static BPF subprogram.
The address is taken with ld_imm64 or loaded from read-only data.
Supported by x86-64, arm64 and riscv64 JITs (Alexei Starovoitov, Pu
Lehui)
- Add unwind_goto and unwind_exit instructions, so that Rust panic or
C++ exception can run destructors of every frame it passes through.
The normal path is free of unwind code. Supported by x86-64 and
arm64 JITs (Alexei Starovoitov)
- Support programs compiled by rust-bpf: treat load and store through
a number as arena access with BPF_F_ARENA_SCALAR, accept rust names
in BTF (Alexei Starovoitov)
- Raise BPF program stack size from 512 bytes to 2 KiB on x86-64 and
arm64 (Kumar Kartikeya Dwivedi)
- Support struct, union and __int128 up to 16 bytes passed and
returned by value in BPF subprograms and kfuncs, and fix x86-64 and
arm64 trampolines for such arguments (Yonghong Song)
- Introduce a common way to attach struct_ops to a cgroup via
bpf_link. bpf_tcp_ops is the first user and mirrors TCP sock_ops
callbacks (Martin KaFai Lau, Amery Hung)
- Describe inlined functions in BTF. New kinds tell where the inline
sites are and how to fetch the arguments there.
CONFIG_DEBUG_INFO_BTF_INLINE keeps it apart from the main BTF in
.BTF.inline section or in btf_vmlinux_inline.ko (Alan Maguire)
- Fix many memory safety, lifetime and locking bugs in BPF core,
verifier, iterators, local storage, dynptr, devmap, cpumap and
seg6local (Josef Bacik, Alexei Starovoitov)
- Diff stat is dominated by selftests and by removal of
lib/test_bpf.c. Its 16k lines of instruction tests were converted
to BPF selftests that BPF CI runs on every architecture it covers
(Daniel Borkmann)
Other features and fixes:
- Add KASAN checks to memory accesses of JITed programs on x86-64
(Alexis Lothoré)
- Complete unification of helper, kfunc and subprog argument checks
in the verifier (Amery Hung)
- Add bpf_copy_from_user_mm[_str]() kfuncs (Anastasios Papagiannis)
- Various features and fixes (Daniel Borkmann):
- Add .bpf keyring for program signature verification, modelled
after dm-verity keyring, and support ML-DSA in signing tools
- Emit shorter and faster code in x86-64 JIT for patterns that
LLVM generates
- Fix various issues in gotox handling
- Let BPF LSM set xattrs at inode creation with bpf_inode_init_xattr()
(David Windsor, Daniel Borkmann)
- Use sleepable page allocation in sleepable arena paths. Fix races
between arena free, allocation and user page fault (Emil Tsalapatis)
- Switch BPF crypto from lskcipher to AES-CBC and AES-ECB libraries
(Eric Biggers)
- Add bpf_proactive_reclaim() kfunc (Hui Zhu)
- Render decl_tags in libbpf btf_dump and add tests for bpftool C
dump (Ihor Solodrai)
- Speed up tracing_multi attach on x86 (Jiri Olsa)
- Various features and fixes (Kumar Kartikeya Dwivedi):
- Add BPF_PROG_STREAM_OPEN command to read BPF streams through a
file descriptor with poll support
- Let kernel structs publish arena pointers with __arena type tag
- Fix __uninit kfunc output buffers and fastcall rewrite with
indirect stack accesses
- Refuse CO-RE relocations for signed programs
- Add enqueue_rcvq and dequeue_rcvq hooks to bpf_tcp_ops to adjust
sk_rcvlowat and avoid unnecessary wakeups (Kuniyuki Iwashima)
- Add bpf_ksock_sendto() kfunc and allow ksock connect and send from
bpf_wq (Mahe Tardy)
- Fix racy plt target update in arm64 bpf_arch_text_poke()
(Matthew Wood)
- Restructure BPF selftests Makefile as a layered build
(Mykola Lysenko)
- Speed up hash map lookups for u32 and u64 keys (Mykyta Yatsenko)
- Add signed div/mod, movsx, bswap and gotol to MIPS JITs, signed
div/mod to parisc JITs (Nicholas Dudar, Johan Almbladh)
- Fix stack overflow in build ID parser on 32-bit (Nickolai
Zeldovich)
- Add stack arguments, signed arena loads and gotox to riscv64 JIT.
Pu Lehui is now co-maintainer of riscv BPF JITs (Pu Lehui, Chen
Pei, Feng Jiang)
- Add bpf_call_rcu() and bpf_call_rcu_tasks_trace() kfuncs. Support
fetching and/or/xor atomics in arena on x86-64 (Puranjay Mohan)
- Fix flaky selftests, selftests with clang 23 and bpf-gcc
(Qiliang Yuan, KaFai Wan, Vineet Gupta)
- Fix builds broken by fatal resolve_btfids warnings, BTF generation
on ARC, and define arch_cmpxchg_local() on arc, hexagon and
openrisc (Sasha Levin)
- Reduce memory use of hash maps by up to 50% per element
(T.J. Mercier)
- Mark pointer fields of sched_ext ops arguments as trusted (Tejun
Heo)
- Remove legacy bpf_asm, bpf_dbg and bpf_jit_disasm tools (Xia Yan)
- Fix index overflow in queue and stack maps, arena range tree after
allocation failure, tail call loop after freplace detach, lost
signal in bpf_send_signal() (Yuan Chen)
- Many more fixes and cleanups"
* tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (660 commits)
selftests/bpf: Time tc_edt from its first packet with data
selftests/bpf: Test unwind_exit of an exception callback
selftests/bpf: Tests for 32-bit scalar evolution bounds computation
bpf: Reject unwind_goto and unwind_exit in offloaded progs
bpf: Support 32-bit linear scalar evolution
bpf: Make unwind_exit of an exception callback exit in JITs
selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach
selftests/bpf: Test ksock sendto()
bpf: Add bpf_ksock_sendto() kfunc
selftests/bpf: Test unwinding from R0: R2 subprog
selftests/bpf: Add a C++ prog with exceptions
selftests/bpf: Add tests for unwind_goto and unwind_exit
bpf, arm64: Support unwind_goto and unwind_exit
bpf, x86: Support unwind_goto and unwind_exit
bpf: Add unwind_goto and unwind_exit insns
tools/bpf: Remove legacy BPF tools
bpf: Annotate data races on bpf_lru_node type
selftests/bpf: Add arena allocation race tests
bpf: Fix arena race between page free and alloc leading to incoherency
bpf: Revalidate faulted arena pages before installing user mappings
...
|
||
|
Linus Torvalds
|
90b754d401 |
Bootconfig updates for v7.4:
- bootconfig: Parser robustness and validation improvements
. Skip printing early params to cmdline from bootconfig: Suppress
early_param keys from /proc/cmdline and warn the user, since bootconfig
does not invoke early_param handlers and silently ignoring them is
misleading.
. Reject unexpected data after null character: Detect and reject non-null
data following an intermediate null character in the bootconfig buffer,
preventing silently ignored configuration after an early termination.
- bootconfig: Code cleanups
. Merge _xbc_exit() into xbc_exit(): Since memblock_free() now handles
late freeing and NULL addresses, the separate _xbc_exit() helper and
its early argument are unnecessary. Inline it into xbc_exit().
. Remove redundant assignment in xbc_parse_array(): The node->child = 0
assignment after the loop duplicates what xbc_init_node() already did.
. Skip internal tree sanity checks in kernel: Move the node index bounds
loop from xbc_verify_tree() into a userspace-only xbc_sanity_check_tree()
to reduce boot-time overhead, since out-of-bounds indices cannot be
produced by malformed input.
. Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h: Share the
footer size constant between kernel and user-space tools, replacing the
hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression in init/main.c.
- tools/bootconfig: Tooling improvements
. Remove unused PAGE_SIZE macro from the bootconfig tool.
. Consolidate xbc_init() to error message wrapper: Use
init_xbc_with_error() for all bootconfig initialization paths in the
tool for simpler and more consistent error handling.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrX+EEbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bSdEIAKQhVr/CRW7/50NFdHB7
XnyJFjGgAmY0DYEhlfv0v2S0YjDcicrTzrV1qMeNF/MwZ/2rMEOZhAnVUVlM3eIi
28k/mEUixMmZGBeLtUUmdrbF8OkvptdmwtjWYdXF2PUDqRlxfvUV/vWqvVuL5EAu
xcDykilReFxmHLUWTJIn8EhfcXP96Lm+wOMhbLI97cAVaP/swtegqHEefIBPvSj4
YIkZtetAWJQIJKGeq97gQHA7SAlIdZEQW5YgUqr7eKAdK8ffIOk0+nr7bmNIER+m
fBe6DHO7Ho3B4EzH/u5MiQBDmYcZ0Akp7meP3h6VXvEpfuCeuqhzsO8+szzkmjbe
4UQ=
=hhPo
-----END PGP SIGNATURE-----
Merge tag 'bootconfig-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
"Parser robustness and validation improvements:
- Skip printing early params to cmdline from bootconfig
Suppress early_param keys from /proc/cmdline and warn the user,
since bootconfig does not invoke early_param handlers and silently
ignoring them is misleading
- Reject unexpected data after null character
Detect and reject non-null data following an intermediate null
character in the bootconfig buffer, preventing silently ignored
configuration after an early termination
Code cleanups:
- Merge _xbc_exit() into xbc_exit()
Since memblock_free() now handles late freeing and NULL addresses,
the separate _xbc_exit() helper and its early argument are
unnecessary. Inline it into xbc_exit()
- Remove redundant assignment in xbc_parse_array()
The node->child = 0 assignment after the loop duplicates what
xbc_init_node() already did
- Skip internal tree sanity checks in kernel
Move the node index bounds loop from xbc_verify_tree() into a
userspace-only xbc_sanity_check_tree() to reduce boot-time
overhead, since out-of-bounds indices cannot be produced by
malformed input
- Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h
Share the footer size constant between kernel and user-space tools,
replacing the hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression in
init/main.c
Tooling improvements:
- Remove unused PAGE_SIZE macro from the bootconfig tool
- Consolidate xbc_init() to error message wrapper
Use init_xbc_with_error() for all bootconfig initialization paths
in the tool for simpler and more consistent error handling"
* tag 'bootconfig-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h
bootconfig: Skip internal tree sanity checks in kernel
tools/bootconfig: Consolidate xbc_init() to error message wrapper
bootconfig: Reject unexpected data after null character
bootconfig: Skip printing early params to cmdline from bootconfig
tools/bootconfig: remove unused PAGE_SIZE macro
bootconfig: remove redundant assignment in xbc_parse_array()
bootconfig: merge _xbc_exit() into xbc_exit()
|
||
|
Linus Torvalds
|
5b212610d0 |
printk changes for 7.4
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmrZyHobFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTy92IP/ietEM8xPS2BJJ56RfmN NjHb5QhFyz3B5i8XeB0aDdbBJHkwDQrEjW7thMtPMBHHzh21GmXi9pnholNIkXLV ZmY2gf9kMJpP36REycSYXaKmczfcWsaLDl0PIY1oDy6KTme5wMADFIEvr+U6ke6C WEoDNUzHapLnoxPsSna/sxmHqR0Qazn4NSsep1ZswaZt/tsbgDKKjrMVs/lBtE/Y hbegh6fesPgZ7D11wpynVBiV+lqqEH9N4HgnmPKis7NcHexdkBxkqJfcUYdx9B0y H3e3k8+2P9xYsosD55inUvLszt7STKsg3UHJasWRvzBXD6SZ/5cq5QIcWYmH62P5 HLSbaNHXUAMV28kLD+BI57Gs2JcCJIcIEwsA8u7OlqLeGQU7ZFv15UHbDqcj3lek ynA+Gda5gj9qoAD+vzWPfTZe35Ue5K2xWkDjinq8vyJabr2tkEJuoKtxyqqQ+DLV jMjlwdWL0K4lo4VthWgkGNgAwkzJ68BuNMPMNcOtzArTD50rfXJsSTcSlaaCMd/l SAcKW6Q0yB0R2mJfx+latpRZ6ObLMfUMJ5mf8U/jSYtKuGKevOJIhsuQpIxR+yQc dHaskuv/WT3f7l0RsaIRa39louAi1U9AKRr/CC+a2o+CTLhGb1c5Vji4eVxnE2Is SRfaZPvwaYgJaziobXIXL94t =Tbb9 -----END PGP SIGNATURE----- Merge tag 'printk-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - John Ogness became PRINTK co-maintainer - Unregister boot consoles when any proper console is registered at the end of the boot phase. Before they were removed only when the so-called preferred console, usually set via the last 'console=' parameter, got registered - Fix computation for increasing the printk ringbuffer on systems with many CPUs and possibly long backtraces from all CPUs - Cleaned up irq_works handling for deferred printk operations - Use acquire/release semantic for filled_random_ptr_key - Allow to use ':' in console options - More code clean up * tag 'printk-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: MAINTAINERS: Make John PRINTK co-maintainer lib/vsprintf: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols printk: Remove console options before decoding the name printk: increase the ring buffer for more than 16 CPUs by default printk_ringbuffer: Avoid needless read of prb_desc printk: Use two irq_works instead per-CPU lib/vsprintf: Use acquire/release for ptr_key publication printk: Remove remaining boot consoles when a real console exists |
||
|
Linus Torvalds
|
845f394e46 |
Summary
* Disallow partial vector updates Stage sysctl vector writes before updating. Removes the chance of leaving a sysctl vector partially updated due to erroneous input. This is not an atomic write; a concurrent reader can still see a partially updated vector. * Remove redundant sysctl config guards Remove locations where (CONFIG_SYSCTL && CONFIG_PROC_FS) was checked. They are superfluous as CONFIG_SYSCTL now depends directly on CONFIG_PROC_FS. * Rewrite selftests using KTAP helpers Each test now reports its own KTAP result and runs in a subshell. Test suite continues after failure. * Misc Fix a use-after-free in the selftests test_sysctl module. Quiet an unused variable warning in fs/proc/proc_sysctl.c:init_header(). Add tests for partial vector updates and the int jiffies converters. * Testing This series was run through the sysctl selftests and kunit in x86_64. It landed in linux-next between rc2 and rc3, giving the latest changes considerable of testing -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmrXYRgACgkQupfNUreW QU+lhAv+JqvwmiQWN76cYKgmMdLTL4nUvVjD81Z88o74ticb/zjbAdE+1efLVIpj m+R/t1riVuJQCN4hFbt1Z39leS83E1ea425FGpkXCrWerUDgqi2WxXyVUzORMGih u7qOU98T+cLyBT9TAb/ZTDpD6opniCEzo8bKIRIyO5VSQUznfWlrdWbEd5nXTKOA Gac9+OoDf8uOO1rC507zb2xkVhFZxYTTSdvaB4CrK3IWc3FRSWf+bu8CgGi+kld0 pBCvmR34v6ohQtjooOlbfvVB/h3ZbTyKzllfo14bB7n0bilKRANGvbVu5jKVQc9r aB8A6LVAHiFuwURVSivgCtWShXwgVgGrnO3vNIMyxrxSY0Jw8KMJRx9J8k22H6Px tiL5WWLnGP4vZaYA3DWtMNzVWFyXzkts0HQ6PveHixzpzPD99QcvVfUssHZXicm2 29YTicsdmT3KPS+DQ6BvRs+Z2VtxASaGkhJr8ivZbSpDAenzjX+UQ19Nfz9gzWgi Lw5+8hVW =lEdI -----END PGP SIGNATURE----- Merge tag 'sysctl-7.04-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Disallow partial vector updates Stage sysctl vector writes before updating. Removes the chance of leaving a sysctl vector partially updated due to erroneous input. This is not an atomic write; a concurrent reader can still see a partially updated vector. - Remove redundant sysctl config guards Remove locations where (CONFIG_SYSCTL && CONFIG_PROC_FS) was checked. They are superfluous as CONFIG_SYSCTL now depends directly on CONFIG_PROC_FS. - Rewrite selftests using KTAP helpers Each test now reports its own KTAP result and runs in a subshell. Test suite continues after failure. - Misc Fix a use-after-free in the selftests test_sysctl module. Quiet an unused variable warning in fs/proc/proc_sysctl.c:init_header(). Add tests for partial vector updates and the int jiffies converters. * tag 'sysctl-7.04-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: selftests: sysctl: Check the sign of a negative jiffies read sysctl: Add jiffies converter entries to the test module sysctl: quiet unused variable warning in fs/proc/proc_sysctl.c:init_header() sysctl: unregister tables before freeing bitmap sysctl: Rewrite selftests on top of KTAP helpers sysctl: remove redundant CONFIG_PROC_FS checks sysctl: consolidate CONFIG_SYSCTL into a single block in kernel/sysctl.c sysctl: collapse redundant CONFIG_SYSCTL nesting in kernel/sysctl.c sysctl: Add 0013 to test partially updated vectors sysctl: Disallow partial updates for erroneous sysctl vectors sysctl: Reject uint arrays before calling the general proc_vec sysctl: Split data conversion and file position handling |
||
|
Linus Torvalds
|
c0e8d30137 |
Modules changes for 7.4-rc1
- Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. The changes to several #include lists have been reported to cause trivial conflicts in linux-next with the drm, drm-xe, and usb trees. -----BEGIN PGP SIGNATURE----- iQFkBAABCABOFiEEIduBR9MnFA82q/jtumpXJwqY6poFAmrWJvAbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyFBxwZXRyLnBhdmx1QHN1c2UuY29tAAoJELpqVycK mOqalOYH/RpwszqX+OuRhf3G9IDokSZFZyiAJLZan3H7jZNb9VBVLYmTTRYF/UE4 uXKeGAUXZOaUdhVjQi/1LqX3NbDO1NfUCM9sbk3EPal0L6ILbcmkBecXu9JXHxvB 6sfEAdTMdAn28613wcnbjmdGfEkgHuDZqZeld4dIAtZ+GvLzFz0D+o0zkigCnT4I faKU9GLIHJe2Cn5FB40b1+M+IGY9t6bl2+WxVc1rd9oSZXfr8ptE7NPllhiOmOhD /aMVpeSlXzo8DYxIhvtZGwDh5NrJglPFdFRXYuHUDLxkWCCFtXRt//LtWv3EpKqp dgQUH5QAO5E/+OuycHFLaXOUiKVS0P4= =bCLk -----END PGP SIGNATURE----- Merge tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. * tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: drivers: Replace __MODULE_STRING() with __stringify() module: Fix uninitialized count read of unloaded taint tracking record rust: module_param: Fix potentially incorrect access of `SetOnce<T>` module: Remove the error-injection.h include from linux/module.h drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION() drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION() syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION() net: Include error-injection.h for ALLOW_ERROR_INJECTION() block: Include error-injection.h for ALLOW_ERROR_INJECTION() module: Bring includes in linux/kmod.h up to date time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... umh, treewide: Explicitly include linux/umh.h where needed modules/kmod: Allocate argv with kmalloc_array() module/kallsyms: Ignore local labels and mapping symbols during module load module/kallsyms: Refactor current symbol filtering into is_core_symbol() module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol() |
||
|
Linus Torvalds
|
c5fd5e67c7 |
mm.git review status for linus..mm-stable
Everything:
Total patches: 539
Fixes: tags: 101
cc:stable patches: 67
Reviews/patch: 1.62
Reviewed rate: 76%
Excluding DAMON:
Total patches: 407
Fixes: tags: 84
cc:stable patches: 44
Reviews/patch: 2.00
Reviewed rate: 87%
Excluding DAMON and selftests:
Total patches: 360
Fixes: tags: 78
cc:stable patches: 44
Reviews/patch: 2.02
Reviewed rate: 89%
Summary of patch series in this merge, ordered by descending size:
- "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau (Meta)):
Give khugepaged a proper workout. Extend the tests to all supported mTHP
orders, check exactly which windows collapsed, and make scan completion
deterministic. Race collapse against faults, pinning, fork and remap;
verify that the contents survive.
Add coverage for whole-page-table zaps and memory pressure too.
- "selftests/mm: separate GUP microbenchmarking from functional testing"
(Sarthak Sharma):
Untangle GUP benchmarking from correctness testing. Move the benchmark
into tools/mm, add a standalone harness-based GUP selftest, and move shared
helpers into tools/lib/mm. Give each tool one job instead of mixing timing
measurements with correctness checks.
Cover the mapping, pinning and batch-size combinations explicitly.
- "mm: Switch device DAX to section-based vmemmap optimization" (Muchun Song):
Apply section-based vmemmap optimization to device DAX. Rework the backing
metadata layout to save memory while preserving the handling of device
memory hotplug and its different alignment and lifetime requirements.
- "mm: Introduce section-based vmemmap optimization for HugeTLB" (Muchun
Song):
Cut the memory consumed by HugeTLB's struct page array with section-based
vmemmap optimization. Arrange the metadata so large huge pages need fewer
backing pages, while keeping initialization, teardown and the various
hugepage configurations straight.
- "mm/huge_memory: clean up and decouple the anon and file split helpers"
(Kairui Song):
Separate anonymous and file-backed folio splitting, which have rather
different locking and bookkeeping requirements. Move the work into
separate helpers, drop dead checks and tidy swap-cache handling. Fix error
paths, including one that could leave a folio frozen.
Keep the swap cache cases separate from file-cache splitting.
- "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):
Make per-VMA locking unconditional and clean up the old conditional code
around it. This removes configuration-dependent plumbing and lets callers
depend on one locking model rather than carrying both cases along.
- "memcg: remove the v1 soft limit" (Shakeel Butt):
Remove the old cgroup v1 memory soft-limit machinery. This has long since
been superseded by the newer memory-control interfaces; hauling around a
separate reclaim scheme for it no longer buys us much.
- "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):
Read /proc/PID/smaps_rollup using per-VMA locks where possible, rather than
holding mmap_lock across the entire walk. Retain the contention fallback
and add tearing tests. This considerably reduces latency when another
thread is busy changing its mappings.
- "mm/damon: introduce data access-as-a-data attribute" (SJ Park):
Teach DAMON to expose memory access observations as data attributes, making
them available to the probe and filtering machinery. Extend the
interfaces, documentation and tests so the new information can be used
rather than merely collected.
- "Remove PG_private by using page/folio->private checks instead" (Zi Yan):
Get rid of PG_private and use the folio's private pointer to say whether
private data is attached. Convert the filesystem users, including erofs,
f2fs and md, and clean up the old accessors and flags. There are a few
special cases, notably swapcache and hugetlb, which need explicit care.
- "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes (ARM)):
Make freeing userspace page tables safe against RCU readers. Sort out the
page-table lifetime and locking rules so walkers cannot stumble over freed
tables while mappings are being torn down.
- "make unused huge shrinker memcg aware" (Qi Zheng):
Make shmem's unused-huge-folio shrinker aware of memory cgroups, so reclaim
can find those folios under the right memcg. Wire up the per-memcg
tracking and its lifetime rules, and give the shrinklist its own lockdep
class to avoid spurious dependency reports.
- "mm: Drop pxd_ERROR()" (Anshuman Khandual):
Remove the old pxd_ERROR() page-table checks and their
architecture-specific baggage. Simplify the common page-table interfaces
and callers now that these checks no longer serve a useful purpose.
- "memcg: group struct fields by access pattern" (Shakeel Butt):
Rearrange memcg's hot and cold fields according to how they're actually
accessed. Keep frequently updated counters and their neighboring state
from fighting over cachelines and reduce needless cacheline traffic.
- "mm/damon/core: fix the size charged for a filter-trimmed region" (Donggeun
Yoo):
Fix DAMOS quota accounting when a filter trims a monitoring region. Charge
only the part left after filtering, not the original region, and add KUnit
coverage. Previously the excluded memory could eat into the quota and make
schemes run more slowly than requested.
- "mm/damon: add kunit and selftests for probes and probe weights" (SJ Park):
Add more tests for DAMON probes and their weights, including validation and
the results reported to userspace. This is mostly about catching
regressions in the newer probe infrastructure before they become harder to
diagnose.
- "mm: memcontrol: constify the read side of the read side of the memcg API"
(Tal Zussman):
Mark the read-only parts of the memcg interface const, from folio and
lruvec accessors to counters and swap helpers. Most of this is mechanical,
but it makes the contracts clearer and lets the compiler catch accidental
writes.
- "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):
Support the new prepare/apply probe operations in DAMON's virtual-address
backend. This brings vaddr monitoring into line with the probe
infrastructure and makes the added probe types useful there too.
- "mm/mglru: clean up folio counters and flag usage" (Kairui Song):
Simplify MGLRU's folio counters and flag handling. Remove redundant
accounting paths and make the state transitions easier to follow without
changing the intended reclaim policy.
- "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
(Mike Rapoport (Microsoft)):
Clarify and straighten out the set_direct_map_valid_noflush() interface
across architectures and execmem. Make the requested mapping changes and
the callers' expectations agree, rather than relying on subtly different
architecture behavior.
- "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):
Free zswap writeback folios as soon as their disk write completes. They
are cold temporary buffers, so putting them on the LRU only makes reclaim
rediscover them later. Extend swap-cache dropbehind and let zswap keep
these folios off the LRU altogether.
- "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):
Clean up the GUP-fast call chain and simplify how the fast-path helpers
pass their arguments and results around. Keep the page-pin behavior the
same while making the call sequence easier to maintain.
- "mm: optimize zone-device memmap initialization" (Li Zhe):
Speed up initialization of zone-device struct pages. Avoid redundant work
when setting up large device-memory ranges, where touching every descriptor
can get expensive.
- "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):
Reduce the size of zswap_entry by storing a compact pool identifier instead
of a full pointer. Keep the pool lookup and lifetime handling correct
while saving per-entry metadata.
- "mm/damon: support access monitoring of hugetlb-backed memory" (Krishna
Iyer):
Let DAMON monitor hugetlb-backed memory too. Extend the relevant access
checks and add coverage so those mappings no longer fall through a hole in
the monitoring machinery.
- "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport
(Microsoft)):
Tidy execmem's read-only-executable cache and fix its handling of the
awkward allocation and release cases. The aim is to make the cache's
ownership and permission transitions more predictable.
- "zsmallc: remove old object read API" (Sergey Senozhatsky):
Drop zsmalloc's old object-read API and move its remaining users to the
supported access mechanism. This removes a duplicate interface which we no
longer need.
- "mm/mempolicy: stop copying state in the interleave paths" (Gregory Price):
Stop copying mempolicy state in the interleave paths when a reference to
the existing policy will do. This avoids extra work and makes the
ownership rules less obscure.
- "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry Song
(Xiaomi)):
Make MGLRU's generation advancement cheaper and fix cases where cold and
hot folios end up in the wrong order. Adjust the counter and list handling
so reclaim doesn't keep passing over the better eviction candidates.
- "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):
Treat MF_DELAYED as a partially completed memory-failure operation, not an
outright failure. Propagate that result correctly through shmem and the
generic handler, fix the extra-reference accounting, and add tests for the
resulting SIGBUS behavior.
- "tools/mm/page_owner_sort: fix --sort, add module filter, improve usage" (Ye
Liu):
Fix page_owner_sort's --sort handling, add module-based filtering and make
the usage output more helpful. This makes the tool less frustrating when
tracking down who is holding on to pages.
- "mm/damon: move damos filter range arguments validation to core" (SJ Park):
Move DAMOS filter range validation into the core, where all callers can
share it. Also close the sysfs read-twice races which could pass
inconsistent ranges, and add tests for invalid input.
- "mm/damon: misc cleanups" (Zenghui Yu (Huawei)):
Clean up a collection of small DAMON rough edges in the core, interfaces
and tests. No large behavior change here, just simpler code and fewer
opportunities for confusion.
- "mm/damon: cleanup code, add test cases, and update guidances in docs" (SJ
Park):
Clean up DAMON's core and interfaces, add missing test cases and bring the
documentation into line with the code. These changes should make the newer
facilities easier to understand and maintain.
- "mm/damon: introduce hugepage_size probe filter" (SJ Park):
Add a DAMON probe filter for hugepage size. Let users select a range of
folio sizes through sysfs, validate the range and document the new
interface, so monitoring can concentrate on memory backed by the desired
hugepage sizes.
- "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu (Huawei)):
Fix some pagemap ioctl test assumptions and clean up their setup and
reporting. Make failures point to the operation that went wrong rather
than to test harness bookkeeping.
- "mm: avoid large folio splits when swap is unavailable" (Johannes Weiner):
Avoid splitting large folios merely to attempt swap when no swap space is
available. There is little point paying for an expensive split when
reclaim cannot actually swap the resulting pages out.
- "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):
Fix the workingset shadow-node budget with MGLRU enabled. Keep the shadow
entries within the intended limits so refault tracking does not quietly
consume more metadata than it should.
- "selftests/mm: TAP output and global-state fixes" (Song Hu):
Fix selftests which produce misleading TAP output or fail to restore global
settings after a run. A test ought to leave the system as it found it,
particularly when a whole suite follows behind.
- "mm: remove page_swap_entry()" (Tal Zussman):
Remove page_swap_entry() and convert its remaining users to the folio and
swap-entry helpers. Lose an old page-level interface and make the swap
paths a little more consistent.
- "mm: refactor zonelist constructors and iterators" (Gregory Price):
Refactor the zonelist construction and walk helpers to reduce duplicated
logic. Keep the allocation ordering rules intact while making it clearer
how zones are selected.
- "mm: kmemleak: batch the struct page scan" (Breno Leitao):
Scan adjacent struct pages in batches instead of taking kmemleak_lock once
for every single page. This preserves scan coverage and the lock-hold
bound, while cutting overhead substantially on debug kernels.
- "mm/damon: misc improvements in tests and documents" (Zenghui Yu (Huawei)):
Fix some DAMON selftests which leave kdamond running or fail under Python
safe-path mode, and improve the KUnit coverage and documentation. Nothing
especially glamorous, but these are worth doing.
- "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):
Add a DAMOS core filter using weighted probe-hit counts. This gives
schemes another way to select regions based on what the monitoring probes
observed.
- "mm/mglru: fix ineffective memory protection for non-kswapd reclaim" (Ridong
Chen):
Fix MGLRU's memory protection handling for reclaim outside kswapd. The
protection settings weren't having the intended effect in these paths,
leaving protected memory more exposed than requested.
- "mm/damon: improve readability, clarity and test coverage" (SJ Park):
Simplify a handful of DAMON core helpers, clarify their behavior and expand
test coverage. There are no intended userspace-visible changes in this
batch.
- "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng Wang):
Stop identifying reclaim and compaction workers through the PF_KSWAPD and
PF_KCOMPACTD task flags. Use their kthread functions instead and remove
the redundant flag plumbing.
- "mm/hugetlb: fix surplus accounting and availability checks during demotion"
(Longlong Xia):
Fix HugeTLB surplus accounting and availability checks when demoting huge
pages. Keep the counters and reservation decisions consistent as one huge
page turns into several smaller ones.
- "mm/damon: add kunit tests for probe_hits handling and probe params
validation" (Jason Angelov):
Add KUnit tests for DAMON probe-hit handling and invalid probe parameters.
These cover edge cases that were too easy to miss in ordinary monitoring
tests.
- "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms" (SJ
Park):
Fix a few DAMON bugs in KUnit tests, quota-goal handling and the sysfs
refresh interval. Small fixes, but the incorrect results and control
behavior were real.
- "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):
Simplify zswap's invalidate and store paths to avoid avoidable lookups and
work. Keep the entry lifetime rules intact while making those frequent
operations cheaper.
- "mm: replace custom ratelimiting logic" (Pedro Falcato):
Replace hand-rolled MM rate limiting with the common kernel helpers. There
is no need to maintain another local version of the same mechanism.
- "mm/vmalloc: minor cleanups" (Ye Liu):
Tidy some vmalloc initialization and reporting code, and pull duplicated
vmap-area insertion work into a helper. No functional changes are
intended.
- "mm/mglru: clean up isolate_folios for readability and clarity" (Ridong
Chen):
Clean up MGLRU's isolate_folios() so the decisions are easier to read and
verify. Keep reclaim behavior unchanged while removing unnecessary twists
in the control flow.
- "Catch automatic storage in IDA and Maple Tree definitions" (Yury Norov):
Catch IDA and maple-tree definitions placed in automatic storage where the
lifetime rules are wrong or easy to get wrong. Add checks so such mistakes
are harder to slip through unnoticed.
- "mm, swap: some random fixes and cleanups" (Kemeng Shi):
Fix and simplify a few unrelated swap paths, removing redundant work and
tidying up error handling. A small collection of things which were better
fixed than left lying around.
- "mm/page_io: folio conversion cleanups" (Tal Zussman):
Finish some page-to-folio conversions in swap I/O, removing obsolete
wrappers and using folio operations consistently. The I/O behavior is
intended to remain the same.
- "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):
Skip empty swap clusters during swapoff instead of walking slots which have
nothing to release. This avoids pointless work on sparsely used swap
devices.
- "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):
Teach the VMA trace output to decode architecture-specific flags, rather
than leaving them as unexplained bits. That should make tracing a good
deal more useful when debugging unusual mappings.
- "mm, swap: don't spin on a bad swap entry" (Breno Leitao):
Stop repeatedly retrying a swap entry which is already known to be bad.
Make the error path terminate cleanly instead of wasting CPU chasing an
entry that cannot be used.
- "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock" (Qi Xi):
Fix an out-of-range shift in isolate_single_pageblock() and tighten its
associated boundary handling. UBSAN found the issue; the result should be
more robust pageblock isolation.
- "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):
Fix a use-after-free in khugepaged tracepoint handling. Make sure the
information recorded by tracing stays valid for as long as the trace event
needs it.
- "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):
Fix several DAMOS problems across the core and physical- and
virtual-address backends. The changes close error cases and bring the
implementations back into agreement.
- "mm/hugetlb_cgroup: move the per-node usage along with the folio" (Hongfu
Li):
Move HugeTLB per-node usage accounting when folios migrate between nodes or
are reparented to another cgroup. Otherwise numa_stat can retain stale
charges and even underflow when the folio is freed.
- "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify kmalloc"
(Mike Rapoport (Microsoft)):
Document the typed k[mz]alloc_obj() allocation helpers and clear up some
kmalloc guidance. Make it easier for callers to choose the right
interface.
- "selftests/mm: Validate selections and scope memfd_secret setup" (Tianyi
Chen):
Check selftest selections before running and confine memfd_secret setup to
the cases that actually need it. Avoid confusing failures caused by the
test harness itself.
- "mm/damon: move zero damos quota target_value handling to the core layer"
(SJ Park):
Handle a zero DAMOS quota goal target in the core rather than making each
user of the interface invent its own rule. Keep quota decisions consistent
across callers.
- "mm/damon: Introduce a huge page collapsing mechanism using auto tuning"
(Asier Gutierrez):
Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
monitoring feedback to decide when collapse is worthwhile rather than
forcing one fixed policy onto every workload.
- "kmemleak: fix stale documentation and raise the verbose default" (Breno
Leitao):
Bring the kmemleak documentation up to date and require a third confirming
scan before verbose kernels print a suspected leak. The extra scan helps
suppress transient false positives in noisy debug builds.
- "mm/memory: improve insert_pages() error handling" (Avi Weiss):
Tighten insert_pages() error handling so partial failures are reported and
cleaned up consistently. The caller should not have to guess how far the
operation got.
- "mm/damon: allow NULL or unstarted damon_ctx parameter for damon_call()" (SJ
Park):
Make damon_call() handle NULL and not-yet-started contexts safely.
Simplify the rules for callers and avoid an indefinite wait on an invalid
state.
- "mm/damon: introduce pgidle_set probe filter type" (SJ Park):
Add a pgidle_set DAMON probe filter, giving monitoring users another way to
select pages by their idle-tracking state. Wire it through the filter
interfaces and tests.
- "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):
Remove DAMON core helpers which no longer have callers. Keep the API
surface smaller rather than retaining dead code just in case.
- "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):
Avoid calling pmd_folio() on special PMD mappings that have no struct page.
The old assumption could fault in procfs walkers; use the normal-folio
checks and handle those mappings properly.
- "mm: remove three unused helpers from mm.h" (Tal Zussman):
Remove three unused helpers from mm.h. Fewer obsolete interfaces for the
next person to stumble over.
- "mm/damon: improvements in efficiency, error handling, documents" (Liew Rui
Yan):
Skip needless DAMOS quota work once the quota is full, propagate a missing
sysfs error and tidy a couple of comments. The ignored error could make a
monitoring-start request appear successful when it wasn't.
- "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui Yan):
Explain DAMON's nr_snapshots accounting in the design documentation and
straighten out the associated terminology. Make it clearer what users
should expect from that counter.
- "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson Felipe
Pereira):
Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
child's cgroup to become unpopulated before reconfiguring it, and avoid
another test assumption which breaks under constrained scheduling.
- "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):
Correct the KSM advisor documentation and a misleading code comment. Keep
the description aligned with how the advisor actually works.
- "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb() fails"
(Ackerley Tng):
Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
failure exits undo what was allocated rather than leaving stale accounting
or resources behind.
- "mm, memcg: fix memory.peak reset clobbering other fds' watermark" (Ridong
Chen):
Fix memory.peak reset handling so resetting one file descriptor doesn't
overwrite the watermark kept for another. Keep those per-open measurements
independent as intended.
- "mm: reject zone device folios in more folio walkers" (Gregory Price):
Reject zone-device folios in page walkers that cannot safely handle them.
Extend the existing checks rather than assuming every folio has ordinary
system-memory backing.
- "percpu: remove code with no effect" (Sang-Heon Jeon):
Remove a few pieces of percpu code which no longer do anything. There is
no reason to keep maintaining dead paths.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCatbvywAKCRDdBJ7gKXxA
jrEfAP91yviLKCh8AEazeeBo4D65ntp0FmZB9qqCj46+YuEkowD9HPAyTpD+PjWS
yp/lLvvS4RIg6chID4S2U/pLGzlypg4=
=RIh/
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:
- "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau):
Give khugepaged a proper workout. Extend the tests to all supported
mTHP orders, check exactly which windows collapsed, and make scan
completion deterministic. Race collapse against faults, pinning, fork
and remap; verify that the contents survive.
Add coverage for whole-page-table zaps and memory pressure too.
- "selftests/mm: separate GUP microbenchmarking from functional testing"
(Sarthak Sharma):
Untangle GUP benchmarking from correctness testing. Move the
benchmark into tools/mm, add a standalone harness-based GUP selftest,
and move shared helpers into tools/lib/mm. Give each tool one job
instead of mixing timing measurements with correctness checks.
Cover the mapping, pinning and batch-size combinations explicitly.
- "mm: Switch device DAX to section-based vmemmap optimization" (Muchun
Song):
Apply section-based vmemmap optimization to device DAX. Rework the
backing metadata layout to save memory while preserving the handling
of device memory hotplug and its different alignment and lifetime
requirements.
- "mm: Introduce section-based vmemmap optimization for HugeTLB"
(Muchun Song):
Cut the memory consumed by HugeTLB's struct page array with
section-based vmemmap optimization. Arrange the metadata so large
huge pages need fewer backing pages, while keeping initialization,
teardown and the various hugepage configurations straight.
- "mm/huge_memory: clean up and decouple the anon and file split
helpers" (Kairui Song):
Separate anonymous and file-backed folio splitting, which have rather
different locking and bookkeeping requirements. Move the work into
separate helpers, drop dead checks and tidy swap-cache handling. Fix
error paths, including one that could leave a folio frozen.
Keep the swap cache cases separate from file-cache splitting.
- "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):
Make per-VMA locking unconditional and clean up the old conditional
code around it. This removes configuration-dependent plumbing and
lets callers depend on one locking model rather than carrying both
cases along.
- "memcg: remove the v1 soft limit" (Shakeel Butt):
Remove the old cgroup v1 memory soft-limit machinery. This has long
since been superseded by the newer memory-control interfaces; hauling
around a separate reclaim scheme for it no longer buys us much.
- "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):
Read /proc/PID/smaps_rollup using per-VMA locks where possible,
rather than holding mmap_lock across the entire walk. Retain the
contention fallback and add tearing tests. This considerably reduces
latency when another thread is busy changing its mappings.
- "mm/damon: introduce data access-as-a-data attribute" (SJ Park):
Teach DAMON to expose memory access observations as data attributes,
making them available to the probe and filtering machinery. Extend
the interfaces, documentation and tests so the new information can be
used rather than merely collected.
- "Remove PG_private by using page/folio->private checks instead" (Zi
Yan):
Get rid of PG_private and use the folio's private pointer to say
whether private data is attached. Convert the filesystem users,
including erofs, f2fs and md, and clean up the old accessors and
flags. There are a few special cases, notably swapcache and hugetlb,
which need explicit care.
- "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes):
Make freeing userspace page tables safe against RCU readers. Sort out
the page-table lifetime and locking rules so walkers cannot stumble
over freed tables while mappings are being torn down.
- "make unused huge shrinker memcg aware" (Qi Zheng):
Make shmem's unused-huge-folio shrinker aware of memory cgroups, so
reclaim can find those folios under the right memcg. Wire up the
per-memcg tracking and its lifetime rules, and give the shrinklist
its own lockdep class to avoid spurious dependency reports.
- "mm: Drop pxd_ERROR()" (Anshuman Khandual):
Remove the old pxd_ERROR() page-table checks and their
architecture-specific baggage. Simplify the common page-table
interfaces and callers now that these checks no longer serve a
useful purpose.
- "memcg: group struct fields by access pattern" (Shakeel Butt):
Rearrange memcg's hot and cold fields according to how they're
actually accessed. Keep frequently updated counters and their
neighboring state from fighting over cachelines and reduce needless
cacheline traffic.
- "mm/damon/core: fix the size charged for a filter-trimmed region"
(Donggeun Yoo):
Fix DAMOS quota accounting when a filter trims a monitoring region.
Charge only the part left after filtering, not the original region,
and add KUnit coverage. Previously the excluded memory could eat into
the quota and make schemes run more slowly than requested.
- "mm/damon: add kunit and selftests for probes and probe weights" (SJ
Park):
Add more tests for DAMON probes and their weights, including
validation and the results reported to userspace. This is mostly
about catching regressions in the newer probe infrastructure before
they become harder to diagnose.
- "mm: memcontrol: constify the read side of the read side of the memcg
API" (Tal Zussman):
Mark the read-only parts of the memcg interface const, from folio and
lruvec accessors to counters and swap helpers. Most of this is
mechanical, but it makes the contracts clearer and lets the compiler
catch accidental writes.
- "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):
Support the new prepare/apply probe operations in DAMON's
virtual-address backend. This brings vaddr monitoring into line with
the probe infrastructure and makes the added probe types useful there
too.
- "mm/mglru: clean up folio counters and flag usage" (Kairui Song):
Simplify MGLRU's folio counters and flag handling. Remove redundant
accounting paths and make the state transitions easier to follow
without changing the intended reclaim policy.
- "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
(Mike Rapoport (Microsoft)):
Clarify and straighten out the set_direct_map_valid_noflush()
interface across architectures and execmem. Make the requested
mapping changes and the callers' expectations agree, rather than
relying on subtly different architecture behavior.
- "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):
Free zswap writeback folios as soon as their disk write completes.
They are cold temporary buffers, so putting them on the LRU only
makes reclaim rediscover them later. Extend swap-cache dropbehind and
let zswap keep these folios off the LRU altogether.
- "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):
Clean up the GUP-fast call chain and simplify how the fast-path
helpers pass their arguments and results around. Keep the page-pin
behavior the same while making the call sequence easier to maintain.
- "mm: optimize zone-device memmap initialization" (Li Zhe):
Speed up initialization of zone-device struct pages. Avoid redundant
work when setting up large device-memory ranges, where touching every
descriptor can get expensive.
- "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):
Reduce the size of zswap_entry by storing a compact pool identifier
instead of a full pointer. Keep the pool lookup and lifetime handling
correct while saving per-entry metadata.
- "mm/damon: support access monitoring of hugetlb-backed memory"
(Krishna Iyer):
Let DAMON monitor hugetlb-backed memory too. Extend the relevant
access checks and add coverage so those mappings no longer fall
through a hole in the monitoring machinery.
- "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport):
Tidy execmem's read-only-executable cache and fix its handling of the
awkward allocation and release cases. The aim is to make the cache's
ownership and permission transitions more predictable.
- "zsmallc: remove old object read API" (Sergey Senozhatsky):
Drop zsmalloc's old object-read API and move its remaining users to
the supported access mechanism. This removes a duplicate interface
which we no longer need.
- "mm/mempolicy: stop copying state in the interleave paths" (Gregory
Price):
Stop copying mempolicy state in the interleave paths when a reference
to the existing policy will do. This avoids extra work and makes the
ownership rules less obscure.
- "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry
Song):
Make MGLRU's generation advancement cheaper and fix cases where cold
and hot folios end up in the wrong order. Adjust the counter and list
handling so reclaim doesn't keep passing over the better eviction
candidates.
- "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):
Treat MF_DELAYED as a partially completed memory-failure operation,
not an outright failure. Propagate that result correctly through
shmem and the generic handler, fix the extra-reference accounting,
and add tests for the resulting SIGBUS behavior.
- "tools/mm/page_owner_sort: fix --sort, add module filter, improve
usage" (Ye Liu):
Fix page_owner_sort's --sort handling, add module-based filtering and
make the usage output more helpful. This makes the tool less
frustrating when tracking down who is holding on to pages.
- "mm/damon: move damos filter range arguments validation to core" (SJ
Park):
Move DAMOS filter range validation into the core, where all callers
can share it. Also close the sysfs read-twice races which could pass
inconsistent ranges, and add tests for invalid input.
- "mm/damon: misc cleanups" (Zenghui Yu):
Clean up a collection of small DAMON rough edges in the core,
interfaces and tests. No large behavior change here, just simpler
code and fewer opportunities for confusion.
- "mm/damon: cleanup code, add test cases, and update guidances in
docs" (SJ Park):
Clean up DAMON's core and interfaces, add missing test cases and
bring the documentation into line with the code. These changes should
make the newer facilities easier to understand and maintain.
- "mm/damon: introduce hugepage_size probe filter" (SJ Park):
Add a DAMON probe filter for hugepage size. Let users select a range
of folio sizes through sysfs, validate the range and document the new
interface, so monitoring can concentrate on memory backed by the
desired hugepage sizes.
- "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu):
Fix some pagemap ioctl test assumptions and clean up their setup and
reporting. Make failures point to the operation that went wrong
rather than to test harness bookkeeping.
- "mm: avoid large folio splits when swap is unavailable" (Johannes
Weiner):
Avoid splitting large folios merely to attempt swap when no swap
space is available. There is little point paying for an expensive
split when reclaim cannot actually swap the resulting pages out.
- "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):
Fix the workingset shadow-node budget with MGLRU enabled. Keep the
shadow entries within the intended limits so refault tracking does
not quietly consume more metadata than it should.
- "selftests/mm: TAP output and global-state fixes" (Song Hu):
Fix selftests which produce misleading TAP output or fail to restore
global settings after a run. A test ought to leave the system as it
found it, particularly when a whole suite follows behind.
- "mm: remove page_swap_entry()" (Tal Zussman):
Remove page_swap_entry() and convert its remaining users to the folio
and swap-entry helpers. Lose an old page-level interface and make the
swap paths a little more consistent.
- "mm: refactor zonelist constructors and iterators" (Gregory Price):
Refactor the zonelist construction and walk helpers to reduce
duplicated logic. Keep the allocation ordering rules intact while
making it clearer how zones are selected.
- "mm: kmemleak: batch the struct page scan" (Breno Leitao):
Scan adjacent struct pages in batches instead of taking kmemleak_lock
once for every single page. This preserves scan coverage and the
lock-hold bound, while cutting overhead substantially on debug
kernels.
- "mm/damon: misc improvements in tests and documents" (Zenghui Yu):
Fix some DAMON selftests which leave kdamond running or fail under
Python safe-path mode, and improve the KUnit coverage and
documentation. Nothing especially glamorous, but these are worth
doing.
- "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):
Add a DAMOS core filter using weighted probe-hit counts. This gives
schemes another way to select regions based on what the monitoring
probes observed.
- "mm/mglru: fix ineffective memory protection for non-kswapd reclaim"
(Ridong Chen):
Fix MGLRU's memory protection handling for reclaim outside kswapd.
The protection settings weren't having the intended effect in these
paths, leaving protected memory more exposed than requested.
- "mm/damon: improve readability, clarity and test coverage" (SJ Park):
Simplify a handful of DAMON core helpers, clarify their behavior and
expand test coverage. There are no intended userspace-visible changes
in this batch.
- "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng
Wang):
Stop identifying reclaim and compaction workers through the PF_KSWAPD
and PF_KCOMPACTD task flags. Use their kthread functions instead and
remove the redundant flag plumbing.
- "mm/hugetlb: fix surplus accounting and availability checks during
demotion" (Longlong Xia):
Fix HugeTLB surplus accounting and availability checks when demoting
huge pages. Keep the counters and reservation decisions consistent as
one huge page turns into several smaller ones.
- "mm/damon: add kunit tests for probe_hits handling and probe params
validation" (Jason Angelov):
Add KUnit tests for DAMON probe-hit handling and invalid probe
parameters. These cover edge cases that were too easy to miss in
ordinary monitoring tests.
- "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms"
(SJ Park):
Fix a few DAMON bugs in KUnit tests, quota-goal handling and the
sysfs refresh interval. Small fixes, but the incorrect results and
control behavior were real.
- "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):
Simplify zswap's invalidate and store paths to avoid avoidable
lookups and work. Keep the entry lifetime rules intact while making
those frequent operations cheaper.
- "mm: replace custom ratelimiting logic" (Pedro Falcato):
Replace hand-rolled MM rate limiting with the common kernel helpers.
There is no need to maintain another local version of the same
mechanism.
- "mm/vmalloc: minor cleanups" (Ye Liu):
Tidy some vmalloc initialization and reporting code, and pull
duplicated vmap-area insertion work into a helper. No functional
changes are intended.
- "mm/mglru: clean up isolate_folios for readability and clarity"
(Ridong Chen):
Clean up MGLRU's isolate_folios() so the decisions are easier to read
and verify. Keep reclaim behavior unchanged while removing
unnecessary twists in the control flow.
- "Catch automatic storage in IDA and Maple Tree definitions" (Yury
Norov):
Catch IDA and maple-tree definitions placed in automatic storage
where the lifetime rules are wrong or easy to get wrong. Add checks
so such mistakes are harder to slip through unnoticed.
- "mm, swap: some random fixes and cleanups" (Kemeng Shi):
Fix and simplify a few unrelated swap paths, removing redundant work
and tidying up error handling. A small collection of things which
were better fixed than left lying around.
- "mm/page_io: folio conversion cleanups" (Tal Zussman):
Finish some page-to-folio conversions in swap I/O, removing obsolete
wrappers and using folio operations consistently. The I/O behavior is
intended to remain the same.
- "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):
Skip empty swap clusters during swapoff instead of walking slots
which have nothing to release. This avoids pointless work on sparsely
used swap devices.
- "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):
Teach the VMA trace output to decode architecture-specific flags,
rather than leaving them as unexplained bits. That should make
tracing a good deal more useful when debugging unusual mappings.
- "mm, swap: don't spin on a bad swap entry" (Breno Leitao):
Stop repeatedly retrying a swap entry which is already known to be
bad. Make the error path terminate cleanly instead of wasting CPU
chasing an entry that cannot be used.
- "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock" (Qi Xi):
Fix an out-of-range shift in isolate_single_pageblock() and tighten
its associated boundary handling. UBSAN found the issue; the result
should be more robust pageblock isolation.
- "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):
Fix a use-after-free in khugepaged tracepoint handling. Make sure the
information recorded by tracing stays valid for as long as the trace
event needs it.
- "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):
Fix several DAMOS problems across the core and physical- and
virtual-address backends. The changes close error cases and bring the
implementations back into agreement.
- "mm/hugetlb_cgroup: move the per-node usage along with the folio"
(Hongfu Li):
Move HugeTLB per-node usage accounting when folios migrate between
nodes or are reparented to another cgroup. Otherwise numa_stat can
retain stale charges and even underflow when the folio is freed.
- "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify
kmalloc" (Mike Rapoport):
Document the typed k[mz]alloc_obj() allocation helpers and clear up
some kmalloc guidance. Make it easier for callers to choose the right
interface.
- "selftests/mm: Validate selections and scope memfd_secret setup"
(Tianyi Chen):
Check selftest selections before running and confine memfd_secret
setup to the cases that actually need it. Avoid confusing failures
caused by the test harness itself.
- "mm/damon: move zero damos quota target_value handling to the core
layer" (SJ Park):
Handle a zero DAMOS quota goal target in the core rather than making
each user of the interface invent its own rule. Keep quota decisions
consistent across callers.
- "mm/damon: Introduce a huge page collapsing mechanism using auto
tuning" (Asier Gutierrez):
Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
monitoring feedback to decide when collapse is worthwhile rather than
forcing one fixed policy onto every workload.
- "kmemleak: fix stale documentation and raise the verbose default"
(Breno Leitao):
Bring the kmemleak documentation up to date and require a third
confirming scan before verbose kernels print a suspected leak. The
extra scan helps suppress transient false positives in noisy debug
builds.
- "mm/memory: improve insert_pages() error handling" (Avi Weiss):
Tighten insert_pages() error handling so partial failures are
reported and cleaned up consistently. The caller should not have to
guess how far the operation got.
- "mm/damon: allow NULL or unstarted damon_ctx parameter for
damon_call()" (SJ Park):
Make damon_call() handle NULL and not-yet-started contexts safely.
Simplify the rules for callers and avoid an indefinite wait on an
invalid state.
- "mm/damon: introduce pgidle_set probe filter type" (SJ Park):
Add a pgidle_set DAMON probe filter, giving monitoring users another
way to select pages by their idle-tracking state. Wire it through the
filter interfaces and tests.
- "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):
Remove DAMON core helpers which no longer have callers. Keep the API
surface smaller rather than retaining dead code just in case.
- "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):
Avoid calling pmd_folio() on special PMD mappings that have no struct
page. The old assumption could fault in procfs walkers; use the
normal-folio checks and handle those mappings properly.
- "mm: remove three unused helpers from mm.h" (Tal Zussman):
Remove three unused helpers from mm.h. Fewer obsolete interfaces for
the next person to stumble over.
- "mm/damon: improvements in efficiency, error handling, documents"
(Liew Rui Yan):
Skip needless DAMOS quota work once the quota is full, propagate a
missing sysfs error and tidy a couple of comments. The ignored error
could make a monitoring-start request appear successful when it
wasn't.
- "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui
Yan):
Explain DAMON's nr_snapshots accounting in the design documentation
and straighten out the associated terminology. Make it clearer what
users should expect from that counter.
- "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson
Felipe Pereira):
Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
child's cgroup to become unpopulated before reconfiguring it, and
avoid another test assumption which breaks under constrained
scheduling.
- "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):
Correct the KSM advisor documentation and a misleading code comment.
Keep the description aligned with how the advisor actually works.
- "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb()
fails" (Ackerley Tng):
Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
failure exits undo what was allocated rather than leaving stale
accounting or resources behind.
- "mm, memcg: fix memory.peak reset clobbering other fds' watermark"
(Ridong Chen):
Fix memory.peak reset handling so resetting one file descriptor
doesn't overwrite the watermark kept for another. Keep those per-open
measurements independent as intended.
- "mm: reject zone device folios in more folio walkers" (Gregory
Price):
Reject zone-device folios in page walkers that cannot safely handle
them. Extend the existing checks rather than assuming every folio has
ordinary system-memory backing.
- "percpu: remove code with no effect" (Sang-Heon Jeon):
Remove a few pieces of percpu code which no longer do anything. There
is no reason to keep maintaining dead paths.
* tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits)
mm: shmem: assign a lock class to the unused huge shrinklist
mm: vmscan: put rotation-missed folios at the LRU tail
mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches
mm: kmemleak: move the struct page scan into a helper
mm/damon: document that a zero sample_interval is accepted
mm/damon: fix typos in comments
mm/damon/sysfs: propagate damon_call() error in turn_damon_on
mm/damon/core: skip quota score setup when the quota is full
mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
mm/damon/core: charge only the part of a region the filter left
mm: disallow raw PFN mappings of huge/shared zeropage
selftests/mm: zap whole PTE tables in the khugepaged race harness
selftests/mm: add memory-pressure threads to the khugepaged race harness
selftests/mm: race the collapse of windows with holes
selftests/mm: add khugepaged race harness
selftests/mm: check that one khugepaged pass collapses one window
selftests/mm: run every supported collapse order by default
selftests/mm: cover a shared-source collapse write race
selftests/mm: parameterize the mixed-source collapse case by source order
selftests/mm: add order-parameterized khugepaged collapse cases
...
|
||
|
Linus Torvalds
|
734bef548a |
Networking changes for 7.4.
Core & protocols
----------------
- Continue the work on removing rtnl_lock dependencies:
- per-netns ARP and ND neighbour tables, with the default settings
now configurable per netns (inheritance from init_net is
controlled by the new net.core.neigh_inherit_init_net sysctl)
- RCU-protected configuration and rtnl_lock-less fill_info() for
hsr, netkit, sit, vlan and vxlan devices
- per-netns device unregistration for ip tunnel and gre devices
- use the netdev instance lock instead of rtnl_lock when reading
speed and duplex via sysfs
- batch the flushing of uncached routes at device unregistration
time, relieving rtnl_lock contention on netns dismantle.
- Add hardware pacing offload support, admin-controlled via a new
rtnetlink attribute, with sch_fq integration (implemented in idpf).
- Re-segment BIG TCP GSO packets into GSO packets fitting the
egress device limits instead of plain MSS-sized segments,
improving throughput for mixed BIG TCP / non-BIG TCP paths
by up to 70%.
- Generate RSS keys that spread flows over all the RX queues; the
previous random keys could leave some queues unused.
- Optimize the bridge VLAN forwarding paths: cache the port-VLAN in fdb
entries and consider only VLAN members when flooding, for ~10% more
Mpps in the fdb forwarding path.
- A few TCP/IP performance improvements aimed at efficient cache
usage and reducing contention.
- Add the TCP ROCCET congestion control, a CUBIC variant aimed at
avoiding bufferbloat in cellular networks.
- Continue the conversion of getsockopt callbacks to sockopt_t.
- Add an ethtool command to list the front-facing ports of an
interface, including SFP cages and modules, using the phy_port
representation.
- Enable BIG TCP support for bareudp tunnels.
- Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
transitions (listen() + shutdown() + connect() and connect() +
connect(AF_UNSPEC) + listen()).
- Remove most BUG_ON()s from core packet processing, replacing them
with error paths.
Wireless
--------
- Latency improvements, including lockless station get/dump and beacon
updates, plus RTNL reduction and locking cleanups.
- Infrastructure for non-station TX/RX with MLO.
- NAN (Wi-Fi Aware) Instant Communication support and other NAN
improvements.
- Control frame Integrity Protocol (CIP) and protected TWT support.
- Improvements for AP regulatory checks.
Netfilter
---------
- Disable br_netfilter in user namespaces and schedule it for removal
in 2027.
- Restrict the raw table in nft_compat to the specific family, hook and
priority.
- Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and
vice versa).
- Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
integration with memcg.
- Allow discovering conntrack zone filtering support in ctnetlink
dumps, and fix nfnetlink_hook handling of large dumps.
Deletions
---------
- Move the LLC type 2 sockets out of tree. There are no known users and
the code attracts a never-ending stream of LLM-driven fixes.
Device drivers
--------------
- New drivers:
- Meta Platforms NIC (mpnic), the second-generation NIC from Meta
- initial skeleton of the Nebula-matrix NICs driver (nbl)
- X-Powers AC200/AC300 Fast Ethernet PHYs
- Ethernet high-speed NICs:
- Intel:
- i40e: XDP metadata support for RX hash and VLAN tag
- ice: expose the E825 TSPLL state via the DPLL subsystem
- nVidia/Mellanox:
- move the data direct infrastructure from IB to core, in
preparation for netdev support.
- reduce the memory used per offloaded TC rule
- Meta (fbnic):
- support large io_uring zero-copy RX buffers
- Microsoft vNIC (mana):
- add BQL support
- Ethernet NICs consumer, and embedded:
- Airoha:
- LRO offload support
- Cadence (macb):
- context swapping for ringparam and MTU changes, avoiding
buffer loss under memory pressure
- Mucse (rnpgbe):
- TX/RX and link status support
- NXP (enetc):
- SR-IOV improvements and VF support for ENETC v4
- Qualcomm (ppe):
- IPQ5424 support
- Realtek PCI (r8169):
- phylink support
- RSS support for RTL8127
- Renesas (ravb):
- gPTP support for R-Car Gen4
- Synopsys (stmmac):
- XDP multi-buffer support on the TX side
- tc mqprio hw queue priority offload
- support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
DP1000 and Qualcomm sa8255p
- Ethernet switches:
- Mediatek (mt7530):
- fast age and change conduit support
- Microchip (ksz):
- support for KSZ8995XA/KS8995XA
- Microchip (lan966x):
- PCIe FDMA support, ~20x throughput increase in PCIe endpoint
- Microchip (sparx5):
- Time Aware Shaper (taprio) offload
- Motorcomm (yt921x):
- LED and SerDes PCS support
- Realtek (rtl8365mb):
- EEE support
- Ethernet PHYs:
- Broadcom:
- enable jumbo frames on BCM54xx
- Realtek:
- support for RTL8261CE_CG and RTL8261D_VM
- MDIO support for RTL838x and RTL839x
- WiFi drivers:
- Broadcom (brcmfmac):
- FT/OKC roaming offload
- Intel (iwlwifi):
- UHR sniffer support
- support for newer UEFI/BIOS tables
- MediaTek (mt76):
- mt7925 NAN improvements
- offchannel/scan improvements and MLO fixes
- Morse Micro (mm81x):
- monitor mode support
- Qualcomm (ath12k):
- IPQ5332 platform infrastructure
- Realtek (rtw88):
- RTL8723BS support
- SDIO TX performance improvements
- Realtek (rtw89):
- P2P_DEVICE support
- BT-coex updates for RTL8922D
- Bluetooth:
- move H:4 reassembly into the Bluetooth core
- add generic support for vendor packets
- MGMT: add security level changed event
- Bluetooth drivers:
- btusb: support Bulk Serialization Mode
- Intel: support Draco and Titan Lake, allow unsigned firmware
- Mediatek: MT7928 support
- Qualcomm: QCC2072 support
- Broadcom: Synaptics 4384 support
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmraNIAWHHBhb2xvLmFi
ZW5pQGdtYWlsLmNvbQAKCRApJHmNzI8TpBaeD/9iBxxaZzworKk3v+RalWo4noIC
QsZ8E0Du7vDruS2nESbZpUpf0lKxNxJVnXEj/q0acObzUuGFJBaqZ8Uzn337w6WK
nuM1YppPE9lIMNAgDhxKUIMGeVLHuQd3wQPsOs0nlywNehzrKYAfCUtcB3xD2H+I
xaUdTRooop5l6GpSS0CP7li/kzHb5GagVI2VmoOFCb+0BPl6tr+ITW8s0/Z/oyZC
Lx4Fl0Hhj0li4eHr0DS3vgS7jqmPFYOxo4zhGzXqCYaagPpvazR9RfFhP16BfJ/D
TPI3oIkqcyvttrTtgwYhLDJjw1+m+r1vmhel7Tp5XLHQJ4WXuunPBGrq9w7Xd+IF
JLd8VbUiXB2A/+fNSD3Q1nzukjRjlEsR2ZyRqAWqXWDhXYbAd0D/vptJJwem1ozm
RRoe9Gk2N+iSsqvfAq6coTRPEKrlsh27v36uWQZgQ2jA2SnrNsTuJwlhiET0Jc6T
kTEM0yjLDiUxsefOgGs5s10EnfLa2sL/0NWow0s83x6Dm3f3x2fvm2e0UlI3gLNI
43AgMaNO1IsNOWEiJC/O81pt/6FuF8cX+cJXtlLBW1ZTJnEnVtNlafJVnyfblblx
TXyzGtM0cUXyJsaS8/Qx1GUQO9N9MiWI4mCtDUWthBxvdpkn93G0pNXwnjybcnAH
0nX3+pVqFZCrG/PmvQ==
=ZOCE
-----END PGP SIGNATURE-----
Merge tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
Pull networking updates from Paolo Abeni:
"This includes a significant number of low-priority fixes - especially
in the NIC drivers area - that we deferred from the last few RCs in
the previous cycle, which can't be easily outlined in the synopsis
below.
Core & protocols:
- Continue the work on removing rtnl_lock dependencies:
- per-netns ARP and ND neighbour tables, with the default settings
now configurable per netns (inheritance from init_net is
controlled by the new net.core.neigh_inherit_init_net sysctl)
- RCU-protected configuration and rtnl_lock-less fill_info() for
hsr, netkit, sit, vlan and vxlan devices
- per-netns device unregistration for ip tunnel and gre devices
- use the netdev instance lock instead of rtnl_lock when reading
speed and duplex via sysfs
- batch the flushing of uncached routes at device unregistration
time, relieving rtnl_lock contention on netns dismantle.
- Add hardware pacing offload support, admin-controlled via a new
rtnetlink attribute, with sch_fq integration (implemented in idpf).
- Re-segment BIG TCP GSO packets into GSO packets fitting the egress
device limits instead of plain MSS-sized segments, improving
throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.
- Generate RSS keys that spread flows over all the RX queues; the
previous random keys could leave some queues unused.
- Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
fdb entries and consider only VLAN members when flooding, for ~10%
more Mpps in the fdb forwarding path.
- A few TCP/IP performance improvements aimed at efficient cache
usage and reducing contention.
- Add the TCP ROCCET congestion control, a CUBIC variant aimed at
avoiding bufferbloat in cellular networks.
- Continue the conversion of getsockopt callbacks to sockopt_t.
- Add an ethtool command to list the front-facing ports of an
interface, including SFP cages and modules, using the phy_port
representation.
- Enable BIG TCP support for bareudp tunnels.
- Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
transitions (listen() + shutdown() + connect() and connect() +
connect(AF_UNSPEC) + listen()).
- Remove most BUG_ON()s from core packet processing, replacing them
with error paths.
Wireless:
- Latency improvements, including lockless station get/dump and
beacon updates, plus RTNL reduction and locking cleanups.
- Infrastructure for non-station TX/RX with MLO.
- NAN (Wi-Fi Aware) Instant Communication support and other NAN
improvements.
- Control frame Integrity Protocol (CIP) and protected TWT support.
- Improvements for AP regulatory checks.
Netfilter:
- Disable br_netfilter in user namespaces and schedule it for removal
in 2027.
- Restrict the raw table in nft_compat to the specific family, hook
and priority.
- Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
versa).
- Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
integration with memcg.
- Allow discovering conntrack zone filtering support in ctnetlink
dumps, and fix nfnetlink_hook handling of large dumps.
Deletions:
- Move the LLC type 2 sockets out of tree. There are no known users
and the code attracts a never-ending stream of LLM-driven fixes.
Device drivers:
- New drivers:
- Meta Platforms NIC (mpnic), the second-generation NIC from Meta
- initial skeleton of the Nebula-matrix NICs driver (nbl)
- X-Powers AC200/AC300 Fast Ethernet PHYs
- Ethernet high-speed NICs:
- Intel:
- i40e: XDP metadata support for RX hash and VLAN tag
- ice: expose the E825 TSPLL state via the DPLL subsystem
- nVidia/Mellanox:
- move the data direct infrastructure from IB to core, in
preparation for netdev support.
- reduce the memory used per offloaded TC rule
- Meta (fbnic):
- support large io_uring zero-copy RX buffers
- Microsoft vNIC (mana):
- add BQL support
- Ethernet NICs consumer, and embedded:
- Airoha:
- LRO offload support
- Cadence (macb):
- context swapping for ringparam and MTU changes, avoiding
buffer loss under memory pressure
- Mucse (rnpgbe):
- TX/RX and link status support
- NXP (enetc):
- SR-IOV improvements and VF support for ENETC v4
- Qualcomm (ppe):
- IPQ5424 support
- Realtek PCI (r8169):
- phylink support
- RSS support for RTL8127
- Renesas (ravb):
- gPTP support for R-Car Gen4
- Synopsys (stmmac):
- XDP multi-buffer support on the TX side
- tc mqprio hw queue priority offload
- support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
DP1000 and Qualcomm sa8255p
- Ethernet switches:
- Mediatek (mt7530):
- fast age and change conduit support
- Microchip (ksz):
- support for KSZ8995XA/KS8995XA
- Microchip (lan966x):
- PCIe FDMA support, ~20x throughput increase in PCIe endpoint
- Microchip (sparx5):
- Time Aware Shaper (taprio) offload
- Motorcomm (yt921x):
- LED and SerDes PCS support
- Realtek (rtl8365mb):
- EEE support
- Ethernet PHYs:
- Broadcom:
- enable jumbo frames on BCM54xx
- Realtek:
- support for RTL8261CE_CG and RTL8261D_VM
- MDIO support for RTL838x and RTL839x
- WiFi drivers:
- Broadcom (brcmfmac):
- FT/OKC roaming offload
- Intel (iwlwifi):
- UHR sniffer support
- support for newer UEFI/BIOS tables
- MediaTek (mt76):
- mt7925 NAN improvements
- offchannel/scan improvements and MLO fixes
- Morse Micro (mm81x):
- monitor mode support
- Qualcomm (ath12k):
- IPQ5332 platform infrastructure
- Realtek (rtw88):
- RTL8723BS support
- SDIO TX performance improvements
- Realtek (rtw89):
- P2P_DEVICE support
- BT-coex updates for RTL8922D
- Bluetooth:
- move H:4 reassembly into the Bluetooth core
- add generic support for vendor packets
- MGMT: add security level changed event
- Bluetooth drivers:
- btusb: support Bulk Serialization Mode
- Intel: support Draco and Titan Lake, allow unsigned firmware
- Mediatek: MT7928 support
- Qualcomm: QCC2072 support
- Broadcom: Synaptics 4384 support"
* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
Bluetooth: btusb: disable by default Qualcomm multi-subsystem
tipc: fix broadcast sender hang on last acker departure
tipc: fix use-after-free of broadcast reception link at node release
r8169: clear TX LPI on RTL8168h at link up after phylink conversion
tun: Require CAP_NET_ADMIN to attach to an ownerless device
net/sched/sch_cake: drop dead nla_nest_end() error check
net/sched/sch_cake: widen buffer_used to u64
net/sched/sch_cake: reduce parent backlog when clearing a tin
net/sched/sch_cake: serialize reconfiguration with the datapath
tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
net/mlx5e: Stop asserting for RTNL when closing channels
net: shrink the payload-only part of skb dataref to one bit
net: wwan: iosm: validate msg_head before indexing msg_ring
net: bgmac: rate limit RX error messages
selftests: net: veth: test XDP_TX to a peer with GRO enabled
veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
pppoe: delete session hash entries by pointer match
net: lan969x: don't disable hardirqs in fdma tx clear
net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
net: lan969x: fix DSM calendar for empty taxis
...
|
||
|
Linus Torvalds
|
864c07de0c |
hardening updates for v7.4-rc1
- Provide kmalloc_obj*-style API for devm_kmalloc() - Improve seq_buf API for saner C String handling with several bug fixes along the way (Kees Cook, Bill Wendling) - Overflow helper readability improvements (Bill Wendling) - Unexport native_write_cr4() (Dennis Chen) - um: fix CONFIG_GCOV for built-in code (Johannes Berg) - Improve stackinit test coverage (Justin Stitt) - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann) - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim) - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov) - Fix randstruct to recognize new container_of() behavior - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too - Fix a couple remaining allocation return type mismatches -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCatpUqAAKCRA2KwveOeQk u6f7AQCmaAF+jGVxeljdguKRrge+bjxpsK+RIyDzf7JMUauxPwD/RvGklH+QCACS xj4tExbgBFOAo48uvqfUiGsJLaCJAQg= =uEMy -----END PGP SIGNATURE----- Merge tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - Provide kmalloc_obj*-style API for devm_kmalloc() - Improve seq_buf API for saner C String handling with several bug fixes along the way (Kees Cook, Bill Wendling) - Overflow helper readability improvements (Bill Wendling) - Unexport native_write_cr4() (Dennis Chen) - um: fix CONFIG_GCOV for built-in code (Johannes Berg) - Improve stackinit test coverage (Justin Stitt) - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann) - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim) - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov) - Fix randstruct to recognize new container_of() behavior - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too - Fix a couple remaining allocation return type mismatches * tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits) overflow: Match arithmetic in both parts of __builtin_choose_expr lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4() extcon: realtek: Remove const from type_c_cfg allocation type coresight: cti: Add const to con_groups allocation type docs: core-api: Document the seq_buf API nvdimm: ndtest: Return the string length from flags_show() powerpc/papr_scm: Return the string length from the sysfs show functions seq_buf: Add seq_buf_init_append() bpf: Remove dead newline stripping from format_disasm_line() seq_buf: Add seq_buf_terminate() seq_buf: Add seq_buf_strlen() seq_buf: Clear what a writer did not claim when a seq_buf overflows seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow scsi: lpfc: Print rx monitor records straight into the seq_buf seq_buf: Do not pop from an overflowed seq_buf seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk() .get_maintainer.ignore: Add Kees Cook devres: Provide kmalloc_obj*-style API for devm_kmalloc mm: Move default_gfp() into gfp_types.h kunit/stackinit: Clean up XFAIL under instrumentation ... |
||
|
Linus Torvalds
|
bf23250845 |
This update includes the following changes:
API:
- Fix algif_skcipher source SG overrun.
- Allow hmac(sha512) for non-root users.
Algorithms:
- Add wrapper for zeroing AES key context.
- Avoid redundant stream initialisations in zstd.
Drivers:
- Remove hisilicon/sec.
- Handle digest-only authenc requests in atmel.
- Handle zero-length skcipher requests in mxs-dcp.
- Lower the default priority of caam/qi2.
Others:
- Optimise key comparison in rhashtable lookup that uses constant parameters.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmrVtLsACgkQxycdCkmx
i6cflxAAghMP47yn7CoImtft1TZoEDhj2pdoe0AiIoaynN8SJUFIvikMA6KnOMdM
dd4O6G4A5wkcMXXedmhxhKHOv9jZdBHFq+YeCvxWkaHlRm20ZSk+CL2/Mdt4ZCVz
9YibMnl9d/HYyUKJ9+4XU+3rCzEXXf+8mnLc4DdFTXeH2zhw4+ZvpBA9aDxnBI+V
rZm7+SusnFR9Bh0OWsJlPUfZ1Xzkm+DtFTctiCc9nUUV5z8ykCya3WxCuSb/BTUU
T6sZTJNJGRPE2n1kRYIsvSgvlGaAv8NLVWX1IGyosdDJrJ5pPgm8tbl6ZR9BqVZT
o0ysImwyHK8YrDcBWk+SlohFSHDzNTTQMCx9/UEwNmsRaf4M5yYP964ASsqAenQz
vm3lstFBktEeZe6T/Z1sw9cISDY38v0I2G9fbU/Rz7ZhqLD12U5fzV3PmdBXSG9S
fXXO6n5N0EfT/NXDwgncBgQLV+ejp/SJbiDDhrSxtLdPFU9BUkPhmEvxJ5pAiB/3
eOfVWZFOelzpx5FGArWy73MDpoMiX7Cki3fr2BtSY1/gEtQDMKkooH/Mq97cV1f+
CXjv744YEfGwoD9Dw620bEGRKXg3+ISA6h5+LelyfY6NOWO78kRhY2DvnWGHPV4B
0Glkj64Zpxp7W3CHVNIriy6DhU3+QuJGhUhXEoRGrnwJAp+kElY=
=hDmH
-----END PGP SIGNATURE-----
Merge tag 'v7.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto updates from Herbert Xu:
"API:
- Fix algif_skcipher source SG overrun
- Allow hmac(sha512) for non-root users
Algorithms:
- Add wrapper for zeroing AES key context
- Avoid redundant stream initialisations in zstd
Drivers:
- Remove hisilicon/sec.
- Handle digest-only authenc requests in atmel
- Handle zero-length skcipher requests in mxs-dcp
- Lower the default priority of caam/qi2
Others:
- Optimise key comparison in rhashtable lookup that uses constant
parameters"
* tag 'v7.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (146 commits)
crypto: atmel-tdes - consolidate error paths in atmel_tdes_dma_init()
crypto: atmel-tdes - reuse fast in atmel_tdes_crypt_start()
crypto: atmel-tdes - use separate DMA scatterlists
MAINTAINERS: delete entry for John Allen
hwrng: amd - use PMBASE_OFFSET consistently
hwrng: cctrng - simplify cctrng_probe()
hwrng: intel - simplify intel_rng_mod_init()
crypto: qat - fix use of destroyed vf2pf_lock on VF restart
crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
hwrng: imx-rngc - Use optional clock
crypto: talitos - init tasklets before requesting IRQs
crypto: algif_skcipher - rewind rounded output bytes
crypto: algif_hash - Allow hmac(sha512) for unpriviledged users
crypto: sa2ul - Remove unused fields
hwrng: stm32 - use devm_platform_ioremap_resource() in stm32_rng_probe()
hwrng: stm32 - drop redundant initializations
hwrng: amd - simplify control flow in amd_rng_mod_init()
hwrng: stm32 - reuse clock rate in stm32_rng_clock_freq_restrain()
hwrng: stm32 - use swap() in stm32_rng_probe()
hwrng: cctrng - drop redundant initializations
...
|
||
|
Linus Torvalds
|
2a08195e4d |
linux_kselftest-kunit-7.4-rc1
A single fix to kunit_run_all_tests() to return void since callers don't check the return value and the integer return type is a remnant from when the function was executed as initcall which is no longer the case. - kunit: Return void from kunit_run_all_tests() -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmrZGf4ACgkQCwJExA0N QxxB9xAA5r3AP1HYBFNXXcLrCZGT2Rx5L2l2Hww0MSi0gjvsT9eDGNtzIjMe1dfB wV19gv+hI+ZNZ3O1XhZrMQkjZ2v/DSqAZTsWqIwAS7fxy0iBMnDpZ85+ykRzmEhw dayNZ1lFRKedF8Z+z9PbWj9Y+omgl3Tprnn6C78tuuHKCMV3u4lvdYHlTb64Yh1C m8aGzPjO6447kLFTKLWutNVX/PaYqs+LPlarJDIXr2JPMfHtQZJxsFVZoyR0aGgw HTyOGapZU38j9pwmK067ISmkMqYg2X4Zps0AfPqoXnZ7cDvILlN6y2hbxZgAYURq 5pUeI9rLuTQlbIqsLcsEzqBBRAPTds3orpSs/KMGyOHYsD/1CuUdvID+DTTtRfTj A5X5aMnwlmxaIs34rhmL5ab1n0SBD4od/HRm8sKPwKheBDRBxlilYiiwSglYfsWy u+su4BqV241HQ6d9Kl+AyR/aQ7eJ67EJ8+T/urZ7v42eZgofEjCNsZQgC7KXQbD8 URFDjlLVlysVVvQkUB80388MY8k+NuYY7udDa1fMS/Ss+5/yV1lDI/GHBPsD9rgL mWSfzQxbhXR4GCsN3Pnff1M5uq2iPZSNdBc156kuqFhhs1+Gv67KqnO0wVWY0u8f Nco94UzofXkgKp+yDpp9uNSdkrRzMJwmgTlpiPAphwsXLzq7Gus= =7n9z -----END PGP SIGNATURE----- Merge tag 'linux_kselftest-kunit-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit update from Shuah Khan: "A single fix to kunit_run_all_tests() to return void since callers don't check the return value and the integer return type is a remnant from when the function was executed as initcall which is no longer the case" * tag 'linux_kselftest-kunit-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Return void from kunit_run_all_tests() |
||
|
Linus Torvalds
|
7cd80b8168 |
ARCH=um updates:
- NOMMU support, mostly for mm/ testing
The only bigger change, we added support for building with
!CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
selftests targetted to NOMMU are moving elsewhere, but are
runnable on ARCH=um without MMU.
- Tighter page permissions
Tighten page permissions to catch more bugs (ARCH=um is,
after all, often used for testing), and also mark __init
memory inaccessible for the same reason.
- Various maintenance/cleanups
Fix build on really old hosts, fix leaks, make the code a
bit more robust, header cleanups, typo fixes, the usual.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmrYc78ACgkQ10qiO8sP
aAC06Q/9Fx+5BID0egPcp0FOD/AhK6eWrMIxQ5n1z0g3UUKU/UvZcs/XiApUfn3B
JB9yVT2Knm+JQiP/nWkUVt6IkoMOcMN/TmYLp55wZrJkUMys3FJnHWMs4TDIjlJV
nZ+Z8SDtCEDKXxvoUYDt+TqVIGbnhLAjNJlYzX3GLdrS09f5TwCVz7rda3mTEz0B
WoimFVmwPCLZcTqZOgzRCiv3BdBJlNraMUOrXaLxpJgtrBRRS62YTlUHRt2dI2sw
dBBChRI8ZxKF8kxGznt3+3av2/t3dlaT0BA6erb69X2kMSsDJChkUVZfWitg17d4
GcSRL3XeuybuO03Nda0zRkSRTYPmcK/rWqX4T+ujG2CBw0shfKo8yuTd++oLXpQS
sQPh8aFRvJ09hTHTtJur6oHAfX8klfvdUAffpnuySOpcHPdzjEjcgNtXJtunAPaE
deXqoqv2MMwF4tVyQH+zm0v6exlslls6RkzjaRvLhKT9jf6oo8Kbhew2ut0KheRI
Yts5gdzxr7DGM0w+IhOHGNdJL1AMD1se7N8iAvdg+Md9L7IvOycpJf7xGT2eUubT
my03KEMUfAPkX1IALCSJqi5gBnx9mrxhf/JM44qk0SCp6RSkcbipW/2tbX5bI+He
aa/Tm9KGDRhF3uxLvBGCt3Yuo67CT91WLUExQvs2+kfxKxVYhGg=
=bKwe
-----END PGP SIGNATURE-----
Merge tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull UML updates from Johannes Berg:
- NOMMU support, mostly for mm/ testing
The only bigger change, we added support for building with
!CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
selftests targetted to NOMMU are moving elsewhere, but are
runnable on ARCH=um without MMU.
- Tighter page permissions
Tighten page permissions to catch more bugs (ARCH=um is,
after all, often used for testing), and also mark __init
memory inaccessible for the same reason.
- Various maintenance/cleanups
Fix build on really old hosts, fix leaks, make the code a
bit more robust, header cleanups, typo fixes, the usual.
* tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)
um: place large BSS inputs in an output section
um: fix shutdown __inittext access
um: time-travel: fix sched_yield() behaviour
um: require MMU for UML PCI support
um: vector: avoid NULL queue dereference in legacy RX mode
um: use %pB to print functions in stack traces
um: mprotect() __init memory
um: move init text between __init_begin/end
um: improve checking for --no-warn-rwx-segments
um: make stub compilation more robust
um: link .lbss/.ldata/.lrodata correctly
um: add perf-event support
x86/um: remove unused <asm/required-features.h> header
um: fix typo "hander" in comment
um: Add definition of __NR_close_range for older host OSs
um: virtio_uml: switch to dynamic root device
um: Tighten exec permissions on page mappings
Documentation: um: document nommu UML
um: allow deselecting CONFIG_MMU
um: nommu: add userspace runner processes
...
|
||
|
Linus Torvalds
|
2e51c645fe |
soc: driver updates for 7.4
There are lots of minor updates for driver subsystems managed through
the soc tree (turris-omnia platform, cache driver, tee drivers, arm-cci,
bus, memory) as well as soc vendor specific drivers (starfive, xilinx,
microchip, nxp, amlogic, imx, renesas, samsung, ti, nvidia).
The more notable changes are:
- Larger updates for Qualcomm SoCs including support for SM8950 (Maili)
SM8975 (Hawi), Glymur, Shikra, and IPQ5424
- Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3,
and MT8167 in existing drivers
- Arm SCMI firmware driver support for ACPI PCC transport and module
autoloading of protocol specific drivers
- Apple crash log support for CrgA embedded controller
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrZvIwACgkQmmx57+YA
GNk+6g/9GA1wDmaqXI04Nnc3oh4fZ/LUXmyAPvLbJjL7CtNuPn2oSFyBjFbZmpLY
Ponhx2dV1Hei7/GzYA/BLGrxSkGoAfLSuPI0lB96Fhnk62hWQMGdOzC0nL+Bhk0C
fBeUolJG4gepPvPmXQEjAuXweO7Ff/xqK33njbjndEkxyCrsQC8LIRB5079VCupr
vu8YMNluIxmdVHmSPPdIKVjYsHZdVy59m9lSPoXWan9vdSK4SsLlo2JOE4FPXLQX
3AQFZWovPkBVz+AmXmi8X8iFMO0t8D21w6uhCDXfJzylD89VkuxiYqoAGJclNkXo
hMoiG2yZ6D4lNCHgI3Vs/CQtoNlHIXdC9Vc3vK0oobwYJIOUeJy9cpH+7/eREtX0
MF49XzNgdwb6eruTSvE6JbA1jjudVrOWHBuaOUXwsoofPfm3+XG6aR+QQRhgVx4l
LITffvauD2xMRAjbfO0nGtsbmKZRE99lxhYIhgvhL6BftbYZcLcwztopOidRkKAe
FjMKhH8tXzSYAQHYqVuHGEu4E9O92yePkkDUiasMJD2/V6ZjsEf0guilpjRZJkL1
2PINkDo24Ejo7mv5cfOsQDgPo1WwMUn8iNYLb7rOmaxsRHsXmmFSUhQgyKIU4ZT3
JEFBG76wvdXHG1aGEeQbMf+62XjqlJbo25jLl3L01T898Ks28RE=
=t02i
-----END PGP SIGNATURE-----
Merge tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC driver updates from Arnd Bergmann:
"There are lots of minor updates for driver subsystems managed through
the soc tree (turris-omnia platform, cache driver, tee drivers,
arm-cci, bus, memory) as well as soc vendor specific drivers
(starfive, xilinx, microchip, nxp, amlogic, imx, renesas, samsung, ti,
nvidia).
The more notable changes are:
- Larger updates for Qualcomm SoCs including support for SM8950
(Maili) SM8975 (Hawi), Glymur, Shikra, and IPQ5424
- Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3, and
MT8167 in existing drivers
- Arm SCMI firmware driver support for ACPI PCC transport and module
autoloading of protocol specific drivers
- Apple crash log support for CrgA embedded controller"
* tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (176 commits)
platform: cznic: turris-omnia-mcu: stop button emulation producers
cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers
soc: mpfs: use kref cleanup on probe failure
arm64: enable HAVE_SHARED_GPIOS for all ARM64 platforms
bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port()
bus: arm-cci: Drop CPU node reference in cci_ace_init_ports()
soc: fsl: dpio: Free the IRQ before releasing the I/O object
soc: fsl: dpio: Fix cleanup on IRQ registration failure
bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr
bus: fsl-mc: drop the fwnode links of the dpmacs nodes
soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
soc: qcom: geni-se: Drop unused icc_ddr parameter from geni_icc_get()
firmware: qcom: scm: Allow QSEECOM on ThinkPad T14s Gen 7
dt-bindings: mailbox: qcom: Document Maili CPUCP mailbox controller
dt-bindings: spmi: glymur-spmi-pmic-arb: Add compatible for Qualcomm Maili SoC
soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove
ASoC: dt-bindings: qcom,apr: Add modem_apps GLINK channel for shikra
firmware: qcom: tzmem: disable SHM bridge for SM7125 platform
soc: qcom: ubwc: Add Kalambo UBWC config
firmware: qcom: scm: Allow QSEECOM on Kalambo CRD
...
|
||
|
Petr Mladek
|
046d687e58 | Merge branch 'for-7.4' into for-linus | ||
|
Linus Torvalds
|
7be4bc52fd |
Driver core changes for 7.4-rc1
- core:
- Add TAINT_FORCED_BIND to taint the kernel and driver module before manual
sysfs bind/unbind operations; make add_taint_module() available to
driver core and update taint decoding tools and documentation
- Constify device_show/store_*() attribute parameters and adapt x86 MCE and
perf users to prepare for const dev_ext_attribute instances
- Fix UAF in NUMA access node registration failure handling by dropping
the device reference with put_device() instead of directly freeing the node
- debugfs:
- Make debugfs_create_str() read-only to eliminate double-free races between
concurrent writers; reject writable modes; convert interconnect and
SoundWire users to local file operations with mutex-protected strings
- kobject:
- Fix out-of-bounds access in kobject_action_type() when parsing action
strings containing embedded NUL bytes
- Fix the kobject_set_name() reference in kset_register() kernel-doc
- Rust:
- DMA:
- Tie Coherent, CoherentBox and CoherentHandle to the device's bound
lifetime to prevent retaining DMA allocations beyond driver unbind;
propagate the lifetime through nova-core and the DMA sample driver
- I/O:
- Require explicit base types for registers and replace relative registers
with typed subregion projections; reimplement register!() as a proc
macro, support registers using existing types without inline bitfields,
and convert nova-core, Tyr and the PCI sample; add AsRepr/AsReprMut and
transmute helpers with deferred size checks for representation
conversions
- Wrap ResourceSize in a transparent newtype with explicit conversions,
including checked conversion to usize
- PCI:
- Add typed PCIe extended capability lookup and SR-IOV accessors for the
First VF Offset and decoded VF BAR addresses and widths, keeping raw
SR-IOV registers private to preserve PCI core ownership of their state
- scatterlist:
- Honor the device's maximum segment size as well as the DMA mapping limit
when constructing SG tables
- Return u32 from SGEntry::dma_len() to match the C segment length type
- misc:
- Validate auxiliary DeviceId name length explicitly to improve
compile-time diagnostics for oversized device ID table entries
- Drop unnecessary 'static bounds from debugfs ScopedDir file creation
methods to support data containing non-'static references, including DMA
buffers
- misc:
- Add Johan Hovold as driver core maintainer
- Simplify platform_device_alloc() by returning early on allocation failure
- Fix typos in driver core and kernfs comments
-----BEGIN PGP SIGNATURE-----
iJEEABYKADkWIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCatNacRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQRZR3jtaqyi7YegD8ChAjvp7WireJHjodlAMA
j2Ty0NLjR8715/Ml/QNxnTUA/1/Auj3pXS5/VesKPp+PU6VVB4IdjjHzuzSY+7sz
y7wN
=GYmP
-----END PGP SIGNATURE-----
Merge tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
"Core:
- Add TAINT_FORCED_BIND to taint the kernel and driver module before
manual sysfs bind/unbind operations; make add_taint_module()
available to driver core and update taint decoding tools and
documentation
- Constify device_show/store_*() attribute parameters and adapt x86
MCE and perf users to prepare for const dev_ext_attribute instances
- Fix UAF in NUMA access node registration failure handling by
dropping the device reference with put_device() instead of directly
freeing the node
debugfs:
- Make debugfs_create_str() read-only to eliminate double-free races
between concurrent writers; reject writable modes; convert
interconnect and SoundWire users to local file operations with
mutex-protected strings
kobject:
- Fix out-of-bounds access in kobject_action_type() when parsing
action strings containing embedded NUL bytes
- Fix the kobject_set_name() reference in kset_register() kernel-doc
Rust:
- DMA:
- Tie Coherent, CoherentBox and CoherentHandle to the device's
bound lifetime to prevent retaining DMA allocations beyond
driver unbind; propagate the lifetime through nova-core and the
DMA sample driver
- I/O:
- Require explicit base types for registers and replace relative
registers with typed subregion projections; reimplement
register!() as a proc macro, support registers using existing
types without inline bitfields, and convert nova-core, Tyr and
the PCI sample; add AsRepr/AsReprMut and transmute helpers with
deferred size checks for representation conversions
- Wrap ResourceSize in a transparent newtype with explicit
conversions, including checked conversion to usize
- PCI:
- Add typed PCIe extended capability lookup and SR-IOV accessors
for the First VF Offset and decoded VF BAR addresses and widths,
keeping raw SR-IOV registers private to preserve PCI core
ownership of their state
- scatterlist:
- Honor the device's maximum segment size as well as the DMA
mapping limit when constructing SG tables
- Return u32 from SGEntry::dma_len() to match the C segment length
type
- misc:
- Validate auxiliary DeviceId name length explicitly to improve
compile-time diagnostics for oversized device ID table entries
- Drop unnecessary 'static bounds from debugfs ScopedDir file
creation methods to support data containing non-'static
references, including DMA buffers
Misc:
- Add Johan Hovold as driver core maintainer
- Simplify platform_device_alloc() by returning early on allocation
failure
- Fix typos in driver core and kernfs comments"
* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
rust: pci: add extended capability and SR-IOV support
kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
rust: io: convert ResourceSize into a transparent newtype
rust: scatterlist: return u32 from SGEntry::dma_len()
MAINTAINERS: add myself as driver core maintainer
debugfs: make debugfs_create_str() read-only
soundwire: debugfs: replace writable string helper
interconnect: debugfs: replace writable string helper
docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
driver core: platform: Simplify platform_device_alloc()
kobject: fix out-of-bounds access in kobject_action_type()
rust: scatterlist: honor the device's maximum segment size
driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
module: fix up documentation for add_taint() and add_taint_module()
module: pull out add_taint_module() to be public
driver core: Constify the signature of device_show/store_*()
drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
rust: auxiliary: validate DeviceId name length
driver core: fix typos in comments
...
|
||
|
Linus Torvalds
|
ccc4d9f891 |
Updates for the VDSO subsystem:
- Ensure that the CLOCK_AUX base calculations are properly scaled against
the base timekeeper. The update function failed to take the fractional
nanosecond part into account, which results in a rounding error.
- Cleanup and consolidate the vsyscall headers to get rid of pointless
copies all over the architectures.
- Replace a runtime conditional in the time getter function for namespaced
clocks by simple pointer arithmetic which speeds up the read function.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmrYiqIQHHRnbHhAa2Vy
bmVsLm9yZwAKCRCmGPVMDXSYofADD/94Tna5WrqZ5EEnnoIaoTqfy0c5DyenCUtJ
MynlaHq68+AD+iGEpmTC5zc+WiNjaLTQ/LVQXPcBCij4mPMyu02i5Gl+KZSoYOuf
gWCjOMa9ItADKVtDLyVbGXfnZCPkZEDj7cf6fZ6qeRIWgQjGAj54I8N0TfVQ7zG3
kkafIittFzcBZPOyz7m2a5/82C5qLsyjmX2QmCj9CqLqwjhMcNO9TPgK7nbBMhqo
/rjtLVv/m8oAR+Z+6HYy7+aRnmdrYoD0VW6+umNbg7YcxyzqJ901P0IvJlOKAo2n
k7uvoJJc8Dd21iSYJb0KIC+5SVtawvtL1aCbKLf5uNSeteJuMx8PQQc85YHb5Bj8
4ocXw3XYptefheABP1qezkv+LEBU6Cbtv7h4nZ3nhcyo4ed9Xf2eE9wHV6EraF6U
MS6V7KcKOFwXxFR7aXvtCVPgUhHkkO2xbRXRLBizOF9dJZgmg2crLQRsov4nnLd8
PxAgoNJhOkfrWLjTPdNYu0GlIHzbJyJVk8HW1bmnGVQYPyj2W34es7KQKSU9eS17
WSUkZFdsm/BiBiGwYz7vej/No60k58gDMMqRmJSHdTxgni4O0f3w7u/PohEOX/Xb
lK2l2SgVvKQiQlwhjK+260XLtnUKEn7HGCYnTJDQAw3eh7YqIkJ0TsWbyU3u1yTC
IVPAg10T4A==
=cFdX
-----END PGP SIGNATURE-----
Merge tag 'timers-vdso-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull VDSO updates from Thomas Gleixner:
"Updates for the VDSO subsystem:
- Ensure that the CLOCK_AUX base calculations are properly scaled
against the base timekeeper. The update function failed to take the
fractional nanosecond part into account, which results in a
rounding error.
- Cleanup and consolidate the vsyscall headers to get rid of
pointless copies all over the architectures.
- Replace a runtime conditional in the time getter function for
namespaced clocks by simple pointer arithmetic which speeds up the
read function"
* tag 'timers-vdso-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
vdso/vsyscall: Keep the CLOCK_AUX base scaled
vdso/math64: Add and use __iter_div64_u64_rem()
vdso/math64: Use OPTIMIZER_HIDE_VAR() in __iter_div_u64_rem()
vdso/gettimeofday: Avoid runtime conditional in do_hres_timens()
vdso: Remove __ASSEMBLER__ guards from vsyscall.h
vdso: Add asm-generic/vdso/vsyscall.h
vdso: Remove unnecessary vdso/vsyscall.h includes
riscv/hwprobe: Include vdso/datapage.h
arm64/vdso: Delete asm/vdso/vsyscall.h inclusions
x86/vdso: Delete asm/vdso/vsyscall.h inclusions
sparc/vdso: Delete asm/vdso/vsyscall.h inclusion
s390/vdso: Delete asm/vdso/vsyscall.h inclusions
sparc/vdso: Move __VDSO_PAGES to asm/vdso.h
x86/vdso: Move vDSO page definitions to asm/vdso.h
vdso: Delete asm-generic/vdso/vsyscall.h
vdso/vsyscall: Define fallback time synchronization functions in vsyscall.c
vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.c
vdso/gettimeofday: Define fallback __arch_get_vdso_u_time_data() in gettimeofday.c
vdso: Move the kernel-side time update helpers to a new header
|
||
|
Linus Torvalds
|
a56a18c14a |
Report CSD-lock stall recovery time
* Refactor to simplify csd_lock_wait_toolong() function prototype. * Report time required to recover from a CSD-lock stall. * Add a test of this reporting. -----BEGIN PGP SIGNATURE----- iQJHBAABCgAxFiEEbK7UrM+RBIrCoViJnr8S83LZ+4wFAmrNfTsTHHBhdWxtY2tA a2VybmVsLm9yZwAKCRCevxLzctn7jEVLD/9/yL6kJBQB1M6zXqzlCD6mbZ6zTJXy +VngewIiv4tGNODT5wx9CvRxl9eURiaobpGGbMl7CJF8k1YEbEfhKizsYicbkSpJ FzfoxudaZH8isld6JweY0ZpJ08VqiScHkIByp0Ybgh7dTNPkivULInxFqtJgcfvK 06tQsMMle5oxiN/a+FJFSnkyVFNj9lAwwkzPfpFObsq3OotA7hU0LYmS6cp4m7HC 7A8+6mJt/MsEOXlnq3NY4WaoxW/DwvznSIpxj3TO4cSsateUVfFDI3ks9KY+uNIy s+i+zBUQemgVQCGiWxY/0s3osimaGk7flU5L8mMjabuj1UWRPwudFUpY0I3xPrnd /giRHSTEe6n5e6jRqoMlPIvIaVMyG4FbEWzPfps/YOE1bLHzatLPisFqxwsbMbXG pYRmkyn93NoO+zYRJScD9C3DBsYY1OSF0MaUWImLo59/1Eo9PdZCBcLEtwUCP7te yIxZKzGiVJXUOevUVPW86nhFS4bnBvTAiZ8mH2nrlNKFplsHpnS3No6k5P0yx4as oFvE3vdGFJOK4fGvZ2ixVr0HpRtMzsroclAK+PP4qgK6CMqOD+oXYSITtCLycXBz yeKzIkTXxszkFJmOrd/x/MykMxEf4nmzg9WwdH0fVjrcjswpo/jRpJhCrQG0p9ar Fcj4dwgldy+7UQ== =eLu3 -----END PGP SIGNATURE----- Merge tag 'csd-lock.2026.10.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull CSD lock updates from Paul McKenney: "Report CSD-lock stall recovery time: - Refactor to simplify csd_lock_wait_toolong() function prototype - Report time required to recover from a CSD-lock stall - Add a test of this reporting" * tag 'csd-lock.2026.10.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: lib/test_csd_lock: Add a module to stall a CPU on a CSD lock locking/csd-lock: Report how long a stuck CSD lock took to recover locking/csd-lock: Pack csd_lock_wait_toolong() state into a struct |
||
|
Linus Torvalds
|
9ba46df344 |
bitmap updates for v7.4
- __MAKE_OP() removal (Yury, Mark); - bitmap parsing fixes (Shashank); - Rust docs updates (Georgios). -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEi8GdvG6xMhdgpu/4sUSA/TofvsgFAmrVbSMACgkQsUSA/Tof vshlsQv+NeRJp2focN/6QYq9ec2tp8uwdY1Ur9tiHdonE3Oq04EMNjbsVOLxn9u2 eFfTzb7UyjCjKGab8h0ZzZxg34rBCvIYCwW66FcEeXzpPiTJVKPHYx6Mp+Gg1UiF QSIRXJsXiI5zj7ltORBb+FYHVVwGN80EGle1fjAN3cTA5OmiVcwLVml8jCfTzUJJ lEsJm57MDyH3XVnrBTm4HE8yMQZkDYhh8KUFQClZJsl7D9VcymtNIqkz33lm1Zqh ItoYq4nJD0t4emTVRvH+KcfJnnv1my68rErbDNv7T0gjKY/razPkN+EFeB6e6NFv J6lFW2OHTeAmpbMSxUCHuqx5m/wRxPdlkN1o3CoAd+pUbjs/Dz59PnffTlGLw6yD AMg3m+6/4B+Ucmb6+WWpEHEuixUXm1Vnjl63EHaHPJNHFRzQGKnEtMJblKphwE7k v0sq75ev4rvZ6SACICydZa0l88M8Z/q3Rj0W6SmuQHRZObsHLPprzqn5KIeEfTjO 7iv6Vkry =5Jv7 -----END PGP SIGNATURE----- Merge tag 'bitmap-for-v7.4-rc1' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: "This includes __MAKE_OP() macro removal from me with the follow-up from Mark, cleanups for bitmaps parser from Shashank and a couple Rust docs fixes from Georgios" * tag 'bitmap-for-v7.4-rc1' of https://github.com/norov/linux: rust: bitmap: document panics in `next_bit` and `next_zero_bit` rust: id_pool: document panics in `find_unused_id` and `release_id` bitmap: test bitmap_parselist() with a group size close to UINT_MAX bitmap: bitmap_parselist(): don't wrap around on a huge group size bitmap: test bitmap_parselist() with text after the group size bitmap: bitmap_parselist(): reject trailing characters after group size bitmap: test bitmap_parse() with an illegal character before 8 hex digits bitmap: bitmap_parse(): reject non-hex character before 8 digits bitfield: Restore be16_replace_bits() bitfield: get rid of __MAKE_OP machinery |
||
|
Thorsten Blum
|
e60b8f7a1d |
lib: kstrtox: use isdigit() in _parse_integer_limit()
Use isdigit() to replace the open-coded implementation. Link: https://lore.kernel.org/20261013072108.4407-3-blum@kernel.org Signed-off-by: Thorsten Blum <blum@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Armaan Sandhu
|
5d72266218 |
lib/cmdline: fix get_options() count and overflow with large ranges
get_range() stops writing once the array is full, but get_options() still
advances its index by the whole range. So "1-100" parsed into four ints
reports 99 numbers, and a range like "0-2147483647" wraps the index
negative and writes outside the array.
Stop once a range fills the array, bail out in validation mode before the
count overflows, and saturate the range length in get_range(). Add KUnit
cases; without the fix "0-2147483647" panics the test kernel.
Only root can supply this input, so this is a robustness fix.
[akpm@linux-foundation.org: add additional test case from Leizhen]
Link: https://lore.kernel.org/20261005213945.359905-1-armaan.sandhu0504@gmail.com
Fixes:
|
||
|
Linus Torvalds
|
95615dd9ff |
Crypto library updates for 7.4
- Migrate the x86 and riscv optimized implementations of various AES modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/. This makes the library APIs be properly accelerated on these architectures, while still accelerating crypto_skcipher as well. It removes a lot of redundant glue code, since the crypto API boilerplate no longer needs to be duplicated for these architectures. It also fixes the longstanding issue where optimizations for these AES modes were disabled by default on these architectures. - Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes - Move the SipHash code into lib/crypto/ - Update the ChaCha and Poly1305 functions to take size_t lengths, resolving issues where lengths over INT_MAX were mishandled - Make frame pointer unwinding work properly in some of the x86 assembly functions, by following the standard %rbp convention - Add helper functions for zeroizing structs - Make a few documentation improvements -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCatTfbBQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOK9yhAP0RU5ofTuvc8jj2o02JlXnnxwzda+zh tpJYOIHfW6+2UwD/XjbNgngca3ByRL2f3rt2xdSaqSIjmRMP4Blkgeazsw4= =zs1E -----END PGP SIGNATURE----- Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Migrate the x86 and riscv optimized implementations of various AES modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/. This makes the library APIs be properly accelerated on these architectures, while still accelerating crypto_skcipher as well. It removes a lot of redundant glue code, since the crypto API boilerplate no longer needs to be duplicated for these architectures. It also fixes the longstanding issue where optimizations for these AES modes were disabled by default on these architectures. - Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes - Move the SipHash code into lib/crypto/ - Update the ChaCha and Poly1305 functions to take size_t lengths, resolving issues where lengths over INT_MAX were mishandled - Make frame pointer unwinding work properly in some of the x86 assembly functions, by following the standard %rbp convention - Add helper functions for zeroizing structs - Make a few documentation improvements * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (49 commits) lib/crypto: md5: remove unused header lib/crypto: mips/chacha: Handle lengths of 2 GiB or more lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code lib/crypto: chacha: Use size_t length lib/crypto: poly1305: Use size_t length lib/crypto: x86/sha512: Follow the normal %rbp convention lib/crypto: x86/sha256: Follow the normal %rbp convention lib/crypto: x86/sha1: Follow the normal %rbp convention lib/crypto: chacha20poly1305: zeroize state in __chacha20poly1305_decrypt lib/crypto: sparc/aes-xts: Add optimization using the AES opcodes lib: Move SipHash into lib/crypto/ lib/crypto: x86/aes-ctr: Remove some unreachable code crypto: x86/aesni-intel - Add transitional selections crypto: aes - Boost priority of encryption modes further lib/crypto: x86/aes: Set RNDKEY in aes_cbc_encrypt_aesni() lib/crypto: riscv/aes-xts: Migrate optimized code into library lib/crypto: riscv/aes-ctr: Migrate optimized code into library lib/crypto: riscv/aes-cbc: Migrate optimized code into library lib/crypto: riscv/aes-ecb: Migrate optimized code into library lib/crypto: riscv/aes: Pass key struct to assembly code ... |
||
|
Linus Torvalds
|
6303381334 |
Add emulation of two-byte cmpxchg()
These commits add a cmpxchg_emu_u16() function that emulates two-byte cmpxchg() in terms of four-byte cmpxchg() for architectures not having native instructions for this purpose. They also make use of this cmpxchg_emu_u16() function in those architectures, namely sh, arc, csky, and xtensa. This permits use of two-byte cmpxchg() in common code. However, it sadly does not permit easy implementation of all algorithms needing on two-byte atomic operations because there are some systems still supported by Linux that do not have native two-byte store instructions. There is reason to believe that these systems will soon no longer be supported by Linux. -----BEGIN PGP SIGNATURE----- iQJHBAABCgAxFiEEbK7UrM+RBIrCoViJnr8S83LZ+4wFAmrNfLUTHHBhdWxtY2tA a2VybmVsLm9yZwAKCRCevxLzctn7jEgGD/9i6D9QznxjJfc3LIUITq/dWm8XRyN+ ILMCiE03UxOrU5iQ54Xk98QcPmXsifCNHUKcs8Av+fZM38eEdwpxsW+eha08E8Ri SynzKpmEhHW7ntXfB+8DhCmyhjvBqttX24J9Ntv9sol35XuCIWSVFTEH0Lwrk3A4 KuA9QsG0Cx8MjAnImpBK3YjFQrUZc6nA6WWAWxOJ9LScXuG3WMnT6pvCqbUUOToY A2g+5fl4Z5xYVupDvdfviQ6Tz/r+w+/HoIesznqLash2HR9Emtj5NAOqKQ3G01Yn 95uYT6u258qA837cA/LSBcNuLlxrAr5UDwj9eI8YqThb8IhspY2ZkI7hA/iZVqT6 irc5JN3yEG505Budjxdf3PudeybuCdQEYr5g3u2ZVf/02bkEpCFaJ6kHRqv6k/H7 tvKGA/qYgjlxmQiHAIolGVY+1pZzQ6c8O7bVJI191s1aG/y8yOjqN3+e9BUr1Cnx 8wNqbWu/3Zzsy7n3dM8gGRfygxaSb2osjePA6B/1uPnglmDyQs4hBnRvDz9jphbY lPi302ZFHZLe6Otu4ifRe9F2/4dHo0k0l07dHpf8m622m/OOsUGIAULUf6tfRmCq 5znc9dY4zWo8Q4lUjl0Pu8t0i62LSCT+kQuepOb4nvD3aS7hbeqSanS8AZiVZ/NG Tb5JDnoCv/J5Bg== =4K7Y -----END PGP SIGNATURE----- Merge tag 'cmpxchg-emu.2026.10.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull two-byte cmpxchg emulation from Paul McKenney: "These commits add a cmpxchg_emu_u16() function that emulates two-byte cmpxchg() in terms of four-byte cmpxchg() for architectures not having native instructions for this purpose. They also make use of this cmpxchg_emu_u16() function in those architectures, namely sh, arc, csky, and xtensa. This permits use of two-byte cmpxchg() in common code. However, it sadly does not permit easy implementation of all algorithms needing on two-byte atomic operations because there are some systems still supported by Linux that do not have native two-byte store instructions. There is reason to believe that these systems will soon no longer be supported by Linux [1]" Link: https://lore.kernel.org/all/20260908152808.3928630-4-arnd@kernel.org/ [1] * tag 'cmpxchg-emu.2026.10.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: xtensa: Emulate two-byte cmpxchg csky: Emulate two-byte cmpxchg ARC: Emulate two-byte cmpxchg sh: Emulate two-byte cmpxchg lib: Add two-byte cmpxchg emulation function |
||
|
Linus Torvalds
|
776bb6df3f |
Locking updates:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUlMkRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1jSug//cjg5WItJ31KfJuzjlRhLJmMdjaPflV+7
y99hHMLZFu8+L20U8lqBLCCdjmgS3RnPUHsncSwxZHOIrp3zAduc85oa4FMultwq
XT39jTLEiIfa/2S5/k48PCFZbB6kgFGZGLiAd/h8HuUi4w8t0deGNggdtQCANOdF
OnpZedXttevu+tbqZFVn2CBZ9Y83S8au1GNuQTu/CAILAPFOalJWP/L+yxns6uZo
W/5oJvW+RmjswKBFKEgPJSOg56VPURZBPqPZntB9TVyiUSAx7wQeXhMdVFL6e6hx
MEE5uxbKAqau0LmbTJy7GHpZym4p2hNHIyACxiQX7eXd4l20C/INHVgwYvSRgF9F
V2VgBMPxH6wXxxNeFujBnNfeUaZfb/9c/E0AQfIQNhexqXahA8bBfmwDy3T+2smq
usRFLW676zAam2WybsJmANSHZ+KhKaVolOBJTLEUnGA2CG5ONt/xa3HqHNTKCI22
CY6D6iSgKBzhmso2A7EGdajx3kBkNycfdrVlqXz6YIw7MiNZlONPWf7698bzszPL
HcE9KWr+0Pt23R5t6g1BBg7T0mnARX8/k3UR5fUC+1zovoKQAm4k8VacDMhF1GSP
xt7EKiQgNjSRPKdlF+vAlk97qEWqIqkHjvyw5dX+Gz3d4uJ+UHwJDqMM50dEm8g6
JgqckejzN1A=
=nN01
-----END PGP SIGNATURE-----
Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Add max local_interrupt_disable() nesting level kunit test case
irq: Explain better on NMI_MASK overflow condition
irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
|
||
|
Linus Torvalds
|
cb95904b47 |
Scheduler updates:
Kconfig updates:
- Simplify PREEMPT_DYNAMIC (Mark Rutland)
Fair scheduler updates:
- Remove redundant RUN_TO_PARITY check (Elif Topuz)
- Declare augmented callbacks per field, fix rb_add_augmented_cached()
descent (Yiwei Lin, Peter Zijlstra)
- Restart fair hrtick after same-task repicks (Shubhang Kaushik)
- Improve the scheduling latency of short slice tasks (Vincent Guittot)
Deadline/RT scheduler updates:
- Check start_dl_timer expiry with ktime_before()
(Liang Hao)
- irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
Siewior)
Energy-aware scheduling updates:
- Implement the steal_governor, introduce preferred CPUs and
steal-driven vCPU backoff (Shrikanth Hegde)
Multi-processor load-balancing updates:
- Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
- Randomize equally shallow idle CPU picks (Christian Loehle)
- Remove redundant core_sched_seq (Hui Su)
Cache-aware scheduling updates:
- Avoid publishing partial LLC utilization (Jemmy Wong)
NUMA-balancing updates:
- Reset NUMA fault locality after scan period update (Eric Kim)
Proxy execution updates:
- Ongoing work to implement sleeping owner handling for proxy
execution (John Stultz, Vasily Gorbik)
- Preparatory steps to make sched_ext compatible with proxy
execution (Andrea Righi)
Scheduler infrastructure updates & fixes:
- Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
- Avoid modifying wait-entry on failed priority registration
(Hui Su)
- Use the new static key API for sched_feat (Hongyan Xia)
- Convert paravirt_steal to new static key APIs (Hongyan Xia)
- cputime: Don't account idle time twice after dyntick-idle
(Stian Halseth)
Scheduler debugging updates:
- Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
(Sechang Lim)
- Fix context analysis errors in non-preferred CPU push (Shrikanth
Hegde)
Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
Thomas Huth and Vladimir Zapolskiy.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUomIRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1ik+Q/+Jx0tXmwOm/wk1ba50zz/tkUL17APJzD1
0TdHSf0sqssyVnQVmGBNWoKfp30zzrnd8Yf46PH5kUmyIxX0LqazAXsPA/0lxAY6
jB2b5ZGosyQQPqyjM1q48K/BMB+GGO9xDKlFxxkBsICi+vS+6diBzXM70xla9M4O
CcAO5DHb50otN/TljfnkmbxG7vgssCVZyS7XG6bSyhd6tUrcr4DVD7gYOMbSVcaL
8Cgu+b54rOAcrcWU1454YKHI5etUOTjblCbFgISrdw7lwf4dKVtTAKSanFX9n522
q9sQ1vzuRz6JfSak9nxFkCy5SMjuHJ53DkVNR4eUXNmM0tHdAcVd8jOexmQVBrug
Yjloo/WydUqGT2TYYEVQPi4J+jMqMRyDIp3TL9UuQjwcjHRnUpd8EVmoNme0TOi+
e3SoS+xOSVBLgbMFwrjJR/tQuqDPjgBrgIyg8wL+ed5cY6Equ+J3467wp8lO7RBN
uGwChvxQAOaMlkh5tIR38Zjq9kzs79y85vz3uD2SNk17TcvijVw9UsmQKfAkpdZo
5FUDM2AdyOhOtZkzMNLHfjjBLSMVCBRo726c6WbELibhuWN7xTAJSJx8o8JNOCrC
vOBcNNAHpU7BwqA0gFIA3lL1uMXvKn9npKKjnB2C4WxhFGf23NF6uPapyA4sMZ00
YwRGvOeDvu4=
=cPCx
-----END PGP SIGNATURE-----
Merge tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler updates from Ingo Molnar:
"Kconfig updates:
- Simplify PREEMPT_DYNAMIC (Mark Rutland)
Fair scheduler updates:
- Remove redundant RUN_TO_PARITY check (Elif Topuz)
- Declare augmented callbacks per field, fix
rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)
- Restart fair hrtick after same-task repicks (Shubhang Kaushik)
- Improve the scheduling latency of short slice tasks (Vincent
Guittot)
Deadline/RT scheduler updates:
- Check start_dl_timer expiry with ktime_before() (Liang Hao)
- irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
Siewior)
Energy-aware scheduling updates:
- Implement the steal_governor, introduce preferred CPUs and
steal-driven vCPU backoff (Shrikanth Hegde)
Multi-processor load-balancing updates:
- Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
- Randomize equally shallow idle CPU picks (Christian Loehle)
- Remove redundant core_sched_seq (Hui Su)
Cache-aware scheduling updates:
- Avoid publishing partial LLC utilization (Jemmy Wong)
NUMA-balancing updates:
- Reset NUMA fault locality after scan period update (Eric Kim)
Proxy execution updates:
- Ongoing work to implement sleeping owner handling for proxy
execution (John Stultz, Vasily Gorbik)
- Preparatory steps to make sched_ext compatible with proxy execution
(Andrea Righi)
Scheduler infrastructure updates & fixes:
- Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
- Avoid modifying wait-entry on failed priority registration
(Hui Su)
- Use the new static key API for sched_feat (Hongyan Xia)
- Convert paravirt_steal to new static key APIs (Hongyan Xia)
- cputime: Don't account idle time twice after dyntick-idle
(Stian Halseth)
Scheduler debugging updates:
- Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
(Sechang Lim)
- Fix context analysis errors in non-preferred CPU push (Shrikanth
Hegde)
Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
Thomas Huth and Vladimir Zapolskiy"
* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
sched: Replace nr_iowait_cpu() with a bool accessor
Revert "sched/fair: Remove dead code on enqueue_task_fair()"
sched/cache: Avoid publishing partial LLC utilization
sched/cputime: Don't account idle time twice after dyntick-idle
sched/psi: Remove the RCU wait from trigger destruction
sched/eevdf: Remove redundant RUN_TO_PARITY check
sched/wait: Avoid modifying entry on failed priority registration
rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
rbtree: Update augmented data on the way down in rb_add_augmented_cached()
rbtree: Declare augmented callbacks per field with RB_AUG()
rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
smpboot: Don't park the thread if work is pending
irq_work: Flush lazy work CPU down on PREEMPT_RT
irq_work: Update a comment regarding CPU hotplug invocation
sched/topology: Add asymmetric SMT packing override
sched/fair: Honor asymmetric SMT priority in idle selection
sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
sched/core: Fix context analysis errors in non-preferred CPU push
virt/steal_governor: Enable the driver
virt/steal_governor: Implement steal_governor policy loop
...
|
||
|
Linus Torvalds
|
dd8845db6d |
- Document and cleanup the signal frame handling with the goal to allow
process migration between CPUs with different FPU capabilities but which use only a common set of FPU features, i.e., think checkpoint/restore. By Andrei Vagin - Consolidate how XSTATE features are checked by doing them once during boot with the intent of removing cpu_has_xfeatures(). Latter will happen in the next cycle. Work by Eric Biggers - Other cleanups -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrW6K8ACgkQEsHwGGHe VUqFJg//WXn5Lu71l3TnoucbDjvdKoTvYH1zwrvxJirPsWK5+12Hvr2psTwh2GPF 6xEYJJEJHMt5VzSo+vjA5aHwqZOFhgQefBEpZqzgWYUBZ7q0ALsGbVzF1iVYNRTW MHYg8V7OMdlq6mgB06sdTJbIG+EfiQch2EiefMK7PdBa+fU2oxBMbSDvCPl537ug yF6+Qv/sKDKPZdZNvA6d5Vy/k0UpV4Cd1YyWhFjJtiYU1bSBjL1AazM5b9qMbl4E t2hlZ+Agi7yucsoZ+tD1IMJsjYyRByZPPQAGNvqZv1YOYWp6LnbHi8cKSpY+N8zS RnVao7PkfyZzjcV0q4fYpzzGIiZZWwpa9k1y98F7MBVEi7hWG5VaguNDI6+2xvs8 FQDNGG1TWtjPltgxsO4ouy2QzbrwzRiWfpP2YHAx5BsYUue5IFeIF3LlwPz0pKz6 2tfsIuMQe5kr43Q3g/LwJuaISLS0rhAXXPceWI8Oiz+sJSsjadnQgOG/tLyySfpF Kea3OIexbpzQ+DtaxQXzPeGp80sOdG9QontV1Ce4HpieWizKSN3ggqcbhae3aUlh P0fGALhhlLZFpwkyRkcCbRcyu0yrCaNmfwG9KWa4gajGVCfr9Y/WvyBhsT7nTfaQ +ngSKg968mDmgdD0SwJ/ejpJg4cGeAAMj7q/VN15qUlEgomkTEg= =OJI1 -----END PGP SIGNATURE----- Merge tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 FPU state updates from Borislav Petkov: - Document and cleanup the signal frame handling with the goal to allow process migration between CPUs with different FPU capabilities but which use only a common set of FPU features, i.e., think checkpoint/restore (Andrei Vagin) - Consolidate how XSTATE features are checked by doing them once during boot with the intent of removing cpu_has_xfeatures(). Latter will happen in the next cycle (Eric Biggers) - Other cleanups * tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Remove additional remnants of math emulation x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU selftests/x86: Add tests for signal frame FPU portability x86/fpu: Pre-fault only required size of xstate buffer x86/fpu: Fix potential underflow in xstate_calculate_size() x86/fpu: Document reasoning of FX-only fallback x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig() x86/fpu: Clean up and rename variables in signal frame handling x86/fpu: Document signal frame layout and portability xor: Add AVX-512 optimized xor_gen() xor: Remove redundant X86_FEATURE_OSXSAVE check lib/crc: x86: Stop using cpu_has_xfeatures() lib/crypto: x86: Stop using cpu_has_xfeatures() crypto: x86 - Stop using cpu_has_xfeatures() um: Check for missing AVX and AVX-512 xstate bits x86/fpu: Check for missing AVX and AVX-512 xstate bits |
||
|
Thomas Zimmermann
|
a88cef9206 |
lib/fonts: Add font_glyph_cursor() helper
The new helper font_glyph_cursor() fills a glyph with a cursor pattern. As with the font_glyph_rotate_*() helpers, the caller has to provide the output memory. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de> |
||
|
Nickolai Zeldovich
|
0007654a7b |
lib/buildid: reject file offsets that do not fit in pgoff_t
On a 32-bit kernel, parsing the build ID of a crafted ELF file can copy
far more than the intended bytes into a 64-byte on-stack buffer in
__build_id_parse(), corrupting the stack of whatever context fetches the
build ID. This might be reachable without privilege: perf records a build ID
for PERF_RECORD_MMAP2 on the no-fault path when a process mmaps its own file
(build_id_parse_nofault() from perf_event_mmap()), and BPF build-id stack
maps do the same.
freader_get_folio() turns a 64-bit file offset into a page cache index
with file_off >> PAGE_SHIFT and passes it to filemap_get_folio().
pgoff_t is unsigned long, 32-bit on a 32-bit kernel, so an ELF64 e_phoff
of 2^44 + k * PAGE_SIZE truncates to index k. filemap_get_folio()
returns the cached folio at index k, whose folio_pos() is far below the
requested file_off. In freader_fetch() the folio does not contain
file_off, so the "crossing folio boundaries" path computes
part_sz = folio_off + folio_sz - file_off as a large u64 (file_off is
much larger), and the following memcpy() truncates it to size_t and
copies a page into the 64-byte buffer. On a 64-bit kernel the index is
not truncated, the folio is not cached and the fetch returns -EFAULT, so
only 32-bit kernels are affected.
Reject a file offset that cannot be represented as a page cache index
before the lookup, so such a file fails the build ID parse cleanly as it
already does on 64-bit.
Reproduced on i386 under QEMU with CONFIG_STACKPROTECTOR_STRONG: mmapping
a crafted ELF (ELFCLASS64, e_phoff = 2^44) while a perf event with
attr.build_id is open panics with "stack-protector: Kernel stack is
corrupted in: __build_id_parse"; with this patch the parse returns
-EFAULT and the mmap completes cleanly. Built for i386 with W=1, no new
warnings.
Fixes:
|
||
|
Arnd Bergmann
|
655e6054ac |
standalone cache drivers for v7.4
Three low-priority bugfixes for issues in the hisi hha and sifive ccache drivers as well as the core code. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCas5Q3gAKCRB4tDGHoIJi 0oGjAQDNu65EIEIG0QRSpnL6VaQxzNbZiIqFn7576RRATButXwEAllZD4LS/oKbw Xo+lIakKF81bPDo5xfD5HvDQ8PYJIg8= =8yqa -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrSVG8ACgkQmmx57+YA GNnZJg/9HD4J9BtF7zdAOmoV8C6VmHbneoM+4uZ7jLj7dmklP0RoXHoK7/hfTMJi 9U0ZM58771oAbH/C1qk2J9PLCaSqclxg/zA4GVi7L8ihHlnqbSyRjhJBYqEEvyJZ nLONg+haYlROMxMBHi03HrDdmQmd93ezBxdsU5xgcC+4REjXuhfu6Rf5XFuaMO6U 3IttfN9xuxDDRRkF+n53bzJMdsp+hgSz9+QgwL8zsLexoxllwSv/dr267ro6/z/6 xvZY6x9N1XE9GqEbX4bmaqz7fY39gRVcXX1Rh+KWGu1lrjqO5T++xc8+oUzE6O8r FRtL3UeImH37kQWXGvoe5l4bfWCb1X3j4A+PFC/7dlCiN8GdMhVHpl3cfg9xSf/D ySnkSpjkkn8fisnAyvtFk0p4U65S1ff0O5aP1xEHD2K3BN8/b/uYazRr4KXm9G+w 7POFCZ2wb9ny2Ego/evbPtcoq8YOpU2BzwqYI3fCTE/VHfYBA5/dbhC84f1vUyib LCGPCCcJJ8NsubPWW5W9SdLjiw/k2pX2FO4Nay7EF1qkvSMsaW9RDfIDH3CM0BRN 72XCIS6T109MKDJtt/q2enYBsuSI42A8WvXugMW5L27ryc+49fZvfT1ZBdQ60RUf SRSfKpqqRfsNZ7hH2jyYtCQC4DHjHjLJOCIzLd4JbRp9HqUdYWY= =B2E0 -----END PGP SIGNATURE----- Merge tag 'cache-for-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers standalone cache drivers for v7.4 Three low-priority bugfixes for issues in the hisi hha and sifive ccache drivers as well as the core code. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> * tag 'cache-for-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers cache: sifive_ccache: Remove redundant dev_err_probe() cache: hisi_soc_hha: use named initializers for acpi_device_id Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Mohamad Raizudeen
|
20ec6916d8 |
lib/crypto: md5: remove unused header
The `<linux/unaligned.h>` header is included but never actually used. The code handles memory accesses using memcpy() instead of the unaligned helpers. Remove this unused header to avoid false dependencies. Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com> Link: https://patch.msgid.link/20261016023558.8797-1-raizudeen.kerneldev@gmail.com Signed-off-by: Eric Biggers <ebiggers@kernel.org> |
||
|
Vladimir Kukharenko
|
ff2d72f2bf |
lib/crypto: mips/chacha: Handle lengths of 2 GiB or more
The MIPS ChaCha assembly, which is chacha_crypt_arch() itself, tests the remaining length with signed branches, so for 2 GiB + 64 bytes or more it takes the final partial block path too early and processes less than requested. It is only used on 32-bit kernels, where size_t is 32 bits, so declaring the length as size_t does not avoid this. No in-tree caller passes such lengths. The partial block code also keeps the remaining length as a negative value, so instead of changing the assembly, rename it to chacha_crypt_mips() and add a C chacha_crypt_arch() that passes it at most 1 GiB per call. Tested in QEMU user mode: with a length of 0xfffff045 the assembly processed about 4 KiB and advanced the block counter by 64; with the same 1 GiB loop in C, a 1.25 GiB + 4101 byte buffer matches a C reference. An LLM review of this code found the bug. Assisted-by: LLM Signed-off-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014-libcrypto-chacha-32bit-2gib-v1-2-e0719ca0be89@genproof.com Signed-off-by: Eric Biggers <ebiggers@kernel.org> |
||
|
Vladimir Kukharenko
|
f92159895b |
lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code
chacha_doarm() compares the remaining length with signed conditions (blt, movle/movgt, bgt), and DIV_ROUND_UP(bytes, CHACHA_BLOCK_SIZE) in chacha_crypt_arch() wraps above 0xffffffc0, so lengths of 2 GiB or more are mishandled. size_t is 32 bits on arm, so declaring the length as size_t does not avoid this. On a Cortex-A7, an in-place chacha20_crypt() of 2 GiB + 4101 bytes changed only one byte. Use unsigned conditions (blo, movls/movhi, bhi) and DIV_ROUND_UP_POW2(). This affects the scalar code, which is used when NEON isn't usable and always on Cortex-A5 and Cortex-A7. No in-tree caller passes such lengths. Tested in QEMU on a Cortex-A7 with CONFIG_VMSPLIT_1G. An LLM review of this code found the bug. Assisted-by: LLM Signed-off-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014-libcrypto-chacha-32bit-2gib-v1-1-e0719ca0be89@genproof.com Signed-off-by: Eric Biggers <ebiggers@kernel.org> |
||
|
Eric Biggers
|
e42003dba6 |
lib/crypto: chacha: Use size_t length
Upgrade the ChaCha functions from 32-bit lengths to size_t. 'size_t' is the best practice for buffer lengths, and it's what the rest of the crypto library uses. Moreover, all the 64-bit ChaCha assembly functions actually already treated the length as 64-bit, despite it being declared as 32-bit in C on arm64, ppc64, and x86_64. For arm64 and x86_64, this caused unspecified behavior due to the high 32 bits of the corresponding register having an unspecified value in those architectures' ABIs. However, in practice these bits are always zero and no issue occurred. (ppc64 was fine too, since there the ABI zero-extends 32-bit arguments.) These issues date to the original introduction of the ChaCha code. However, as noted above, they don't have any real-world impact currently; so this is an API robustness improvement only. Reported-by: Vladimir Kukharenko <vladimir@genproof.com> Closes: https://lore.kernel.org/r/20261012-libcrypto-4gib-lengths-v1-0-ea566c129a2e@genproof.com Tested-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014152604.323310-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org> |
||
|
Eric Biggers
|
0b58c136c2 |
lib/crypto: poly1305: Use size_t length
Upgrade the Poly1305 functions from 32-bit lengths to size_t. 'size_t' is the best practice for buffer lengths, and it's what the rest of the crypto library uses. Moreover, all the 64-bit Poly1305 assembly functions actually already treated the length as 64-bit, despite it being declared as 32-bit in C on arm64, mips64, ppc64, and riscv64: - On arm64, this caused unspecified behavior due to the high 32 bits having an unspecified value in that architecture's ABI. However, in practice these bits are always zero and no issue occurred. (ppc64 was fine too, since there the ABI zero-extends 32-bit arguments.) - On mips64 and riscv64, this caused incorrect behavior on lengths above S32_MAX, due to the sign extension done by those architectures' ABIs. Note that no current callers pass lengths over S32_MAX. Also, the expression 'desc->buflen + nbytes >= POLY1305_BLOCK_SIZE' in poly1305_update() could overflow if nbytes was in [UINT_MAX - 14, UINT_MAX]. Note that again, no current callers pass lengths this large. These issues date to the original introduction of the Poly1305 code. However, as noted above, they don't have any real-world impact currently; so this is an API robustness improvement only. Reported-by: Vladimir Kukharenko <vladimir@genproof.com> Closes: https://lore.kernel.org/r/20261012-libcrypto-4gib-lengths-v1-0-ea566c129a2e@genproof.com Tested-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014152604.323310-2-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org> |
||
|
Jakub Kicinski
|
f5e575a787 |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-7.3-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/microchip/lan865x/lan865x.c |
||
|
Thomas Weißschuh
|
5062889371 |
vdso/gettimeofday: Avoid runtime conditional in do_hres_timens()
Currently the derivation of the non-namespaced clock from its namespaced sibling uses a runtime conditional. This conditional mirrors the VDSO_RAW check in __cvdso_clock_gettime_common(), in a non-obvious way. Replace the runtime conditional with unconditional pointer arithmetic, which removes the duplication of logic and also is smaller and faster. Also get rid of the weird double use of the 'vc' variable, pointing both to the array of clocks and later to one specific one. This saves 31 bytes of .text on x86_64. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260921-vdso-timens-conditional-v1-1-eac173f8bd92@weissschuh.net |
||
|
Thomas Weißschuh
|
d6df494a01 |
vdso: Remove unnecessary vdso/vsyscall.h includes
None of these files uses anything from the header. Remove the inclusion. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-13-63ae856cc659@linutronix.de |
||
|
Thomas Weißschuh
|
ca0da001d3 |
vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.c
__arch_get_vdso_u_rng_data() is only used in getrandom.c. vsyscall.h has become a dumping ground for different kinds of fallbacks. Move the fallback function definition into getrandom.c, similar to other fallbacks. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-3-63ae856cc659@linutronix.de |