mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
v7.4-rc1
57505 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
7a3d2740d1 |
Misc timer fixes:
- Fix on-stack hrtimer cleanup in play_idle_precise(), and
add the hrtimer_on_stack cleanup class to facilitate the fix
(Hui Su)
- Fix clock_getres() system call's handling of NULL output
pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)
- Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time
is exactly equal to the nonzero expiry (Hungyu Lin)
- Fix do_timens_ktime_to_host() time offset subtraction underflow
check (Hungyu Lin)
- Report zero remaining time for disarmed SIGEV_NONE posix timers,
and add a self-test to detect this bug in the future (Hung-Jui Lin)
- Fix NOHZ 'full kick' handling bug that can cause missed
tick updates (Peng Wang)
- Fix field access bug in the vdso/gettimeofday code that works
only by accident (Thomas Weißschuh)
- Fix & prevent immediate clocksource watchdog rerun after a delay
(Karl Mehltretter)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrm49IRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iTDA/5Aebi9AA+RG07pniYhgx8D47I+mEB+5EG
Jthzq2OZ2rdH4IlI+YKN4KsQNnksNEkXzFmOe4KjVdogfr4JJqJ3UOv0HeNSaOtK
2MD68CswEOZQR9L/8X6VaVoCZp3TkoRP6OPU0DSJeD/ELU8xeKhyBlerA0isgluU
Oc9fePsQniN3zay7QkfViBM5D1D9SA54rp8TPaq9ZxstLqPFjzFcMtFLILm1syeZ
vnsCz1dX5sUkEKkcDClcv3gp8LL7l3r+M+z7MuplO7NYYqCFzD/DFodKVIVMBr1u
pd9XuGHo+6qF9+WXzC3wlLd6ZauC0gSFqOGdqeQoiQrOwt2xxNNFtr2NvHPtCmOL
2014sHRk2KxZP1Hc7VvwGRD/fSTrkTYlQMXkuP5zQMzlpSiWLzmffH5Y2RohS6BB
NyEw7bI9LaQ1zUatuYPkwKKcZQNhM6uaUIjfWvCIQYC0WmgIhN2r+4gTDc4jenU4
6YDnxmE3dyTHlPgksBViDN/p6sNszeoq/KgRSRuM8H7VD6TlKgcHEmGXF3LhgAtY
U7tfQ63ReDWuj2KmNyhT1lP0kBEJKbTouXn3CuGvtsmupLR+gmgZ13p8iPPpqgbO
P8GH+5l2Cz9SieFbJqoXZ5D8dOEB5sVjAden7iZol2ALjIlWySDPaFWFJjqsDUfy
Lmfu0V5K5ZU=
=WzWb
-----END PGP SIGNATURE-----
Merge tag 'timers-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix on-stack hrtimer cleanup in play_idle_precise(), and
add the hrtimer_on_stack cleanup class to facilitate the fix
(Hui Su)
- Fix clock_getres() system call's handling of NULL output
pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)
- Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time
is exactly equal to the nonzero expiry (Hungyu Lin)
- Fix do_timens_ktime_to_host() time offset subtraction underflow
check (Hungyu Lin)
- Report zero remaining time for disarmed SIGEV_NONE posix timers,
and add a self-test to detect this bug in the future (Hung-Jui Lin)
- Fix NOHZ 'full kick' handling bug that can cause missed
tick updates (Peng Wang)
- Fix field access bug in the vdso/gettimeofday code that works
only by accident (Thomas Weißschuh)
- Fix & prevent immediate clocksource watchdog rerun after a delay
(Karl Mehltretter)
* tag 'timers-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
clocksource: Prevent immediate watchdog rerun after a delay
vdso/gettimeofday: Correct the read of tz_minuteswest and tz_dsttime
tick/nohz: Reevaluate the tick for kicks flushed outside hardirq
selftests: timers: Add a test for disarmed SIGEV_NONE timers
posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers
time/namespace: Fix overflow when converting absolute deadlines
timers/itimer: Keep a nonzero value at CPU timer expiry
posix-timers: Accept NULL clock_getres() output in stubs
sched/idle: Use hrtimer cleanup class in play_idle_precise()
hrtimer: Add cleanup class for on-stack timers
|
||
|
Linus Torvalds
|
9b6f2eabc8 |
RTC for 7.4
Subsystem:
- the hctosys limit for 32bit platforms is now configurable
- introduce lock guard for for rtc_device.ops_lock
- use sysfs_emit() instead of sprintf() were possible
- selftest fixes
New driver:
- Raspberry Pi 5 RTC
Drivers:
- abx80x: add support for ABX81X
- bd70528: properly enable wakeup
- cmos: Fix ACPI RTC alarm handling
- ds1685: power-off fixes
- mt6397: add nvmem support
- pcf85063: add HW UIE support
- rs5c372: Ricoh R2223x support
- rzn1: add R-Car X5H support
- s35390a: allow use of output pin for interrupt signal 1 for wakealarm to
support synology devices
- sun6i: add Allwinner B288 support
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmrmdmcACgkQY6TcMGxw
OjLB/g/9EG6jcs15Ci3pgKQ4g6h6UKHN86WIA64uPMjvuyAvmyccmrlW6AvwOhoH
kAp77s8hbujENJk4HPvT4kU0G7KlxpxfZwuvicHNBqGQ1L100Ahx22FdrgXxcejk
MKuN+30H6iJ01eDEmxJ530VlWCRBTusd8HexDh3Q6IY2mNLiphJXJ+moDheKBnAO
ECh8lc6Qnb5fFRYqUmAK0QLNKjU8kz6FCgj+vnuSaRftEAgniFmHTJHIiTdB0Bwp
REdpSMuhjM85oeCxcYu1r1ABnE08a3EbkoHelPlDiO/p1NNQ227IbciCG3rX++bJ
pa5IWkt2nfvC3RIyxuM5pcCSLpRHgji34LLiCkSzP99S3yujVYcZiBYltuYz5rx0
Jg4hIb1EmyV7AimQ3XZp1Y+/R2NxKVVHl7MEioq/EFYQFDo04EwcJAYIPn/ZPLDG
sVpbO/o3lmocP7f6n7jZFkuapQwZ68nijiuRby51gUK4uuraPQou4/igsBlJWn0s
z6MbS/1jtpRbAQ+8m8ev6LP5s7+4iALd4C8DGYEN53JOpx03LNLFpxPR14i8a5kt
FaXMjA6f12WvKaVcYJv++r/pxho/iSfXRQiSV3algm921Z5hpkCRi8xauI9sJJmG
IWjp+xZ+svPE+Ch7kn4jHbEGLbJy2sBSG30TKEE9WhUVOaHdhQo=
=NTHB
-----END PGP SIGNATURE-----
Merge tag 'rtc-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
Pull RTC updates from Alexandre Belloni:
"This introduces a way to lift the hctosys limit for 32-bit systems to
ensure systems relying on it can pass Y2038. Add a driver for the
Raspberry Pi 5 RTC and add support for the Abracon abx81x, Ricoh
R2223x, Renesas R-Car X5H and Allwinner B288 RTCs to existing drivers:
Subsystem:
- the hctosys limit for 32bit platforms is now configurable
- introduce lock guard for for rtc_device.ops_lock
- use sysfs_emit() instead of sprintf() were possible
- selftest fixes
New driver:
- Raspberry Pi 5 RTC
Drivers:
- abx80x: add support for ABX81X
- bd70528: properly enable wakeup
- cmos: Fix ACPI RTC alarm handling
- ds1685: power-off fixes
- mt6397: add nvmem support
- pcf85063: add HW UIE support
- rs5c372: Ricoh R2223x support
- rzn1: add R-Car X5H support
- s35390a: allow use of output pin for interrupt signal 1 for wakealarm to
support synology devices
- sun6i: add Allwinner B288 support"
* tag 'rtc-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (89 commits)
rtc: rs5c372: use sysfs_emit() instead of sprintf()
rtc: ds1307: use sysfs_emit() instead of sprintf()
rtc: isl1208: use sysfs_emit() instead of sprintf()
rtc: ds1685: use sysfs_emit() instead of sprintf()
rtc: ds1343: use sysfs_emit() instead of sprintf()
rtc: rx8025: use sysfs_emit() instead of sprintf()
rtc: x1205: use sysfs_emit() instead of sprintf()
rtc: bq32k: use sysfs_emit() instead of sprintf()
rtc: ep93xx: use sysfs_emit() instead of sprintf()
rtc: pcf2127: use sysfs_emit() instead of sprintf()
rtc: rv3029: use sysfs_emit() instead of sprintf()
rtc: ds1685: keep setting PAB until power is removed
rtc: ds1685: do not sleep in the power-off handler
rtc: ds1685: arm the wake-up alarm at power-off only if an alarm is set
rtc: rv3028: use sysfs_emit() instead of sprintf()
rtc: pcf85063: add 1 Hz update interrupt (UIE) support
rtc: pcf85063: preserve the alarm flag in clkout register updates
rtc: pcf85063: do not clear AIE in the interrupt handler
rtc: pcf85063: use devm_of_clk_add_hw_provider() for clkout
rtc: s35390a: Add synology quirk
...
|
||
|
Linus Torvalds
|
cbbddb6b08 |
power utilities 2026.10.31
turbostat 2026.10.31 Fix --cpu option to work more than once. Fix --Joules option to work with --show power. Remove hard-coded 8192-CPU limit. Decode Uncore Frequency Agent Types. Dump RDT (Resource Director Technology) config. Dump RP (Resource Priority) config. Recognize Rugged Panther Lake. Fix PMT mmap size, bounds check, and mask computation. Misc cleanups and minor fixes. x86_energy_perf_policy 2026.10.31 Harden input parsing and bounds checks. Fix optarg keyword matching. Rewrite MSR device path discovery. Misc cleanups and minor fixes. -----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEE67dNfPFP+XUaA73mB9BFOha3NhcFAmrmJyQUHGxlbi5icm93 bkBpbnRlbC5jb20ACgkQB9BFOha3Nhfugg//QCJbYp/aOZ1k9siqw1pE/z9HJlIr 2T6vgEadOEqY1Z/ObCeH/E/pgAnrSxbCkX8AOlhdqVBysD6JVn/rvsOo6yLfpI5V A7QcYzZfOi9tOP4m6hHC3gmAjkYC8b1vCHMiq+F4QOW1sq7zFIZ5SHPJFUZNrHvK 54UrRCJ6BfJGw1W/cGozgwYVCJW7yXVHd2845nEhj8SGrkeZZVilkbrDiwFTxvWJ PC6QpsScLLq0lKFkr7fIFb/QGr1Zz0dwqCsDzO5z4wHqvvAZ+yAGSYLw3MG/6LBL PzFRivNETn7jwNcaQOp0H7teThC3s+WDioFLQjIrp2VNv5/yQeG1FZjh/EnlRBOi WcelJfwzWMrkmXfHE1UGrn9Y6HLFddRSxjdpyEQ+QGpH2NAyUxwFDauz9JZl3Tdd E/3T6F+BRvDOm/sHg3zMOCewUsbEdbxwLs+g6RNH7QkapcofOtUwzuNGUfD3ETF5 qbTN+4P1T3FDxeI9GK6yLUZD6DsgIFwGEWOrD2VIp0XZaTNGGLHSwU0vQFEN3Tlq sKMkGdtnThTp4nRnWwbDqAQpWVEX+62HsUlOuPYL25CDAyyPfFIBGnCGDqyPLUEp Mlp/CMg8jA1VsFzzNX4aMGSjvszfJG+wVtHd/yluid4aqJFofl6Uza3FA5brCAF4 hp0PVFWnJF907Z4= =fZ/K -----END PGP SIGNATURE----- Merge tag 'power-utilities-2026.10.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull x86 power utilities updates from Len Brown: "Turbostat: - Fix --cpu option to work more than once - Fix --Joules option to work with --show power - Remove hard-coded 8192-CPU limit - Decode Uncore Frequency Agent Types - Dump RDT (Resource Director Technology) config - Dump RP (Resource Priority) config - Recognize Rugged Panther Lake - Fix PMT mmap size, bounds check, and mask computation - Misc cleanups and minor fixes x86_energy_perf_policy: - Harden input parsing and bounds checks - Fix optarg keyword matching - Rewrite MSR device path discovery - Misc cleanups and minor fixes" * tag 'power-utilities-2026.10.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (42 commits) tools/power x86_energy_perf_policy: Version 2026.10.31 tools/power turbostat: Version 2026.10.31 tools/power turbostat: Fix PMT mmap size and bounds check tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask() tools/power turbostat: Fix --Joules when used with --show power MAINTAINERS: Add x86_energy_perf_policy x86_energy_perf_policy: Simplify write_sysfs() return type x86_energy_perf_policy: Use calloc to initialize string buffer x86_energy_perf_policy: Cleanup: Constify read only parameters x86_energy_perf_policy: Cleanup: Drop unused signal.h x86_energy_perf_policy: Document MSRHEADER x86_energy_perf_policy: Cleanup: Check fseek() in VM path x86_energy_perf_policy: Cleanup: Define BCLK_MHZ x86_energy_perf_policy: Cleanup: Define HWP_WINDOW_MAX_USEC x86_energy_perf_policy: Bound package iteration x86_energy_perf_policy: Harden against potential ratio overflow x86_energy_perf_policy: Fix optarg keyword matching x86_energy_perf_policy: Cleanup: Use snprintf() for platform-profile x86_energy_perf_policy: Harden with strtol() x86_energy_perf_policy: Harden update_cpufreq_scaling_freq() ... |
||
|
Len Brown
|
8969e647d0 | Merge branches 'turbostat' and 'x86_energy_perf_policy' into utilities | ||
|
Len Brown
|
ed9324befb |
tools/power x86_energy_perf_policy: Version 2026.10.31
Since 2026.04.25: Harden input parsing and bounds checks. Fix optarg keyword matching. Rewrite MSR device path discovery. Misc cleanups and minor fixes. Signed-off-by: Len Brown <len.brown@intel.com> |
||
|
Len Brown
|
a8d65a89a3 |
tools/power turbostat: Version 2026.10.31
Since version 2026.09.28: Fix --cpu option to work more than once. Fix --Joules option to work with --show power. Remove hard-coded 8192-CPU limit. Decode Uncore Frequency Agent Types. Dump RDT (Resource Director Technology) config. Dump RP (Resource Priority) config. Recognize Rugged Panther Lake. Fix PMT mmap size, bounds check, and mask computation. Misc cleanups and minor fixes. Signed-off-by: Len Brown <len.brown@intel.com> |
||
|
Kaushlendra Kumar
|
cfdb43387f |
tools/power turbostat: Fix PMT mmap size and bounds check
Remove assert(offset == 0), to allow non-zero PMT offsets. Fix the pmt_mmio_open() mapping to round-up (offset + size). Fix the offset bounds check to disallow running past the end of the region. [lenb: commit message re-write] Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com> Signed-off-by: Len Brown <len.brown@intel.com> |
||
|
Kaushlendra Kumar
|
3d6fc92be1 |
tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask()
The function uses plain int literal '1' for bit shifting, which causes undefined behavior when msb >= 31. This is because shifting a 32-bit int by 32 or more bits is undefined behavior in C. Fix by using 1ULL (unsigned long long) instead of 1 to ensure 64-bit arithmetic on all platforms. Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com> Signed-off-by: Len Brown <len.brown@intel.com> |
||
|
Len Brown
|
ab6e94fb4a |
tools/power turbostat: Fix --Joules when used with --show power
The "--Joules" option displays energy in Joules, replacing the same metrics displayed as power in Watts. But when used with --show power, it deletes the power metrics without replacing them with their energy counterparts: $ sudo ./turbostat -q --list --show power --Joules CoreTmp,PkgTmp,RAM_J,PKG_%,RAM_% Fix it thus: $ sudo ./turbostat -q --list --show power --Joules CoreTmp,PkgTmp,Pkg_J,Cor_J,GFX_J,RAM_J,PKG_%,RAM_%,Sys_J Signed-off-by: Len Brown <len.brown@intel.com> |
||
|
Linus Torvalds
|
dd384658c7 |
perf tools changes for v7.4
- Support instruction tracking on arm64 for data type profiling, resolving stack, global, per-CPU and 'current' variable accesses, so that 'perf annotate --data-type' resolves types on arm64 the way it does on x86. - Port the Python scripts to the perf module and standalone execution, and improve the module: lazy sample callchains and event copies, GIL handling, better session/thread lookup, new treport, flamegraph and sqlite/postgres exporters. - Reenable and fix the attribute expectation test suite: per-PMU bit masks, other core PMUs' events, dummy tracking events, group checks and spelled out skip reasons. - perf trace: filter the target's tasks in BPF, open the BPF output event on every CPU, add an option to disable syscall augmentation and raise TRACE_AUG_MAX_BUF. - perf jitdump: harden record parsing, validating unwinding sizes and symbol names, byte-swapping debug entries via safe accessors and fixing frees on error paths. - perf annotate-data fixes: bound the member nesting recursion, resolve type DIEs in the debug file they came from, adjust the offset for flex-arrays and show the sample count in the data-type browser. - perf symbol and debug info: try linked debug files for DSOs, avoid repeated failing searches, set binary/symtab types for split kallsyms, JIT maps and the build-id cache, fix libbfd symbol loading. - perf config: serialize config file access with a mutex, add the DEFINE_MUTEX() and DO_ONCE() primitives and a robust process shared mutex, add the core.hybrid-merge option. - perf report: add --progress and --no-progress options. - perf mem: add a false sharing workload to 'perf test', request PERF_SAMPLE_CPU by default, use the IBS swfilt filter when available and decode L0 in the memory level. - perf test: take turns using the perf mlock budget in the mmaping tests, add the 'needs_mlock' suite flag, scope the probe based tests to their PID and make more tests non-exclusive. - perf vendor events intel: update events and metrics to TMA 5.2, refresh the event tables and fix umask encodings. - perf build: run shellcheck, mypy and pylint in parallel, make pylint opt-out with NO_PYLINT=1, fix clean and install dependencies. - Add a script and a 'make sync-headers' target to sync the tools/ copies of kernel headers with the kernel sources, plus the resulting syncs of the cpufeatures, KVM, fs, mount, fcntl, socket, rtnetlink, if_addr and sound headers. - Fix cs-etm HW_ID mapping synthesis for raw trace, queue teardown leaks and duplicate v0 global mappings. - Add a 'perf bench atomic' benchmark for atomic operations. - Filter events before creating lock_stat in 'perf lock contention'. - Add a 'perf test' case for events re-armed with PERF_EVENT_IOC_REFRESH. - Fix memory leaks on 'perf c2c' output fields and add function view stdio coverage to its test. - Fix a NULL dereference resolving callchains in 'perf machine'. - Optimize the libdw fallback when DWARF is missing and try the symbol file first when checking for debuginfo. - Don't call eprintf() in pr_debugN() when not verbose. - Don't delete cumulative caller entries before the stat_acc decays in 'perf report'. - Fix ring buffer cursor handling: keep the consumed cursor in forward mode and use the head selected by read_init. - Fix 'perf test mmap-basic' user rdpmc detection and only test userspace reading on supported platforms. - Build fixes: include sys/types.h for ssize_t, errno.h before kernel headers and fix jevents.py type annotations for mypy 2.x. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCauUL4QAKCRCyPKLppCJ+ JzsyAQCNjqGOBYEUaDbQAbK1/1h9D9QER9s+4aU3Np2zT9XSPAD/RkY12uxT3YAO NcQlaj0On+I46SkgyGzGrV9mOvDZJwo= =b9um -----END PGP SIGNATURE----- Merge tag 'perf-tools-for-v7.4-1-2026-10-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next Pull perf tool updates from Arnaldo Carvalho de Melo: - Support instruction tracking on arm64 for data type profiling, resolving stack, global, per-CPU and 'current' variable accesses, so that 'perf annotate --data-type' resolves types on arm64 the way it does on x86. - Port the Python scripts to the perf module and standalone execution, and improve the module: lazy sample callchains and event copies, GIL handling, better session/thread lookup, new treport, flamegraph and sqlite/postgres exporters. - Reenable and fix the attribute expectation test suite: per-PMU bit masks, other core PMUs' events, dummy tracking events, group checks and spelled out skip reasons. - perf trace: filter the target's tasks in BPF, open the BPF output event on every CPU, add an option to disable syscall augmentation and raise TRACE_AUG_MAX_BUF. - perf jitdump: harden record parsing, validating unwinding sizes and symbol names, byte-swapping debug entries via safe accessors and fixing frees on error paths. - perf annotate-data fixes: bound the member nesting recursion, resolve type DIEs in the debug file they came from, adjust the offset for flex-arrays and show the sample count in the data-type browser. - perf symbol and debug info: try linked debug files for DSOs, avoid repeated failing searches, set binary/symtab types for split kallsyms, JIT maps and the build-id cache, fix libbfd symbol loading. - perf config: serialize config file access with a mutex, add the DEFINE_MUTEX() and DO_ONCE() primitives and a robust process shared mutex, add the core.hybrid-merge option. - perf report: add --progress and --no-progress options. - perf mem: add a false sharing workload to 'perf test', request PERF_SAMPLE_CPU by default, use the IBS swfilt filter when available and decode L0 in the memory level. - perf test: take turns using the perf mlock budget in the mmaping tests, add the 'needs_mlock' suite flag, scope the probe based tests to their PID and make more tests non-exclusive. - perf vendor events intel: update events and metrics to TMA 5.2, refresh the event tables and fix umask encodings. - perf build: run shellcheck, mypy and pylint in parallel, make pylint opt-out with NO_PYLINT=1, fix clean and install dependencies. - Add a script and a 'make sync-headers' target to sync the tools/ copies of kernel headers with the kernel sources, plus the resulting syncs of the cpufeatures, KVM, fs, mount, fcntl, socket, rtnetlink, if_addr and sound headers. - Fix cs-etm HW_ID mapping synthesis for raw trace, queue teardown leaks and duplicate v0 global mappings. - Add a 'perf bench atomic' benchmark for atomic operations. - Filter events before creating lock_stat in 'perf lock contention'. - Add a 'perf test' case for events re-armed with PERF_EVENT_IOC_REFRESH. - Fix memory leaks on 'perf c2c' output fields and add function view stdio coverage to its test. - Fix a NULL dereference resolving callchains in 'perf machine'. - Optimize the libdw fallback when DWARF is missing and try the symbol file first when checking for debuginfo. - Don't call eprintf() in pr_debugN() when not verbose. - Don't delete cumulative caller entries before the stat_acc decays in 'perf report'. - Fix ring buffer cursor handling: keep the consumed cursor in forward mode and use the head selected by read_init. - Fix 'perf test mmap-basic' user rdpmc detection and only test userspace reading on supported platforms. - Build fixes: include sys/types.h for ssize_t, errno.h before kernel headers and fix jevents.py type annotations for mypy 2.x. * tag 'perf-tools-for-v7.4-1-2026-10-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next: (425 commits) perf machine: Fix NULL deref in thread__resolve_callchain_sample() perf pmu-events: Fix jevents.py type annotations for mypy 2.x perf parse-events: Include errno.h before kernel headers perf print_insn: Include sys/types.h for ssize_t perf tests mmap-basic: Fix user rdpmc detection logic perf tests mmap-basic: Only test userspace reading on supported platforms perf mmap: Preserve the consumed cursor in forward mode perf mmap: Use the head selected by read_init perf hist: Do not delete cumulative caller entries before stat_acc decays perf debug: Avoid calling eprintf() in pr_debugN() when verbose < n perf libdw: Optimize fallback logic for missing DWARF tools headers: Sync KVM headers with the kernel sources tools headers: Sync UAPI sound/asound.h with the kernel sources tools headers: Sync UAPI linux/mount.h with the kernel sources tools headers: Sync UAPI linux/fs.h with the kernel sources tools headers: Sync UAPI linux/fcntl.h with the kernel sources tools headers: Sync linux/socket.h with the kernel sources tools arch x86: Sync the cpufeatures.h copy with the kernel sources tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources tools headers UAPI: Sync linux/if_addr.h with the kernel sources ... |
||
|
Linus Torvalds
|
2a500a04d6 |
Driver core fixes for 7.4-rc1
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind operations associated with misleading fuzzing reports. It also taints established workflows, including VFIO device passthrough; a more targeted approach will be revisited after 7.4. - Rate limit synthetic uevent failure messages to prevent log flooding from repeated invalid writes to sysfs uevent files -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCauOoegAKCRBFlHeO1qrK Li9DAP40jVb0AyHVlniDMGwdCajihY4NweTKKMAdiJJ5f+FX/AEAtm5ZK7rflqQn z5b4dHsFFGPEWfaKZ+w1Qx7L39njJQo= =UZoc -----END PGP SIGNATURE----- Merge tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull more driver core fixes from Danilo Krummrich: - Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind operations associated with misleading fuzzing reports. It also taints established workflows, including VFIO device passthrough; a more targeted approach will be revisited after 7.4. - Rate limit synthetic uevent failure messages to prevent log flooding from repeated invalid writes to sysfs uevent files * tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers" driver core: Limit the messages on a refused uevent |
||
|
Sasha Levin
|
aba9df1806 |
selftests/fuse: add the missing symlink caching test
Commit |
||
|
Linus Torvalds
|
453ebbefe2 |
ktest updates for v7.4:
- Sort configs before writing config file Currently the .config file is created from the perl hash array from reading the applied min-configs. The order is determined by how perl hashes the values. This causes the .config file to be created in different orders for each run, and the order may determine the final value of the .config file after it goes through a make oldconfig. Sort the values when creating the .config so that the result is the same for every run. - Add total test time to run output Have ktest display the total test time of running all the tests. This is useful to find issues in the build, install, boot or test run where things are hanging for longer than expected. - Update reading of the git output during bisect The ktest bisect is an automated way to run git bisect. Since there currently no easy way to know if the bisect found the bad commit (I'm talking with the git maintainers to fix this[1]), it parses the output for the line "is first bad commit". But a recent update to git has the output state "is the first 'bad' commit" which breaks ktest bisect. Have ktest handle both output strings. [1] https://lore.kernel.org/all/20261020141011.0015d172@gandalf.local.home/ -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCauKhoRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qhDpAQDUFnlVRxa53IzPRyW4ZeBk01bzkbP8 r4j4BO8Ror0lLgD/e+L2+Dg4NZcgqNf/zvsX0AjILkYIRGYoWdAdpwE2cwI= =tvoG -----END PGP SIGNATURE----- Merge tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest updates from Steven Rostedt: - Sort configs before writing config file Currently the .config file is created from the perl hash array from reading the applied min-configs. The order is determined by how perl hashes the values. This causes the .config file to be created in different orders for each run, and the order may determine the final value of the .config file after it goes through a make oldconfig. Sort the values when creating the .config so that the result is the same for every run. - Add total test time to run output Have ktest display the total test time of running all the tests. This is useful to find issues in the build, install, boot or test run where things are hanging for longer than expected. - Update reading of the git output during bisect The ktest bisect is an automated way to run git bisect. Since there currently no easy way to know if the bisect found the bad commit (I'm talking with the git maintainers to fix this[1]), it parses the output for the line "is first bad commit". But a recent update to git has the output state "is the first 'bad' commit" which breaks ktest bisect. Have ktest handle both output strings. [1] https://lore.kernel.org/all/20261020141011.0015d172@gandalf.local.home/ * tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest: Accept quoted bad term in git bisect output ktest.pl: Add total test run time to output ktest: Sort config keys before writing config files |
||
|
Linus Torvalds
|
a9547379cb |
Thermal control fixes for 7.4-rc1
- Fix CPU mask truncation in power limit trace event used by the power
allocator thermal governor (Hungyu Lin)
- Fix code indentation in create_s32_tzp_attr() and rearrange it to
use early return when applicable (Thorsten Blum)
- Allow cross builds of the Intel thermal tests (Sasha Levin)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmrk+OUSHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1l6sH/1hdre7kr1AixczWHUuhG22QZpOT2uV0
UWQ5woVkcFivobTemz+3OZR5sA2bx2iuO7AsNUqDwOTEnxuH4vAB7STwp7CM2gBE
x2/1ZWdHje7QBw0sXEiH5RYQDkLeOMcfS8lXnXzoEVIkRz86vEd9yzRQfbvK/nNv
PEhTScmXN+euC1ZWglVOjzx/NEEjHnLvSrAU2nuKhEp7VOx0niL2BAtMKYM0w44X
cmPpmqs2TG1ya5rGNxwQYZa9XKFZ9QSNXfPClyncy1MJDRJKBcvYo5Xi7JZGh3yh
pTJeuS4UPYwKEWCEdSFOsbgruWjxfLAqQlMfGNAfWOMvB8YMl8Kt/Mk=
=M2+P
-----END PGP SIGNATURE-----
Merge tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"These fix three issues related to thermal control:
- Fix CPU mask truncation in power limit trace event used by the
power allocator thermal governor (Hungyu Lin)
- Fix code indentation in create_s32_tzp_attr() and rearrange it to
use early return when applicable (Thorsten Blum)
- Allow cross builds of the Intel thermal tests (Sasha Levin)"
* tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: sysfs: Fix indentation in create_s32_tzp_attr()
thermal: Fix CPU mask truncation in power limit trace event
selftests/thermal: allow cross builds of the Intel tests
|
||
|
Linus Torvalds
|
17fa96334e |
Arm:
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4
- Cleanup the HCR_EL2 bit fields to exclusively use the generated
definitions, fixings a nasty regression introduced in 6.16, where
barriers were not upgraded from NSH to ISH anymore
- Fix publication of state when a vcpu is forced out of the guest
- Let vcpu pausing nest correctly
- Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the architecture
- Don't warn on SMCCC filter reserved range allocation failure
- Prevent GICv5 and TLBI hypercalls to be used from the host when pKVM
is active
- Enforce that only GICv3 guests are supported for pKVM
- Don't try to access GICv5 EL2 sysregs from EL1
- Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E
by checking the feature dependencies
- Require matching VGIC and ITS model
- Cleanup TRACE_REMOTE dependencies
- Fix random comments
Arm selftests:
- selftests: Skip unwritable ID fields in the failed-run test
- Move pkvm_selftests() after all CPUs have initialized EL2
RISC-V:
- Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest
- Implement KVM_PRE_FAULT_MEMORY ioctl()
- Replace imsic switch-case macros with range checks
RISC-V fixes:
- Avoid redundant interrupt check for pending timers
- Reject vCPU creation after AIA initialization
- Fix build with vector support disabled
- Fix IPI delivery for out-of-order vcpu_id
- Use a raw lock for IMSIC wakeup state
- Reject vCPU creation after AIA initialization
RISC-V selftests:
- Lazy V-extension enablement for KVM selftests
- Show sepc/scause/stval CSRs in KVM selftests vcpu dump
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrk4AIUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroM1yQf+OHsn+QrPUWBv+DDSPcj3iEBVal2/
3YyJSUaDn295nymw4vk0mviwOD7ntEhVNCeT94x8CTibtQUs37GyQOBI88tX0XeU
TZ4oNVrPZByWGd4MEQNpM25hCt5vEXLY6dydZ4GVF2EJKDJ6tT9VqZwX94DJsLgU
HKcSDBSQ6Pzd80bVgwIhzKox2b2U8nrQfhtAKTxetKVWBjPULbCIWYG/PugrP21P
4VikMoWGDovGhqy7ud8kZ3i6feVST1cD8To61BRrmGp04b0knGWrINFyRnh0bFPa
muZeineILYSDLDKFSk0A0KBPjnM7KoQnwaNpDzS/Xl+7K8kKnPvDGWVwZg==
=Zlk1
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull more KVM updates from Paolo Bonzini:
"ARM64:
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4
- Cleanup the HCR_EL2 bit fields to exclusively use the generated
definitions, fixings a nasty regression introduced in 6.16, where
barriers were not upgraded from NSH to ISH anymore
- Fix publication of state when a vcpu is forced out of the guest
- Let vcpu pausing nest correctly
- Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the
architecture
- Don't warn on SMCCC filter reserved range allocation failure
- Prevent GICv5 and TLBI hypercalls to be used from the host when
pKVM is active
- Enforce that only GICv3 guests are supported for pKVM
- Don't try to access GICv5 EL2 sysregs from EL1
- Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E
by checking the feature dependencies
- Require matching VGIC and ITS model
- Cleanup TRACE_REMOTE dependencies
- Fix random comments
ARM64 selftests:
- selftests: Skip unwritable ID fields in the failed-run test
- Move pkvm_selftests() after all CPUs have initialized EL2
RISC-V:
- Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest
- Implement KVM_PRE_FAULT_MEMORY ioctl()
- Replace imsic switch-case macros with range checks
RISC-V fixes:
- Avoid redundant interrupt check for pending timers
- Reject vCPU creation after AIA initialization
- Fix build with vector support disabled
- Fix IPI delivery for out-of-order vcpu_id
- Use a raw lock for IMSIC wakeup state
- Reject vCPU creation after AIA initialization
RISC-V selftests:
- Lazy V-extension enablement for KVM selftests
- Show sepc/scause/stval CSRs in KVM selftests vcpu dump"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits)
KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC
KVM: arm64: vgic: Require matching VGIC and ITS models
KVM: arm64: gic-v5: Drop unused addr variable
KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E
KVM: arm64: selftests: Skip unwritable ID fields in the failed-run test
tracing/remotes: Fix TRACE_REMOTE build when TRACING=n
KVM: arm64: Move pkvm_selftests() after all CPUs have initialized EL2
KVM: arm64: Get rid of compatibility HCR_EL2 aliases
KVM: arm64: Convert HCR_xyz to HCR_EL2_xyz
KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests
KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch
KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1
KVM: arm64: Validate the host-provided vgic model in pKVM
KVM: arm64: Reject the stage-2 flush hypercalls under pKVM
KVM: arm64: Return on kvm_gmem_get_pfn() failure in gmem_abort()
KVM: riscv: selftest: add Zicclsm, Ziccamoa, Ziccif, Za64rs
RISC-V: KVM: Allow Zicclsm, Ziccamoa, Ziccif, Za64rs in guest
MAINTAINERS: name the kvm-riscv/linux riscv_kvm_next branch
RISC-V: KVM: Don't write MMIO load result to x0
RISC-V: KVM: Use a raw lock for IMSIC wakeup state
...
|
||
|
Linus Torvalds
|
6e07889d8f |
arm64 fixes:
- Release the GCS on a failed fork. copy_thread() can allocate a GCS
for CLONE_VM threads but a later copy_process() failure left the VMA
in the parent's mm. Implement exit_thread() to free it and stop
kernel threads and user workers inheriting the parent's GCS
base/size. Add a kselftest for the clone3() failure case
- Do not set PTE_CONT on invalid PTEs in contpte_set_ptes(). Batched
set_ptes() of present-invalid entries (e.g. PROT_NONE) created contpte
groups that the single-PTE helpers did not unfold, corrupting a
neighbouring guard marker via test_and_clear_young_ptes()
- Release the MPAM mon_sel lock on the mpam_save_mbwu_state() error
paths
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmrk3ssACgkQa9axLQDI
XvFwiQ/+LSIVXGHJIWom8Wu6e3P+Ho0FxbDbxgT3VHXR6uHjdyNa/nN60IXVQES8
KJ7Kydrh8X+90eDYQY7iKwuXwNQsxwdYMFGLa26aFDaOv3bK0bI2xM3zpRAg98qy
UwXApfatt4iCm1pB8E8n3XJ64eVccapfrf6Mv5wnn1cg8vSsrlR6S3HotATGc8cG
+1cuoI3fgByDqiVkssJka2ZhM5tWBxEg4mQ3Un6O6vTQTAZCp/vbsRgOjupKsgRU
zLWh8KNEoV1ehYtPuwXQ+sRiOhfBHOuNK3i+FlmTEuRjcLJ2xbkpIzCEJvy2+n9+
n+0ewG0EkRrf4NodgeDmBB6zSyLhfKjorp634NqWj8UKF2z4uPLJzhb5xJXeeByZ
uOynRR19fj2YOWIc/vF1p+4yQCSi6eOEASU/5oYSqsnKU/As6Xoum22dMtRERB6e
YH8cQT0RXw0qWJ46+/6rRqIpugNa+kkVcQloP2YLKl4QpPYGhtK8Kw4dymx6OQcl
zDoiP8R2hQzylMjzvNRA+KugCOKsCPy4j7A3w3aiBVOkhOsfoHK4zkx3LJp/su/d
gRNiDJgN4S57yrmvEUlXmBXUI1QzeXnRNHm/xYb7SGe/DeDaJElS+EmcPFi/i6Up
VaKyApaS017oBq/pS5Ku1DL4jr8EjPM9xW7//Tczq4MzPyl4ogY=
=ZNuk
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Three fixes that turned up during the merging window: shadow stack not
freed during a failed fork or it is unmapped from parent when a worker
thread exits (same commit covers both); PTE_CONT set on PROT_NONE
entries but subsequently ignored by the unfolding code since
pte_valid() is false (pte_present() is true); an MPAM lock not
released on the error path.
Summary:
- Release the GCS on a failed fork.
copy_thread() can allocate a GCS for CLONE_VM threads but a later
copy_process() failure left the VMA in the parent's mm. Implement
exit_thread() to free it and stop kernel threads and user workers
inheriting the parent's GCS base/size. Add a kselftest for the
clone3() failure case
- Do not set PTE_CONT on invalid PTEs in contpte_set_ptes().
Batched set_ptes() of present-invalid entries (e.g. PROT_NONE)
created contpte groups that the single-PTE helpers did not unfold,
corrupting a neighbouring guard marker via
test_and_clear_young_ptes()
- Release the MPAM mon_sel lock on the mpam_save_mbwu_state() error
paths"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
selftests/arm64: GCS must not leak on a failed clone3
arm64/gcs: release GCS on failed fork
arm64/mm: restrict transparent contpte mappings to valid PTEs
arm_mpam: Release the mon_sel lock on mpam_save_mbwu_state() errors
|
||
|
Linus Torvalds
|
0c8bf38058 |
vfs-7.4-rc1.fixes
Please consider pulling these changes from the signed vfs-7.4-rc1.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCauTJqQAKCRCRxhvAZXjc
okLyAP0bHWHQ8CIbegVzZbMVssaMJl1KiqxfkGbS6Nk/j1StkwEA5+UGbFnQ2qG6
uxDILfnlsd834jlOlOauzaSpbAJgwQk=
=uPnP
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- writeback:
- Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The
list was left out of order so move_expired_inodes() could stop
before older inodes, and the lazytime expiration timestamp was
reset
- Clear the old wb's dirty-I/O state and bandwidth contribution when
a batch of inode switches leaves its dirty lists empty. An empty
wb stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth
- Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
inodes let a scan racing a sync()'s queue_io() move lazytime
inodes past the sync's cutoff, so sync() returned without
persisting their timestamps
- Don't kick writeback for an IOCB_DONTCACHE write on an inode that
has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
write to a block device dereferenced NULL
- statmount/listmount/listns:
- Refuse statmount() string requests with a buffer that isn't larger
than struct statmount
- Don't wrap around with a U64_MAX cursor in listmount() and
listns()
- Don't end listns() at an inactive namespace
- Only add init_ipc_ns and init_net to the namespace trees if
CONFIG_IPC_NS and CONFIG_NET_NS are enabled
- iomap:
- Only mark blocks uptodate in __iomap_write_begin() after reading
them and let __iomap_write_end() mark the zeroed blocks uptodate
once the copy from userspace succeeded
- Check a chunk against max_integrity_io_size() on its own before
the bio size check
- Only enforce block alignment for direct I/O into holes and
unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set
- backing-file:
- Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
passthrough opens the backing file with vfs_open() which skips
may_open(), so anyone who may open the FUSE file for writing could
overwrite an append-only backing file anywhere or write to an
immutable one. Open, mmap and writes now check the backing inode
the way may_open() and do_mmap() do
- Always call kiocb_end_write() for a queued write
- Let backing files inherit FMODE_NONOTIFY from the user file. The
event fds fanotify creates for permission events on a stacked
filesystem raised FS_OPEN_PERM on the real path from inside the
listener's read() and deadlocked listeners with marks on both
layers
- pidfs:
- Look the task up before checking for exit information in
PIDFD_GET_INFO and start over if the task no longer owns the pid
once all fields have been read. A caller racing release_task() got
neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
exit information was available, and a caller racing a sub-thread's
exec reported that thread's tid as the pid
- Clear the mask bits of fields that lie beyond the struct size the
caller passed. The uapi header promises that the mask names no
such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
coredump and supported mask bits set for fields that were never
written
- aio:
- Give the aio ring a ->read_folio that fails with EIO so a fault on
a ring whose file was truncated gets SIGBUS instead of jumping to
NULL
- Check nr_events against the ring size before doubling it in
ioctx_alloc()
- splice:
- Only write back an implicit file position in do_splice() when the
splice helper succeeded. splice doesn't take f_pos_lock so a
failed splice restored a stale snapshot over a position that a
concurrent getdents() had moved. On ext2 the next readdir then
trusted an offset inside a directory entry
- Retry tee() when the input pipe was emptied or the output pipe
filled between the prep steps and link_pipe() instead of returning
0 while the input pipe still has writers, as splice_pipe_to_pipe()
does
- ucount:
- Take the reference that pins a ucounts level on the 0 -> 1
transition before checking the rlimit
- Read the parent ucounts before dropping the rlimit count in
do_dec_rlimit_put_ucounts()
- inode:
- Rotate inodes whose page cache couldn't be dropped to the tail of
the LRU
- Skip inodes that another LRU walker is isolating
- setns:
- Set nsset->flags before anything in prepare_nsset() can fail so
the error path drops the cred prepared for CLONE_NEWUSER. A
failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
together with its user namespace
- Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
again when more namespaces are requested
- minix:
- Restore uptodate on the pinned bitmap buffers before redirtying
them after a failed writeback instead of tripping the warning in
mark_buffer_dirty(), as ext2 and ext4 do for their superblock
buffers
- Reject rmdir() of a directory with a corrupted link count with
EFSCORRUPTED instead of hitting the drop_nlink() warning
- userns: Keep the exec securebits and their locks when creating or
joining a user namespace. set_cred_user_ns() reset all securebits to
SECUREBITS_DEFAULT so anyone who may create a user namespace could
shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
a single unshare(CLONE_NEWUSER)
- fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
pwrite64(), preadv() and pwritev() wrappers
- proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
last vread_iter() copy instead of the running total
- eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
can't be created in EPOLL_CTL_MOD instead of reporting success
without suspend protection
- coredump: Mark do_coredump() noinline_for_stack
- nsfs: Check the trailing bytes of a namespace file handle in bytes
instead of words
- netfs: Restore the per-level and per-point decoding of the debug mask
- exportfs: Release the directory file get_name() opened with
__fput_sync(). From nfsd's kernel threads the deferred fputs arrived
faster than delayed_fput retired them and each pinned the directory's
readdir state, growing unreclaimable slab by about 90 MB per second
under a parallel tree walk
- fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
unmounted as of v7.0 its struct ramfs_fs_info was leaked
- signal: Check the blocked mask for every entry
dequeue_synchronous_signal() looks at. The scan could select a
blocked synchronous signal and deliver it while blocked
- super: Convert the superblock device table from an rhltable to a
plain hashtable under a spinlock. This fixes a bug from v7.3 where
fs_bdev_freeze() froze a btrfs filesystem through a stale member that
open_ctree() had already released while the freeze was waiting for
SB_BORN
- fork: Leave rcu_users at zero until copy_process() can't fail
anymore. bpf_task_acquire() handed out trusted references to the new
task from the task_alloc LSM hook and sched_ext's ops.init_task() and
a failing fork freed the task behind them
- xattr: Always run cap_convert_nscap() for a security.capability
write. A zero-length setxattr() skipped it and let an unprivileged
caller without CAP_SETFCAP or write permission on the file plant an
empty security.capability xattr that made every execve() of the
binary fail with EINVAL
- namei: Skip the S_ISDIR assertion in
- proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
first lookup by anyone with search permission ran d_invalidate() on
the dentry and detached every mount on it, locked mounts included
- libfs: Hold one mount reference for all pins instead of one per pin.
The pin count is what keeps the mount alive, so the per-pin reference
only cost a mntget() and a mntput() through
mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
configfs file that comes and goes
- iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
any type
- watch_queue: Give info_id its own storage instead of overlaying it
with rcu_head
- filelock: Take an active superblock reference while waiting for a
delegation break. After a lazy umount closing the delegation holder
could shut down the superblock under the waiter whose final iput()
then ran shmem_evict_inode() on freed state
- fs: Skip the copy_file_range() write limit checks when there is no
data to copy
- bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
close_range() became synchronous this cycle close(), close_range()
and the closes on exec and exit no longer go through filp_close().
fexit stays rejected since the file may be gone by then
- fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
spuriously woken waiter kept its on-stack entry queued, took that as
proof that the pin was alive and used the freed acct structure when
umount() of the accounting file raced acct(2)
- dcache: Don't fail __d_obtain_alias() for an inode without links and
aliases. The ESTALE check added this cycle broke open_by_handle_at()
and nfsd file handle decoding on NFS and FUSE where i_nlink is just
what the server last reported and the handle may well still be valid
- selftests/ovl: Fix the mountinfo expectations of the detached layer
test which has failed since it was added
* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
fs: don't fail __d_obtain_alias() for unlinked inodes
ns: don't add init_ipc_ns and init_net without namespace support
aio: avoid request count overflow in ioctx_alloc()
selftests/ovl: fix detached layer mountinfo expectations
bpf: Allow bpf_d_path() from filp_close_sync()
fs: skip copy_file_range write limits when there is no data
minix: reject rmdir of a directory with a corrupted link count
fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
ucount: read the parent ucounts before dropping the rlimit count
splice: retry tee() instead of returning 0 when it races
selftests/pidfd: test that fields beyond the struct size are not reported
pidfs: do not report fields that do not fit into the caller's struct
fs: let backing files inherit FMODE_NONOTIFY from the user file
splice: avoid stale f_pos writeback on error
backing-file: always end a queued write
filelock: keep superblock active through delegation wait
watch_queue: keep info_id separate from rcu_head
iomap: only follow dio alignment requirement if specified
iov_iter: fix NULL deref in iov_iter_alignment()
backing-file: enforce append-only and immutable backing inodes
...
|
||
|
Linus Torvalds
|
8ebbaf8835 |
block-7.4-20261029
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrjrZ0QHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpl3xEACV0gok/rxtzKB/z2gedIdA1NjY488cNdH3
UP+YpoTNm4GE/A9bfmTLWjGaQlxmDSdlM8cmQzAKTjHNiGNFK/Pv+fqWzaz38Aet
tUrxby2748CC3oin4BVxdTLqgSg35Yaw2S/zM/Zsxt3eMHtOdWZZYo8FKkvdf7fp
DR166vphOGQFu598Allrd4OTXj+TLd6EFlZ7WSN7fq2a8193XuIvfH5HRkDEUbVB
GA1wlltke/zildACho1MldBDkQYeGGGVk/J/1V5P8sB7TRrzyiRbO8RyfvwSR6OH
ChNeVXA/iLjwJA9HVX7+q+VnVQRK/EgIVZZoum+BG9WO9ZcUaelxgF3ZIdYc0Pj0
MDwg6iL4oWZKAqdb1jCYpjOqT3avp+oSQSD9sGpnzSmta2sMtQyulo00UGMBDuBP
xx8zzeggbuJymFXrCTAZ7Ek1EUNZh3qcWgdUOhxHV+R0s9ovyZszOdGV4dLNm0wX
aBO375d4O9FutZRzUA5vxEHbBue+S3maPkW2txn4WlnJNGRDIN/GyKoY6c5oyogy
ApYQ2Gqlbvf7VOPiYVADhycVNUzcolf8EBOXu8zFvMTA8aXLwXalrIaEurnhpE51
EQaPIZFXH4/dj6noHpgvYaAGFAFXpSSSXVIkG8a0CuhkDjrf6vU+dbt4PVhWP3xT
BSFU97FGbw==
=i457
-----END PGP SIGNATURE-----
Merge tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:
"Bigger than usual for an end-of-merge-window pull request, main reason
being that the MD side I had missed a pull on, and both NVMe and block
got a good pile of LLM driven fixes where some of them may as well
just go in now rather than wait a full cycle. This contains:
- NVMe fixes via Keith:
- nvme-tcp fallout from the parallel queue allocation: initialize
pf_cache_lock and the header digest before requests are set up,
and don't dereference a NULL queue->ctrl on reconnect
- nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
limit each queue type to the online CPUs, and clear a poll map
with no poll queues
- nvme-tcp io_work priority inversion with send_mutex held
(Seiji), error recovery on read_sock failure and skipping TLS
control records while waiting for the ICResp (Martin B), TLS
handshake timeout validation, and an address attribute race
- nvme-rdma NULL metadata_sgl dereference with T10-PI
- nvme-pci early boot hang with the quirks parameter
- nvme-multipath ANA log bounds underflow, and an nvme-fc
discovery reference leak
- nvmet hardening: rdma inline SGL out-of-bounds write and short
connect requests, fc use-after-free in LS create connection and
teardown on admin queue failure, pci-epf transport error
reporting and SGL length checks, zns NUMD wrap, fc stale read
data, auth state and status fixes, ports list and qid_max
locking, rdma double puts and irq-safe locking, and a double
free on metadata SGL allocation failure
- nvmet fixes from Josef: big discard length truncation, NULL
derefs for PCI endpoint targets and debugfs host_traddr, stop
listening when a tcp port is removed, and don't BUG() in
nvme-loop when a scan runs beside a reset
- MD fixes via Yu Kuai:
- raid5 validation: reject too few disks, invalid reshape disks, a
per-device size below one chunk, and an inconsistent reshape
state from the superblock instead of BUG(), plus journal payload
size checks
- raid5 error path and lifetime fixes: extra_page leak and NULL
derefs in free_conf/setup_conf, draining released_stripes before
destroying the cache, RCU for the big_stripe_tree lookup, and
per-array io_unit slab names
- md core: reject v0.90 arrays with too many devices, validate
bblog_size, take reconfig_mutex when enabling PPL, fix the
mddev->private NULL deref when stopping an array under IO, and
don't hand out the array before mddev->kobj is added
- raid10 missing barrier wakeup, raid0 device count validation, a
bogus mddev_unlock() in lbs_store(), and shared helpers
- blk-mq fixes from Josef:
- don't trust the bio cookie in blk_mq_poll()
- keep tag sharing fair after a queue update
- don't bring back flags of a completed request from the timeout
handler
- honor a restarted timer
- initialize the dma state for P2P
- quiesce a queue joining a quiesced tag set
- set up and exit hctxs under tag_list_lock
- free the tag bitmaps in the SRCU callback
- blk-cgroup and friends from Josef:
- keep the old blkg while reassociating a bio
- free struct ioc after a grace period
- don't truncate v1 iops limits
- fix root io.stat on 32-bit
- don't free a blkg with its punt work queued
- flush iolatency enable_work after going offline
- pass dead group I/O counts on and make reset_stats reset them
- don't enter reclaim under rq_qos_mutex
- Other core fixes from Josef:
- a disk use-after-free in sync_bdevs()
- don't losing the status of a failed flush request
- 64-bit sector math for mac partitions
- apply the segment size to the integrity buffer
- blk-iocost: abort a weight transfer on invalid donation weights,
and publish hweights as one atomic value
- Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
reachable via dm-inlinecrypt
- Fix recursive i_rwsem locking in blkdev_write_iter(), from two
fixes for the same race landing in the window
- Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
an infinite loop in blk_rq_map_user_iov()
- Check the open mode for LOOP_SET_STATUS in the compat ioctl
- rnbd-srv use-after-free and kobject fixes
- drbd timer and req_lock fixes
- zloop cleanups and error path fixes
- cdrom header and kernel-doc cleanups"
* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
zloop: check that the zone backing file support ->{read,write}_iter
zloop: fput file after failed zone init
zloop: share more code for opening a zone backing file
zloop: remove a duplicate call to zloop_get_block_size
block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
blk-iocost: publish hweights as one atomic value
blk-iocost: abort weight transfer on invalid donation weights
rnbd-srv: publish the sess_dev at the end of OPEN
rnbd-srv: fix use-after-free on two CLOSE messages
block/rnbd-srv: drop the sess_dev kobject unlocked
block/rnbd-srv: don't free the device on a sysfs error
drbd: take req_lock to skip the initial sync as peer
drbd: stop the start_resync timer of a dying device
block: apply the segment size to the integrity buffer
blk-mq: free the bitmaps of tags in the SRCU callback
block: partitions/mac: compute the sectors in 64 bits
blk-mq: set up a queue under tag_list_lock
blk-mq: exit the hctxs of a queue under tag_list_lock
blk-mq: quiesce a queue that joins a quiesced tag set
...
|
||
|
Amir Goldstein
|
8457ca071f
|
selftests/ovl: fix detached layer mountinfo expectations
set_layers_via_detached_mount_fds was copied from the attached-fd test
and still looks for /tmp paths. Detached open_tree() layers are recorded
by d_path() as upperdir=/upper, workdir=/work, and lowerdir+=/ and
datadir+=/ for each cloned directory. The test has failed since it was
added.
Reported-by: Disha Goel <disgoel@linux.ibm.com>
Link: https://lore.kernel.org/linux-unionfs/20260924112858.51392-2-disgoel@linux.ibm.com
Fixes:
|
||
|
Ihor Solodrai
|
3a00ecc890
|
bpf: Allow bpf_d_path() from filp_close_sync()
The d_path selftest closes its descriptors with close_range() so that its fentry program on filp_close() runs. Commit |
||
|
Nickolai Zeldovich
|
28767d4934
|
selftests/pidfd: test that fields beyond the struct size are not reported
PIDFD_GET_INFO must not set the mask bit of a field that lies beyond the struct size encoded in the ioctl command. Add a test that requests the coredump fields and the supported mask with PIDFD_INFO_SIZE_VER0 over a full-size, poisoned struct, and checks that the mask names none of those fields and that the poison behind the first 64 bytes is intact. Add fallback definitions of PIDFD_INFO_SIZE_VER0 to VER3 to pidfd.h, like the other uapi constants there. Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu> Link: https://patch.msgid.link/20261024041334.831273-3-nickolai@csail.mit.edu Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> |
||
|
Linus Torvalds
|
1b8b675037 |
RISC-V updates for v7.4
- Add support for crash hotplug
- Improve user copy performance on cores with fast misaligned
accesses
- Optimize code paths involving pgtable_l{4,5}_enabled() by patching
in the return values during early boot (since these don't change
during runtime), or by specifying the return values directly in
Kconfig files (for purpose-built kernels)
- Change the PCIe bus reassignment behavior to depend on the
PCI_REASSIGN_ALL_BUS PCI flag (as ARM64 does)
- Avoid an unnecessary sstatus CSR read during context switch
- Make the sbi_ecall() macro variadic, improving code clarity
- Refactor __switch_to_vector() to prepare for upcoming vector context
switch optimizations
- Add a kselftest for vectorized user copy
- Add bounds checking on the shadow stack restore token address to
avoid it being used as an attack vector
- Fix the shadow stack and indirect branch landing pad control functions to
only update the CPU's envcfg CSR when operating on the current task
- For MIPS RISC-V systems, add support for early boot-applied errata;
and for P8700 RISC-V systems, avoid WFI usage in the kernel (since
it is buggy)
- Add the "B" RISC-V ISA extension to hwcap and hwprobe reporting
- Add support for specifying and reporting the "Zic64b" RISC-V ISA
extension, and add it to the SpacemiT K1, K3, and Sophgo SG2044 DT
files
- Require the block size of cache management operations to be
specified in DT schema validation for the RISC-V ISA extensions
Zicbom, Zicbop, and Zicboz
- Some miscellaneous fixes: fix an incorrect bitfield width in the
RVG_SYSTEM_CSR_MASK bitmask macro; make RISCV_ALTERNATIVE mandatory,
now that XIP kernel support has been removed; and remove some
unnecessary includes in kernel/smp.c
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmrivM8ACgkQx4+xDQu9
KkubQw//ann5hPn4CqJh4UjYlhbHM4QxaVpYs6i9fTGdyw1R+JcWxglcAuCkuEHl
At5BFt2aR5y1FQwJqbVUYI0nxJCVCQNPf+6aormHtWnCrxM+9e5jE4Wqhae9BDpB
yUNjRixJVU2Fz8O4WTeJBYsPaOguZXLNltlt5Oi14Zw85hCOX71bSkrORToY3CfQ
L3FLe1gvGfeZyr6jj3c5RkcLHW01zrR0H3/dOcy8T+rEfVLHp90/fUufZPnrW5rj
fIlbDRpQ5ZRlYr5hZ8X+U6Zs6qThGV5LX00wPghrfzdCiD6X7EnYNtmMaTV9aLlS
UZSNrOCHf8lwogvwxYhdQuO+6F72Vj38Y/3CYjwi1+1FuukDlT2mejsXXU3JN8T/
8tCY7zAB0KpTDK1N2Udr+zDXKCQuZ7YYpQJ9UxKjMAn7NwZKB4PmUjfXfSIsKLps
FtzGWa8OM8a5GagpSHewA5c/SVLlkmrlE/0/GtzA4DfVMJyNt37OUWfEogXT7A8A
9neAIgG8K1Dhq8U20scDmDKyZHobOX7+nsVohUiduZgfSgL2P/qHuWhkjNeACliK
FhJcwtGITsF/lrUUBBoAnSYjZwkytaoOwA8eSnNRRxrfzYCgQWCxyYcXqMKI2KyK
FQQlKbEm8eML88f+E9W0t6QqeFMtq6h8GXU8+B0TvrVz0DGfoH0=
=Vdpl
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V updates from Paul Walmsley:
- Add support for crash hotplug
- Improve user copy performance on cores with fast misaligned accesses
- Optimize code paths involving pgtable_l{4,5}_enabled() by patching in
the return values during early boot (since these don't change during
runtime), or by specifying the return values directly in Kconfig
files (for purpose-built kernels)
- Change the PCIe bus reassignment behavior to depend on the
PCI_REASSIGN_ALL_BUS PCI flag (as ARM64 does)
- Avoid an unnecessary sstatus CSR read during context switch
- Make the sbi_ecall() macro variadic, improving code clarity
- Refactor __switch_to_vector() to prepare for upcoming vector context
switch optimizations
- Add a kselftest for vectorized user copy
- Add bounds checking on the shadow stack restore token address to
avoid it being used as an attack vector
- Fix the shadow stack and indirect branch landing pad control
functions to only update the CPU's envcfg CSR when operating on the
current task
- For MIPS RISC-V systems, add support for early boot-applied errata;
and for P8700 RISC-V systems, avoid WFI usage in the kernel (since it
is buggy)
- Add the "B" RISC-V ISA extension to hwcap and hwprobe reporting
- Add support for specifying and reporting the "Zic64b" RISC-V ISA
extension, and add it to the SpacemiT K1, K3, and Sophgo SG2044 DT
files
- Require the block size of cache management operations to be specified
in DT schema validation for the RISC-V ISA extensions Zicbom, Zicbop,
and Zicboz
- Some miscellaneous fixes: fix an incorrect bitfield width in the
RVG_SYSTEM_CSR_MASK bitmask macro; make RISCV_ALTERNATIVE mandatory,
now that XIP kernel support has been removed; and remove some
unnecessary includes in kernel/smp.c
* tag 'riscv-for-linus-7.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (28 commits)
riscv: mm: unexport _pgtable_l4_enabled and _pgtable_l5_enabled
riscv: introduce RISCV_ISA_SV48 and RISCV_ISA_SV57
riscv: support early isa ext and use it to optimize pgtable_l4|l5_enabled
riscv: convert pgtable_l4|l5_enabled to inline function
riscv: remove RISCV_ALTERNATIVE Kconfig option
riscv: Add a getter for user PMLEN support
riscv: dts: sophgo: sg2044: Add Zic64b ISA extension
riscv: dts: spacemit: k1: Add Zic64b ISA extension
riscv: dts: spacemit: k3: Add Zic64b ISA extension
riscv: Add Zic64b to cpufeature and hwprobe
dt-bindings: riscv: Add Zic64b extension description
dt-bindings: riscv: Require block-size for Zicbom, Zicbop, and Zicboz
riscv: Add B to hwcap and hwprobe
riscv: remove unused profile.h includes
riscv: cfi: Only write envcfg CSR when task is current
riscv: cfi: Bounds check restore token before swap
riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause
selftest: riscv: test vectorized user copy
riscv: vector: refactor context switch for kernel-mode vector
riscv: do not read csr in vector context switch
...
|
||
|
Iván Ezequiel Rodriguez
|
f46be4da2c |
selftests/arm64: GCS must not leak on a failed clone3
KTAP coverage for clone3(CLONE_VM|CLONE_PIDFD) with a bad pidfd pointer: sixteen failures must not grow the parent's GCS VMA count. Assisted-by: LLM Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com> Reviewed-by: Mark Brown <broonie@kernel.org> Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> |
||
|
Greg Kroah-Hartman
|
a287f97d42 |
Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"
This reverts commit
|
||
|
Linus Torvalds
|
fb7bd3a2aa |
Rust fixes for v7.4
Toolchain and infrastructure:
- Fix 'objtool' warnings for the upcoming Rust 1.101.0 (expected
2026-12-24) by adding one more 'noreturn' function.
'kernel' crate:
- Fix KCFI failures on every call from C to Rust IRQ handlers and
'hrtimer' callbacks by giving the C enum bindings the correct
'cfi_encoding'. Also prevent the same issue for DMA callbacks
taking 'dma_data_direction'.
- 'workqueue' module: fix a runtime warning when queueing work on the
deprecated 'system_wq' by switching to 'system_{percpu,dfl}_wq'.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmrjhsQACgkQGXyLc2ht
IW1GyRAA1g5eQ1ymFBsHuk0IYbbapFsVGE084mCkVVWCew0pA3Hf2RO9U2ydvZ/A
ZUzmjigGxWtZr1uz7RSIdQhm+wxdOrIEu//WOtgc3EmNnQ7aBI5dHQg0Knzi8Aw1
f32SuqC1Xu7UjEvdo4Ll8Jq+KzwgyNrvOSU6uFFJwhmHHfO+f7kPQQgRYNX+2229
Y1UKg3wHiFLSaQn008DegNkJeESCvfZGR0WL2CGxaJL3A1tF1V7kwg7ePBdJOIY4
0juVvYxnJ1nqBXOfvfIZuVDXS/pqIPIQjq/MOO/bUxu+hvE/rJIctJi/UGimwWNc
krHUQ1CGA53gVrS8rC8pAzUYUOnoiR+738TjuwH/DmSH3mIDPRd8q8wVLRgbeB18
ysh1kW3qbE613xb9mmBn68F9NC0nGTf1dZur4B8yU2EZz/UcE4mWvO3e5f7II1Wc
4k7oyG70SKpzdPiAt3bCgJWevdvX1/u94IxyGSLF3UEcR2OLmjDXLCfQwUzeKLfA
pzB7ujf+XR9SGCIorNyS+0O186s2352PJANSeiNB2b33lcThMHHAghi3VFV8RD7/
+rjYGJ0K80CExw9MBDeDxOfkTkAh63ChLgkDBg9Hdfs7N/gyZRS6Ybl1b3N9XhaE
8xKQ/IxpSMKLG4EMKxhIK+Il5DnmTaKY6RG6dLlW3D82+C7KATo=
=zTmN
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix 'objtool' warnings for the upcoming Rust 1.101.0 (expected
2026-12-24) by adding one more 'noreturn' function
'kernel' crate:
- Fix KCFI failures on every call from C to Rust IRQ handlers and
'hrtimer' callbacks by giving the C enum bindings the correct
'cfi_encoding'. Also prevent the same issue for DMA callbacks
taking 'dma_data_direction'
- 'workqueue' module: fix a runtime warning when queueing work on the
deprecated 'system_wq' by switching to 'system_{percpu,dfl}_wq'"
* tag 'rust-fixes-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: dma: declare cfi_encoding for dma_data_direction
rust: hrtimer: declare cfi_encoding for hrtimer_restart
rust: irq: declare cfi_encoding for irqreturn
objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
rust: workqueue: replace deprecated system_wq with system_{percpu,dfl}_wq
|
||
|
Linus Torvalds
|
4dd16e3113 |
Current release - new code bugs:
- mctp: usblib: fix assertion breaking esoteric builds
Previous releases - regressions:
- eth: ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl
- eth: mlx4: always create the eth and ib auxiliary devices
- Revert advertising the TCP MSS from the configured MTU
- eth: tg3: invert restart quirk logic to restrict SNP power-down bypass
- eth: bnxt: recycle agg buffers when Rx head buffer allocation fails
- netlink: check sk_rcvbuf before charging the dump skb
Previous releases - always broken:
- net: fix frag_list leak in skb_segment_list() error path
- sctp: reject forged cookie peer_addr with unknown address family
- vxlan: keep reserved_bits across changelink
- net: limit priority VLAN untag depth
- inet: frags: prevent acceptance of partially authenticated reassembly
- gro: do not GRO GSO packets with inconsistent payload
- tcp: avoid double destroy in tcp_abort() of an unaccepted child
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmrjeuQACgkQMUZtbf5S
IrsVgRAAv5gGdXhE5FnO5QqM5t8+B8cR2859TV3959TJlVbOSoP7yCtPh5seI8uo
nMzE6OzKp47aN50ZB/iZ6zLUoZ0sr/dWgmrN979cH9ZSIFhsjwB7xhJD9a54ltoX
V/ezBxW6WuYFFeEwk+4q8M9rxeNJJ2/ILqeifzormhXyTDPRxtJTJlvLoQ8Tz2R5
Ke6AP7XEs9fWgwRxpxMa19vDzzMxtOBxfQwhzlypes/5CRIKl57aWrAoFMgXHABT
ayhnXabctzW92OnOq6gA8VLEaAHN9rX3RHGaphNzHcO5skxIk/Blwb2s6mZKARvC
PCCTb5lXwzM8jejGZo2vC8+XdcebR1VWZxgw0vnSVkiUZbDoHpeOot0IpAffGzGO
8tikWJ3Hy81J4WjR+KfsD+xLC26YnlsydRDlyTxnEZnwpeHUueZwE1ONzCIIwtGg
okRQOdis82s6H76FDBb8/Uumds5ODdDsM7Cc2DUP/EiFOf4YOOTX4M0XrKlcvZS/
xpaiFkuNemModIhplCzei1ps3DTGpTXYITJD3ykEaZlVF2d7uRj7+v9Tb7Vjl9yK
cNwz1IOIggx9zlioayZbtCWzs5SOtpUicQ+h02ECb6kbnq9Uc2w3jLwLQrCcAFqy
UFWtCKKQZ3pilMt+SM4Gi49875BNPgfkIL4JhB15YFJ81ipZKSI=
=3jq2
-----END PGP SIGNATURE-----
Merge tag 'net-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Current release - new code bugs:
- mctp: usblib: fix assertion breaking esoteric builds
Previous releases - regressions:
- Revert advertising the TCP MSS from the configured MTU
- netlink: check sk_rcvbuf before charging the dump skb
- eth:
- ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl
- mlx4: always create the eth and ib auxiliary devices
- tg3: invert restart quirk logic to restrict SNP power-down bypass
- bnxt: recycle agg buffers when Rx head buffer allocation fails
Previous releases - always broken:
- net: fix frag_list leak in skb_segment_list() error path
- sctp: reject forged cookie peer_addr with unknown address family
- vxlan: keep reserved_bits across changelink
- net: limit priority VLAN untag depth
- inet: frags: prevent acceptance of partially authenticated reassembly
- gro: do not GRO GSO packets with inconsistent payload
- tcp: avoid double destroy in tcp_abort() of an unaccepted child"
* tag 'net-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (137 commits)
tun: drop batched packets while the device is down
selftests: net: netlink-dumps: start a dump with a notification queued
netlink: check sk_rcvbuf before charging the dump skb
net/sched: act_ife: do not consume the inner header on egress
openvswitch: use eth_type_trans_careful() in internal_dev_recv()
net: use eth_type_trans_careful() in __dev_forward_skb2()
loopback: use eth_type_trans_careful()
net: add eth_type_trans_careful()
tcp: initialize mapped children before route lookup
tcp: fix reordering addition overflow in MTU probing
tcp: avoid double destroy in tcp_abort() of an unaccepted child
net: bgmac: fix TX DMA unmapping and slot cleanup
gro: do not GRO GSO packets with inconsistent payload
net/packet: check TX_RING fragments before memory accounting
eth: bnxt: hand XDP frags over to the copybreak skb
eth: bnxt: free XDP frags when xdp_do_redirect() fails
eth: bnxt: don't leak buffers when XDP agg buffer allocation fails
eth: bnxt: resize Rx head buffers when rx-copybreak changes
eth: bnxt: recycle agg buffers when Rx head buffer allocation fails
netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts
...
|
||
|
Linus Torvalds
|
46806af187 |
bpf-fixes
-----BEGIN PGP SIGNATURE-----
iQJRBAABCgA7FiEE+soXsSLHKoYyzcli6rmadz2vbToFAmrjbZEdHGFsZXhlaS5z
dGFyb3ZvaXRvdkBnbWFpbC5jb20ACgkQ6rmadz2vbTqGEQ//bqWuSeYGypshirYQ
4rxejupvJBJmrD+pI3MSDKVDaLgslm2vW8+vYB+rxpwzje4EsBtVqoHVxzk4yMoQ
WyuJ7988W3RRZw5x5EEruS65C2pM5H2Ilzj2f8Z5gYUfvB72/TGJD2sDXxlTAtUb
ESujBo/M9JRyYZBE5SMJT00r17clwf8NHoT3nr1FKAaDLQopE2zAnE/RwB1lEm3V
MtUcnyDWEwu9ITOxMAwymzYI4FHadqxLJ5MCyCFUeqWAkJcPoVGHWN9Z/0cLTBYt
46PZIotJUEio1PsF6/3y0ZAS2whCAzBuuQCcRG1qBoOdczaDN8fl7RAuTvFmSpPJ
H5Z1GUAXvoFAPpfb9upwYwrEc5hH7+4w9LsGjEumKZ2kHzPccH8K3jtUJRRvYiL8
W7LH4iiu/yPvYHKsgt89csGy6uoACUTn3Xbgfho4DzMoOO8Q8Ahw3SKMpPLIXPk2
1q8Olv9d2pdaVRVJ4qXGPV4510LXW5KwDBHiztZKij8HvasPJS4goaTRKOSIqYOx
GCWCuyM4F22N1suHyUZea507PPVFBKcNBRXWt3nNbKWZNFXpayyS2UI/3kusFFuD
+EFcu0sNDENJ04/SGgujswvGGYrahT8AsHSkwM8jMpiajBiI0ozjWyLwVYk17mAY
WrPIg+X/Uh5nxk5o5RIbniOJ8l8=
=kHds
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
- Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that
were added for rust-bpf in this merge window. We found a cleaner
approach that does it on compiler side instead of kernel/libbpf. No
released kernel has them (Alexei Starovoitov)
- Fix bpf_send_signal_task() returning -EPERM when it is called from a
kernel thread (Aditya Sharma)
- Various fixes (Alexei Starovoitov):
- Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix
objtool warning during the build
- Fix scalar evolution: clear delta of a widened register, don't
widen a pointer to a buffer, don't clamp a register whose type
changed in the loop, and reset the range of a clamped packet
pointer
- Finish the insn in the state that maybe_fork_scalars() splits
off, so that pruning doesn't drop it at the head of a counted
loop
- Preserve the registers that carry stack arguments across
arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64
- Don't re-sort subprog_info[] for every new subprogram
- Fix flaky map_kptr and rcu_reentry selftests
- Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()
and bpf_xdp_load_bytes(), since the destination can be a slice of the
same packet (Ayushman Rout)
- Fixes and follow-ups for scalar evolution: reject pointer operands in
32-bit recurrences and latches, don't intersect with the current
register range on clamp to avoid a false 'verifier bug', avoid false
infinite loop reports, and recognize a 32-bit copy of the induction
variable (Eduard Zingerman)
- Fix out-of-bounds write to btf->types[] for split BTF and propagate
btf_add_type() errors in btf_check_all_metas() (Feng Yang)
- Fix use-after-free in bpf_timer callback that fires after its inner
map was freed (Mani Tofigh)
- Fix x86 JIT stopping before jumps converge: size backward jumps by
the insns they jump over (Mykyta Yatsenko)
- Fix use-after-free of struct_ops trampoline: dissociate struct_ops
progs before the grace period of the map (Qiliang Yuan)
- Validate stack argument reads against the caller state to fix
out-of-bounds read in the verifier, and reject callbacks with stack
arguments (Weiming Shi)
- Tie borrowed iterator results and pointers loaded from trusted fields
to the lifetime of their source, so that iterator next, destroy and
reference release invalidate them (Xu Yunxiang)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)
bpf: Don't re-sort subprog_info[] for every new subprogram
bpf: Fix out-of-bounds btf->types write for split BTF
selftests/bpf: Test stack arguments across may_goto
bpf: Keep stack arguments in arch_bpf_timed_may_goto()
selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
bpf: Finish the insn in the state that maybe_fork_scalars() splits off
selftests/bpf: Test the clamp of pointers in scalar evolution
bpf: Reset the range of a packet pointer that scalar evolution clamps
bpf: Don't clamp a register whose type changed in the loop
selftests/bpf: Test a loop that moves a pointer to a buffer
bpf: Don't widen a pointer to a buffer in scalar evolution
selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed
selftests/bpf: Wait for the last maps of map_kptr to be freed
selftests/bpf: Test that a widened register is not linked
bpf: Clear delta of a register that scalar evolution widens
bpf, x86: Remove r0_on_stack from fetching atomics in arena
bpf: Remove BPF_F_ARENA_SCALAR
selftests/bpf: Remove tests for arena access through numbers
libbpf: Keep format strings of bpf_printk() in .rodata
libbpf: Remove .arena.data
...
|
||
|
Linus Torvalds
|
cb01c6914e |
A handful of late-arriving changes, most of which were ready ahead of the
merge window:
- More Portuguese translation updates
- Some docs-build and self-test fixes
- Bring documentation for the user-space access primitives in
include/linux/uaccess.h into the docs build. This revealed a number of
malformed kerneldoc comments, which are fixed in a subsequent tweak to
uaccess.h.
-----BEGIN PGP SIGNATURE-----
iQFDBAABCgAtFiEEIw+MvkEiF49krdp9F0NaE2wMflgFAmriEykPHGNvcmJldEBs
d24ubmV0AAoJEBdDWhNsDH5YC9IH/ikTCYIK+3Nz8odNLbEh505Ug0KDaAK6Cux5
Wb6eKpMaLfwxMojV80V8/lZMMmKzkeGWRO60TgF4V6MNdziOuj2UoFNIx/M+9jkw
5kPsc/vwGdtt2bR7FN1GKbchH9sh22Baw0aCTk+ymMMTFqDHDJ7qXrCfvm8MNAXg
8+xPr9acR4hYy9Bd8HOKx+noym8qmRvLqeznM5hvOBlQtYk5ZJWwIfuiiH61pzyv
89BrR9fMhObO/5ObSv9OpxFR+28SeB2986zXw1HTyskCrFes9s0Dd6EQfVvL6NxV
ldCt1odfoyAa5KJurvJ3piILJANrcID5PBDlqN/T8jG9oO6gxRc=
=xUko
-----END PGP SIGNATURE-----
Merge tag 'docs-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull more documentation updates from Jonathan Corbet:
"A handful of late-arriving changes, most of which were ready ahead of
the merge window:
- More Portuguese translation updates
- Some docs-build and self-test fixes
- Bring documentation for the user-space access primitives
in include/linux/uaccess.h into the docs build.
This revealed a number of malformed kerneldoc comments,
which are fixed in a subsequent tweak to uaccess.h"
* tag 'docs-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
uaccess: fix some erroneous kerneldoc comments
docs/translations/pt_BR: admin-guide: add efi-stub.rst
docs/translations/pt_BR: admin-guide: add kernel-parameters.rst
docs/translations/pt_BR: admin-guide: add bootconfig.rst
docs/translations/pt_BR: admin-guide: add perf-security.rst
docs/translations/pt_BR: admin-guide: add LSM/index.rst
docs/translations/pt_BR: admin-guide: add hw-vuln/index.rst
docs/translations/pt_BR: admin-guide: add cputopology.rst
docs/translations/pt_BR: admin-guide: add sysctl/index.rst
docs/translations/pt_BR: admin-guide: add sysfs-rules.rst
docs/translations/pt_BR: admin-guide: add features.rst
docs: pt_BR: process: translate userspace debugging guide
docs: kerneldoc.py: preserve headings in kernel-doc output
docs: xforms_lists: Handle DECLARE_KHOSER_PTR() struct members
docs: test_doc_build: don't select urllib3 yanked version
docs: test_doc_build: address pylint warnings
docs: test_doc_build: update it to support newer Sphinx versions
docs: test_doc_build: better handle python version
docs: admin-guide: Fix typo in kernel-parameters.txt
docs: core-api: include documentation from linux/uaccess.h
|
||
|
Linus Torvalds
|
729beb5aa8 |
sched_ext: Fixes for v7.4
This is a big pull for fixes, but much of it was in the works before the
merge window. Most of these fixes are in sub-scheduler support, which nests
BPF schedulers under a parent that hands them CPUs. It was heavily reworked
over recent cycles and is now functionally complete. Porting real schedulers
on it drove the latest additions and keeps finding corner cases. For
example, once CPUs are shared and can be taken back, the kernel must keep
every task moving when its scheduler can't run it or is failing, and those
fallbacks interact subtly with each other and with other new core features.
- The fallback paths meant to keep a task moving when its scheduler can't
run it or is failing could themselves leave it stuck.
- The stall watchdog could blame a scheduler for time it wasn't responsible
for, even taking down all of sched_ext.
- Sub-schedulers were told late, or not at all, which CPUs they could use.
- Deferred callbacks could stay queued or be dropped under core scheduling
and proxy execution, with a sched/core fix to the duplicate check.
- Hardening: tracing programs can no longer call kfuncs that could deadlock
the CPU.
-----BEGIN PGP SIGNATURE-----
iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCauEJww4cdGpAa2VybmVs
Lm9yZwAKCRCxYfJx3gVYGah7AQD1rUZbNZrXHvV1cJ/WpB9UB6Ex05n4s5hDEbmZ
uMmCWgEAz3zfoly/Tbo4VvUPNVAyWj3gfpIwIPpwCklfODhIjAo=
=rDNB
-----END PGP SIGNATURE-----
Merge tag 'sched_ext-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo:
"This is a big pull for fixes, but much of it was in the works before
the merge window.
Most of these fixes are in sub-scheduler support, which nests BPF
schedulers under a parent that hands them CPUs. It was heavily
reworked over recent cycles and is now functionally complete. Porting
real schedulers on it drove the latest additions and keeps finding
corner cases.
For example, once CPUs are shared and can be taken back, the kernel
must keep every task moving when its scheduler can't run it or is
failing, and those fallbacks interact subtly with each other and with
other new core features.
- The fallback paths meant to keep a task moving when its scheduler
can't run it or is failing could themselves leave it stuck
- The stall watchdog could blame a scheduler for time it wasn't
responsible for, even taking down all of sched_ext
- Sub-schedulers were told late, or not at all, which CPUs they could
use
- Deferred callbacks could stay queued or be dropped under core
scheduling and proxy execution, with a sched/core fix to the
duplicate check
- Hardening: tracing programs can no longer call kfuncs that could
deadlock the CPU"
* tag 'sched_ext-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (34 commits)
sched_ext: Reject scx_bpf_sub_grant/revoke() in tracing programs
sched_ext: Fix the rescue overload pick ejecting the wrong sub under bypass
sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running
sched_ext: Fix a lone IMMED task waiting behind a kept prev
sched_ext: Fix queued bypassed tasks stalling when the host loses SCX_CAP_BASE
sched_ext: Let the bypass load balancer move tasks homed on other cpus
sched_ext: Factor out bypass_lb_move() and insert with the donor DSQ unlocked
sched_ext: Fix the bypass load balancer stranding tasks on cpus where the host lacks SCX_CAP_BASE
sched_ext: Fix bypassed tasks stalling when the host lacks SCX_CAP_BASE
sched_ext: Expire prev's slice in dispatch_one() under bypass
sched_ext: Fix a cpu idling after put_prev_task_scx() queues its task on the local DSQ
sched_ext: Refuse extending a kernel slice
sched_ext: Mark the rescue grant as a kernel slice with SCX_TASK_KERNEL_SLICE
sched_ext: Fix a cpu idling with a runnable rescuee
sched_ext: Restore a rescuee's slice after ops.stopping()
sched_ext: Fix rescue served time disagreeing with the slice under proxy execution
sched_ext: Move refill_task_slice_dfl() below apply_slice_vtime()
sched_ext: Fix bypassed tasks looping on a host without SCX_CAP_ENQ
sched_ext: Fix bypassed tasks stranded by the reenqueue limit
sched_ext: Clear holding_cpu where the claim is confirmed
...
|
||
|
Linus Torvalds
|
2152c755f7 |
cgroup: Fixes for v7.4
- cgroup.kill did not kill a process whose thread group leader had exited
while other threads still ran, nor those threads once moved to another
cgroup, letting a process survive its container being killed.
- A cgroup.procs write under favordynmods could migrate a newly forked
process before fork linked it to its cgroup, corrupting cgroup task lists.
- cpuset partition fixes for nested hierarchies: invalidation, revival,
shrinking and switches between root and isolated could leak isolated CPUs,
skip or miscompute the housekeeping check, or leave wrong effective CPUs.
- A root partition can no longer be created under an isolated parent or
stay valid under one, as disabling it could leave no housekeeping CPUs.
- Enabling a partition failed when a grandchild held tasks, although the
parent had none of its own.
- Separately, an allocation racing with a cpuset.mems update could drop
its mempolicy nodemask and land on the wrong node, and a memoryless node
in cpuset.mems triggered a spurious "movable nodes only" warning.
- Two no-functional-change cleanups of the effective CPU computation.
-----BEGIN PGP SIGNATURE-----
iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCauD/Ow4cdGpAa2VybmVs
Lm9yZwAKCRCxYfJx3gVYGUHZAQDs9j6gMDplJmgdPYo9OE+lxV+CbeyQcAiKmYgU
UKkYWQD/dQqxs+SocRMl6uPMInFCd9tplbZgAhbAKsmRWUfyBwI=
=flEV
-----END PGP SIGNATURE-----
Merge tag 'cgroup-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
- cgroup.kill did not kill a process whose thread group leader had
exited while other threads still ran, nor those threads once moved to
another cgroup, letting a process survive its container being killed
- A cgroup.procs write under favordynmods could migrate a newly forked
process before fork linked it to its cgroup, corrupting cgroup task
lists
- cpuset partition fixes for nested hierarchies: invalidation, revival,
shrinking and switches between root and isolated could leak isolated
CPUs, skip or miscompute the housekeeping check, or leave wrong
effective CPUs:
- A root partition can no longer be created under an isolated
parent or stay valid under one, as disabling it could leave no
housekeeping CPUs
- Enabling a partition failed when a grandchild held tasks,
although the parent had none of its own
- Separately, an allocation racing with a cpuset.mems update could
drop its mempolicy nodemask and land on the wrong node, and a
memoryless node in cpuset.mems triggered a spurious "movable
nodes only" warning
- Two no-functional-change cleanups of the effective CPU
computation
* tag 'cgroup-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)
cgroup/cpuset: Integrate compute_partition_effective_cpumask() into compute_effective_cpumask()
cgroup/cpuset: Relocate compute_*effective_cpumask() and compute_effective_nodemask()
cgroup/cpuset: Release invalid isolated CPUs with a shrunk root partition parent
cgroup/cpuset: Release invalid isolated CPUs in compute_partition_effective_cpumask()
cgroup/cpuset: Make sure compute_partition_effective_cpumask() is only called for valid partition
cgroup/cpuset: Prevent recursive call of remote_cpus_update() via update_cpumasks_hier()
selftests/cgroup: Check for a single range nohz_full CPUs before running test matrix
cgroup/cpuset: Minor fixes to prstate_housekeeping_conflict()
cgroup/cpuset: Fix incorrect effective_cpus bug in update_cpumasks_hier()
cgroup/cpuset: Properly compute effective xcpus in update_parent_effective_cpumask()
cgroup/cpuset: Find furthest isolated ancestor for invalidated isolated partition
cgroup: don't kill migrated processes through their exiting threads
cgroup/cpuset: check effective mems for a movable-only configuration
cgroup/cpuset: Fix task checking when enabling a partition
cgroup: serialize migrations of newly forked processes
selftests/cgroup: test cgroup.kill with an exited thread group leader
cgroup: fix cgroup.kill for exited thread group leader
selftests/cgroup: Skip test_cpuset_prs.sh test if some required CPUs are offline
selftests/cgroup: Add tests for nohz_full housekeeping check
selftests/cgroup: Add tests for isolcpus housekeeping check
...
|
||
|
Jhonata Poma-Hansen
|
e615d0a8b2 |
selftests: net: netlink-dumps: start a dump with a notification queued
Add a test which starts a link dump on a socket with SO_RCVBUF 2048 while a link notification is still queued, after a large read made the kernel attempt large dump skbs. It reads like libnl does, peeking before each read, and expects the dump to complete with a zero status and at least one link. The notifications come from bringing lo up and down, so the test runs in its own netns and is skipped without the privileges to create one. The test fails without the previous patch. Signed-off-by: Jhonata Poma-Hansen <jhonata.poma@gmail.com> Link: https://patch.msgid.link/20261027-netlink-dump-livelock-v2-2-c4bb05352a33@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Eric Dumazet
|
695e1408eb |
net: use eth_type_trans_careful() in __dev_forward_skb2()
A tc egress BPF program can push a tiny link-layer header with
bpf_skb_change_head() on an skb whose head is almost empty, then
redirect it to an Ethernet device ingress. __bpf_redirect_common()
only checks mac_header < network_header, and __dev_forward_skb2()
crashes in eth_type_trans():
tc filter add dev lo egress pref 1 matchall action vlan pop_eth continue
tc filter add dev lo egress pref 2 bpf da obj prog.o
# prog: bpf_skb_change_head(skb, 1, 0);
# return bpf_redirect(veth1_ifindex, BPF_F_INGRESS);
# AF_PACKET SOCK_RAW on lo: eth / eth / 8192 bytes of payload
kernel BUG at include/linux/skbuff.h:2839!
RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)
Call Trace:
__dev_forward_skb2 (net/core/dev.c:2507)
dev_forward_skb_nomtu (net/core/dev.c:2546)
__dev_queue_xmit (net/core/dev.c:4738 net/core/dev.c:4998)
packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
Use eth_type_trans_careful(), and drop the packet if the Ethernet
header can not be pulled. This also covers other dev_forward_skb()
users (veth, macvlan, ipvlan, netdevsim, l2tp_eth).
Update the empty_skb BPF selftest: at lwt_xmit, BPF_PROG_TEST_RUN
strips the Ethernet header, so the "veth ETH_HLEN+1" packet is a 1-byte
skb. Redirecting it to veth ingress used to read the Ethernet header
past skb->tail and deliver a 1-byte frame; it is now dropped with
NET_RX_DROP, as veth_xmit() already does at egress.
Fixes:
|
||
|
Jamie Nguyen
|
8daacee78b |
selftests: net: txtimestamp: fix out-of-bounds read in raw UDP checksum
With -r (SOCK_RAW, IPPROTO_UDP) the test writes only the UDP header and
payload, and the kernel adds the IP header. get_udp_csum() still expects
the IP source and destination addresses to directly precede the UDP
header, and reads 2 * alen bytes before the start of the buffer: 8 bytes
for IPv4, 32 bytes for IPv6.
ASan reports a heap-buffer-overflow for both -4 -r and -6 -r. Without
ASan the read usually goes unnoticed, but it faults when the buffer is
the first chunk in the heap. That happens on Ubuntu 26.04, where the
kselftest runner wraps the test in uutils stdbuf, and txtimestamp.sh
fails with SIGSEGV on every run.
Even without a crash, -r packets were sent with a checksum computed
over unrelated heap memory, so their UDP checksum was invalid.
Build the pseudo-header from the destination address and checksum only
the UDP header and payload. -R and -P already write daddr as both the
source and destination address, so their checksums are unchanged. With
-r the kernel selects the source address, which equals daddr for the
loopback addresses used by txtimestamp.sh.
Fixes:
|
||
|
Kunhai Dai
|
0150554a3f |
blk-iocost: publish hweights as one atomic value
current_hweight() publishes the cache generation and both weights with
separate stores. Refreshers running on different CPUs can interleave
their stores and leave a new generation paired with weights from an older
calculation. The compiler can also reorder the generation store before
the weight stores, so a reader that sees the new generation can accept
stale weights.
A stale weight is not only a reporting artifact. It feeds the cost
calculation and the donation logic, where an inconsistent combination can
lead to a zero divisor in transfer_surpluses().
In addition, the slow path rereads iocg->hweight_active/inuse after
publishing them, so the value it returns can be the one written by another
refresher instead of the locally computed one.
Pack the generation and both weights into a single atomic64_t and publish
them with one atomic write. Readers take one atomic snapshot and return
the local values. Weights are in [1, WEIGHT_ONE]; storing each minus one
preserves the full range in 16 bits and leaves 32 bits for the generation.
The two weight fields remain as the donation workspace used under
ioc->lock. Tracepoints decode the packed cache without refreshing it and
iocost_monitor.py is updated accordingly.
Developed with assistance from Claude Code (Anthropic): the assistant
drafted the packed representation, the helpers and the tracepoint/monitor
changes, and ran the checks listed below. The author reviewed the result
and remains responsible for it.
Fixes:
|
||
|
Christian Brauner
|
9084efd0a2
|
selftests/exec: check that user namespaces keep the exec securebits
Check that the exec securebits survive creating a user namespace with unshare(CLONE_NEWUSER) and joining one with setns(): - both bits with their locks, which can't be changed in there - both bits without their locks, which can still be cleared in there - only the locks, which keep the bits from being set in there The other securebits are reset as before. Link: https://patch.msgid.link/20261026-work-securebits-userns-v1-2-b35473fa1a34@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> |
||
|
Chuck Lever
|
7c5d62eff7 |
selftests: tls: Cover splice on a nonblocking socket
Every existing splice call in this file either passes SPLICE_F_NONBLOCK or runs on a blocking socket, so nothing exercises the socket's own O_NONBLOCK on the splice path. A change that stops consulting sock->file->f_flags puts splice(2) and sendfile(2) back to sleeping in tls_rx_rec_wait(), and the suite still reports pass. Splice from a nonblocking socket without SPLICE_F_NONBLOCK, first with no record queued, which must return EAGAIN, then with a record to deliver. A kernel that ignores the socket flag sleeps until the harness timeout rather than returning. Signed-off-by: Chuck Lever <cel@kernel.org> Link: https://patch.msgid.link/20261027015215.605919-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Yongjian Wang
|
b4aac29a21 |
Revert "selftests: net: packetdrill: add tests for advertised MSS with PMTU exceptions"
This reverts commit |
||
|
Paolo Bonzini
|
1689c80fca |
KVM/arm64 fixes for 7.4, take #1
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4 - Cleanup the HCR_EL2 bit fields to exclusively use the generated definitions, fixings a nasty regression introduced in 6.16, where barriers were not upgraded from NSH to ISH anymore - Fix publication of state when a vcpu is forced out of the guest - Let vcpu pausing nest correctly - Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the architecture - Don't warn on SMCCC filter reserved range allocation failure - Prevent GICv5 and TLBI hypercalls to be used from the host when pKVM is active - Enforce that only GICv3 guests are supported for pKVM - Don't try to access GICv5 EL2 sysregs from EL1 - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E by checking the feature dependencies - Require matching VGIC and ITS model - Cleanup TRACE_REMOTE dependencies - selftests: Skip unwritable ID fields in the failed-run test - Move pkvm_selftests() after all CPUs have initialized EL2 - Fix random comments -----BEGIN PGP SIGNATURE----- iQIyBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmrgrdgACgkQI9DQutE9 ekOMAg/3fvq4WaywPyBUCab+vfuqZ9fZLAPRPY6Zw9B2har0TOhX2H9QsTfgOzXd FPp4QSe4kUhdSr/U5yD1eV/GMKz8HjyODtGjUpYlxCd+gYoguO4RMjVhBq4mpMPF 1vFcEf01xQox+ER3wZgDfMJoZTgHev0isZFae4F4KfHHRAtGnosQHau37zSg3Cbq E+jdZVaYwGsSp2Cia4+NfM4CzV2PI8Mk/hK2MKI3Y1iS8kdi6Wjw7taaUg90IvQc vP9L55cfEv8LB+Ge6dNq1a5CmkoOayEW+IfunERWFhVSul3KvJHimweRmybv2aIo K8jo2xz/zFmOe6tZPsPNxnv1vl0zjGv3mcRk3cvmriyeVoV5m6MOmx0IQZcW4NDl MKwFZf8K6HVcQVodHAKiOExGkjwK83g3TMIKJyGnNuyk7FIBigkhwmSnMeUAom2b PNeW5QjChL/B7aQjRrU7mdjCHY+vUdv/m6f1htJdtryeNPzHpyD5WnfimjziZVbX DKFs3sd5XNW8LgyP1YTh8/T/PoBq8i5ML7mWBy9Xy3unfOvBCpj67m76UG1GdyGA mbtQv7/iGnVlVWJFg31Ein1jIe8fsjzDn0j8RN1YuD2vb3yrM0+kZ/A/b+XoLG7W 3aPzMr2dyISrpxOkXoMyjKE9lc+qOpcWjBN4X2ylm2FeLiHppg== =AHVx -----END PGP SIGNATURE----- Merge tag 'kvmarm-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.4, take #1 - Fix a couple of embarrassing merge mistakes in kvmarm-7.4 - Cleanup the HCR_EL2 bit fields to exclusively use the generated definitions, fixings a nasty regression introduced in 6.16, where barriers were not upgraded from NSH to ISH anymore - Fix publication of state when a vcpu is forced out of the guest - Let vcpu pausing nest correctly - Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the architecture - Don't warn on SMCCC filter reserved range allocation failure - Prevent GICv5 and TLBI hypercalls to be used from the host when pKVM is active - Enforce that only GICv3 guests are supported for pKVM - Don't try to access GICv5 EL2 sysregs from EL1 - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E by checking the feature dependencies - Require matching VGIC and ITS model - Cleanup TRACE_REMOTE dependencies - selftests: Skip unwritable ID fields in the failed-run test - Move pkvm_selftests() after all CPUs have initialized EL2 - Fix random comments |
||
|
Linus Torvalds
|
c339f4010d |
platform-drivers-x86 for v7.4-1
Highlights:
- acer-wmi:
- Add HWMON support for Aspire A315-58G
- Add platform profile, HWMON, and fan control support for Nitro
ANV15-51
- Add support for mode key on some models (e.g. Nitro AN16-41)
- acer-wmi-battery: Add battery control driver
- ACPI: video: Remove CONFIG_X86 dependency as WMI now supports non-X86
archs
- alienware-wmi-wmax: Add support for Alienware Area-51 AAT2250
- amd/hsmp: Add support for Family 1Ah client platforms
- amd/pmc:
- Do not rely on intermediate cycle counting in the wakeup delay logic
- Make HP Laptop 14-fq1xxxx and Thinkpad L14 Gen3 (21C5) use s2idle
quirk
- Make Asus ROG Flow Z13 use spurious_8042 quirk
- Add support for AMD 1Ah Family DCh SoC
- amd/pmf:
- Add support for AMDI0112
- Fix compat ioctl handling
- arm64: asus-glymur-ec: Add support
- arm64: lenovo-yoga-slim7x-gen11-ec: Add support
- arm64: qcom-hamoa-ec: Disable SCI IRQ during suspend
- arm64: thinkpad-t14s-ec: Do not send KEY_KBDILLUMTOGGLE on FN + Space
as EC already steps keyboard backlight
- asus-armoury:
- Add discrete GPU power state attribute
- Add support for discrete GPU disable on ProArt H7606
- Support tunables with more models
- asus-nw-wmi: Make ROG Flow X13 GV302X use the tablet-mode switch quirk
- asus-wmi:
- Make ASUS ProArt PX13 use the tablet-mode switch quirk
- Add support for mute LED
- Fix screenpad backlight problems
- Correct kbd_rgb_state_index description (keyboard -> shutdown)
- ayaneo-ec: Add support for AYANEO 2S
- bitland-mifs-wmi: Correct interpretation of WMI call output
- dell-dw5826e: Add support for _DSM with revision 0 (Slate PTL CS 14,
Yukon PTL CSLW 14, Yukon PTL 360 14)
- hp-bioscfg: Many fixes
- hp-wmi:
- Add change control support for HP Spectre x360 16-aa0xxx
- Do not show any fan attribute when no fans are available
- Add support for OMEN 16-am0xxx, OMEN 16-am2xxx, OMEN 17-ck1xxx, OMEN
MAX 16-ah0xxx, OMEN Slim 16t-an000, OMEN Transcend 14-fb1xxx
- Add HP Laptop 15-fd1xxx support
- Add Victus 15-fb3xxx, Victus 16-d1xxx (8A26), Victus 16-e0xxx support
- huawei-wmi: Add support for Honor MagicBook camera privacy toggle key
- ideapad-laptop:
- Add support for Mode key and Phone Link key found on some Yoga Pro
7 models
- Add support for camera switch on some Yoga Pro 7 and Legion Pro 7
models
- intel/hid: Support 5-button array on HP EliteBook x360 1030 G2
- intel/pmc:
- Add rugged Panther Lake support
- Fix Nova Lake PCD-S telemetry constants
- intel/pmt:
- Block mmap when read_telem() callback is present
- Fix PCI device to device generalization
- intel/speed-select-if: Always enumerate on recent server CPUs
(Family 19, i.e., Diamond Rapids and onwards)
- intel/tpmi: Prepare for enumerating non-PCI devices
- intel-uncore-freq:
- Restore limits properly also on sparse setups
- Add rugged Panther Lake support
- intel/vsec:
- Reset state properly before re-enumeration
- Fix inverted logic in get features function
- lenovo-wmi-capdata: Support non-supported, stubbed WMI query method
for capdata device
- msi-ec:
- Prevent out of bounds charge thresholds
- Add support for MSI Creator Z16 A11UE, MSI GL65 Leopard 9SCXK,
MSI Katana 15 B13VFK
- msi-wmi: Ignore key events for keys already handled by atkbd
- oxpec:
- Add support for charge limit on OneXPlayer Apex
- Add OneXPlayer 3 support
- panasonic-laptop:
- Add support for FN key
- surface: aggregator_registry:
- Remove non-existing sensors device and fix tablet-mode detection on
Surface Pro 11
- Add performance profile and fan support for Surface Pro 11
- thinkpad_acpi:
- Add keyboard attachment detection and reporting found on Thinkpad
X1 Fold
- Add support for Thinkpad L440 fan speed reporting
- tools/power/x86/intel-speed-select:
- Correct make clean
- Increase wait time after SST PP level switch to prevent stale
capability readings
- tuxedo:
- Fix keyboard LED map ordering
- Correct interpreting intensity vs RGB levels
- uniwill-laptop:
- Correct brightness handling for 3 level keyboard
- Add keyboard backlight support for TUXEDO devices
- Add support for PCSpecialist Recoil 16 AMD
- Add support for screen rotation key found on PCSpecialist Recoil 16
AMD and TUXEDO Stellaris 16 Gen7
- Implement rainbow animation as trigger
- Correct led labels to match LED subsystem conventions
- Add support for LAPKC71E Intel NUC x15
- wmi:
- Remove X86 dependency to allow supporting arm64 laptops in future
- wmi-bmof: Move under drivers/platform/wmi/
- Miscellaneous cleanups / refactoring / improvements
The following is an automated shortlog grouped by driver:
acer-wmi:
- Add support for Acer Nitro AN16-41
- Add support for Acer Nitro ANV15-51
- Cycle platform profile on mode key 0x4
- enable hwmon on Aspire A315-58G
- Remove unused platform_profile_support variable
- split hwmon from platform profile quirk
- use bool for boolean quirk fields
ACPI: video:
- Remove CONFIG_X86 handling from nvidia_wmi_ec_supported()
add Acer battery control driver:
- add Acer battery control driver
Add ACPI_COMPANION() NULL check in topstar_acpi_probe:
- Add ACPI_COMPANION() NULL check in topstar_acpi_probe
amd: hfi:
- Fix a use-after-free when unloading the driver
- Fix out-of-bounds reads when parsing ranking data
- Rely on ACPI enumeration instead of a dummy device
amd/hsmp:
- Add HSMP client support for Family 1Ah
- Document and expose client telemetry table in UAPI
- Recognize Family 1Ah client platforms and hide server-only paths
- Route metric table through the client messages
amd/pmc:
- Add HP Laptop 14-fq1xxx to s2idle quirk list
- Add PMC driver support for AMD 1Ah Family DCh SoC
- Add spurious_8042 to ASUS ROG Flow Z13 GZ302EA
- Add Thinkpad L14 Gen3 (21C5) to quirk_s2idle_bug
- clear devm-managed pointers on remove to prevent stale reuse
amd: pmc:
- Drop scratch_reg from amd_1ah_m80_cpu_info
- Only create amd_pmc_idlemask if scratch defined
amd/pmf:
- Add AMDI0112 ACPI ID
- fix compat ioctl handling
- Fix power_supply refcount leak in amd_pmf_get_battery_prop()
- Inline !AMD_PMF_DEBUG stub
- Inline simple helper function of Smart PC TA interfaces
- Inline simple helper function of SPS Layer
- Inline simple helper functions of Core Layer
- Inline wrappers of ap{mf,ts}_if_call_store_buffer()
- Validate the APTS state index
amd:
- Stop counting intermediate cycles with metrics table
arm64:
- Add a driver for the EC found on ASUS Glymur machines
- add Lenovo Yoga Slim 7x Gen 11 EC driver
arm64: qcom-hamoa-ec:
- Disable the SCI IRQ during suspend
arm64:
- Remove redundant dev_err_probe()
arm64: thinkpad-t14s-ec:
- don't send KEY_KBDILLUMTOGGLE on Fn+Space
asus-armoury:
- add dGPU disable fallback DEVID for ProArt H7606 series
- Add dgpu_power_state attribute
- add power limits quirk for FA608PM
- add power limits quirk for FA608UH
- add power limits quirk for FA608UP
- add power limits quirk for G533QS
- add power limits quirk for G614FM
- add power limits quirk for G713QR
- Add power limits quirk for GA401IHR
- add power limits quirk for GA402NV
- add power limits quirk for GU605CM
- add support for GX651AR
- Add XBOX ROG Ally X 20 Tunables
- let attribute groups decide their own visibility
- move has_valid_limit() above the attribute declarations
- Prevent disabling dGPU when in use
- use sysfs_create_groups() and sysfs_remove_groups()
asus-laptop:
- Fix typo in infos_show() comment
asus-nb-wmi:
- add tablet mode quirk for ROG Flow X13 GV302X
- Fix typo in asus_nb_wmi_quirks() comment
asus-wmi:
- Add ASUS_WMI_DEVID_DGPU_POWER_STATE define
- Add mute LED support
- add tablet-mode switch quirk for ASUS ProArt PX13
- don't warn when LPS0 is unavailable
- fix screenpad power state detection
- fix TUF keyboard power state shutdown naming
- fix unclear usage of bd->props.power
- fix use-after-free unregistering kbd_led led
- name the TUF keyboard RGB state and speed codes
- Remove redundant per-device wmi_lock and duplicate rfkill ops
- Remove unused platform_profile_support member
- remove unused screenpad_brightness
- rename TUF RGB state DEVID to _CMD
- Serialize WMI method evaluations with a mutex
- use backlight_is_blank() for screenpad power
- validate custom fan curves on enable
ayaneo-ec:
- Add AYANEO 2S charge control
bitland-mifs-wmi:
- Detect failed function calls
- Treat WMI_FN_SYSTEM_AC_TYPE as optional
dell: alienware-wmi-wmax:
- add Alienware Area-51 AAT2250
dell-dw5826e:
- Extend _DSM support to revision 0
dell-wmi-aio:
- Convert to use the bus-based WMI API
- Use named defines for event types
docs: TPMI:
- use literal block for commands
gpd pocket fan:
- Cancel work before releasing GPIOs
hp_accel:
- Fix typo in lis3lv02d_acpi_write() comment
hp-bioscfg:
- allow clearing current_password
- consolidate common package-element parsing
- fix 16-byte heap overflow for empty auth token
- fix non-ASCII truncation in hp_get_string_from_buffer()
- fix off-by-one in password length check
- fix OOB reads in hp_get_string_from_buffer()
- fix oops on short integer attribute buffer
- fix slab-out-of-bounds write in hp_convert_hexstr_to_str()
- NUL-terminate the SPM auth token
- remove dead bounds check in audit_log_entries_show
- return -E2BIG from validate_password_input()
- Support allocating large number of BIOS vars
- validate SPM state returned by firmware
- zero the hex-string decode buffer in hp_convert_hexstr_to_str()
hp-wmi:
- Add board 8E41 (OMEN Transcend 14) to feature board list
- add charge_behaviour support for Spectre 8C15/8C17
- Add OMEN board 8A17 thermal profile support
- Add OMEN board 8A18 thermal profile support
- Add OMEN board 8D40 thermal profile support
- Add OMEN board 8D42 thermal profile support
- Add support for HP Laptop 15-fd1xxx (board 8DE1)
- Add support for Omen 16-am0xxx (8D3F)
- add support for OMEN 16-am2xxx boards
- Add Victus 15-fb3xxx support
- Add Victus 16-d1xxx board 8A26 support
- Add Victus 16-e0xxx board 88EE support
- Disable hwmon attributes when no fans are usable
- fix heap OOB read and memory corruption in hp_wmi_perform_query()
- Fix hwmon keep-alive teardown
- Remove unused platform_profile_support variable
huawei-wmi:
- add camera toggle keycode
ibm_rtl:
- Fix potential OOB read at signature search
ideapad-laptop:
- Add Yoga Pro 7 14IAH10 Mode key
- Map Smart Connect hotkey to KEY_LINK_PHONE
- Report camera switch as SW_CAMERA_LENS_COVER
int1092:
- Mark as orphan
intel/hid:
- Enable 5 button array on HP EliteBook x360 1030 G2
intel/pmc:
- Add rugged Panther Lake support to intel_pmc_core
- Fix stale NVL PCD-S S0ix_LPM telemetry constants
intel/pmt:
- Add register access callbacks
- Block mmap when callback is present
- complete pcidev to device update
- Do not remap when using callbacks
- refactor rc with a return value
- refactor rmw with a return value
intel: power-domains:
- Handle failed init in tpmi_get_linux_die_id()
- Handle failed init in tpmi_get_power_domain_mask()
intel_telemetry:
- initialize default trace verbosity
intel/tpmi:
- Build the TPMI control words in one expression
- Declare the loop counters in their loops
- Describe a TPMI instance by its two devices
- Describe the device creation policy on the function
- Do not assume TPMI is enumerated from PCI
- Drop unused arg from tpmi_set_control_base()
- Fix typo in TPMI_FEATURE_NAME_LEN comment
- Get tpmi_info directly from the parent device
- Include the headers tpmi_common.c relies on
- Keep the feature resources in intel_tpmi_info
- Remove unused vsec_dev from intel_tpmi_pm_feature
- Split off the PCI VSEC enumeration
- Split out enumeration independent init and exit
- Turn TPMI_GET_SINGLE_ENTRY_SIZE() into a function
- Use DEFINE_RES_MEM() for the feature resources
- Use DEFINE_SHOW_STORE_ATTRIBUTE() for mem_write
- Use guard() for tpmi_dev_lock in the status read
- Use scnprintf() to build the debugfs names
- Use scope based cleanup in the memory dump
- Use static strings for the feature device names
intel-uncore-freq:
- Add support for rugged Panther Lake
- Continue restoring limits on resume
intel/vsec:
- Fix inverted walk_header() test in get_features()
- Pass a struct device to intel_vsec_set_mapping()
- reset state before re-enumerating
- Use bool for run_once
intel: wmi:
- Remove redundant callbacks
- Use sysfs_emit in sbl-fw-update
ISST:
- Avoid model check for recent servers
lenovo-wmi-capdata:
- Adopt new WMI API
- Defer mutex initialization
- Detect stubbed capdata device
- Do not match missing components
- Do not stop the AC notifier chain on error
- Only allocate sub-master info when necessary
lenovo-wmi-{capdata,other}:
- Only allocate capdata list when necessary
lenovo-wmi-capdata:
- Register component even on WMI error
- Store a pointer to component info
lenovo-wmi-helpers:
- Adopt new WMI API
lib/string_choices:
- Add str_supported_unsupported() helper
MAINTAINERS:
- Add Aaron Erhardt as maintainer of TUXEDO DRIVERS
- Add myself as a LENOVO drivers co-maintainer
mellanox:
- Remove redundant dev_err()
msi-ec:
- Add MSI Creator Z16 A11UE EC firmware
- Add MSI GL65 Leopard 9SCXK EC firmware
- Add MSI Katana 15 B13VFK EC firmware
- Report valid charge thresholds when unset
msi-laptop:
- Fix typo in struct quirk_entry comment
msi-wmi:
- Fix hotkeys dropped with vendor backlight
- Ignore WMI events for keys also handled by atkbd
- Sort scancodes numerically
olpc:
- Reserve space for a string terminator
oxpec:
- Add OneXPlayer 3 quirk
- Fix Apex charge limit control
panasonic-laptop:
- Fix typo in the file history comment
- register FN key up/down events
Remove redundant dev_err()/dev_err_probe():
- Remove redundant dev_err()/dev_err_probe()
platform/x86: thinkpad_acpi:
- Revert: Add X9-14 Gen 1 to non-standard thermal/fan quirk tables
samsung-laptop:
- Fix typo in sabi_configs comment
simatic-ipc:
- fix platform device leak on registration failure
surface: aggregator_registry:
- Add performance profile and fan support for Surface Pro 11
- Add Surface Laptop 8th Edition
- Fix tablet-mode detection on Surface Pro 11
- Remove sensors device for Surface Pro 11
think-lmi:
- Use ARRAY_SIZE() in tlmi_errstr_to_err()
- Use scnprintf() in new_password_store()
- Use sysfs_emit() in pending_reboot_show()
thinkpad-acpi:
- Add X1 Fold keyboard attachment detection
thinkpad_acpi:
- Add X9-14 Gen 1 to non-standard thermal/fan quirk tables
- convert conditional mutex locks to ACQUIRE_ERR()
- convert mutex_lock() to guard(mutex)
- fix deadlock in hotkey input open/close
- Fix fan speed reporting on ThinkPad L440
- fix typos in comments
- Remove unreachable code in beep_read()
- Use bool for local is_thinkpad variable
- use __free(kfree) for automatic cleanup
- Use input_device_enabled()
- Use str_supported_unsupported() helper
tools/power/x86/intel-speed-select:
- Clean all the produced files
- Correct macro name in debug output
- Fix signed shift UB in BIT() macro
- Increase wait time after SST PP level switch
- v1.27 release
toshiba_haps:
- Remove unnecessary ret in toshiba_haps_resume()
tuxedo:
- Don't use device driver data
- Fix keyboard LED map ordering
- Set HID report ID on success
- Update and extend documentation
- Use intensity according to HID spec
uniwill-laptop:
- Add PCSpecialist Recoil 16 AMD
- Enable kb backlight and lightbar for TUXEDO
- Extend support for the Intel NUC x15
- Fix breathing animation on Intel QC
- Fix brightness notify for 3 level keyboards
- Fix typo in the kbd LED brightness comment
- Implement rainbow animation as trigger
- Label multicolor LEDs correctly
- Map the screen rotation key
- Report correct lightbar brightness
wmi-bmof:
- Move to generic WMI code
wmi:
- Introduce wmidev_exists()
- Remove dependency on CONFIG_X86
yogabook:
- use assign_bit()/change_bit() where applicable
Merges:
- Merge branch 'fixes' into review-ilpo-next
- Merge branch 'platform-drivers-x86-intel-pmt' into for-next
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCauHB9QAKCRBZrE9hU+XO
MZV2AQCkkN0AWkpcntUWH2Ocw4fxIkGGGit7runnoFMsO0OApgEAtYECez8g+lbW
UHrOn4M0tqqGx6qcj0/isbJP6TApGwI=
=cGZu
-----END PGP SIGNATURE-----
Merge tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver updates from Ilpo Järvinen:
"The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc:
- new model names and recent CPU support
- more special button / function key handling
- battery and hardware monitoring quirks
Tool updates to intel-speed-select
WMI now supports non-x86 architectures
Miscellaneous cleanups / refactoring / improvements"
* tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits)
platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes
platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD
platform/x86: asus-armoury: add power limits quirk for GU605CM
platform/x86: asus-armoury: add power limits quirk for G533QS
platform/x86: asus-armoury: add power limits quirk for GA402NV
platform/x86: asus-armoury: add power limits quirk for FA608UP
platform/x86: asus-armoury: add power limits quirk for FA608UH
platform/x86: asus-armoury: add power limits quirk for FA608PM
platform/x86: asus-armoury: add power limits quirk for G713QR
platform/x86: ibm_rtl: Fix potential OOB read at signature search
platform/x86: acer-wmi: Add support for Acer Nitro AN16-41
platform/x86: acer-wmi: Cycle platform profile on mode key 0x4
platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable
platform/x86: gpd pocket fan: Cancel work before releasing GPIOs
platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables
platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd
platform/x86: msi-wmi: Sort scancodes numerically
platform: arm64: Add a driver for the EC found on ASUS Glymur machines
MAINTAINERS: Add myself as a LENOVO drivers co-maintainer
...
|
||
|
Alexei Starovoitov
|
b433cdb1cc
|
selftests/bpf: Test stack arguments across may_goto
Each test passes arguments 6-8 on the stack. Thus it uses all the registers in which the JITs of x86-64, arm64 and riscv64 pass stack arguments. may_goto then ------------------------------------------- --------------------------- 70000 iterations in the callee the callee reads the args the time is up in the callee the callee reads the args 70000 iterations in the caller, after the the caller calls the callee writes of the args 70000 iterations have one look at the clock. Without the fix on x86-64 the second test fails, and the first test fails with the hpet clocksource. The third test passes there. The result depends on the registers that the C code uses. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-20-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
df9e4a87a8
|
selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
The insn that forks is the head of a loop that scalar evolution counted. The state with 0 that maybe_fork_scalars() splits off is within the state that is kept at the head. The access is out of bounds only in the state with 0. Without the previous patch the verifier accepts the prog. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-18-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
ed50365314
|
selftests/bpf: Test the clamp of pointers in scalar evolution
test the loop result -------------------------------------- ------------------------- ------ clamp_released_pointer releases ringbuf memory reject clamp_invalidated_pkt_pointer calls bpf_skb_pull_data() reject clamp_pkt_pointer_keeps_no_range compares with pkt_end reject clamp_pkt_pointer_keeps_range_of_entry has no compare loads In the first three tests a flag in a 32-bit spill separates the first iteration from the second one. Scalar evolution does not widen the flag. Thus the verifier does not prune the state that returns to the head of the loop, and it verifies the second iteration with the clamped register. Without the fixes the three progs load. In the last test the compare with pkt_end is in front of the loop. Its range must stay valid in the loop. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-16-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
1b4ed112be
|
selftests/bpf: Test a loop that moves a pointer to a buffer
ptr_buf moves one pointer to a buffer until it gets to a second pointer. It never reads through the pointer. It loads only if scalar evolution widens the pointer, and that is no longer the case. Change it to the loop that real progs have, for example bpf_iter_bpf_percpu_array_map.c. It counts in a register and reads through the pointer in each iteration. Without "bpf: Don't widen a pointer to a buffer in scalar evolution" the verifier rejects it with "invalid variable buffer offset". Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-13-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
3c0ca9f9a9
|
selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed
The test arms a handler at rcu_segcblist_enqueue() for its thread. Then it
deletes an element of a task storage map. The delete gets to
rcu_segcblist_enqueue(), and the handler does a nested delete there.
The handler fires at the first rcu_segcblist_enqueue() in the thread. A
page fault can be the first:
skel->bss->target_pid = tid the handler is armed
the next insn is in a page that is not in memory
asm_exc_page_fault
filemap_fault
v9fs_issue_read
p9_req_put
irq_work_run
rcu_defer_drain
rcu_segcblist_enqueue
the handler deletes the element
bpf_map_delete_elem() -ENOENT
test_rcu_reentry:FAIL:boot_delete unexpected error: -2 (errno 2)
The result depends on the layout of test_progs. In the binary that failed,
test_rcu_reentry() crosses the end of a page immediately after the store.
This binary fails each time when it is on 9p. A copy of the same file on
ext4 passes.
Move the store and the delete to a function. Call it one time without a pid
and with a bad fd. This call brings the text and .bss into memory, and it
does not arm the handler.
Fixes:
|
||
|
Alexei Starovoitov
|
2ad395a384
|
selftests/bpf: Wait for the last maps of map_kptr to be freed
map_kptr_race/htab_leak fails occasionally in a complete run of test_progs: test_htab_leak:FAIL:htab refcount unexpected htab refcount: actual 6 != expected 2 This is a race between two tests. It is not a leak in the kernel. - map_kptr runs immediately before htab_leak. The two tests examine the refcount of the same test object. - The kernel frees maps asynchronously. Thus the maps drop their references some time after close(). - map_kptr waits for that after each subtest, but not after the last one. Wait after the last subtest too. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-10-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
1651157604
|
selftests/bpf: Test that a widened register is not linked
Scalar evolution widens a register that has delta 4. Then the prog copies the register. With the stale delta the verifier finds that a read of uninitialized r9 is dead code, and it loads the prog. See "bpf: Clear delta of a register that scalar evolution widens". Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-9-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
b62dee3a8b
|
bpf: Remove BPF_F_ARENA_SCALAR
Rust has no address spaces. Thus a prog in Rust accesses arena through
scalars. With BPF_F_ARENA_SCALAR the verifier accepts each load and each
store through a scalar as an access to arena.
The verifier rewrites one insn at a time. Thus it must add one insn to each
access. The compiler knows the source of each pointer. It can emit one
addr_space_cast for each pointer, as it does for the __arena pointers of C.
flag: one move for each access cast: one cast for each pointer
ax = (u32)r1 r1 = addr_space_cast(r1, 0, 1)
r2 = *(u64 *)(ax + 0) r2 = *(u64 *)(r1 + 0)
ax = (u32)r1 r3 = *(u64 *)(r1 + 8)
r3 = *(u64 *)(ax + 8)
20 progs of rust-bpf, with the flag and with the casts that a prototype of
an LLVM pass emits:
flag casts
moves or casts 1568 571
insns 14864 13938
jited bytes 72351 69111
No released kernel has the flag. LLVM does not emit the casts for Rust at
this time. Until it does, Rust progs that access arena do not load.
scx_mavd and scx_nitosis set the flag too. They are experimental schedulers
in C in sched-ext/scx, and they use the flag to omit __arena. They must use
__arena again.
This reverts commit
|
||
|
Alexei Starovoitov
|
fe8e06aa05
|
selftests/bpf: Remove tests for arena access through numbers
With BPF_F_ARENA_SCALAR the verifier accepts a load or a store through a scalar as an access to arena. The next patch removes the flag. Remove its tests. Keep one test. Without the flag the verifier must reject such a load, also in a prog that has an arena. Move this test to verifier_arena.c. The removed tests were the only tests of a special path in the x86 JIT for the fetching AND/OR/XOR atomics. Only the flag used that path. arena_atomics tests the usual path. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261027190314.1440199-5-alexei.starovoitov@gmail.com |
||
|
Alexei Starovoitov
|
58cbd31c39
|
libbpf: Keep format strings of bpf_printk() in .rodata
The format strings of bpf_printk() moved from .rodata to .rodata.str for
one reason. .arena.data moved .rodata into arena, and helpers cannot read
strings from arena.
.arena.data is removed. Move the strings back to .rodata. As a result, an
object that has its own .rodata has one map less.
This reverts commit
|
||
|
Alexei Starovoitov
|
5b0678b2f9
|
libbpf: Remove .arena.data
Rust has no address spaces. Thus a global variable cannot have the __arena
attribute. The .arena.data section was a workaround. It told libbpf to do
two things:
- Move .data, .bss and .rodata into arena.
- Load the progs with BPF_F_ARENA_SCALAR.
The compiler must select the location of a variable, not libbpf. libbpf
already puts the .addr_space.1 section in arena. The __arena variables of C
are in this section, and LLVM can use it for Rust too. Until LLVM does
that, the global data of Rust progs stays in array maps.
This reverts commit
|