Commit graph

1,462,193 commits

Author SHA1 Message Date
Michal Wajdeczko
09b45fd9d3 drm/xe/guc: Drop redundant register read
The xe_mmio_wait32() already returns the last value of the register
for which we were waiting, there is no need read it again.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260127193727.601-5-michal.wajdeczko@intel.com
2026-02-02 22:35:44 +01:00
Michal Wajdeczko
943c4d0637 drm/xe/guc: Limit sleep while waiting for H2G credits
Instead of endlessly increasing the sleep timeout while waiting
for the H2G credits, use exponential increase only up to the given
limit, like it was initially done in the GuC submission code.

While here, fix the actual timeout to the 1s as it was documented.

Suggested-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260127193727.601-4-michal.wajdeczko@intel.com
2026-02-02 22:35:43 +01:00
Michal Wajdeczko
eec43f3684 drm/xe: Move exponential sleep logic to helper
We want to reuse the same increased sleep logic in other places.
To avoid code duplication, move it to the helper.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260127193727.601-3-michal.wajdeczko@intel.com
2026-02-02 22:35:42 +01:00
Michal Wajdeczko
94a2ceb190 drm/xe: Promote relaxed_ms_sleep
We want to have single place with sleep related helpers for better
code reuse. Create xe_sleep.h and move relaxed_ms_sleep() there.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260127193727.601-2-michal.wajdeczko@intel.com
2026-02-02 22:35:41 +01:00
Michal Wajdeczko
316b05ae7e drm/xe/pf: Simplify IS_SRIOV_PF macro
Instead of two having variants of the IS_SRIOV_PF macro, move the
CONFIG_PCI_IOV check to the xe_device_is_sriov_pf() function and
let the compiler optimize that. This will help us drop poor man's
type check of the macro parameter that fails on const xe pointer.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Link: https://patch.msgid.link/20260128222714.3056-1-michal.wajdeczko@intel.com
2026-02-02 22:22:57 +01:00
Shuicheng Lin
9f9c117ac5 drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep
Correct the function name in the kerneldoc.
It is for below warning:
"Warning: drivers/gpu/drm/xe/xe_tlb_inval_job.c:210 expecting prototype for
xe_tlb_inval_alloc_dep(). Prototype was for xe_tlb_inval_job_alloc_dep()
instead"

Fixes: 15366239e2 ("drm/xe: Decouple TLB invalidations from GT")
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260129233834.419977-8-shuicheng.lin@intel.com
2026-02-02 22:05:00 +01:00
Shuicheng Lin
0651dbb9d6 drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early
Correct the function name in the kerneldoc.
It is for below warning:
"Warning: drivers/gpu/drm/xe/xe_tlb_inval.c:136 expecting prototype for
xe_gt_tlb_inval_init(). Prototype was for xe_gt_tlb_inval_init_early()
instead"

v2: add () for the function. (Michal)

Fixes: db16f9d90c ("drm/xe: Split TLB invalidation code in frontend and backend")
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260129233834.419977-7-shuicheng.lin@intel.com
2026-02-02 22:04:58 +01:00
Shuicheng Lin
9fd8da7179 drm/xe: Fix kerneldoc for xe_migrate_exec_queue
Correct the function name in the kerneldoc.
It is for below warning:
"Warning: drivers/gpu/drm/xe/xe_migrate.c:1262 expecting prototype for
xe_get_migrate_exec_queue(). Prototype was for xe_migrate_exec_queue()
instead"

Fixes: 916ee4704a ("drm/xe/vf: Register CCS read/write contexts with Guc")
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260129233834.419977-6-shuicheng.lin@intel.com
2026-02-02 22:04:55 +01:00
Arnd Bergmann
451c3a0356 rcu: Mark lockdep_assert_rcu_helper() __always_inline
There are some configurations in which lockdep_assert_rcu_helper() ends up
not being inlined, for some reason. This leads to a link failure because
now the caller tries to pass a nonexistant __ctx_lock_RCU structure:

ld: lib/test_context-analysis.o: in function `test_rcu_assert_variants':
test_context-analysis.c:(.text+0x275c): undefined reference to `RCU'
ld: test_context-analysis.c:(.text+0x276c): undefined reference to `RCU_BH'
ld: test_context-analysis.c:(.text+0x2774): undefined reference to `RCU_SCHED'

I saw this in one out of many 32-bit arm builds using gcc-15.2, but
it probably happens in others as well.

Mark this function as __always_inline to fix the build.

Fixes: fe00f6e846 ("rcu: Support Clang's context analysis")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Link: https://patch.msgid.link/20260202095507.1237440-1-arnd@kernel.org
2026-02-02 22:02:49 +01:00
Breno Leitao
a56a38fd91 uprobes: Fix incorrect lockdep condition in filter_chain()
The list_for_each_entry_rcu() in filter_chain() uses
rcu_read_lock_trace_held() as the lockdep condition, but the function
holds consumer_rwsem, not the RCU trace lock.

This gives me the following output when running with some locking debug
option enabled:

  kernel/events/uprobes.c:1141 RCU-list traversed in non-reader section!!
    filter_chain
    register_for_each_vma
    uprobe_unregister_nosync
    __probe_event_disable

Remove the incorrect lockdep condition since the rwsem provides
sufficient protection for the list traversal.

Fixes: cc01bd044e ("uprobes: travers uprobe's consumer list locklessly under SRCU protection")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260128-uprobe_rcu-v2-1-994ea6d32730@debian.org
2026-02-02 22:01:07 +01:00
Xiang-Bin Shi
171efc7009 x86/ibs: Fix typo in dc_l2tlb_miss comment
The comment for dc_l2tlb_miss incorrectly describes it as a "hit".
This contradicts the field name and the actual bit definition.

Fix the comment to correctly describe it as a "miss".

Signed-off-by: Xiang-Bin Shi <eric91102091@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260123075719.160734-1-eric91102091@gmail.com
2026-02-02 22:01:07 +01:00
Arnd Bergmann
7833570dae jfs: avoid -Wtautological-constant-out-of-range-compare warning
A recent change for the range check started triggering a clang warning:

fs/jfs/jfs_dtree.c:2906:31: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
 2906 |                         if (stbl[i] < 0 || stbl[i] >= DTPAGEMAXSLOT) {
      |                                            ~~~~~~~ ^  ~~~~~~~~~~~~~
fs/jfs/jfs_dtree.c:3111:30: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
 3111 |                 if (stbl[0] < 0 || stbl[0] >= DTPAGEMAXSLOT) {
      |                                    ~~~~~~~ ^  ~~~~~~~~~~~~~

Both the old and the new check were useless, but the previous version
apparently did not lead to the warning.

Remove the extraneous range check for simplicity.

Fixes: cafc667982 ("jfs: replace hardcoded magic number with DTPAGEMAXSLOT constant")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
2026-02-02 14:47:12 -06:00
Samuel Wu
75ce02f4bc PM: wakeup: Handle empty list in wakeup_sources_walk_start()
In the case of an empty wakeup_sources list, wakeup_sources_walk_start()
will return an invalid but non-NULL address. This also affects wrappers
of the aforementioned function, like for_each_wakeup_source().

Update wakeup_sources_walk_start() to return NULL in case of an empty
list.

Fixes: b4941adb24 ("PM: wakeup: Add routine to help fetch wakeup source object.")
Signed-off-by: Samuel Wu <wusamuel@google.com>
[ rjw: Subject and changelog edits ]
Link: https://patch.msgid.link/20260124012133.2451708-2-wusamuel@google.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-02 21:39:21 +01:00
Christoph Hellwig
b244c89a70 readahead: push invalidate_lock out of page_cache_ra_unbounded
Require the invalidate_lock to be held over calls to
page_cache_ra_unbounded instead of acquiring it in this function.

This prepares for calling page_cache_ra_unbounded from ->readahead for
fsverity read-ahead.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20260202060754.270269-3-hch@lst.de
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02 12:38:13 -08:00
Tejun Heo
4544e9c4ec selftests/sched_ext: Fix init_enable_count flakiness
The init_enable_count test is flaky. The test forks 1024 children before
attaching the scheduler to verify that existing tasks get ops.init_task()
called. The children were using sleep(1) before exiting.

7900aa699c ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free()
to finish_task_switch()") changed when tasks are removed from scx_tasks -
previously when the task_struct was freed, now immediately in
finish_task_switch() when the task dies.

Before the commit, pre-forked children would linger on scx_tasks until freed
regardless of when they exited, so the scheduler would always see them during
iteration. The sleep(1) was unnecessary. After the commit, children are
removed as soon as they die. The sleep(1) masks the problem in most cases but
the test becomes flaky depending on timing.

Fix by synchronizing properly using a pipe. All children block on read() and
the parent signals them to exit by closing the write end after attaching the
scheduler. The children are auto-reaped so there's no need to wait on them.

Reported-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Cc: David Vernet <void@manifault.com>
Cc: Andrea Righi <arighi@nvidia.com>
Cc: Changwoo Min <changwoo@igalia.com>
Cc: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 09:45:09 -10:00
Christoph Hellwig
23eec9fd64 fsverity: don't issue readahead for non-ENOENT errors from __filemap_get_folio
Issuing more reads on errors is not a good idea, especially when the
most common error here is -ENOMEM.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20260202060754.270269-2-hch@lst.de
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02 11:31:21 -08:00
Stephen Boyd
f08e7edbe2 Microchip clock updates for v6.20
This update includes:
 - clean up microchip/clk-core.c to:
 -- fix a sparse warning related to multiple initializations of
    pic32_sclk_ops.determine_rate()
 -- correct the return values of roclk_get_parent() and sclk_get_parent()
 -- drop an unused include header
 - adjust the PolarFire driver Kconfig section as the driver is now used by
   non-PolarFire devices
 - update the documentation for the Microchip PIC64GX SoC clock controller
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTsZ8eserC1pmhwqDmejrg/N2X7/QUCaXSSLQAKCRCejrg/N2X7
 /TOWAP9XbpUFGfQ31opouYKn5xIPn4rBqpAK1FjwzrKmwHVCpgD+O4NBr1rdEPZd
 zDASxKYbkCoaY8F31Ju6F7pc6ERc9wU=
 =HEKm
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmmA9aUUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSV4QQ//ZJCxVcZV0+sZUF+RoPB7NrK9mq33
 4DCef9aG+Wu9yTgzoFiHor7HDW+1D8neQApWtJKd0DEFohK+Q2dSk8dwxNMBj07O
 3VwCCNV49pCDmXJl9F7KT3ZgKCHg8cT8/51sQyZI160ez8TR5bK/S46UDUsfo/3S
 OpvtgvDuR+qI8emHR64oBLGf13qJ7doLCOUJoiz5CKd+69E4VoZ+BXQmTkVd5qIs
 eyOAjUjAz93eZJRCm7d/Feuh/z+CEghOkZeC8eVMvNnRzKN90MgCNbdmvVnUdGKg
 YG9RxbF2kofhdJ9TtqeN0qju339DZ8c+NcyN4AczyGpw61fBMx8EDq1MfCU4SkwZ
 yxFQXerZ8xtDQsvDSUMcIsNNvSiz1PELs5z5/x0tJtrLS9oA2G2U3nFkv3JoMsHL
 tjaoqrD1i8/n5RwSVURvuWR4VT5rPmuFU5UBa5KIwJoOx+dSXWFCx9Zc/W1Phb41
 acoMKfKfajbI59RV6HR7b52txJ14nj+4IwJn6wbxoJbqkOt8b+4lkRJuDJ4tilk5
 bvf+IkNKPey8vDrFFOVV9rjQgYUnrFQpoZpDsrIg4I6AAhF+TTfdlYCjCnrz7Uo3
 FzHo/Na0PgysuIAjLRp8kFb0R30CrzZ1ccMGYMpRDGt9EPNqc5w605WP8XNP3KNc
 9a7gxLRy8eHuX1o=
 =Vz0Y
 -----END PGP SIGNATURE-----

Merge tag 'clk-microchip-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip

Pull Microchip clk driver updates from Claudiu Beznea:

 - clean up microchip/clk-core.c to:
 -- fix a sparse warning related to multiple initializations of
    pic32_sclk_ops.determine_rate()
 -- correct the return values of roclk_get_parent() and sclk_get_parent()
 -- drop an unused include header
 - adjust the PolarFire driver Kconfig section as the driver is now used by
   non-PolarFire devices
 - update the documentation for the Microchip PIC64GX SoC clock controller

* tag 'clk-microchip-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux:
  dt-bindings: clock: mpfs-clkcfg: Add pic64gx compatibility
  dt-bindings: clock: mpfs-ccc: Add pic64gx compatibility
  clk: microchip: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE
  clk: microchip: core: remove unused include asm/traps.h
  clk: microchip: core: correct return value on *_get_parent()
  clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops
2026-02-02 11:06:00 -08:00
Stephen Boyd
2fa598ae97 Additional check for an error pointer and not only for NULL when a
gatelink is added.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmlyck8QHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgS9uB/9NqQnGRwB0ndYHhkpPnpG2tjW3kuP64d+3
 DTsHwwirSsHOXu/nkg2+Vnhx0/Q6IC22Z5qO7zcz24Tm5GjPzVqywEmxvTJjMny8
 N4c3QRTtSwlrOc6hHN8Fg5ZYfLaZY7jqMUhJhZyFDoCUq4pILp63Q+V4JVX6jNcF
 aougnxe1gl5TdCEbekxmmZR1ySOmFu5/78zR02JPiWJ2vAkbRm2O2AdurJCqQO1f
 qAewiFAki66r7DPvQIGZd2ST8elqGQt3WeMifgkAtyjLs8yVas81Fj0kBib+WoXl
 6zKJeFxLf7ULla4VrCyS535JVPGBqBIpyEVq5pgpZUv6OOIeh/I5
 =0YM7
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmmA9VcUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSUfMw//cEm0LJQXdjnmMi9CrE4huYZP3vLP
 0KzzBNjesa0s9CvXpCaGjDjZqiUoXhohS9X9ABmHxFWusBkFx2J3FyqhbSwwnEHX
 wcuDKhHpGYDA1fijLoIHFpVFQBRTJAB41NUANN4bk7rH2mrIJX0AvrzmAZd4fDbw
 xhFitlIUyHkTBu4MpULRAoVNrKQ26zWzr7AiLAqZWSPD6V5+zMVBKRWHbXDRmBxo
 DRHBjmizJws4yY2nVCgYxi9z5vZYorZn8CLtQFJOQV1wFwqNyI/0zv+RL66J0uUz
 Ks+wont8ubez6igTIoUF75ZjPYMThqu2th4M7JC05IognOKiFtH6EIt8ncHlt7VI
 EO4mKPourgFKJEQoIzRL+HQUwoxtwP22ZBNmXAuppfvRfhpi4P20u4K4lLMY0hPF
 Z56f+A8NuUN8x85u2ZObCGbMSjH7NDPiA0GwfI+TZWHeixMAX6HYJ2OMNA2K3jUa
 ONmFfzxnqYHJ8ddb4PT1f69ZTNyF4iI9vgCORblkIa+iClEJFWJ/voaUo6yn6lMn
 JTuAJlt57GQYl4WNRW2qadZCKVXLKct+BICYqOXgkRQnE+98STAjeXe0h9zcnmH0
 qwBj4waAHA3h5KbV+7Hht3qUxFx3JQZp1AUsLA7G/oMc1oGjMHXEiOBwnOg7fbkw
 xTpLEOWhOAvjbZ4=
 =1g7g
 -----END PGP SIGNATURE-----

Merge tag 'v6.20-rockchip-clk-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip

Pull a Rockchip clk driver update from Heiko Stuebner:

Additional check for an error pointer and not only for NULL when a
gatelink is added.

* tag 'v6.20-rockchip-clk-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link()
2026-02-02 11:03:30 -08:00
Olga Kornievskaia
5248d8474e pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
It is possible to have a task get stuck on waiting on the
NFS_LAYOUT_DRAIN in the following scenario

1. cpu a: waiter test NFS_LAYOUT_DRAIN (1) and plh_outstanding (1)
2. cpu b: atomic_dec_and_test() -> clear bit -> wake up
3. cpu c: sets NFS_LAYOUT_DRAIN again
4. cpu a: calls wait_on_bit() sleeps forever.

To expand on this we have say 2 outstanding pnfs write IO that get
ESTALE which causes both to call pnfs_destroy_layout() and set the
NFS_LAYOUT_DRAIN bit but the 1st one doesn't call the
pnfs_put_layout_hdr() yet (as that would prevent the 2nd ESTALE write
from trying to call pnfs_destroy_layout()). If the 1st ESTALE write
is the one that initially sets the NFS_LAYOUT_DRAIN so that new IO
on this file initiates new LAYOUTGET. Another new write would find
NFS_LAYOUT_DRAIN set and phl_outstanding>0 (step 1) and would
wait_on_bit(). LAYOUTGET completes doing step 2. Now, the 2nd of
ESTALE writes is calling pnfs_destory_layout() and set the
NFS_LAYOUT_DRAIN bit (step 3). Finally, the waiting write wakes up
to check the bit and goes back to sleep.

The problem revolves around the fact that if NFS_LAYOUT_INVALID_STID
was already set, it should not do the work of
pnfs_mark_layout_stateid_invalid(), thus NFS_LAYOUT_DRAIN will not
be set more than once for an invalid layout.

Suggested-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Fixes: 880265c77a ("pNFS: Avoid a live lock condition in pnfs_update_layout()")
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
2026-02-02 13:17:11 -05:00
Shuicheng Lin
c2a6859138 drm/xe/query: Fix topology query pointer advance
The topology query helper advanced the user pointer by the size
of the pointer, not the size of the structure. This can misalign
the output blob and corrupt the following mask. Fix the increment
to use sizeof(*topo).
There is no issue currently, as sizeof(*topo) happens to be equal
to sizeof(topo) on 64-bit systems (both evaluate to 8 bytes).

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Link: https://patch.msgid.link/20260130043907.465128-2-shuicheng.lin@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-02-02 10:09:48 -08:00
Xin Wang
568d9d0d83 drm/xe: use entry_dump callbacks for xe2+ PAT dumps
Move xe2+ PAT entry printing into the entry_dump op so platform
specific logic stays localized, simplifying future maintenance.

v2:
 - Do not null xe->pat.ops for VFs.
 - Skip PAT init and dump on VFs (-EOPNOTSUPP), avoiding NULL ops use.

v3:
 - fixed typo

v4: (Matt)
 - Switch xe2_dump() to use the new ops->entry_dump() vfunc.
 - Remove xe3p_xpc_dump() and reuse the common xe2_dump() for Xe3p XPC.
 - This also fixes Xe3p_HPM media PAT dumping by using the proper
non-MCR access for the PAT register range (bspec 76445).

Cc: Matt Roper <matthew.d.roper@intel.com>
Suggested-by: Brian Nguyen <brian3.nguyen@intel.com>
Signed-off-by: Xin Wang <x.wang@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Link: https://patch.msgid.link/20260130175349.2249033-1-x.wang@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-02-02 10:03:43 -08:00
Linus Torvalds
dee65f7936 lsm/stable-6.19 PR 20260202
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmmA0HcUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXMPrg/7BPDOeAatY8n+me4BahevlI9MkGBp
 KFwbq2iKObO9lMyp6uJUYz0OpBdUZ7DcTAoaxqbnEKF0qix5IgFJS3Gs3QrG94JN
 kQwJeKkBJDIJum86tQ+ewoLYutGqxraklflbZKJ5c56733MgSJB9S0u/fJrDVOMV
 7HOKnyFFc+o3G2mmc3EW1EWpC33FK/e0ocOTFDXQNYeyo/jTenoxloyG6F+TS3kT
 BTj3KF+25KiX2Isl8SfV/Os8m50AyTUDkMLk3sawt0v1xT5nxGwKFoHa1tftvFpx
 A2LrI6YeZvkD57XXISiFJV1FSjAsMSEbJYmx1HPxQrjXZwxqAaJEnJMqysWuXP/Q
 1smImPcaYIv9kmCDNBLkXtNhjH/P4QCHcwxBfzPm7cLtKg1n8HP/AWn2KbXiyPfO
 hArNp/besQA900FXNHRb0eY1appPoXKK2W0JKmOiY+zS5ASjadNNqJFC7RxoJTeN
 3vdr7lVXHwrpaOtsoWp0RdTbfCdiG2mjsM36DZgTsVt1EvdFM6l6HGSVNjrmQF7q
 zaYVgvqCpulKFOcV6Y0etK8bnYdE3JTskDVWzmMHEidae3zHzVVMKh5BuTnOYBqs
 ZcfiSU/cdnpLzkK6WzEvDClHC4y4i8aII9DR595AZTbSty9h3kAy9Y5qLBObUrIH
 Ai6q0Xp9zFDhzl4=
 =2qEz
 -----END PGP SIGNATURE-----

Merge tag 'lsm-pr-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull lsm fix from Paul Moore:
 "A small patch to address a regression found in the v6.19-rcX releases
  where the /proc/sys/vm/mmap_min_addr tunable disappeared when
  CONFIG_SECURITY was not selected.

  Long term we plan to work with the MM folks to get the core parts of
  this moved over to the MM subsystem, but in the meantime we need to
  fix this regression prior to the v6.19 release"

* tag 'lsm-pr-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY
2026-02-02 09:48:23 -08:00
Chaitanya Kumar Borah
f89dbe14a0 drm/xe/guc: Fix kernel-doc warning in GuC scheduler ABI header
The GuC scheduler ABI header contains a file-level comment that is not
intended to document a kernel-doc symbol. Using kernel-doc comment
syntax (/** */) triggers kernel-doc warnings.

With "-Werror", this causes the build to fail. Convert the comment to a
regular block comment.

HDRTEST drivers/gpu/drm/xe/abi/guc_scheduler_abi.h
Warning: drivers/gpu/drm/xe/abi/guc_scheduler_abi.h:11 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst
 * Generic defines required for registration with and submissions to the GuC
1 warnings as errors
make[6]: *** [drivers/gpu/drm/xe/Makefile:377: drivers/gpu/drm/xe/abi/guc_scheduler_abi.hdrtest] Error 3
make[5]: *** [scripts/Makefile.build:544: drivers/gpu/drm/xe] Error 2
make[4]: *** [scripts/Makefile.build:544: drivers/gpu/drm] Error 2
make[3]: *** [scripts/Makefile.build:544: drivers/gpu] Error 2
make[2]: *** [scripts/Makefile.build:544: drivers] Error 2
make[1]: *** [/home/kbuild2/kernel/Makefile:2088: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

v2:
 - Add Fixes tag (Daniele)

Fixes: b0c5cf4f59 ("drm/gt/guc: extract scheduler-related defines from guc_fwif.h")
Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patch.msgid.link/20260130135210.2659200-1-chaitanya.kumar.borah@intel.com
2026-02-02 09:13:31 -08:00
Daniele Ceraolo Spurio
dd8ea2f2ab drm/xe/guc: Fix CFI violation in debugfs access.
xe_guc_print_info is void-returning, but the function pointer it is
assigned to expects an int-returning function, leading to the following
CFI error:

[  206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe]
(target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a)

Fix this by updating xe_guc_print_info to return an integer.

Fixes: e15826bb3c ("drm/xe/guc: Refactor GuC debugfs initialization")
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: George D Sworo <george.d.sworo@intel.com>
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com
2026-02-02 09:12:56 -08:00
Dmitry Antipov
0a83293322 doc: development-process: add notice on testing
Add testing notice to "Before creating patches" section.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260123071523.1392729-1-dmantipov@yandex.ru>
2026-02-02 10:02:05 -07:00
Gabor Juhos
52fb36a5f9 hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled
When CONFIG_PM is disabled, the GPIO controlled FANs can't be stopped by
using the sysfs attributes since commit 0d01110e63 ("hwmon: (gpio-fan)
Add regulator support").

Using either the 'pwm1' or the 'fan1_target' attribute fails the same way:

  $ echo 0 > /sys/class/hwmon/hwmon1/pwm1
  ash: write error: Function not implemented
  $ echo 0 > /sys/class/hwmon/hwmon1/fan1_target
  ash: write error: Function not implemented

Both commands were working flawlessly before the mentioned commit.

The issue happens because pm_runtime_put_sync() returns with -ENOSYS
when CONFIG_PM is disabled, and the set_fan_speed() function handles
this as an error.

In order to restore the previous behaviour, change the error check in
the set_fan_speed() function to ignore the -ENOSYS error code.

Cc: stable@vger.kernel.org
Fixes: 0d01110e63 ("hwmon: (gpio-fan) Add regulator support")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://lore.kernel.org/r/20260202-gpio-fan-stop-fix-v1-1-c7853183d93d@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-02-02 09:00:28 -08:00
Gabor Juhos
f5c092787c hwmon: (gpio-fan) Fix set_rpm() return value
The set_rpm function is used as a 'store' callback of a device attribute,
and as such it should return with the number of bytes consumed. However
since commit 0d01110e63 ("hwmon: (gpio-fan) Add regulator support"),
the function returns with zero on success.

Due to this, the function gets called again and again whenever the user
tries to change the FAN speed by writing the desired RPM value into the
'fan1_target' sysfs attribute.

The broken behaviour can be reproduced easily. For example, the following
command never returns unless it gets terminated:

  $ echo 500 > /sys/class/hwmon/hwmon1/fan1_target
  ^C
  $

Change the code to return with the same value as the 'count' parameter
on success to indicate that all bytes from the input buffer are consumed.
The function behaved the same way prior to the offending change.

Cc: stable@vger.kernel.org
Fixes: 0d01110e63 ("hwmon: (gpio-fan) Add regulator support")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://lore.kernel.org/r/20260201-gpio-fan-set_rpm-retval-fix-v1-1-dc39bc7693ca@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-02-02 09:00:12 -08:00
David Howells
91db696ade pkcs7: Allow authenticatedAttributes for ML-DSA
Allow the rejection of authenticatedAttributes in PKCS#7 (signedAttrs in
CMS) to be waived in the kernel config for ML-DSA when used for module
signing.  This reflects the issue that openssl < 4.0 cannot do this and
openssl-4 has not yet been released.

This does not permit RSA, ECDSA or ECRDSA to be so waived (behaviour
unchanged).

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Lukas Wunner <lukas@wunner.de>
cc: Ignat Korchagin <ignat@cloudflare.com>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: Stephan Mueller <smueller@chronox.de>
cc: Eric Biggers <ebiggers@kernel.org>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
2026-02-02 16:58:21 +00:00
Mauro Carvalho Chehab
64e4882c82 tools: sphinx-build-wrapper: improve its help message
Besides the parameters that are passed via command line arguments,
the wrapper's behavior is affected by several environment variables.

Document that. While here, use __doc__ for its description.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <e0ccee75f7e7fb499e0f59d5b84469f4b6a21627.1769500383.git.mchehab+huawei@kernel.org>
2026-02-02 09:57:46 -07:00
Mauro Carvalho Chehab
b09cc1ddde docs: sphinx-build-wrapper: allow -v override -q
Documentation builds were using "-q" for a long time, but sometimes
it is nice to see the Sphinx progress, without increasing build
verbosity - which would also turn on kernel-doc verbosity.

Instead of doing that, let's parse the sphinx-build already-existing
-v: each time it is used, it increases the verbosity level.

With that, if the default is to use -q, a single -v will disable
quiet mode. Passing more -v will keep increasing its verbosity.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <38b24e97a3cbd2def418359a8e69b1b087a945ad.1769500383.git.mchehab+huawei@kernel.org>
2026-02-02 09:57:46 -07:00
Mauro Carvalho Chehab
98f51c466a docs: kdoc: Fix pdfdocs build for tools
the "\1" inside a docstring requires proper scaping to not be
considered a hex character and break the build.

Reported-by: Akira Yokosawa <akiyks@gmail.com>
Closes: https://lore.kernel.org/linux-doc/63e99049-cc72-4156-83af-414fdde34312@gmail.com/
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <2fff8ef1d0d64e8b68f15f5c07613f302d773855.1769500383.git.mchehab+huawei@kernel.org>
2026-02-02 09:57:46 -07:00
David Howells
0ad9a71933 modsign: Enable ML-DSA module signing
Allow ML-DSA module signing to be enabled.

Note that OpenSSL's CMS_*() function suite does not, as of OpenSSL-3.6,
support the use of CMS_NOATTR with ML-DSA, so the prohibition against using
signedAttrs with module signing has to be removed.  The selected digest
then applies only to the algorithm used to calculate the digest stored in
the messageDigest attribute.  The OpenSSL development branch has patches
applied that fix this[1], but it appears that that will only be available
in OpenSSL-4.

[1] https://github.com/openssl/openssl/pull/28923

sign-file won't set CMS_NOATTR if openssl is earlier than v4, resulting in
the use of signed attributes.

The ML-DSA algorithm takes the raw data to be signed without regard to what
digest algorithm is specified in the CMS message.  The CMS specified digest
algorithm is ignored unless signedAttrs are used; in such a case, only
SHA512 is permitted.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: Eric Biggers <ebiggers@kernel.org>
cc: Lukas Wunner <lukas@wunner.de>
cc: Ignat Korchagin <ignat@cloudflare.com>
cc: Stephan Mueller <smueller@chronox.de>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
2026-02-02 16:57:39 +00:00
Akiyoshi Kurita
12ea2cff02 docs: ja_JP: process: translate 'Obtain a current source tree'
Translate the "Obtain a current source tree" section in
Documentation/translations/ja_JP/process/submitting-patches.rst.

Signed-off-by: Akiyoshi Kurita <weibu@redadmin.org>
Reviewed-by: Akira Yokosawa <akiyks@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260127130155.16935-1-weibu@redadmin.org>
2026-02-02 09:55:54 -07:00
Johannes Berg
19dd0cc36a ath.git patches for v6.20/v7.0 (#3)
A set of small features and cleanups for the next merge window.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ/mtSHzPUi16IfDEksFbugiYzLewUCaYC1fQAKCRAsFbugiYzL
 ewYLAQDbVliEG5O2mVij/CIwUwfkvuYim9xolxec+TzfwShPsAD+NM4qAuHTFKOp
 bK0hF4v+Bxy03SE/5QuhPZsC1RsQTgE=
 =1LW5
 -----END PGP SIGNATURE-----

Merge tag 'ath-next-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath

Jeff Johnson says:
==================
ath.git patches for v6.20/v7.0 (#3)

A set of small features and cleanups for the next merge window.
==================

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-02 17:55:23 +01:00
Rhys Tumelty
78a00cac1e docs: fix 're-use' -> 'reuse' in documentation
Signed-off-by: Rhys Tumelty <rhys@tumelty.co.uk>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260128220233.179439-1-rhys@tumelty.co.uk>
2026-02-02 09:54:15 -07:00
Gabriel Whigham
1482f61ccd docs: ioctl-number: fix a typo in ioctl-number.rst
"userspace" was misspelled as "userpace".

Signed-off-by: Gabriel Whigham <gabewhigham@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260130042131.51975-1-gabewhigham@gmail.com>
2026-02-02 09:52:48 -07:00
Thomas Böhler
c0f612f8bc docs: filesystems: ensure proc pid substitutable is complete
The entry in proc.rst for 3.14 is missing the closing ">" of the "pid"
field for the ksm_stat file. Add this for both the table of contents and
the actual header for the "ksm_stat" file.

Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Thomas Böhler <witcher@wiredspace.de>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260131-ksm_stat-v2-1-a8fea12d604e@wiredspace.de>
2026-02-02 09:49:03 -07:00
Robin Murphy
5c323ea948 drm/panel-edp: Move FriendlyELEC HD702E
FriendlyELEC's HD702E module is an eDP panel (in as much as it's some
LVDS LCD behind a Chrontel CH7511B eDP bridge), so move its data over
to the eDP driver, also resolving the warning about the missing bpc
value in the process.

The unfortunate combination of HPD not being wired up and the RK3399 eDP
controller's behaviour seems to result in the EDID not being readable
over DP-AUX without probing the panel first, thus the hard-coded mode is
still needed to get things going.

Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/a00a59dcef3693efb02a8ee942848fbeaeaf05ba.1769191673.git.robin.murphy@arm.com
2026-02-02 08:48:44 -08:00
Robin Murphy
e2242223b7 dt-bindings: display: panel: Move FriendlyElec HD702E to eDP
The "E" alludes to the fact that FriendlyElec's HD702E is actually an
eDP panel - move its compatible to the appropriate binding doc.

Cc: devicetree@vger.kernel.org
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/c7f6f75d55a4801eab63a0dc81d14ae27866aca9.1769191673.git.robin.murphy@arm.com
2026-02-02 08:48:20 -08:00
Dave Jiang
0da3050bdd Merge branch 'for-7.0/cxl-aer-prep' into cxl-for-next
Fixup and refactor downstream port enumeration to prepare for CXL port
protocol error handling. Main motivation is to move endpoint
component register mapping to a port object.

cxl/port: Unify endpoint and switch port lookup
cxl/port: Move endpoint component register management to cxl_port
cxl/port: Map Port RAS registers
cxl/port: Move dport RAS setup to dport add time
cxl/port: Move dport probe operations to a driver event
cxl/port: Move decoder setup before dport creation
cxl/port: Cleanup dport removal with a devres group
cxl/port: Reduce number of @dport variables in cxl_port_add_dport()
cxl/port: Cleanup handling of the nr_dports 0 -> 1 transition
2026-02-02 09:39:41 -07:00
Caio Ishikawa
3c55330aac drm/panel: boe-th101mb31ig002: Remove use of deprecated mipi_dsi_dcs_nop()
Replace calls to deprecated mipi_dsi_dcs_nop() with
mipi_dsi_dcs_nop_multi(). No intended functional changes.

Signed-off-by: Caio Ishikawa <caio.ishikawa@proton.me>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260124124959.196051-3-caio.ishikawa@proton.me
2026-02-02 08:18:08 -08:00
ChenXiaoSong
67b3da8d30 smb/client: fix memory leak in SendReceive()
Reproducer:

  1. server: supports SMB1, directories are exported read-only
  2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
  4. client: umount /mnt
  5. client: sleep 1
  6. client: modprobe -r cifs

The error message is as follows:

  =============================================================================
  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
  -----------------------------------------------------------------------------

  Object 0x00000000d34491e6 @offset=896
  Object 0x00000000bde9fab3 @offset=4480
  Object 0x00000000104a1f70 @offset=6272
  Object 0x0000000092a51bb5 @offset=7616
  Object 0x000000006714a7db @offset=13440
  ...
  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
  ...
  Call Trace:
   <TASK>
   kmem_cache_destroy+0x69/0x160
   cifs_destroy_request_bufs+0x39/0x40 [cifs]
   cleanup_module+0x43/0xfc0 [cifs]
   __se_sys_delete_module+0x1d5/0x300
   __x64_sys_delete_module+0x1a/0x30
   x64_sys_call+0x2299/0x2ff0
   do_syscall_64+0x6e/0x270
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712

Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
Fixes: 6be09580df ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
Reported-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-02 10:13:57 -06:00
ChenXiaoSong
e3a4363302 smb/client: fix memory leak in smb2_open_file()
Reproducer:

  1. server: directories are exported read-only
  2. client: mount -t cifs //${server_ip}/export /mnt
  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
  4. client: umount /mnt
  5. client: sleep 1
  6. client: modprobe -r cifs

The error message is as follows:

  =============================================================================
  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
  -----------------------------------------------------------------------------

  Object 0x00000000d47521be @offset=14336
  ...
  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577
  ...
  Call Trace:
   <TASK>
   kmem_cache_destroy+0x94/0x190
   cifs_destroy_request_bufs+0x3e/0x50 [cifs]
   cleanup_module+0x4e/0x540 [cifs]
   __se_sys_delete_module+0x278/0x400
   __x64_sys_delete_module+0x5f/0x70
   x64_sys_call+0x2299/0x2ff0
   do_syscall_64+0x89/0x350
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]
  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577

Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
Fixes: e255612b5e ("cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES")
Reported-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Reviewed-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-02 10:13:57 -06:00
Ming Lei
b84bb7bd91 nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.

This fixes a regression introduced by commit 03b3bcd319 ("nvme: fix
admin request_queue lifetime").

Cc: Keith Busch <kbusch@kernel.org>
Fixes: 03b3bcd319 ("nvme: fix admin request_queue lifetime").
Reported-and-tested-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/linux-block/CAHj4cs9wv3SdPo+N01Fw2SHBYDs9tj2M_e1-GdQOkRy=DsBB1w@mail.gmail.com/
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-02-02 08:09:29 -08:00
Greg Kroah-Hartman
9991bbc6d5 IIO: New device support, features and cleanup for the 6.20/7.0 cycle.
Slightly messier than normal unfortunately due to some conflicts
 and build config bugs related to I3C drivers.
 
 One last minute Kconfig fix right at the top after a linux-next report.
 I've simplified the Kconfig and made it match other instances in the kernel
 so that should be safe enough despite short soak time in front of build bots.
 
 Merge of an immutable branch from I3C to get some stubs that were missing
 and caused build issues with dual I2C / I3C drivers. This also brought in a
 drop of some deprecated interfaces so there is also one patch to update a
 new driver to not use those.
 
 We are having another go at using cleanup.h magic with the IIO mode claim
 functions after backing out last try at this. This time we have wrappers
 around the new ACQUIRE() and ACQUIRE_ERR() macros.
 Having been burnt once, we will be taking it a bit more slowly this time
 wrt to wide adoption of these! Thanks in particular to Kurt for taking
 on this core IIO work.
 
 New Device Support
 ==================
 
 adi,ad18113
 - New driver to support the AD18113 amplifier - an interesting device due
   to the external bypass paths where we need to describe what gain those
   paths have in DT. Longer term it will be interesting to see if this
   simplistic description is enough for real deployments.
 adi,ad4062
 - New driver for the AD4060 and AD4052 SAR ADCs including trigger, event
   and GPIO controller support.  Follow up patch replaced use of some
   deprecated I3C interfaces prior to the I3C immutable branch merge as
   that includes dropping them.
 adi,ad4134
 - New driver for the AD4134 24bit 4 channel simultaneous sampling ADC.
 adi,ad7768-1,
 - Add support for the ADAQ767-1, ADAQ7768-1 and ADAQ7769-1 ADCs after some
   rework to enable the driver to support multiple device types.
 adi,ad9467
 - Add support for the similar ad9211 ADC to this existing driver.
 - Make the selection of 2s comp mode explicit for normal operation and
   switch to offset binary when entering calibration mode.
 honeywell,abp2
 - New driver to support this huge family (100+) of board mount pressure and
   temperature sensors.
 maxim,max22007
 - New drier for this 4 channel DAC.
 memsic,mmc5633
 - New driver for this I2C/I3C magnetometer. Follow on patches fixed up
   issues related to single driver supporting both bus types.
 microchip,mcp747feb02
 - New driver for the Microchip MCP47F(E/V)B(0/1/2)1,
   MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and MCP47F(E/V)B(0/1/2)8
   buffered voltage output DACs.
 nxp,sar-adc
 - New driver support ADCs found on s32g2 and s32g3 platforms.
 ti,ads1018
 - New drier for the ADS1018 and ADS1118 SPI ADCs.
 ti,ads131m02
 - New driver supporting ADS131M(02/03/04/06/08)24-bit simultaneous sampling
   ADCs.
 
 Features
 ========
 
 iio-core
 - New IIO_DEV_ACQUIRE_DIRECT_MODE() / IIO_DEV_ACQUIRE_FAILED() +
   equivalents for the much rarer case where the mode needs pinning
   whether or not it is in direct mode.  These use the ACQUIRE()
   / ACQUIRE_ERR() infrastructure underneath to provide both simple
   checks on whether we got the requested mode and to provide scope
   based release. Applied in a few initial drivers.
 adi,ad9467
 - Support calibbias control
 adi,adf4377
 - Add support to act as a clock provider.
 adi,adxl380
 - Support low power 1KHz sampling frequency mode. Required rework of
   how events and filters were configured, plus applying of constraints
   when in this mode.
 rf-digital,rfd77402
 - Add interrupt support as alternative to polling for completion.
 st,lsm6dsx
 - Tap event detection (after considerable driver rework)
 
 Cleanup and Minor Fixes
 =======================
 
 More minor cleanup such as typos, white space etc not called out except
 where they were applied to a lot of drivers.
 
 Various drivers.
 - Use of dev_err_probe() to cleanup error handling.
 - Introduce local struct device and struct device_node variables to
   reduce duplication of getting them from containing structs.
 - Ensure uses of iio_trigger_generic_data_rdy_poll() set IRQF_NO_THREAD
   as that function calls non threaded child interrupt handlers.
 - Replace IRQF_ONESHOT in not thread interrupt handlers with
   IRQF_NO_THREAD to ensure they run as intended. Drop one unnecessary case.
 iio-sw-device/trigger.
 - Constify configs_group_operations structures.
 iio-buffer-dma / buffer-dma-engine
 - Use lockdep_assert_held() to replace WARN_ON() to check lock is
   correctly held.
 - Make use of cleanup.h magic to simplify various code paths.
 - Make iio_dma_buffer_init() return void rather than always success.
 
 adi,ad7766
 - Replace custom interrupt handler with iio_trigger_generic_data_rdy_poll()
 adi,ad9832
 - Drop legacy platform_data support.
 adi,ade9000
 - Add a maintainer entry.
 adi,adt7316
 - Move to EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() so the compiler
   can cleanly drop unused pm structures and callbacks.
 adi,adxl345
 - Relax build constraint vs the driver that is in input so both may be
   built as modules and selection made at runtime.
 adi,adxl380
 - Make sure we don't read tail entries in the hardware fifo if a partial
   new scan has been written.
 - Move to a single larger regmap_noinc_read() to read the hardware fifo.
 aspeed,ast2600
 - Add missing interrupts property to DT binding.
 bosch,bmi270_i2c
 - Add missing MODULE_DEVICE_TABLE() macros so auto probing of modules can
   work.
 bosch,smi330
 - Drop duplicate assignment of IIO_TYPE in smi330_read_avail()
 - Use new common field_get() and field_prep() helpers to replace local
   version.
 honeywell,mprls0025pa
   Fixes delayed to merge window as late in cycle and we didn't want to delay
   the rest of the series.
 - Allow Kconfig selection of specific bus sub-drivers rather than tying that
   to the buses themselves being supported.
 - Zero spi_transfer structure to avoid chance of unintentionally set fields
   effecting transfer.
 - Fix a potential timing violation wrt to the chip select to first clock
   edge timing.
 - As recent driver, take risk inherent in dropping interrupt direction from
   driver as that should be set by firmware.
 - Fix wrong reported number of data bits for channel.
 - Fix a pressure channel calculation bug.
 - Rework to allow embedding the tx buffer in the iio_priv() structure rather
   than requiring separate allocation.
 - Move the buffer clearing to the shared core bringing it into affect for
   SPI as well as I2C.
 - Stricter checks for status byte.
 - Greatly simplify the measurement sequence.
 - Add a copyright entry to reflect Petre's continued work on this driver.
 intersil,isl29018
 - Switch from spritnf to sysfs_emit_at() to make it clear overflow can't
   occur.
 invensense,icm42600
 - Allow sysfs access to temperature when buffered capture in use as it
   does not impact other sensor data paths.
 invensense,itg3200
 - Check unused return value in read_raw() callback.
 men,z188
 - Drop now duplicated module alias.
 rf-digital,rfd77402
 - Add DT binding doc and explicit of_device_id table.
 - Poll for timeout with times as on datasheet, then replace opencoded
   version with read_poll_timeout().
 sensiron,scd4x
 - Add missing timestamp channel. The code to push it to the buffer was there
   but there was no way to turn it on.
 vti,sca3000
 - Fix resource leak if iio_device_register() fails.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAml/hWARHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0Foi51A/47f463/jhe68XY6wQEmB2q3FinSCor/3A
 tjhisUQd4EwNwkY007b9m7QILogsDJsVDrwpIT84mSoRd6RggyqEpWq/lyLM5AW2
 pq7zSf8D06ne/xPa5PL6Sy/L7edkeXLfU/NMfcLKhzhrm+kfFSKAKzfPzgXDBVZv
 TtFZkk7AaVc5rk4DQfnaSI1Nr1DQqI/rbCLj6dvD/Iq2Ozs1A4Q5GgClbU4sw4nR
 5iQryb9y7nesPoCKHb+qhHoUJMSv1uejTqMhwUecfNc/d47nxeqLmIwlI02YmFu+
 JKSZ5ptYAc2CrV4HTdfjLlfnZfkRCK5DeIalj2jE6hHN1lwqjUBvsP/J+/4RMK1S
 nth2wPRlW24hWjR51AcFhSMOM4nhwj3Tcxrb7w+uqEapbDhNJi7PT7LNalkFPIET
 qdxGCEm02OMBHjggyto/MhoXZj9IiqkvIKtuZ2M10Zq/6eP9TsPlhkRysdcok4f1
 VRmn23uTwJDGc3eAos1HBYLClZznG/kOgo7fyjJxEe7f9Kb2TwculY3yO3thYR2S
 XWFWZzw/Mr3yj0U3qKq7qXQvgME1P8KAFCiG82ZvjvixQpf8+Koe+WWuFVcdYvJi
 29yFbKHVnu58ttcPMvfegLy/iUjc1ZrhRNTJ4dRGa2xjc0eJqKqFs9OYVWKVfh2i
 MMHfMtVIhQ==
 =2IKe
 -----END PGP SIGNATURE-----

Merge tag 'iio-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

Jonathan writes:

IIO: New device support, features and cleanup for the 6.20/7.0 cycle.

Slightly messier than normal unfortunately due to some conflicts
and build config bugs related to I3C drivers.

One last minute Kconfig fix right at the top after a linux-next report.
I've simplified the Kconfig and made it match other instances in the kernel
so that should be safe enough despite short soak time in front of build bots.

Merge of an immutable branch from I3C to get some stubs that were missing
and caused build issues with dual I2C / I3C drivers. This also brought in a
drop of some deprecated interfaces so there is also one patch to update a
new driver to not use those.

We are having another go at using cleanup.h magic with the IIO mode claim
functions after backing out last try at this. This time we have wrappers
around the new ACQUIRE() and ACQUIRE_ERR() macros.
Having been burnt once, we will be taking it a bit more slowly this time
wrt to wide adoption of these! Thanks in particular to Kurt for taking
on this core IIO work.

New Device Support
==================

adi,ad18113
- New driver to support the AD18113 amplifier - an interesting device due
  to the external bypass paths where we need to describe what gain those
  paths have in DT. Longer term it will be interesting to see if this
  simplistic description is enough for real deployments.
adi,ad4062
- New driver for the AD4060 and AD4052 SAR ADCs including trigger, event
  and GPIO controller support.  Follow up patch replaced use of some
  deprecated I3C interfaces prior to the I3C immutable branch merge as
  that includes dropping them.
adi,ad4134
- New driver for the AD4134 24bit 4 channel simultaneous sampling ADC.
adi,ad7768-1,
- Add support for the ADAQ767-1, ADAQ7768-1 and ADAQ7769-1 ADCs after some
  rework to enable the driver to support multiple device types.
adi,ad9467
- Add support for the similar ad9211 ADC to this existing driver.
- Make the selection of 2s comp mode explicit for normal operation and
  switch to offset binary when entering calibration mode.
honeywell,abp2
- New driver to support this huge family (100+) of board mount pressure and
  temperature sensors.
maxim,max22007
- New drier for this 4 channel DAC.
memsic,mmc5633
- New driver for this I2C/I3C magnetometer. Follow on patches fixed up
  issues related to single driver supporting both bus types.
microchip,mcp747feb02
- New driver for the Microchip MCP47F(E/V)B(0/1/2)1,
  MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and MCP47F(E/V)B(0/1/2)8
  buffered voltage output DACs.
nxp,sar-adc
- New driver support ADCs found on s32g2 and s32g3 platforms.
ti,ads1018
- New drier for the ADS1018 and ADS1118 SPI ADCs.
ti,ads131m02
- New driver supporting ADS131M(02/03/04/06/08)24-bit simultaneous sampling
  ADCs.

Features
========

iio-core
- New IIO_DEV_ACQUIRE_DIRECT_MODE() / IIO_DEV_ACQUIRE_FAILED() +
  equivalents for the much rarer case where the mode needs pinning
  whether or not it is in direct mode.  These use the ACQUIRE()
  / ACQUIRE_ERR() infrastructure underneath to provide both simple
  checks on whether we got the requested mode and to provide scope
  based release. Applied in a few initial drivers.
adi,ad9467
- Support calibbias control
adi,adf4377
- Add support to act as a clock provider.
adi,adxl380
- Support low power 1KHz sampling frequency mode. Required rework of
  how events and filters were configured, plus applying of constraints
  when in this mode.
rf-digital,rfd77402
- Add interrupt support as alternative to polling for completion.
st,lsm6dsx
- Tap event detection (after considerable driver rework)

Cleanup and Minor Fixes
=======================

More minor cleanup such as typos, white space etc not called out except
where they were applied to a lot of drivers.

Various drivers.
- Use of dev_err_probe() to cleanup error handling.
- Introduce local struct device and struct device_node variables to
  reduce duplication of getting them from containing structs.
- Ensure uses of iio_trigger_generic_data_rdy_poll() set IRQF_NO_THREAD
  as that function calls non threaded child interrupt handlers.
- Replace IRQF_ONESHOT in not thread interrupt handlers with
  IRQF_NO_THREAD to ensure they run as intended. Drop one unnecessary case.
iio-sw-device/trigger.
- Constify configs_group_operations structures.
iio-buffer-dma / buffer-dma-engine
- Use lockdep_assert_held() to replace WARN_ON() to check lock is
  correctly held.
- Make use of cleanup.h magic to simplify various code paths.
- Make iio_dma_buffer_init() return void rather than always success.

adi,ad7766
- Replace custom interrupt handler with iio_trigger_generic_data_rdy_poll()
adi,ad9832
- Drop legacy platform_data support.
adi,ade9000
- Add a maintainer entry.
adi,adt7316
- Move to EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() so the compiler
  can cleanly drop unused pm structures and callbacks.
adi,adxl345
- Relax build constraint vs the driver that is in input so both may be
  built as modules and selection made at runtime.
adi,adxl380
- Make sure we don't read tail entries in the hardware fifo if a partial
  new scan has been written.
- Move to a single larger regmap_noinc_read() to read the hardware fifo.
aspeed,ast2600
- Add missing interrupts property to DT binding.
bosch,bmi270_i2c
- Add missing MODULE_DEVICE_TABLE() macros so auto probing of modules can
  work.
bosch,smi330
- Drop duplicate assignment of IIO_TYPE in smi330_read_avail()
- Use new common field_get() and field_prep() helpers to replace local
  version.
honeywell,mprls0025pa
  Fixes delayed to merge window as late in cycle and we didn't want to delay
  the rest of the series.
- Allow Kconfig selection of specific bus sub-drivers rather than tying that
  to the buses themselves being supported.
- Zero spi_transfer structure to avoid chance of unintentionally set fields
  effecting transfer.
- Fix a potential timing violation wrt to the chip select to first clock
  edge timing.
- As recent driver, take risk inherent in dropping interrupt direction from
  driver as that should be set by firmware.
- Fix wrong reported number of data bits for channel.
- Fix a pressure channel calculation bug.
- Rework to allow embedding the tx buffer in the iio_priv() structure rather
  than requiring separate allocation.
- Move the buffer clearing to the shared core bringing it into affect for
  SPI as well as I2C.
- Stricter checks for status byte.
- Greatly simplify the measurement sequence.
- Add a copyright entry to reflect Petre's continued work on this driver.
intersil,isl29018
- Switch from spritnf to sysfs_emit_at() to make it clear overflow can't
  occur.
invensense,icm42600
- Allow sysfs access to temperature when buffered capture in use as it
  does not impact other sensor data paths.
invensense,itg3200
- Check unused return value in read_raw() callback.
men,z188
- Drop now duplicated module alias.
rf-digital,rfd77402
- Add DT binding doc and explicit of_device_id table.
- Poll for timeout with times as on datasheet, then replace opencoded
  version with read_poll_timeout().
sensiron,scd4x
- Add missing timestamp channel. The code to push it to the buffer was there
  but there was no way to turn it on.
vti,sca3000
- Fix resource leak if iio_device_register() fails.

* tag 'iio-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (144 commits)
  iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin
  iio: sca3000: Fix a resource leak in sca3000_probe()
  iio: proximity: rfd77402: Add interrupt handling support
  iio: proximity: rfd77402: Document device private data structure
  iio: proximity: rfd77402: Use devm-managed mutex initialization
  iio: proximity: rfd77402: Use kernel helper for result polling
  iio: proximity: rfd77402: Align polling timeout with datasheet
  iio: cros_ec: Allow enabling/disabling calibration mode
  iio: frequency: ad9523: correct kernel-doc bad line warning
  iio: buffer: buffer_impl.h: fix kernel-doc warnings
  iio: gyro: itg3200: Fix unchecked return value in read_raw
  MAINTAINERS: add entry for ADE9000 driver
  iio: accel: sca3000: remove unused last_timestamp field
  iio: accel: adxl372: remove unused int2_bitmask field
  iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll()
  iio: magnetometer: Remove IRQF_ONESHOT
  iio: Replace IRQF_ONESHOT with IRQF_NO_THREAD
  iio: Use IRQF_NO_THREAD
  iio: dac: Add MAX22007 DAC driver support
  dt-bindings: iio: dac: Add max22007
  ...
2026-02-02 17:08:30 +01:00
Daniel Hodges
0a1fc2f301 nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain
authentication key material for NVMe-oF. Use kfree_sensitive() instead
of kfree() in nvmf_free_options() to ensure secrets are zeroed before
the memory is freed, preventing recovery from freed pages.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-02-02 08:06:33 -08:00
Chen Ridong
99a2ef5009 cgroup/dmem: avoid pool UAF
An UAF issue was observed:

BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150
Write of size 8 at addr ffff888106715440 by task insmod/527

CPU: 4 UID: 0 PID: 527 Comm: insmod    6.19.0-rc7-next-20260129+ #11
Tainted: [O]=OOT_MODULE
Call Trace:
<TASK>
dump_stack_lvl+0x82/0xd0
kasan_report+0xca/0x100
kasan_check_range+0x39/0x1c0
page_counter_uncharge+0x65/0x150
dmem_cgroup_uncharge+0x1f/0x260

Allocated by task 527:

Freed by task 0:

The buggy address belongs to the object at ffff888106715400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 64 bytes inside of
freed 512-byte region [ffff888106715400, ffff888106715600)

The buggy address belongs to the physical page:

Memory state around the buggy address:
ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
				     ^
ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

The issue occurs because a pool can still be held by a caller after its
associated memory region is unregistered. The current implementation frees
the pool even if users still hold references to it (e.g., before uncharge
operations complete).

This patch adds a reference counter to each pool, ensuring that a pool is
only freed when its reference count drops to zero.

Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 06:04:13 -10:00
Chen Ridong
592a68212c cgroup/dmem: avoid rcu warning when unregister region
A warnning was detected:

 WARNING: suspicious RCU usage
 6.19.0-rc7-next-20260129+ #1101 Tainted: G           O
 kernel/cgroup/dmem.c:456 suspicious rcu_dereference_check() usage!

 other info that might help us debug this:

 rcu_scheduler_active = 2, debug_locks = 1
 1 lock held by insmod/532:
  #0: ffffffff85e78b38 (dmemcg_lock){+.+.}-dmem_cgroup_unregister_region+

 stack backtrace:
 CPU: 2 UID: 0 PID: 532 Comm: insmod Tainted: 6.19.0-rc7-next-
 Tainted: [O]=OOT_MODULE
 Call Trace:
  <TASK>
  dump_stack_lvl+0xb0/0xd0
  lockdep_rcu_suspicious+0x151/0x1c0
  dmem_cgroup_unregister_region+0x1e2/0x380
  ? __pfx_dmem_test_init+0x10/0x10 [dmem_uaf]
  dmem_test_init+0x65/0xff0 [dmem_uaf]
  do_one_initcall+0xbb/0x3a0

The macro list_for_each_rcu() must be used within an RCU read-side critical
section (between rcu_read_lock() and rcu_read_unlock()). Using it outside
that context, as seen in dmem_cgroup_unregister_region(), triggers the
lockdep warning because the RCU protection is not guaranteed.

Replace list_for_each_rcu() with list_for_each_entry_safe(), which is
appropriate for traversal under spinlock protection where nodes may be
deleted.

Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 06:03:28 -10:00
Chen Ridong
43151f8128 cgroup/dmem: fix NULL pointer dereference when setting max
An issue was triggered:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0000 [#1] SMP NOPTI
 CPU: 15 UID: 0 PID: 658 Comm: bash Tainted: 6.19.0-rc6-next-2026012
 Tainted: [O]=OOT_MODULE
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
 RIP: 0010:strcmp+0x10/0x30
 RSP: 0018:ffffc900017f7dc0 EFLAGS: 00000246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888107cd4358
 RDX: 0000000019f73907 RSI: ffffffff82cc381a RDI: 0000000000000000
 RBP: ffff8881016bef0d R08: 000000006c0e7145 R09: 0000000056c0e714
 R10: 0000000000000001 R11: ffff888107cd4358 R12: 0007ffffffffffff
 R13: ffff888101399200 R14: ffff888100fcb360 R15: 0007ffffffffffff
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 0000000105c79000 CR4: 00000000000006f0
 Call Trace:
  <TASK>
  dmemcg_limit_write.constprop.0+0x16d/0x390
  ? __pfx_set_resource_max+0x10/0x10
  kernfs_fop_write_iter+0x14e/0x200
  vfs_write+0x367/0x510
  ksys_write+0x66/0xe0
  do_syscall_64+0x6b/0x390
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x7f42697e1887

It was trriggered setting max without limitation, the command is like:
"echo test/region0 > dmem.max". To fix this issue, add check whether
options is valid after parsing the region_name.

Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 06:02:42 -10:00
Jiri Olsa
6b95cc562d ftrace: Fix direct_functions leak in update_ftrace_direct_del
Alexei reported memory leak in update_ftrace_direct_del.
We miss cleanup of the replaced direct_functions in the
success path in update_ftrace_direct_del, adding that.

Fixes: 8d2c1233f3 ("ftrace: Add update_ftrace_direct_del function")
Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Closes: https://lore.kernel.org/bpf/aX_BxG5EJTJdCMT9@krava/T/#m7c13f5a95f862ed7ab78e905fbb678d635306a0c
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20260202075849.1684369-1-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-02-02 07:56:20 -08:00