h5_btrtl_open() calls pm_runtime_use_autosuspend(), but
h5_btrtl_close() does not call the matching
pm_runtime_dont_use_autosuspend() when tearing down runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: d9dd833cf6 ("Bluetooth: hci_h5: Add runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
bcm_request_irq() calls pm_runtime_use_autosuspend(), but bcm_close()
does not call the matching pm_runtime_dont_use_autosuspend() when
tearing down runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: e88ab30d36 ("Bluetooth: hci_bcm: Add suspend/resume runtime PM functions")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit updates the Italian translation in `process/` following
these changes:
commit 44abc8fcbf ("Documentation: process: Arbitrarily bump kernel major version number")
commit ba2457109d ("Documentation: process: Also mention Sasha Levin as stable tree maintainer")
commit 5ce70894f6 ("Doc: correct spelling and wording mistakes")
commit 4629837547 ("linux-next: update maintainer info.")
commit 43e9076a00 ("docs: Fix conflicting contributor identity info")
commit b27f9e8079 ("docs: remove Documentation/dontdiff")
commit 9734b3e753 ("docs: 5.Posting: mentioned Suggested-by: tag")
commit 4e6b7141d1 ("docs: clarify rules wrt tagging other people")
commit 944df7a314 ("docs: update the guidance for Link: tags")
commit 0a83293322 ("doc: development-process: add notice on testing")
commit a037699da0 ("docs: Add debugging section to process")
commit 78d979db6c ("docs: add AI Coding Assistants documentation")
commit a66437c279 ("Documentation: Provide guidelines for tool-generated content")
commit a592a36e49 ("Documentation: use a source-read extension for the index link boilerplate")
commit 102606402f ("Documentation: Project continuity")
commit a03ef333fb ("Documentation: security-bugs: explain what is and is not a security bug")
commit d0b343605f ("kernel-docs: Add new section for Rust learning materials")
commit 57937eac1f ("kernel-docs: Add book to process/kernel-docs.rst")
commit d8c949c577 ("docs/licensing: Clarify wording about "GPL" and "Proprietary"")
commit ebf1bafd09 ("LICENSES: Explicitly allow SPDX-FileCopyrightText")
commit 9fa7153c31 ("rust: conclude the Rust experiment")
commit 47cb33cedf ("docs: clarify wording in programming-language.rst")
commit 45a92c0b91 ("docs: maintainers: add SPDX license to the file")
commit 2932ba8d9c ("slab: Introduce kmalloc_obj() and family")
commit e4c8b46b92 ("slab: Introduce kmalloc_flex() and family")
commit d957b4184a ("Documentation: deprecated.rst: kmalloc-family: mark argument as optional")
commit 120a64c802 ("Documentation: process: fix brackets")
commit 079a028d63 ("string: Remove strncpy() from the kernel")
commit e551bd4109 ("Documentation: remove :kyb: tags")
commit 4971ca2007 ("docs: process: email-client: add Thunderbird "Toggle Line Wrap" extension")
commit f44a29784f ("Documentation: update maintainer-pgp-guide for latest best practices")
commit 273aa250f1 ("Documentation: Improve wording on requirements for a free Nitrokey")
commit 6c5c07bc85 ("docs: process: maintainer-pgp-guide: update kernel.org docs link")
commit 54857c5245 ("docs: maintainer-pgp-guide.rst: add a reference for kernel.org sign")
commit a556bd882b ("docs: align with scripts/syscall.tbl migration")
commit e5b1c0fa4f ("Documentation: Remove :manpage: from non-existing man pages")
commit 78a00cac1e ("docs: fix 're-use' -> 'reuse' in documentation")
commit ec6fd28baf ("docs: remove unneeded maintainer_handbooks_main label")
commit 8eae6da5f5 ("docs: auto-generate maintainer entry profile links")
commit bda185c305 ("docs: maintainers_include: Only show main entry for profiles")
commit 2783096fb1 ("docs: submit-checklist: Expand on build tests against different word sizes")
commit fb12098d8e ("docs: submit-checklist: Allow creating cross-references for ABI README")
commit 5a63f0369b ("docs/.../submit-checklist: Use Documentation/admin-guide/abi.rst for cross-ref of README")
commit e5880f95a9 ("docs: process: discourage pointless boilerplate kdoc")
commit 2c62e2e874 ("coding-style: fix verb typo")
commit 197bbebd25 ("docs: Update documentation to avoid mentioning of kernel.h")
commit eba6ffd126 ("docs: kdoc: move kernel-doc to tools/docs")
commit 7c6d969d53 ("Documentation: adopt new coding style of type-aware kmalloc-family")
commit 323fa4b960 ("Documentation: Fix syntax of kmalloc_objs example in coding style doc")
commit d49172bbd7 ("Documentation: clarify the expected collaboration with security bugs reporters")
commit 3a68841d1d ("Documentation: smooth the text flow in the security bug reporting process")
commit ceddb2c001 ("Documentation: insist on the plain-text requirement for security reports")
commit f2b1cbef15 ("Documentation: minor updates to the security contacts")
commit a72b832a48 ("Documentation: explain how to find maintainers addresses for security reports")
commit 496fa1befb ("Documentation: clarify the mandatory and desirable info for security reports")
commit f387e2e2b9 ("Documentation: fix two typos in latest update to the security report howto")
commit aed3c33467 ("Documentation: security-bugs: do not systematically Cc the security team")
commit 4bf85afb9f ("Documentation: security-bugs: clarify requirements for AI-assisted reports")
commit 561458db0d ("docs: security-bugs: add a link to the threat-model documentation")
commit 5f5e734432 ("kbuild: generate offset range data for builtin modules")
commit 41047d53bc ("docs:process:changes: fix version command for btrfs-progs")
commit 82a1978d0f ("kheaders: use 'tar' instead of 'cpio' for copying files")
commit d2b239099c ("docs: changes: update Sphinx minimal version to 3.4.3")
commit 5e25b972a2 ("docs: changes: update Python minimal version")
commit 118c40b7b5 ("kbuild: require gcc-8 and binutils-2.30")
commit 28d51df0db ("Documentation: update binutils-2.30 version reference")
commit fc6edeea53 ("docs: Remove reiserfsprogs from dependencies.")
commit bc20c56e98 ("docs: changes: better document Python needs")
commit 20c0989283 ("kbuild: Bump minimum version of LLVM for building the kernel to 15.0.0")
commit 903922cfa0 ("lib/Kconfig.debug: Set the minimum required pahole version to v1.22")
commit 8913632998 ("Documentation: Fix typos and grammatical errors")
commit c99fcb5850 ("docs: Fix an erroneous reference to sphinx.rst")
commit d8a224f519 ("docs: changes/ver_linux: fix entries and add several tools")
commit ece7e57afd ("docs: changes.rst and ver_linux: sort the lists")
commit f32fb9c58a ("rust: bump Rust minimum supported version to 1.85.0 (Debian Trixie)")
commit c3a00a3f31 ("rust: bump `bindgen` minimum supported version to 0.71.1 (Debian Trixie)")
commit ce3267a39a ("kbuild: Bump minimum version of LLVM for building the kernel to 17.0.1")
commit 2c1ccd9a1d ("docs: changes.rst: restore pahole 1.26 minimum (regressed by sort)")
commit 3f997cbf67 ("docs: process: submitting-patches: split canonical patch format section")
commit 6356f18f09 ("Align git commit ID abbreviation guidelines and checks")
commit cd9123eeb2 ("docs: submitting-patches: clarify Acked-by and introduce "# Suffix"")
commit 25fb101385 ("docs: submitting-patches: clarify difference between Acked-by and Reviewed-by")
commit 08c035da54 ("docs: submitting-patches: clarify that signers may use their discretion on tags")
commit 95767a592d ("docs: submitting-patches: document the format for affiliation")
commit dc896f853e ("docs: submitting-patches: adjust Fixes definition slightly")
commit 22014a2300 ("Documentation/process: submitting-patches: fix typo in "were do"")
commit e36a7b1e17 ("docs: submitting-patches: Clarify that removal of Acks needs explanation too")
commit 8a12e3fbf2 ("docs: submitting-patches: suggest adding previous version links")
commit 6252e5c1c2 ("docs: add an Assisted-by mention to submitting-patches.rst")
commit 48c3876a6a ("docs: submitting-patches: Clarify that "reviewer" is a person")
commit 83f71fbc66 ("docs: submitting-patches: Fix section structure around DCO")
Signed-off-by: Federico Vaga <federico.vaga@vaga.pv.it>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260816193906.68808-1-federico.vaga@vaga.pv.it>
Put a CPU isolated at boot into an isolated partition, change the
partition back to member and check that the CPU remains isolated.
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Fix a '/dev/kmsg' reference which got replaced with '/proc/kmsg' (which
is not accessible to regular users).
Fixes: a03ef333fb ("Documentation: security-bugs: explain what is and is not a security bug")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260819134039.286793-1-johan@kernel.org>
isolated_cpus tracks CPUs isolated with isolcpus= as well as CPUs in
isolated cpuset partitions. When an isolated partition is released,
isolated_cpus_update() removes its whole CPU mask. This also clears CPUs
which were already isolated at boot.
This can be reproduced on a cgroup v2 system booted with
isolcpus=domain,15:
cd /sys/fs/cgroup
echo +cpuset > cgroup.subtree_control
mkdir cpuset-repro
echo 15 > cpuset-repro/cpuset.cpus
echo isolated > cpuset-repro/cpuset.cpus.partition
echo member > cpuset-repro/cpuset.cpus.partition
cat cpuset.cpus.isolated
CPU 15 is absent before the change. It must remain in
cpuset.cpus.isolated after the partition is released.
Update isolated_cpus one CPU at a time and keep CPUs outside the
boot-time domain housekeeping mask isolated.
Fixes: c188f33c86 ("cgroup/cpuset: Account for boot time isolated CPUs")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
check_isolcpus() clears ISOLCPUS before rebuilding it from sched domain
data. Comparing that empty value with
/sys/devices/system/cpu/isolated makes the test fail whenever
isolcpus=domain is present.
That sysfs file is generated from HK_TYPE_DOMAIN_BOOT and does not change
when cpuset updates HK_TYPE_DOMAIN. Re-reading it cannot validate dynamic
housekeeping updates. The cpuset.cpus.isolated and sched domain checks
already cover the two dynamic interfaces, so remove the invalid comparison.
This can be reproduced on a kernel booted with isolcpus=domain,15:
# tools/testing/selftests/cgroup/test_cpuset_prs.sh
The test fails its first state-matrix isolation check before the change and
continues past that check afterward.
Fixes: 6df415aa46 ("cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
The current link http://kernel.dk/blk-mq.pdf leads to a 404 error page.
https://www.kernel.dk/blk-mq.pdf leads to the correct document.
v2 to add the missing www. prefix in the actual file change.
Signed-off-by: Jenson Johnathon Reggentin <mail@jregg.de>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260819192422.42189-1-mail@jregg.de>
In misc cgroup, misc.events does not output a simple "max" key. Instead,
each registered misc resource outputs a separate key suffixed with ".max"
(i.e., "<res>.max").
Update the documentation to clarify that the entry key is "<res>.max".
Suggested-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Cheng Lingfei <chenglingfei@foxmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
A synchronous HCI command that never receives a response leaves
HCI_CMD_PENDING set: hci_req_cmd_complete() is the only place that clears
it, and it only runs when a response matching the last command sent
arrives.
hci_send_cmd_sync() populates hdev->req_skb only when the flag transitions
from clear to set, while hci_dev_open_sync() and hci_dev_close_sync() drop
req_skb without clearing the flag. After a timeout followed by either, the
two disagree: the flag claims a request is outstanding while req_skb is
NULL. Subsequent synchronous commands are then sent with no req_skb, so
hci_event_packet() has nothing to match an arriving event against, and the
caller times out even though the controller answered.
Commands answered by Command Complete recover on their own, since
hci_req_cmd_complete() clears the flag as a side effect. Drivers using
__hci_cmd_sync_ev() with a custom event do not, because a vendor event
never reaches that path. On a WCN3988 (hci_qca over UART) this makes a
controller firmware hang unrecoverable: the driver injects a hardware
error and re-runs qca_setup(), qca_read_soc_version() waits for
HCI_EV_VENDOR, the reply arrives within 4 ms and is discarded, and every
retry fails the same way. The adapter is left down until the driver is
unbound and rebound, or power is removed.
Clear the flag wherever the last request is dropped, restoring the
invariant that req_skb is non-NULL exactly when HCI_CMD_PENDING is set.
Verified on hardware by forcing a command timeout: without this change
setup fails on every attempt, with it setup succeeds on the first.
Fixes: 2615fd9a7c ("Bluetooth: hci_sync: Fix overwriting request callback")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Abdelkader <iabdelka@qti.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
- Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
-----BEGIN PGP SIGNATURE-----
iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaoZ/khccb2xpdmVyLnVw
dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFkK7AP9zvAcDf+DVte8+mZjCMDrvNB1n
UWsBnQkdZ1nDDYBJlwD8D1pvurK4ZV3UIl68IgpTqYKhMspCuOWDHrnBt1QyqQU=
=2iPX
-----END PGP SIGNATURE-----
Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
KVM/arm64 changes for 7.3
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
- Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
Fixes and cleanups around probe error handling, resource
management and a minor Rust cleanup.
Drivers:
- several drivers: drop duplicate IRQ error reporting
- imx-lpi2c: improve probe initialization and error cleanup
- mxs: fix DMA channel leak on probe failure
- ocores: fix clock cleanup on resume failure
- rcar: handle reset controllers without status support
Muxes:
- demux-pinctrl: fix OF node leak on allocation failure
Rust:
- mark trivial I2cAdapter reference-counting methods inline
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaowtFAAKCRDaeAVmJtMt
btHCAQCsWbWHyIgqrfHvJqD0IhdB6jc5UB/9Uu1cArF9V4mCVwD/XLkzuBtKDw82
QAaonKQUp9OaS7TAlZqcmGxMn+yGhg8=
=ULkr
-----END PGP SIGNATURE-----
Merge tag 'i2c-7.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull more i2c updates from Andi Shyti:
"Fixes and cleanups around probe error handling, resource management
and a minor Rust cleanup.
Drivers:
- several drivers: drop duplicate IRQ error reporting
- imx-lpi2c: improve probe initialization and error cleanup
- mxs: fix DMA channel leak on probe failure
- ocores: fix clock cleanup on resume failure
- rcar: handle reset controllers without status support
Muxes:
- demux-pinctrl: fix OF node leak on allocation failure
Rust:
- mark trivial I2cAdapter reference-counting methods inline"
* tag 'i2c-7.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
i2c: rust: mark I2cAdapter methods as inline
i2c: rcar: fix reset handling for Gen5
i2c: mxs: fix DMA channel leak on probe error
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
i2c: ocores: Disable clock on failed resume
i2c: imx-lpi2c: reset controller in probe stage
i2c: imx-lpi2c: properly unwind resources on probe failure
i2c: busses: drop redundant dev_err_probe() around irq helpers
Core changes:
- Use the non-blocking mux_state_try_select() in the generic
MUX pin control back-end.
- Free pin maps on pinctrl_generic_to_map() failure in the core
helpers.
New drivers:
- Qualcomm Maili TLMM SoC pin control.
- Qualcomm PMG1110 PMIC pin control.
- Qualcomm Eliza LPASS LPI TLMM SoC pin control (this is for
the low power audio, LPASS = Low Power Audio SubSystem
portions).
- Upboard support on top of the Intel pin controller.
- Apple T6030 and T6031 support (just compatible strings).
- Samsung Exynos 8855 SoC pin control.
- Mediatek MT6858 SoC pin control.
- Rockchip RK3308B SoC pin control.
- Rockchip RV1106 SoC pin control.
- Airoha EN7523 SoC pin control.
- Airoha AN7563 SoC pin control.
Improvements:
- Qualcomm TLMM GPIOs are unconditionally marked as wakeup capable.
- Qualcomm improvements on top of the Qualcomm PDC (power domain
controller) irqchip improvements from tglx:s tree.
- Qualcomm IPQ806x and IPQ9650 nonurgent pin grop fixups.
- The NPCM8xx driver has been put into shape fixing many pin and
group definitions.
- Some nonurgent Tegra 264 pin assignments are fixed up.
- Some nonurgent fixups to Airoha AN7581 and AN7583 registers and
pin assignments, missing features etc.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmqMBvYACgkQQRCzN7AZ
XXOCRw//aRnxM6R7HJkmcJt70749sE2GSbQ5Vx22zkRLRt8FA0QL4GdPQWjG+rwA
/Q5XhMv5TpSXaBo63fFyAEHEhgbuxlgyUMijpXuMFVHB4AKIcp0P9Mn+TfTkpsIu
QPIUktn2wqaIoFoAZj7G2KhXUyyeQnISplBSFl4wfpsJ25fjKqqeoiOMrMCVc05A
Hfgm047beur5vkvYBIwFG0BC992l9ucSQJ4jDEm2XtkQ/NqIQBd16lYdxrb6vkJu
Bj2qUH/GVQN3c+n2ZgfwVbkoWMum7VgBymxbnjhraJmQoGm27IQsnBtDnhD5bv6s
bk5Y6Vyji0kNhHYU5uBFwjDWmYt5PxjXynkeFuruNuBkqnioQCyoTNlIeiJf5pZv
kM0dBkR0eUTQVPrZX5kXbi9B2JqdbnkdhKbL2YQt1zV0uvs1m8xl3dLu+bvtHjEM
xNghQKkSDvSHDgulbjTcKEthILSA48Q+poCaOoYre8KIOc4I7novSal6UzcHoTH7
4D8+BnwJXbS5RRIG2snUWHRLB8aY+yuPlfAQBrAu0apuKWrnr2SjfWMMek1kDv57
U/iXjSKvjSUQc+sYhq+cPMrD8yYqjIgfg483p4L8xsTIi0Mer6UhnHcZJ82TONTa
K1A3iGlKOtw4jNFOeow8VAW8MyEHcnx3q70rgA2O+eH7WpT28rs=
=sSjn
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
"Core changes:
- Use the non-blocking mux_state_try_select() in the generic MUX pin
control back-end
- Free pin maps on pinctrl_generic_to_map() failure in the core
helpers
New hardware pin control:
- Qualcomm Maili TLMM SoC, PMG1110 PMIC, and Eliza LPASS LPI TLMM SoC
(this is for the low power audio, LPASS = Low Power Audio SubSystem
portions)
- Upboard support on top of the Intel pin controller
- Apple T6030 and T6031 support (just compatible strings)
- Samsung Exynos 8855 SoC
- Mediatek MT6858 SoC
- Rockchip RK3308B and RV1106 SoCs
- Airoha EN7523 and AN7563 SoCs
Improvements:
- Qualcomm TLMM GPIOs are unconditionally marked as wakeup capable
- Qualcomm improvements on top of the Qualcomm PDC (power domain
controller) irqchip improvements from tglx:s tree
- Qualcomm IPQ806x and IPQ9650 non-urgent pin grop fixups
- The NPCM8xx driver has been put into shape fixing many pin and
group definitions
- Some non-urgent Tegra 264 pin assignments are fixed up
- Some non-urgent fixups to Airoha AN7581 and AN7583 registers and
pin assignments, missing features etc"
* tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (130 commits)
dt-bindings: pinctrl: Convert TI DA850 pupd to DT schema
pinctrl: meson: sync some modify from A4
pinctrl: meson: a4: Add input enable pin configuration
pinctrl: realtek: rtd1625: remove unused group name spdif_sel
pinctrl: realtek: rtd1625: fix base_bit for VE4 GPIO 13
dt-bindings: pinctrl: microchip,pic32mzda-pinctrl: Convert to DT schema
Revert "Merge branch 'ib-rsk7204' into devel"
pinctrl: rockchip: Add RV1106 pinctrl support
dt-bindings: pinctrl: rockchip: Add RV1106 compatible
pinctrl: rockchip: Decode drive strength in the get function
pinctrl: fix PINCTRL_GENERIC_MUX not always being selectable
pinctrl: airoha: add support of an7563 SoC
dt-bindings: pinctrl: airoha: add support of an7563 pin controller
pinctrl: airoha: try to find chip scu node by phandle first
pinctrl: airoha: add support of en7523 SoC
dt-bindings: pinctrl: airoha: add support of en7523 pin controller
pinctrl: airoha: an7583: add support for olt pinmux
pinctrl: airoha: an7583: add support for pon_alt pinmux
pinctrl: airoha: an7583: add support for npu_uart pinmux
dt-bindings: pinctrl: airoha: an7583: add missed features
...
generic_write_checks() in f2fs_write_checks() can adjust iocb->ki_pos
for append writes and truncate the iterator to limit the number of bytes
to write.
In f2fs_file_write_iter(), the pinned-file overwrite check currently
uses the position and count saved before f2fs_write_checks(), so it
can check a range different from the actual write range.
The forced buffered I/O cleanup also uses orig_pos saved before
f2fs_write_checks(). For O_APPEND writes, this can make the cleanup
flush and invalidate the wrong page cache range.
Move the pinned-file overwrite check after f2fs_write_checks() and use
the adjusted iocb->ki_pos and iov_iter_count(from). Also save the
adjusted write position and use it for the forced buffered I/O cleanup.
Fixes: 3fdd89b452 ("f2fs: prevent writing without fallocate() for pinned files")
Fixes: 92318f20d7 ("f2fs: preserve direct write semantics when buffering is forced")
Signed-off-by: Seongjae Jeong <jsjlee1020@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Extending a fuse file past a non-page-aligned EOF does not zero the tail of
the old last page. When that page is cached and has been mmap-dirtied beyond
the old EOF, the now in-bounds tail is served to later reads as stale data
rather than zeros, which violates POSIX file-extension semantics.
Some file systems get this zeroing automatically at writeback time
(block_write_full_folio() / iomap_writeback_handle_eof() zero the tail of the
folio straddling i_size). A non-writeback caching fuse file system uses neither
path, so it has to zero the tail itself from the size-extending paths, like
XFS (xfs_file_write_zero_eof()) and ext4 (ext4_block_zero_eof()) do.
Call truncate_pagecache_range() over the newly-exposed range up front from the
three paths that extend a file, before the new size is published:
- a buffered write whose position is past the old EOF (fuse_perform_write());
- a size-extending setattr/truncate (fuse_do_setattr());
- a size-extending fallocate (fuse_file_fallocate()).
This unmaps the stale mappings and zeroes the partial tail of the old EOF
folio, so a later read returns zeros. Truncating [old EOF, write start) before
a buffered write keeps the dropped range disjoint from the written data, so a
write that lands inside the old EOF folio is preserved.
writeback_cache connections are unaffected, as their writes go through
iomap_file_buffered_write(), which zeroes post-EOF folios. The bug is
observable on a non-writeback_cache server that returns FOPEN_KEEP_CACHE on
writable files (without FOPEN_DIRECT_IO), and is caught by the new
write_extend_eof fuse selftest.
Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check
mode. However, it is not part of SCTLR_USER_MASK which imply that on
context switch we never clear SCTLR_EL1.TCSO0, so we are leaking that
setting into another task.
Fix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK
Fixes: 4d51ff5bba ("arm64/kernel: Support store-only mte tag check")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
numa_cma=0:4G reserves nothing at all. dma_numa_cma_reserve() copies the
requested size into a local int before handing it to
cma_declare_contiguous_nid(), so 0x100000000 truncates to zero and the
loop skips the node silently. Both parameters are documented in
kernel-parameters.txt as nn[MG], so that is the syntax the documentation
invites.
Which bits survive decides what a request turns into: 4G, 8G and 16G
reserve nothing, 2G, 3G and 6G sign-extend into a size the allocator
rejects with a warning, and 5G quietly reserves 1G.
It reaches further than those parameters. On a CMA_SIZE_PERNUMA kernel
with no per-node parameter, dma_numa_cma_reserve() takes the per-node
size from the default area, so a plain cma=4G on a multi-node machine
feeds that size through the same local and loses every per-node area.
numa_cma_size[] and pernuma_size_bytes are both phys_addr_t, so use it
for the local too, and give early_numa_cma() separate variables for the
node id and the size while in there.
Fixes: d5cae2261b ("dma-contiguous: simplify numa cma area handling")
Cc: stable@vger.kernel.org
Assisted-by: Kiro:claude-opus-5
Signed-off-by: Alexander Graf <graf@amazon.com>
Reviewed-by: Feng Tang <feng.tang@linux.alibaba.com>
Link: https://lore.kernel.org/r/20260821224252.70640-1-graf@amazon.com
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Currently the stage-2 ptdump calls note_page() at each leaf entry visit.
This simply misses the output of the last region, because note_page()
only dumps output when it detects a change in level/prot, or when the
walk enters a next marker section. The last region in the guest IPA
space with the same level/prot is not dumped since there is no change
after it.
Call note_page_flush() to dump the final region. note_page_flush()
uses ptdump_pg_state.end_address to call the final note_page(), so also
provide the end address.
Also change the second marker's start address to ULONG_MAX so we never
cross it. This avoids dumping redundant marker names (which are NULL),
and advancing beyond the end of the marker array.
Fixes: 7c4f73548e ("KVM: arm64: Register ptdump with debugfs on guest creation")
Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/kvmarm/20260630122758.891011F00A3A@smtp.kernel.org/
Reviewed-by: Dev Jain <dev.jain@arm.com>
Tested-by: Dev Jain <dev.jain@arm.com>
Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
note_page_flush() calls note_page() with addr == 0 and level == -1 to
dump the last row of a ptdump. addr == 0 (1 << 64 wrapped around)
renders a huge region with enormous size for address spaces with
IA bits < 64. For example the stage-2 page tables and the EFI runtime
page table.
More importantly, the last region of the address space and everything
after the address space up to 1 << 64 are merged into one row of
output. If the last region within the address space is valid, it will
appear to remain valid up to 1 << 64 with the same attributes.
Currently only the EFI runtime ptdump is affected by this, but KVM will
soon fix its stage-2 ptdump by using note_page_flush(). Here is an
example of an EFI runtime ptdump (last row):
0x0000008000000000-0x0000000000000000 17179868672G PGD
With this patch:
0x0000008000000000-0x0001000000000000 261632G PGD
To fix this, cache the end address of a ptdump in ptdump_pg_state so
note_page_flush() can call the final note_page() with the correct end
address.
Fixes: 9d80448ac9 ("efi/arm64: Add debugfs node to dump UEFI runtime page tables")
Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Merge series "mm/slab: introduce kfree_rcu_nolock() and improve
slub_kunit coverage" from Harry Yoo. From the cover letter [1]:
This series improves kmalloc_nolock() and kfree_nolock() coverage in
slub_kunit and introduces kfree_rcu_nolock() for unknown context as
suggested by Alexei Starovoitov.
Unknown context means the caller does not know whether spinning on a
lock is safe (e.g., a BPF program attached to an arbitrary kernel
function or in NMI context).
The slab allocator already supports unknown context via kmalloc_nolock()
and kfree_nolock(), but te slab allocator does not support freeing
objects by RCU in unknown context.
It is not ideal to have completely separate batching for unknown context
because the worst scenario where spinning on a lock would lead to
deadlock is very rare, and in most cases, it is safe to use the existing
mechanism (kfree_rcu_sheaf()).
Since most part of the slab allocator already supports unknown context
and sheaves support batching kvfree_rcu() calls for slab objects,
implement kfree_rcu_nolock() with minimal changes by teaching
kfree_rcu_sheaf() how to support unknown context and making it a little
bit harder to allocate an empty sheaf, instead of making intrusive
changes to the existing kvfree_rcu batching logic.
kfree_rcu_nolock() tries to free the object to the rcu sheaf if trylock
succeeds. Once the rcu sheaf becomes full, it is submitted to RCU via
call_rcu() if spinning is allowed or IRQs are enabled (to avoid calling
call_rcu() in the middle of call_rcu()). Otherwise, call_rcu() is
deferred via irq work.
When there is no sheaf available, kfree_rcu_sheaf() falls back to
defer_kfree_rcu(). It submits the object to kvfree_rcu batching via irq
work. To do this, patch 6 converts kvfree_rcu to use kvfree_rcu_head
without visible changes to the API for now.
Unlike kfree_rcu(), only the 2-argument variant is supported. This is
because the last resort of the 1-arg variant is synchronize_rcu(), which
cannot be used in an unknown context.
As suggested by Alexei Starovoitov, kfree_rcu_nolock() can be used with
struct kvfree_rcu_head (8 bytes), which is smaller than struct rcu_head
(16 bytes).
Link: https://lore.kernel.org/all/20260729-kfree_rcu_nolock-v5-0-a28cdcda9673@kernel.org/ [1]
Merge series "mm/slab, alloc_tag: reduce obj_ext memory waste" from
myself. From the cover letter [1]:
It's been bothering me that the memory usage of struct slabobj_ext
depend only on config options and not whether the fields are actually
used. So with both CONFIG_MEMCG=y and CONFIG_MEM_ALLOC_PROFILING=y there
is always objcg field and codetag_ref field. And thus:
1) Having memory allocation profiling config-enabled but not
boot-enabled means wasted memory on unused codetag_refs. This makes
it less suitable for a general distro config and the page allocator
side doesn't suffer from this, only slab and percpu.
2) Complementary, with memory allocation profiling enabled, there are
caches/slabs that don't need the objcg field, so memory is wasted on
those.
This series should solve the point 1) fully for slab; pcpuobj_ext
handling can be perhaps improved similarly, haven't looked into that.
For 2) it avoids allocating objcg fields for KMALLOC_NORMAL and
KMALLOC_NO_OBJ_EXT caches where we know they are not necessary because
kmalloc() with __GFP_ACCOUNT will pick a KMALLOC_CGROUP type (except
with SLUB_TINY).
The named kmem_caches are tricky. They can be created with SLAB_ACCOUNT
and then we know objcg fields are always needed. But also they can be
created without SLAB_ACCOUNT and then some allocations have
__GFP_ACCOUNT and some not and we don't know that in advance.
This series introduces a SLAB_MAY_ACCOUNT flag that's currently internal
only and is applied to all caches (unless kmem accounting is disabled)
except KMALLOC_NORMAL (unless that aliases KMALLOC_RECLAIM) and
KMALLOC_NO_OBJ_EXT.
As a followup we can make SLAB_MAY_ACCOUNT explicit and add it to to
caches where we know __GFP_ACCOUNT is used. Then we could only honour
__GFP_ACCOUNT for those, while warning for an unexpected usage
elsewhere.
To check for regressions, I forward-ported a microbenchmark hacked into
slub_kunit that was used to evaluate sheaves.
Tried 3 scenarios, MEMCG and KFENCE were always enabled:
- CONFIG_MEM_ALLOC_PROFILING=n
- CONFIG_MEM_ALLOC_PROFILING=y but _ENABLED_BY_DEFAULT=n
- same but booted with sysctl.vm.mem_profiling=1
The results are quite noisy, but no regression was apparent, except
perhaps few percents for the last case. I don't expect it will be
visible in any real workloads.
Link: https://lore.kernel.org/all/20260727-b4-objext_split-v3-0-c29ef0f1f257@kernel.org/ [1]
All of the ARCH_MSTARV7 chips have this RTC so it's more likely
ARCH_MSTARV7 wants it than doesn't.
At the same time fix up the indent on the depends on line that looks
like it got converted from a tab to spaces at some point.
Signed-off-by: Daniel Palmer <daniel@0x0f.com>
Link: https://patch.msgid.link/20260713133919.1356748-1-daniel@thingy.jp
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
setup_profiling_timer() is not used by any code at this point. Since a
default weak implementation exists, there is no need to keep this
arch-specific definition around. Remove it along with the now-redundant
profile header includes.
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Message-ID: <20260820123711.142005-1-ailiop@suse.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
From<bool> turns true into 1. A signed Bounded with N = 1 can hold
only -1 and 0. The current implementation can therefore create a value
that breaks Bounded's invariant. Deref relies on that invariant and
calls unreachable_unchecked() when it is broken, so safe Rust can reach
undefined behavior.
The other primitive conversions require the source and destination to
have the same signedness. Treat bool as an unsigned one-bit value and
allow conversions between bool and Bounded only when the backing integer
type is unsigned.
Fixes: 01e345e82e ("rust: num: add Bounded integer wrapping type")
Closes: https://lore.kernel.org/rust-for-linux/OzuVxu0--J-9@younes.io/
Cc: stable@vger.kernel.org
Suggested-by: Alexandre Courbot <acourbot@nvidia.com>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Younes Akhouayri <git@younes.io>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260822-fix-rust-bounded-from-bool-submit-v4-1-aa780bfe7f30@younes.io
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Revert commit 1b08668748 ("locking: Switch to _irq_{disable,enable}()
variants in cleanup guards").
While the guards are properly nested, not all wrapped code is nice, as already
highlighted by that fair.c hunk.
Syzbot found another instance of this pattern in posix_timer_delete(), which
does spin_unlock_irq()+spin_lock_irq() inside scoped_guard(spinlock_irq).
Combined with this patch, that goes sideways most spectacular.
Undo this until we've developed stronger tools / debug for such issues.
Fixes: 1b08668748 ("locking: Switch to _irq_{disable,enable}() variants in cleanup guards")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260824105523.GA4121620%40noisy.programming.kicks-ass.net
rapl_package_add_pmu() fails internally at perf_pmu_register(),
and rapl_pmu_update() leaves the global rapl_pmu.pmu structure
zero-initialized via memset and returns an error. But any
previously probed packages retain has_pmu = true.
When the driver is subsequently unbound or removed,
rapl_package_remove_pmu_locked() sees has_pmu == true and
unconditionally calls perf_pmu_unregister(&rapl_pmu.pmu) on the
zeroed-out structure. This attempts a list_del_rcu() on a NULL
list head, immediately causing a kernel panic.
Fix this by checking if the PMU is actually registered before
attempting to unregister it.
Signed-off-by: Sumeet Pawnikar <sumeet4linux@gmail.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
[ rjw: Added empty line after the new conditional ]
Link: https://patch.msgid.link/20260822094657.12489-1-sumeet4linux@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Split configfs MAINTAINERS entry in C and Rust parts. Mark Breno Leitao as
maintainer of configfs C parts. Mark Andreas Hindborg as maintainer of
configfs Rust parts.
Acked-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
The existing condition in fuse_uring_cmd() is there only to avoid
disabling io-uring for connections that already run with it, missing
was a condition to refuse any IORING_OP_URING_CMD if the
connection/channel didn't get enabled because of missing FUSE_INIT
reply flag FUSE_OVER_IO_URING. Without the reply flag the barrier in
fuse_uring_ready() doesn't work and IO could already be going on and
cause deadlock states (at a minimum one between fch->bg_lock and
queue->lock).
The change itself is trivial, but brings behavior change,
FUSE_OVER_IO_URING has to be set in the FUSE_INIT_REPLY by fuse servers
to accept any IORING_OP_URING_CMD. Libfuse does that and the only
non-libfuse implementation I found (fractal-fuse) also does it.
Qemu patches for fuse-io-uring are not merged yet, as far as I know.
Moved up is the smp_load_acquire(&fch->initialized) check, as a
fuse-server implementation might try to setup io-uring before FUSE_INIT
is processed and might have gotten -EOPNOTSUPP instead of -EAGAIN.
Also fixed is a stale comment that explains the handling of the
FUSE_OVER_IO_URING flag in early RFC versions.
If there should be a report from any library or application we
probably need to revert this commit.
Fixes: 3393ff964e ("fuse: block request allocation until io-uring init is complete")
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fuse_direct_write_iter() captures pos before generic_write_checks(),
which moves ki_pos to EOF for O_APPEND writes:
fuse_direct_write_iter()
{
pos = iocb->ki_pos; /* 0 (user-supplied) */
generic_write_checks(); /* ki_pos -> EOF */
fuse_direct_io(); /* writes at EOF, correct */
invalidate(pos, pos + res); /* [0, res) -- wrong */
}
The post-write invalidation targets a stale range instead of the
actual written range at EOF.
This can cause data inconsistency when the file size is not
page-aligned. The tail page straddling EOF has a valid portion
before EOF that concurrent readers can fault back in during the
DIO write window:
Tail page (file size X not page-aligned):
page_start X (EOF) page_end
|--- valid data ----|-- stale --|
CPU0 (O_APPEND DIO writer) CPU1 (buffered reader)
-------------------------- ----------------------
invalidate [X, X+len)
tail page evicted
FUSE_WRITE in flight ...
read [page_start, X)
tail page re-faulted
[X, page_end) = stale
FUSE_WRITE completes
i_size = X + len
invalidate [0, len) <- WRONG
tail page still cached
read [X, X+len)
hits stale tail page
returns old data
Fix by reading pos back from iocb->ki_pos after generic_write_checks(),
as generic_file_direct_write() does.
Also fix a typo in the comment ("may have" -> "may have competed").
Fixes: 2b0408d028 ("fuse: invalidate page cache after DIO and async DIO writes")
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Bernd Schubert <bernd@bsbernd.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Add a regression test for the bug where extending a file left the tail of
the old partial EOF page exposing stale mmap-dirtied data instead of zeros.
The test is a self-contained raw /dev/fuse server (no libfuse dependency)
that runs without writeback_cache and returns FOPEN_KEEP_CACHE, the
configuration in which the bug is visible. Its backing data is always zero
in the hole, so any non-zero byte a read sees is stale page-cache data.
All offsets are relative to the runtime page size. Four cases:
- write_extend: pollute the post-EOF tail, extend past it by writing into
a later page, and verify the tail reads back as zero;
- ftruncate_extend: same, but extend via ftruncate();
- fallocate_extend: same, but extend via fallocate() at the old EOF;
- extend_into_eof_page_preserves_data: an extending write landing inside
the old EOF page must not be clobbered by the zeroing.
Each case fails without the fix and passes with it.
Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
snd_usbmidi_novation_output() lays out a two-byte header at
transfer_buffer[0..1] and passes &transfer_buffer[2] together with a
length of ep->max_transfer - 2 to snd_rawmidi_transmit():
count = snd_rawmidi_transmit(ep->ports[0].substream,
&transfer_buffer[2],
ep->max_transfer - 2);
ep->max_transfer comes from the output endpoint's wMaxPacketSize via
usb_maxpacket(). A malformed or malicious device can advertise a bulk
OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this
value downwards - so ep->max_transfer becomes 1 and the count argument
becomes -1.
snd_rawmidi_transmit() passes the negative count on to
__snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count"
leaves count1 negative; get_aligned_size() keeps it negative for a
byte-stream substream, so the following memcpy(buffer, ..., count1) runs
with a (size_t)-1 length and writes far past the transfer buffer, which
was allocated with usb_alloc_coherent(ep->max_transfer).
This is the same class of bug that was fixed for snd_usbmidi_akai_output()
in commit 0970274613 ("ALSA: usb-audio: fix OOB write in
snd_usbmidi_akai_output()"); the novation output routine was left
unguarded. Bail out when the endpoint cannot hold the two-byte header
plus at least one payload byte.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Marouane El Moufid <eun0us@espilon.net>
Link: https://patch.msgid.link/178749334830.543645.13722252148340572274@espilon.net
Signed-off-by: Takashi Iwai <tiwai@suse.de>
- Use guard(mutex)() to manage gbuf_resize_mutex;
- Nullify tmp_pages after successful allocation, so that the error
path becomes clearer.
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
z_erofs_gbuf_nrpages is advanced only after every global buffer has been
grown. If a resize fails after some buffers were enlarged, a retry
revisits those enlarged buffers.
Retrying the same size then returns -ENOMEM because alloc_pages_bulk()
has no pages to add and the unchanged return value is treated as a
failure. Retrying an intermediate size allocates a temporary pointer
array smaller than gbuf->nrpages and copies more existing pointers than
the array can hold.
Skip buffers that already satisfy the request. Once all remaining
buffers have caught up, advancing z_erofs_gbuf_nrpages again describes
the guaranteed minimum size across the pool.
Fixes: d6db47e571 ("erofs: do not use pagepool in z_erofs_gbuf_growsize()")
Cc: stable@vger.kernel.org # 6.10+
Signed-off-by: Nikhil Gurudasani <nikhilgurudasani314@gmail.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
erofs_fill_inode() calls mapping_set_large_folios() on each erofs
file's own mapping, but in inode_share mode reads are routed to the
shared inode's page cache instead, whose mapping never had large
folio support enabled.
Set up large folios for the shared inode's mapping as well.
Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
erofs_ishare_fops routes everything that touches the page cache to the
backing file in ->private_data: read_iter clones the iocb onto it, mmap
does vma_set_file(), fadvise calls vfs_fadvise() on it. splice_read was
left as filemap_splice_read(), which works on the user file's own mapping:
it does init_sync_kiocb(&iocb, in), and filemap_get_pages() then takes
iocb->ki_filp->f_mapping.
So splice() and sendfile() fill the per-inode page cache rather than the
shared one. The content is the same either way, since erofs_fill_inode()
sets a_ops on that mapping too, which is why this went unnoticed. Two
identical 8 MiB files under inode_share, reading one of them with splice(2)
alone, in pages:
before own 2048 shared 0
after own 0 shared 2048
"own" is cachestat(fd), which reports the file's own mapping; "shared" is
mmap()+mincore(), which erofs_ishare_mmap() redirects to the backing file.
Read through the backing file, as read_iter already does.
Link: https://lore.kernel.org/all/b7dc7192-d586-45a2-bc4a-b41dc681c9bb@linux.alibaba.com/
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
When inode_share is enabled, erofs_ishare_fops.llseek falls back to
generic_file_llseek, which treats the whole file as data and always
returns i_size for SEEK_HOLE, hiding real holes in sparse files.
Switch it to erofs_file_llseek instead. For user files f_mapping->host
is always the real erofs inode, so SEEK_HOLE/SEEK_DATA resolve the
per-file on-disk layout via iomap_seek_hole()/iomap_seek_data().
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
When NR_CPUS is less than 16, or when SMP is disabled, the default value
of 16 is invalid.
While actual configuration picks up a sensible and valid default
(NR_CPUS or 1), "make savedefconfig" will still write a line like
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS=1
to the defconfig file, even if that matches the sensible default.
Avoid needlessly enlarging the defconfig files, and reduce churn for
updating them, by specifying valid defaults depending on SMP and
NR_CPUS.
While at it, make the prompt depend on SMP, as there is no point in
asking the user about the maximum number of decompression streams if
there is only one valid answer.
Fixes: c9b47e6b23 ("erofs: cap LZMA stream pool size")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
In snic_add_host(), if scsi_add_host() succeeds but
alloc_ordered_workqueue() fails, the function returns -ENOMEM with
shost->work_q left as NULL. The caller's error path then calls
snic_del_host(), which returns early when !shost->work_q without calling
scsi_remove_host(). The Scsi_Host remains registered in sysfs as a zombie
device even after the probe has failed. This causes:
- The leaked host remains visible in /sys/class/scsi_host/ after probe
failure, with state "running".
- Subsequent SCSI host numbering is permanently shifted (the leaked host
ID from ida_alloc() is never reclaimed).
- Memory leak: the Scsi_Host allocation can never be freed because
device_add() took a reference that can only be released by device_del()
inside scsi_remove_host().
Fix by adding scsi_remove_host() in the workqueue allocation failure path
inside snic_add_host(), undoing the successful scsi_add_host() before
returning the error. This is cleaner than modifying snic_del_host() because
snic_del_host() is called from a shared error label that also serves paths
where snic_add_host() was never invoked.
Reproducer (requires no real SNIC hardware):
- Build CONFIG_SCSI_SNIC=y (built-in)
- Add snic.test_mode=1 snic.inject_wq_fail=1 to kernel cmdline
- Boot with a PCI device matching the snic driver (e.g. QEMU edu device,
PCI ID 0x1234:0x11e8, temporarily added to the driver's PCI ID table)
Before the fix:
# /sys/class/scsi_host/ contains a zombie host0:
$ cat /sys/class/scsi_host/host0/proc_name
snic_scsi
$ cat /sys/class/scsi_host/host0/state
running
# ata_piix gets host1, host2 (host0 stuck):
scsi host1: ata_piix
scsi host2: ata_piix
After the fix:
# host0 is properly freed and reused by ata_piix:
scsi host0: ata_piix
scsi host1: ata_piix
# No zombie host in /sys/class/scsi_host/
Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Acked-by: Narsimhulu Musini <nmusini@cisco.com>
Link: https://patch.msgid.link/20260727073438.209673-1-chenchangcheng@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
* Count single_rpc offline failures in statistics output.
* Make invoker threads actually wait for all threads to start.
-----BEGIN PGP SIGNATURE-----
iQJHBAABCgAxFiEEbK7UrM+RBIrCoViJnr8S83LZ+4wFAmqE5f8THHBhdWxtY2tA
a2VybmVsLm9yZwAKCRCevxLzctn7jIB7D/9MgrSRbOAK+Kou/DoIDeNNcPtLV3hH
Scuq6xwsIyvKKs4IhjtDrnilHI51OaPOH6boySPJQ02cC5D1mtXWZBedH6wcQCHS
ItE4AJJD2Mr2yoy1ld3fFPOeLkgqK/3YfN5aMwNB+BmzW9ZmeAhxBZJACwyuj0OE
J+9eIq3TUBqR4gtAprfbDQqXtKGdEfhq62WmJFvM0VVPVujYIDyfSh+1hnEl3yp6
dgb1c3Z2xfMEhp86rLQFgjBYNdgb9GrNb9wX2QEjb0vMw9N5Ky2+do2EprD5DWev
B0ihHt2fAD4tZr2TubnXy5p8gCy2k3nILODmgfu69pS/LMcdIuBe4rRm1lXpjkDG
gem1KHjT4nLWte9dI5+D8urwu5dZOJe99NNQDg/qZkVVdkJ9KWxwDx4azd3AKGnW
qWZUKRks6GL8/SmRuVzQAaVHKtwFh44Wf9h4BoxLNC/dJxokC9+SH4XNUPIHdy5J
BGhZSiAqmixtKGqXI6nshze88gHVwYIU3UukppyXkPmMih+S5dJzFlVB2gJVFaB9
lYxXIPVFr9uVNoV5zipCZUxtPW1jasfqth8u2fqxaBP6ChN/e36lWLhHqOLc7DPh
WgNPQK6wTZnM6eL6qzWqE4A+Bfleaivyp3Ia3gpzyGGgxG0a/5P3m0+/KgPRX0Jm
iaIKs/gamZErtA==
=L89j
-----END PGP SIGNATURE-----
Merge tag 'scftorture.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux
Pull smp_call_function() torture-test updates from Paul McKenney:
- Count single_rpc offline failures in statistics output
- Make invoker threads actually wait for all threads to start
* tag 'scftorture.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:
scftorture: Make invoker threads actually wait for all threads to start
scftorture: Count single_rpc offline failures in statistics output
The NCR5380 entry in MAINTAINERS includes drivers/scsi/arm/cumana_1.c and
drivers/scsi/arm/oak.c. However, those two files are also covered by the
drivers/scsi/arm/ pathname in the ARM/RISCPC entry.
The latter entry is more effective than the former because, AIUI, neither
Michael nor I have access to the necessary hardware. IMHO, such access is a
pre-requisite for the 'maintainer' role for device drivers.
To work on these particular drivers would require an old GCC compiler,
having support for -march=armv3m, which is a problem for contributors.
Cc: Michael Schmitz <schmitzmic@gmail.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Finn Thain <fthain@linux-m68k.org>
Acked-by: Michael Schmitz <schmitzmic@gmail.com>
Link: https://patch.msgid.link/935b08c0fb292888c06c2233570331f2ccadcd53.1787014824.git.fthain@linux-m68k.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Replace the earlier LeapRAID ncq_cmd_prio_enable attribute with the
standard sas_ncq_prio_supported and sas_ncq_prio_enable names documented in
Documentation/ABI/testing/sysfs-block-device, and rename the per-device NCQ
priority state to match.
The earlier ncq_cmd_prio_enable name has not yet been established as part
of a released userspace ABI, so no compatibility alias is needed.
For LeapRAID, sas_ncq_prio_enable is backed by the driver's per-device NCQ
priority state and controls whether RT-class I/O requests are issued with
command priority on supported SATA devices.
Update leapraid.rst to describe the standard attribute names and paths, and
clean up the surrounding RST text for consistency with kernel documentation
style.
Also switch the capability check from open-coded VPD page 0x89 parsing to
sas_ata_ncq_prio_supported(), use kstrtobool() for the enable path, and
expose the NCQ priority attributes only for SATA devices using LeapRAID's
target-private SAS device state.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Dongdong Hao <doubled@leap-io-kernel.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260814090526.395704-1-doubled@leap-io-kernel.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees
the firmware log buffer. leapraid_fw_mmap() checks host_removing, but it
does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and
the VMA open callback runs.
Removal can set host_removing and observe a zero mmap_refcnt between the
check and the VMA open. It can then free the coherent buffer while the
mmap path is still establishing a userspace mapping of it.
Claim a temporary mmap reference while looking up the adapter under
leapraid_adapter_lock. Removal deletes the adapter from the same locked
list after setting host_removing, so a mapping is either rejected or
included in the count that removal waits for. Drop the temporary reference
on the common exit path, after a successful VMA open has acquired the
reference covering the VMA lifetime.
Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
leapraid_fw_mmap() keeps the Scsi_Host reference obtained while looking up
the adapter for the lifetime of the initial VMA. The VMA close callback
drops that reference.
The open callback is also invoked when a VMA is duplicated or split, but it
only increments mmap_refcnt. Since every corresponding close callback
drops a host reference, cloning the mapping can release the host while
another VMA still refers to the adapter.
Take a host device reference for every VMA open and release the lookup
reference once the initial mapping has acquired its own reference. Use
get_device() because a VMA can be cloned after the host enters SHOST_DEL;
an existing VMA still pins the host at that point and open cannot fail.
Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-2-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
